v0.6.0

v0.6.0 — CAA descriptor recognition and trusted registry publishing

This unstable release recognizes the independently measured CAA target-descriptor
profile across Rust, the CLI, Node.js and browsers. Inspection reports the format
with unknown counts. A descriptor contains no document pages: conversion returns
the typed unsupported error before writing PDF bytes and asks for the referenced
document. Target values are neither decoded nor fetched.

Breaking changes and migration

• Rust InputFormat gains Caa. Add InputFormat::Caa to exhaustive matches;
  route it to a request for the referenced document rather than conversion.
  DocumentInfo.page_count remains Option<u32> and is None for CAA.

• JavaScript Format gains "caa", and DocumentInfo.pageCount changes from
  number to number | null. Handle the new format and guard unknown counts:

  const info = await inspect(module, input);
  if (info.pageCount === null) {
    console.log("Page count is unknown");
  } else {
    console.log(`${info.pageCount} pages`);
  }

• CLI inspect --json can report "format": "CAA", null counts and
  "unsupported_reason": "target-descriptor". Consumers must handle that
  format; converting a CAA descriptor exits with status 1.

• Raw WASM adds format code 8, preserving codes 0–7. CAA inspection returns
  raw page count 0 and bookmark count -1; the JavaScript adapter maps unknown
  counts to null. Upgrade JavaScript and WASM together.

Existing document conversion behavior and PDF output are unchanged by CAA
recognition. The bounded probe reads at most 1,024 bytes; the complete measured
field profile is required. Partial or contradictory descriptors are rejected.
No new dependency or external document payload is included.

Format evidence and limits

The NH/CAA checkpoint
records 18 unique external CAA descriptors and an original .nh HN-A document
converted through CLI, Node and Chromium: 433 pages, 365 bookmarks and identical
PDFs. This is the recorded research receipt, not a new release corpus run or a
viewer pixel-parity claim. File extensions do not define input signatures.
Historical CAS remains an unverified sample gap; no CAS decoder is claimed.
Other v0.5.0 limits,
including unverified C8/HN-B outlines and substitute-font fidelity, still apply.
Optional external-corpus tests without inputs are NOT_RUN.

Publication and validation

This is the first release intended to publish caj2pdf-core, caj2pdf-cli and
npm caj2pdf-rust through GitHub OIDC after all release gates. The WASM Rust
crate remains unpublished. The npm upload uses the same tested tarball as the
GitHub asset and requests npm provenance; no long-lived registry token is stored
in CI. Successful publication is established by the tag workflow and registry
records, not by this intention.

The release workflow requires locked native/WASM quality checks, the complete
platform inventory, Node/Chromium tests of the actual npm package, and verified
artifact attestations before publishing. GitHub assets include native binaries,
JS/WASM, OCI, SHA256SUMS and Sigstore bundles. Windows/macOS binaries remain
unsigned. See build provenance for verification.

cargo install --locked caj2pdf-cli --version 0.6.0
cargo add caj2pdf-core@0.6.0
npm install caj2pdf-rust@0.6.0