@beignet/core 0.0.43 → 0.0.44

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @beignet/core
 
+## 0.0.44
+
+### Patch Changes
+
+- 07baa79: Modernize the package-shipped app architecture examples to use the current Zod UUID schema API.
+- 07baa79: Ship versioned Fetch runtime and devtools safety skills, teach core runtime
+  safety conventions, keep Agent Auth guidance discoverable, and trust the new
+  skills in generated apps.
+
 ## 0.0.43
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beignet/core",
-  "version": "0.0.43",
+  "version": "0.0.44",
   "type": "module",
   "description": "Core framework primitives for Beignet",
   "exports": {

package/skills/app-architecture/SKILL.md

@@ -84,7 +84,7 @@ import { z } from "zod";
 import { errors } from "@/features/shared/errors";
 
 export const projectSchema = z.object({
-  id: z.string().uuid(),
+  id: z.uuid(),
   name: z.string().min(1),
 });
 
@@ -94,7 +94,7 @@ const projects = defineContractGroup()
 
 export const getProject = projects
   .get("/:id")
-  .pathParams(z.object({ id: z.string().uuid() }))
+  .pathParams(z.object({ id: z.uuid() }))
   .errors({ ProjectNotFound: errors.ProjectNotFound })
   .responses({ 200: projectSchema });
 ```
@@ -154,6 +154,12 @@ or outbox records must commit together.
 Do not import provider packages from contracts, use cases, routes, UI, or
 feature client modules.
 
+Prefer typed options objects for provider factories. Explicit first-party
+options override matching environment values. Treat injected SDK or database
+clients as caller-owned unless an option such as `closeOnStop: true` delegates
+shutdown to one provider instance, and preserve provider instrumentation when
+using a lower-level direct adapter.
+
 Tenant-owned repository methods should accept `TenantScope` instead of raw
 tenant IDs. Use cases derive it with `requireTenantScope(ctx)` or
 `createTenantScope(...)`; adapters unwrap it with `tenantScopeId(scope)` and
@@ -262,6 +268,31 @@ messages or make `AppError.details` safe to export.
 Best-effort capture is bounded to one second by default. Tune `timeoutMs` when
 needed; use `false` only when reporting may intentionally block the boundary.
 
+## Runtime Safety
+
+- HTTP idempotency defaults to the current actor and includes the current
+  tenant when one exists. The default actor scope fails closed when the
+  required identity is missing. Use
+  `meta.scope: "global"` only for deliberately public operations whose callers
+  should share one key namespace.
+- `formatMailAddress(...)` rejects carriage returns and line feeds before a
+  provider builds headers; providers still own complete email-syntax
+  validation. Mail providers make one vendor call, so put retryable delivery
+  behind jobs or the outbox.
+- Keep storage keys relative and reuse `assertValidStorageKey(...)`,
+  `normalizeStorageKeyPrefix(...)`, `prefixStorageKey(...)`, and
+  `createStoragePublicUrl(...)` from `@beignet/core/ports` in custom adapters.
+  Add provider-specific restrictions only after the shared validation.
+- Uploads are protected by default. Declare `authorize(...)` or deliberately
+  opt into `access: "public"`; server uploads authorize each file before
+  reading bytes for validation. Include actor, tenant, or resource ownership
+  in object keys.
+- Direct-upload completion is stateless, so make `onComplete(...)` idempotent
+  by upload ID or object key and use app-owned issuance state for single-use or
+  revocable grants. Before app-owned completion starts, a failed server batch
+  removes objects already written. After `onComplete(...)` starts, durable
+  references may exist and transaction or compensation belongs to the app.
+
 ## Validation
 
 After core app-architecture changes, run from the app root: