# Changelog

## Unreleased

## 0.4.2 — 2026-07-27

- Move canonical source and package identity from the `zemion` account to the
  `lotobo` organization and consume Toolbox SDK 0.2.3 from its new namespace.
- Remove the outer application frame and align the workbench with the shared
  `min(100%, 90rem)` Toolbox content width.
- Replace the favicon with a file-style Regex mark derived from the MIT-licensed
  OOjs regular-expression icon, retaining its licence and attribution.
- Rebuild the Go WebAssembly engine so its embedded module path uses the new
  canonical repository identity.

## 0.4.1 — 2026-07-27

- Keep the last completed syntax and execution frame visible while edited
  inputs are parsed and executed, then replace it atomically with the newest
  revision instead of rendering transient empty panels.
- Bind every retained result to its exact flavour, options, pattern, flags,
  subject, replacement, mode and syntax snapshots. Mark it as stale, disable
  execution until current syntax is ready, and suppress stale editor ranges
  and cross-panel selection.

## 0.4.0 — 2026-07-27

- Expand the workbench from four to twelve selectable execution profiles:
  JavaScript/ECMAScript, standalone PCRE2, PHP, Perl, Python, Ruby, Java, C++,
  Go, Rust, .NET and Scala/JVM compatibility.
- Add actual PHP 8.5.8 `preg_*` execution through the self-hosted
  `@php-wasm/web-8-5` 3.1.46 runtime. Preserve native UTF-8 byte ranges and
  identify PHP's embedded PCRE2 as 10.44, independently of the standalone
  PCRE2 10.47 pack.
- Add actual Perl 5.28.1 execution through unmodified WebPerl 0.09-beta assets
  as an explicitly legacy beta profile. Pass user values through a fixed
  data-only JSON request, stream pre-tokenized bounded replacement output into
  a separately verified MEMFS binary file, disable runtime regex evaluation,
  reject code assertions and retain the upstream loader's dormant
  interoperability `eval` site as a documented CSP caveat.
- Add actual CRuby 4.0.0 `Regexp` execution through a minimal ruby.wasm
  2.9.3-2.9.4 pack. Native `String#gsub`/`String#sub` block iteration drives a
  fixed byte-bounded CRuby-compatible replacement expander. Use separate
  worker-local WASI request/output files and metadata-only inert JSON instead
  of output escaping or ruby.wasm's JavaScript-eval object conversion; reject
  lossy lone-surrogate requests and pass the strict-CSP browser gate.
- Add Emscripten 6.0.4 libc++ `std::wregex` execution with the modified
  ECMAScript default grammar, alternate standard grammars and a build
  configured with dynamic execution disabled. Stream a fixed bounded
  replacement formatter through the byte cap and verify its grammar against
  libc++ at load.
- Add Go 1.26.5 standard-library `regexp` and Rust `regex` crate 1.13.1
  execution, preserving their native UTF-8 byte ranges and non-backtracking
  semantics. Use bounded streaming replacement expanders that are
  differentially checked against `Regexp.ExpandString` and
  `Captures::expand`, with predictable base64 output transport. Measure exact
  encoded request bytes and reserve native JSON limits for worst-case escaping
  so control-heavy inputs retain the documented decoded limits.
- Add .NET 10.0.10 `System.Text.RegularExpressions` in browser WebAssembly,
  with invariant-culture execution, native UTF-16 ranges and a bounded native
  regex timeout inside the killable worker. Stream bounded replacement tokens
  without materializing `Match.Result`, verify token semantics against native
  .NET at load, and transport output as bounded base64-encoded UTF-8.
- Add an explicitly labelled Scala/JVM compatibility profile backed by the
  verified TeaVM 0.15.0 `java.util.regex` engine. No Scala runtime, Scala
  wrapper API or OpenJDK runtime is claimed.
- Add partial application-owned lexical syntax and replacement providers,
  flavour-specific quick-reference content and capability labels for the eight
  new profiles while keeping each real runtime authoritative.
- Add deterministic, closed-file-set runtime packs, checksums, licences,
  notices, exact toolchain/source identities and release verification for the
  new self-hosted engines.
- Close the existing Pyodide pack's full base-runtime provenance: exact
  primary archive or Git tree identities, vendored JavaScript-port hashes,
  CPython/Emscripten patch and recipe hashes, a preferred-form HACL* route,
  independently anchored notices, and executable identity checks for the
  linked compression/database/parser components.
- Transport bounded Python replacement output as canonical base64 with strict
  declared-length, request-cap and UTF-8 validation instead of
  content-dependent JSON escaping.
- Close the PHP pack's complete native/source/legal inventory with exact
  package, binary, build-recipe, archive and Git identities; independently
  pin 38 legal assets; audit linked component versions; and explicitly exclude
  the GMP, libsodium, tidy, ICU/intl, FreeType, ImageMagick and adjacent AOM
  false-positive or unshipped detections.
- Bound retained heavyweight workers with least-recently-used eviction so
  selecting many profiles does not leave every runtime resident.

## 0.3.0 — 2026-07-27

- Add a self-hosted Pyodide 314.0.3 worker containing CPython 3.14.2 `re`, with
  runtime identity verification, bounded compilation/matching/replacement and
  exact code-point-to-editor-UTF-16 range normalization.
- Add TeaVM 0.15.0's `java.util.regex` class-library implementation as a
  verified self-hosted ES module, with bounded `Pattern`/`Matcher` execution,
  native replacement and exact UTF-16 ranges.
- Identify the Java engine as TeaVM class-library code rather than OpenJDK and
  report its documented `UNICODE_CHARACTER_CLASS`, single-digit replacement
  and unavailable named-replacement compatibility boundaries.
- Add partial application-owned Python and Java lexical syntax and replacement
  providers while keeping the selected runtime compiler authoritative.
- Separate heavyweight engine loading from the per-request execution deadline,
  retain worker recovery after timeout/crash/cancellation and keep every
  runtime local to the release.
- Add flavour-specific quick reference and capability content for all four
  executable engines.
- Keep comparison, generated cases, code generation, minimization, analysis
  and formatting behind their explicitly verified ECMAScript/PCRE2 boundaries;
  Python and Java are never routed through another flavour as a fallback.
- Extend deterministic engine-pack provenance, checksums, licence notices,
  release verification and nested-path delivery checks to the Python and Java
  runtime assets.

## 0.2.0 — 2026-07-27

- Open Quick reference and Capabilities as populated, accessible in-viewport
  dialogs with keyboard dismissal, focus handling and explicit empty states.
- Add flavour-neutral version, flag, option and execution-worker registries
  and expose only the ECMAScript and fully wired PCRE2 runtimes.
- Validate flavour/version/options consistently across workbench requests,
  projects and test suites, including legacy schema-v1 identities.
- Add a production local-first Corpus / Apply workspace with bounded UTF-8
  multi-file and pasted-text input, sequential killable worker jobs, progress,
  cancellation, explicit whole-document/independent-line semantics, preserved
  line separators, bounded capture extraction and replacement previews,
  per-document exact/partial summaries, content-free JSON/CSV/NDJSON reports
  and privacy-gated exact-output downloads and bounded ZIP export.
- Keep corpus content and results ephemeral: project schema v1 stores only the
  selected workspace mode and rejects injected corpus payloads.
- Add a deterministic, offline PCRE2 10.47 WebAssembly runtime with pinned
  source/toolchain identities, provenance, licences and checksums.
- Add bounded PCRE2 compile, match and native-substitution ABI calls with
  match/depth/heap caps, copied caller-owned records, cleanup on every exit,
  UTF-8-to-UTF-16 range normalization and lone-surrogate rejection.
- Run PCRE2 in a dedicated killable/recoverable worker, expose its real
  flavour-specific flags and options, and add lexical syntax/replacement
  coverage, official quick reference, conformance and browser tests.
- Add an ABI-v3 PCRE2 automatic-callout operation with caller-owned event and
  mark buffers, dual event/byte caps, native truncation stop, exact UTF-8 and
  UTF-16 positions, a separate killable worker and a bounded viewer that keeps
  reported fields distinct from derived movement labels.
- Add ECMAScript-scoped advisory static risk diagnostics plus cancellable
  bounded growth probes and cold/warm native-engine benchmarks with median/p95,
  separate timing/outcome plots, runtime identity and strict
  input/output/wall limits.
- Add an ECMAScript/PCRE2 comparison orchestrator with exact per-side requests,
  independent worker timeout outcomes, normalized-range match/capture
  alignment, replacement differences and explicit non-comparable states.
- Add a reviewed PCRE2 10.47 8-bit C17 generator with exact UTF-8 byte arrays,
  native/host limits, error handling, deterministic source identities and
  compile/execute golden gates against the named toolchain.
- Add deterministic, cancellable failing-subject minimization for saved-test
  failures, capture ranges, exact engine timeouts and ECMAScript/PCRE2
  mismatches, with real-worker verification, explicit budgets and honest
  transform-local minimality.
- Add deterministic, seed-addressed ECMAScript positive/negative case
  generation from the normalized AST, with bounded synthesis, actual-engine
  verification, explicit unsupported coverage, cancellable workers and
  provenance-preserving unit-test integration.
- Add an idempotent grammar-backed ECMAScript literal/control formatter with an
  exact preview, separate source/candidate syntax and engine workers, capture
  shape checks, applicable unit-test replay, explicit inconclusive states and a
  mandatory confirmation before apply.

## 0.1.0 — 2026-07-24

- Added the open-source ECMAScript 2025 syntax provider using regexpp 4.12.2.
- Added native browser `RegExp` execution in a killable, recoverable worker.
- Added deterministic explanation and actual extraction trees.
- Added exact capture indices, synchronized highlighting and bounded captures.
- Added replacement, list/extraction and unit-test workspaces.
- Added project import/export, optional local persistence and privacy controls.
- Added resource limits, real timeout termination and recovery tests.
- Added Toolbox SDK integration and deterministic release packaging.
