@assembly-js/app-foundation 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +3 -0
- package/CLAUDE.md +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -19,6 +19,9 @@ A patch release never changes what an app's build requires; a minor release may
|
|
|
19
19
|
not by hand; see `changes/README.md`. CI fails a PR that changes a check script without a
|
|
20
20
|
`bump: minor` change file.
|
|
21
21
|
|
|
22
|
+
## 0.4.1
|
|
23
|
+
- [guidance] Build agents append to `requiredSecrets` instead of rewriting it, and remove an entry only when the user asks to disconnect that integration.
|
|
24
|
+
|
|
22
25
|
## 0.4.0
|
|
23
26
|
- [fix] The renewal response is never cached.
|
|
24
27
|
- [fix] Analytics identify the viewer again in migrated apps.
|
package/CLAUDE.md
CHANGED
|
@@ -533,7 +533,7 @@ Two paths, decided by whether an `assembly-integrations` skill is present and, i
|
|
|
533
533
|
### Two rules
|
|
534
534
|
|
|
535
535
|
1. **Read the credential only from `process.env.<KEY>`, server-side only.** Route handlers, server components, and server actions can read it. Client components, `'use client'` modules, and anything that ends up in the browser bundle cannot. Never hardcode a value, never persist one to the database, never read from the URL, never write `.env*` files.
|
|
536
|
-
2. **Declare every secret you read in `.assembly/app.json`.** Add an entry under
|
|
536
|
+
2. **Declare every secret you read in `.assembly/app.json`.** Add an entry under the existing top-level `requiredSecrets` array in the same change that introduces the call. Append to the array; never replace it with a shorter list. The setup form keeps saved values and asks only for keys that have none, so removing an entry to simplify it gains nothing and drops a credential the deployed app is using. Remove an entry only when the user asked to disconnect that integration, and say which key you removed. The Assembly platform reads this manifest after the build, prompts the user for each value not saved yet, and injects declared secrets as Vercel env vars at deploy.
|
|
537
537
|
|
|
538
538
|
### Adding a secret to an app that already calls the provider
|
|
539
539
|
|