Skip to content

Commit fd60165

Browse files
github-actions[bot]github-actions[bot]
committed
chore: version packages (rc)
1 parent 531fb31 commit fd60165

153 files changed

Lines changed: 20619 additions & 89 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.changeset/pre.json‎

Lines changed: 204 additions & 0 deletions
Large diffs are not rendered by default.

‎examples/app-crm/CHANGELOG.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,98 @@
11
# @objectstack/example-crm
22

3+
## 4.0.92-rc.6
4+
5+
### Patch Changes
6+
7+
- Updated dependencies [690ccf2]
8+
- Updated dependencies [333a374]
9+
- Updated dependencies [5823d59]
10+
- Updated dependencies [3140f9c]
11+
- Updated dependencies [9500ba4]
12+
- Updated dependencies [76d74ec]
13+
- Updated dependencies [0e79785]
14+
- Updated dependencies [86f7a20]
15+
- Updated dependencies [c546c89]
16+
- Updated dependencies [627e65a]
17+
- Updated dependencies [22df871]
18+
- Updated dependencies [9c82146]
19+
- Updated dependencies [744b8f5]
20+
- Updated dependencies [9d1d9c7]
21+
- Updated dependencies [1007379]
22+
- Updated dependencies [4ff8abf]
23+
- Updated dependencies [e38db3d]
24+
- Updated dependencies [2c1988c]
25+
- Updated dependencies [211abdb]
26+
- Updated dependencies [b3de0dd]
27+
- Updated dependencies [35b36f2]
28+
- Updated dependencies [19aaf4b]
29+
- Updated dependencies [0e4a7fb]
30+
- Updated dependencies [f505689]
31+
- Updated dependencies [76682cb]
32+
- Updated dependencies [606d577]
33+
- Updated dependencies [e906126]
34+
- Updated dependencies [08363a0]
35+
- Updated dependencies [444de5b]
36+
- Updated dependencies [6a9dec6]
37+
- Updated dependencies [baeb4f0]
38+
- Updated dependencies [08cd163]
39+
- Updated dependencies [7dc1067]
40+
- Updated dependencies [7674859]
41+
- Updated dependencies [b85cc54]
42+
- Updated dependencies [7a8476f]
43+
- Updated dependencies [518ca7a]
44+
- Updated dependencies [d62f8eb]
45+
- Updated dependencies [a7586cd]
46+
- Updated dependencies [4c5e80e]
47+
- Updated dependencies [4b5702a]
48+
- Updated dependencies [d063a96]
49+
- Updated dependencies [cf7c694]
50+
- Updated dependencies [603cab8]
51+
- Updated dependencies [df95346]
52+
- Updated dependencies [591f675]
53+
- Updated dependencies [9051802]
54+
- Updated dependencies [2f8328c]
55+
- Updated dependencies [f293d45]
56+
- Updated dependencies [f067930]
57+
- Updated dependencies [97ace2a]
58+
- Updated dependencies [ef7b5ef]
59+
- Updated dependencies [8f1851e]
60+
- Updated dependencies [b4b2c7d]
61+
- Updated dependencies [61ea810]
62+
- Updated dependencies [66d99ec]
63+
- Updated dependencies [91eddca]
64+
- Updated dependencies [b61afc1]
65+
- Updated dependencies [97b6658]
66+
- Updated dependencies [0410522]
67+
- Updated dependencies [814db6d]
68+
- Updated dependencies [8dd98bf]
69+
- Updated dependencies [8a9c079]
70+
- Updated dependencies [cc3555e]
71+
- Updated dependencies [ea936f3]
72+
- Updated dependencies [69ac82c]
73+
- Updated dependencies [833ed84]
74+
- Updated dependencies [86d2e5e]
75+
- Updated dependencies [c6a4eeb]
76+
- Updated dependencies [f450ae7]
77+
- Updated dependencies [e124711]
78+
- Updated dependencies [3bb9340]
79+
- Updated dependencies [9d4dfc4]
80+
- Updated dependencies [1059965]
81+
- Updated dependencies [ee264b2]
82+
- Updated dependencies [60b672e]
83+
- Updated dependencies [e654bfd]
84+
- Updated dependencies [6e6c872]
85+
- Updated dependencies [fa5758e]
86+
- Updated dependencies [ecf0bef]
87+
- Updated dependencies [3da3da5]
88+
- Updated dependencies [0dcbc11]
89+
- Updated dependencies [b9f930b]
90+
- Updated dependencies [c9b809f]
91+
- Updated dependencies [32386f8]
92+
- Updated dependencies [a1dd1e4]
93+
- @objectstack/runtime@17.0.0-rc.7
94+
- @objectstack/spec@17.0.0-rc.7
95+
396
## 4.0.92-rc.5
497

598
### Patch Changes

‎examples/app-crm/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@objectstack/example-crm",
3-
"version": "4.0.92-rc.5",
3+
"version": "4.0.92-rc.6",
44
"description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
55
"license": "Apache-2.0",
66
"private": true,

‎examples/app-showcase/CHANGELOG.md‎

Lines changed: 245 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,250 @@
11
# @objectstack/example-showcase
22

3+
## 0.3.14-rc.6
4+
5+
### Patch Changes
6+
7+
- 284e7d2: fix(rest): a crashing hook body answers the sanitised fault envelope, not a raw `TypeError` at 400 (#7543)
8+
9+
`POST /api/v1/data/showcase_task` with `{"title": 12345}` answered
10+
11+
```
12+
400 { "error": "TypeError: not a function", "object": "showcase_task" }
13+
```
14+
15+
— a JS runtime error as the client-facing message, in a body with no `code` at
16+
all. Two contract breaks in one response: an internal fault echoed verbatim to a
17+
caller, and an error body outside the ledgered envelope, so a client keying on
18+
`code` got nothing.
19+
20+
**The seam.** `mapDataError` has two sandbox-unwrap branches, and they are the
21+
only ones in the file that emit `{ error, object }` with no `code` at 400. They
22+
exist for one shape: a hook or action body that runs
23+
`throw new Error('删除被阻断：仍有未结清的发票')` — an author writing a business
24+
rule whose message _is_ the remedy, which is answered verbatim at 400 and
25+
deliberately without a `code`. A body that instead **crashes** arrives as a
26+
thrown error too, so it took the same branch and its `TypeError` went out as if
27+
it were that author's message.
28+
29+
**The fix.** Both branches now separate a body that _reported_ something from a
30+
body that _faulted_, by the thrown error's constructor name — the sandbox
31+
stringifies a throw as `<name>: <message>`, so a leading `TypeError:`,
32+
`ReferenceError:`, `RangeError:`, `SyntaxError:`, `URIError:`, `EvalError:`,
33+
`InternalError:` or `AggregateError:` is structural evidence of a crash rather
34+
than a keyword heuristic over prose. A crash answers the same sanitised
35+
`500 INTERNAL_ERROR` the mapper's terminal branch already gives — which is not
36+
new policy: that branch's own contract (#5489) names this exact case ("a plain
37+
handler bug (`TypeError: x is not a function`) … server faults that a caller
38+
cannot fix and a caller SHOULD retry"). The unwraps simply sat above it and
39+
intercepted the crash first.
40+
41+
Both doors are guarded, not one. The `innerMessage` branch and the raw-message
42+
regex fallback produce byte-identical bodies, so classifying in only one would
43+
make the envelope depend on whether the `SandboxError` instance survived a
44+
rethrow.
45+
46+
**Unchanged:** a deliberate refusal still reaches the caller verbatim at 400
47+
with no `code`. The fix changes _which_ errors take that branch, not what it
48+
emits. A body that expresses a business rule as `throw new RangeError('…')` is
49+
now sanitised — an accepted cost, since that is not the documented authoring
50+
style and the fail-safe direction is the one that does not ship runtime faults to
51+
clients. The operator still gets the full text: 500 is outside
52+
`isExpectedDataStatus`, so `handleRouteError` logs `[REST] Unhandled error` with
53+
the whole error.
54+
55+
**Showcase.** `NormalizeTaskTitleHook` guarded its trim with truthiness
56+
(`if (ctx.input.title)`), so the number `12345` passed the guard and had no
57+
`.trim`. It now checks `typeof … === 'string'`. That is the actual cause of the
58+
reported repro, and with it fixed the request **succeeds** rather than erroring:
59+
`record-validator` coerces a `text` value with `String(value)`, so a number in a
60+
text field breaks no declared contract. These hook bodies are read as
61+
documentation, so the type-safe shape is the one to show — a hook must not assume
62+
a field's runtime type just because its metadata declares one.
63+
64+
- d62f8eb: feat(spec)!: refuse inline credentials at publish — driver `config.password` / `config.authToken` and connector `authentication` on authored entries (#7990)
65+
66+
`sys_metadata.metadata` is served back by the ordinary data API, and a datasource or
67+
connector artefact is persisted whole — so any schema that _accepted_ an inline
68+
credential stored that credential in cleartext at rest. The maintainer-ruled fix
69+
(#7990, Option A: per-artefact contract closure) makes the two measured surfaces
70+
refuse the inline form at publish and divert to the mechanisms that already exist.
71+
72+
**Driver config (postgres / mysql / mongo / turso).** `config.password` (SQL/mongo)
73+
and `config.authToken` (turso) are now declared-unwritable: writing one fails `tsc`
74+
(the input type is `never`) and fails the parse with a prescription naming the
75+
replacement. The former alias spellings (`passwd`, `pwd`, `token`, `jwt`,
76+
`auth_token`, `authtoken`) carry the same refusal. The connection form's masked
77+
secret input is unaffected — it never wrote `config`; it feeds the datasource secret
78+
binder, which encrypts into `sys_secret` and stores only an opaque handle.
79+
80+
**Connector authoring door.** `DeclarativeConnectorEntrySchema` (behind
81+
`defineStack({ connectors })` and `PUT /meta/connector/:name`) now refuses a
82+
non-`none` `authentication` on **every** authored entry — catalog descriptors
83+
included. Until now only provider-bound instances were covered (ADR-0097 §3), so a
84+
descriptor could publish an inline `token`/`key`/`password`/`clientSecret`. The
85+
runtime shape is unchanged: a plugin handing resolved secrets to
86+
`registerConnector` keeps working.
87+
88+
## FROM → TO
89+
90+
```ts
91+
// before — accepted, stored in cleartext in sys_metadata
92+
defineDatasource({
93+
name: "warehouse",
94+
driver: "postgres",
95+
config: { database: "analytics", username: "ro", password: "hunter2" },
96+
});
97+
98+
// after — the secret lives in the secret store; config carries no credential
99+
defineDatasource({
100+
name: "warehouse",
101+
driver: "postgres",
102+
schemaMode: "external",
103+
config: { database: "analytics", username: "ro" },
104+
external: { allowWrites: false, credentialsRef: "sys_secret:<handle>" },
105+
});
106+
// (Setup → Datasources binds the secret for you: its password field encrypts into
107+
// sys_secret and writes external.credentialsRef — it never wrote config.)
108+
```
109+
110+
```ts
111+
// before — descriptor published an inline credential
112+
defineConnector({
113+
name: "erp",
114+
label: "ERP",
115+
type: "saas",
116+
authentication: { type: "api-key", key: "…", headerName: "X-API-Key" },
117+
});
118+
119+
// after — descriptor: no live credentials (document the scheme in prose);
120+
defineConnector({
121+
name: "erp",
122+
label: "ERP",
123+
type: "saas",
124+
description: "Authenticates with an API key in the X-API-Key header.",
125+
});
126+
// instance: reference the credential (ADR-0097 §3)
127+
defineConnector({
128+
name: "erp",
129+
label: "ERP",
130+
type: "saas",
131+
provider: "openapi",
132+
providerConfig: { spec: "./erp-openapi.json" },
133+
auth: { type: "api-key", credentialRef: "ERP_API_KEY" },
134+
});
135+
```
136+
137+
There is deliberately **no automatic rewrite**: moving a cleartext credential into
138+
`sys_secret` requires encrypting it through a running secret binder, which a
139+
source-file transform cannot do — auto-deleting the key would silently drop a live
140+
credential instead. `os migrate meta` surfaces both changes as structured TODOs
141+
(semantic entries `datasource-config-inline-credential-refused`,
142+
`connector-inline-authentication-publish-refused`). The migration story for
143+
**already-stored** cleartext rows is programme scope, tracked as a follow-up card
144+
under #7990 — this release closes the doors that keep writing new ones.
145+
146+
<!-- adr-0087: registered datasource-config-inline-credential-refused, connector-inline-authentication-publish-refused -->
147+
148+
- Updated dependencies [690ccf2]
149+
- Updated dependencies [333a374]
150+
- Updated dependencies [5823d59]
151+
- Updated dependencies [3140f9c]
152+
- Updated dependencies [9500ba4]
153+
- Updated dependencies [76d74ec]
154+
- Updated dependencies [0e79785]
155+
- Updated dependencies [86f7a20]
156+
- Updated dependencies [c546c89]
157+
- Updated dependencies [627e65a]
158+
- Updated dependencies [22df871]
159+
- Updated dependencies [9c82146]
160+
- Updated dependencies [744b8f5]
161+
- Updated dependencies [9d1d9c7]
162+
- Updated dependencies [1007379]
163+
- Updated dependencies [4ff8abf]
164+
- Updated dependencies [e38db3d]
165+
- Updated dependencies [2c1988c]
166+
- Updated dependencies [211abdb]
167+
- Updated dependencies [b3de0dd]
168+
- Updated dependencies [35b36f2]
169+
- Updated dependencies [19aaf4b]
170+
- Updated dependencies [0e4a7fb]
171+
- Updated dependencies [f505689]
172+
- Updated dependencies [76682cb]
173+
- Updated dependencies [606d577]
174+
- Updated dependencies [a5d3aa1]
175+
- Updated dependencies [e906126]
176+
- Updated dependencies [08363a0]
177+
- Updated dependencies [444de5b]
178+
- Updated dependencies [6a9dec6]
179+
- Updated dependencies [baeb4f0]
180+
- Updated dependencies [199ec47]
181+
- Updated dependencies [08cd163]
182+
- Updated dependencies [7dc1067]
183+
- Updated dependencies [7674859]
184+
- Updated dependencies [b85cc54]
185+
- Updated dependencies [7a8476f]
186+
- Updated dependencies [518ca7a]
187+
- Updated dependencies [d62f8eb]
188+
- Updated dependencies [a7586cd]
189+
- Updated dependencies [4c5e80e]
190+
- Updated dependencies [4b5702a]
191+
- Updated dependencies [d063a96]
192+
- Updated dependencies [cf7c694]
193+
- Updated dependencies [603cab8]
194+
- Updated dependencies [df95346]
195+
- Updated dependencies [591f675]
196+
- Updated dependencies [9051802]
197+
- Updated dependencies [2f8328c]
198+
- Updated dependencies [f293d45]
199+
- Updated dependencies [f067930]
200+
- Updated dependencies [97ace2a]
201+
- Updated dependencies [ef7b5ef]
202+
- Updated dependencies [8f1851e]
203+
- Updated dependencies [b4b2c7d]
204+
- Updated dependencies [61ea810]
205+
- Updated dependencies [66d99ec]
206+
- Updated dependencies [91eddca]
207+
- Updated dependencies [b61afc1]
208+
- Updated dependencies [97b6658]
209+
- Updated dependencies [0410522]
210+
- Updated dependencies [814db6d]
211+
- Updated dependencies [477195c]
212+
- Updated dependencies [8dd98bf]
213+
- Updated dependencies [8a9c079]
214+
- Updated dependencies [cc3555e]
215+
- Updated dependencies [ea936f3]
216+
- Updated dependencies [69ac82c]
217+
- Updated dependencies [833ed84]
218+
- Updated dependencies [86d2e5e]
219+
- Updated dependencies [c6a4eeb]
220+
- Updated dependencies [f450ae7]
221+
- Updated dependencies [e124711]
222+
- Updated dependencies [3bb9340]
223+
- Updated dependencies [f1544e2]
224+
- Updated dependencies [9d4dfc4]
225+
- Updated dependencies [1059965]
226+
- Updated dependencies [ee264b2]
227+
- Updated dependencies [60b672e]
228+
- Updated dependencies [e654bfd]
229+
- Updated dependencies [6e6c872]
230+
- Updated dependencies [fa5758e]
231+
- Updated dependencies [ecf0bef]
232+
- Updated dependencies [3da3da5]
233+
- Updated dependencies [0dcbc11]
234+
- Updated dependencies [b9f930b]
235+
- Updated dependencies [c9b809f]
236+
- Updated dependencies [32386f8]
237+
- Updated dependencies [a1dd1e4]
238+
- @objectstack/runtime@17.0.0-rc.7
239+
- @objectstack/spec@17.0.0-rc.7
240+
- @objectstack/service-datasource@17.0.0-rc.7
241+
- @objectstack/driver-sql@17.0.0-rc.7
242+
- @objectstack/cloud-connection@17.0.0-rc.7
243+
- @objectstack/connector-mcp@17.0.0-rc.7
244+
- @objectstack/connector-openapi@17.0.0-rc.7
245+
- @objectstack/connector-rest@17.0.0-rc.7
246+
- @objectstack/connector-slack@17.0.0-rc.7
247+
3248
## 0.3.14-rc.5
4249

5250
### Patch Changes

‎examples/app-showcase/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@objectstack/example-showcase",
3-
"version": "0.3.14-rc.5",
3+
"version": "0.3.14-rc.6",
44
"description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, analytics). Built for demonstration, debugging, and coverage-driven verification.",
55
"license": "Apache-2.0",
66
"private": true,

0 commit comments

Comments
 (0)