@beignet/next 0.0.3 → 0.0.4

package/CHANGELOG.md

@@ -1,5 +1,127 @@
 # @beignet/next
 
+## 0.0.4
+
+### Patch Changes
+
+- 8bcb31f: Mark package READMEs with Beignet's experimental alpha status and 0.0.x stability expectations.
+- d137044: Declare `@beignet/core` as a peer dependency with a lockstep version range in
+  every integration and provider package instead of a regular `"*"` dependency.
+  Installs now always resolve a single shared copy of core, so `instanceof`
+  checks such as `isContractError` and upload error identity keep working, and
+  mixed Beignet versions fail loudly at install time instead of at runtime.
+
+  If your package manager does not install peer dependencies automatically, add
+  `@beignet/core` to your app alongside these packages. `@beignet/nuqs` now also
+  declares `@beignet/react-query` as a peer dependency, and
+  `@beignet/provider-storage-s3` now expects you to install
+  `@aws-sdk/client-s3` and `@aws-sdk/s3-request-presigner` yourself, matching
+  how other providers treat their SDKs.
+
+- 603478f: Align package documentation with the canonical route registry and AppContext conventions.
+- ac78cdf: Make `createAuthHooks` the single route-scoped auth hook API. The factory is
+  now curried — `createAuthHooks<AppContext>()({ resolve })` — so added context
+  fields are inferred from `resolve` instead of passed as a type argument, and a
+  new optional `headers` schema validates the raw lowercase request header
+  record before `resolve` runs, giving `resolve` typed credential headers
+  without contract casts. On `required()` hooks a header schema failure returns
+  a framework-owned 401; `optional()` hooks skip auth resolution; `public()`
+  hooks never parse headers. `defineRouteHook` (and the `RouteHookBuilder`
+  types) are removed — write non-auth route hooks as plain `RouteHook` object
+  literals.
+- 1a79090: Emit Node-compatible ESM: all relative imports in published packages now carry explicit .js extensions, fixing ERR_MODULE_NOT_FOUND when running the CLI or importing package dist files under plain Node.
+- 079bf59: Clarify unsupported catch-all contract path diagnostics and document that catch-all route files belong to runtime adapters, not individual contracts.
+- 303ba07: Define the public HTTP adapter contract and expose the Web Fetch adapter implementation.
+- 493d23b: Make the framework own context assembly with a server context blueprint and first-class service contexts.
+
+  - `createServer(...)` (and the Next/Web adapters) replace the `createContext` option with `context`. Gate-less contexts keep the plain request-factory shorthand; contexts that declare a `gate` must use the blueprint form `{ gate: (ports) => ports.gate, request, service }`. Returning `gate` from a context factory or hook addition is now a compile error.
+  - The gate port gains `gate.attach(ctx)`: it attaches a live, non-enumerable `ctx.gate` getter that re-binds against the receiving object on every access, so identity changes (including auth-hook elevation) can never authorize against a stale context, and spread copies drop the gate loudly instead of silently keeping stale identity. `bind(...)` remains the low-level primitive.
+  - Servers expose `createRequestContext(req)` and `createServiceContext(input?)`; the optional `context.service` factory powers schedule, outbox, command, and background contexts. Provider `setup`, `start`, and `stop` receive a late-bound `createServiceContext` so infra providers no longer hand-build background contexts.
+  - `createTestContextFactory(...)` now attaches the gate after all `extra` and override fields merge, fixing a stale-identity bug in tests.
+  - CLI templates, generators, and doctor diagnostics emit and check the new context blueprint and service-context wrappers.
+
+- eda7b59: Clarify that app-owned error details are public response data and should be
+  mapped explicitly rather than automatically redacted by the framework.
+- ac78cdf: Add `createScheduleRoute(...)` to `@beignet/next` for triggering one registered schedule from a serverless cron route, with the same fail-closed bearer auth and JSON envelope conventions as `createOutboxDrainRoute(...)`. Unknown schedule names throw when the route module loads.
+
+  The inline schedule runner in `@beignet/core/schedules` now accepts `instrumentation` and `instrumentationContext` options and records `schedule` devtools events (`started`, `completed`, `failed`) itself. Recording failures are isolated from schedule execution and reported to `onHookError`. `createScheduleRoute(...)`, `beignet schedule run`, and generated cron routes use this instead of hand-rolled lifecycle hooks.
+
+  Security: cron route bearer secrets in `createScheduleRoute(...)` and `createOutboxDrainRoute(...)` are now compared with a timing-safe SHA-256 digest comparison instead of `!==`.
+
+- 89390fe: Decouple devtools from app code with server-owned instrumentation.
+
+  - `@beignet/core/tracing` is a new dependency-free subpath with the W3C trace
+    primitives (`TraceContext`, `createTraceContext`, `createChildTraceContext`,
+    `parseTraceparent`, `createTraceparent`, `createTraceId`, `createSpanId`).
+    App context types now use `Partial<TraceContext>` instead of importing
+    `DevtoolsTraceContext` from `@beignet/devtools`.
+  - `createServer(...)` owns request instrumentation through a new
+    `instrumentation` option (`ServerInstrumentationOptions | false`). The server
+    resolves request IDs and trace context before user hooks and context
+    creation, passes them to context factories as `requestId` and `trace`,
+    writes `x-request-id`/`traceparent` response headers by default, and records
+    request/error events into the instrumentation port resolved from final ports
+    (`ports.instrumentation`, then `ports.devtools`). The ambient request
+    context (`enterActiveRequestContext` and friends) moved into
+    `@beignet/core/server`.
+  - `createUseCase(...)` instruments runs by default, resolving the
+    instrumentation port from `ctx.ports` per run; opt out with
+    `instrumentation: false`. App `onRun` observers run in addition.
+  - `createInstrumentedAuditLog({ audit, instrumentation })` in
+    `@beignet/core/ports` replaces `createDevtoolsAuditLog`.
+  - `createServer(...)` gains `validateResponses` (default `true`) to skip
+    route-owned response validation, mirroring the client option.
+  - Removed from `@beignet/devtools`: `createDevtoolsHooks`,
+    `createDevtoolsUseCaseObserver`, `createDevtoolsAuditLog`, and the
+    trace/request-context modules. Apps now only need `createDevtoolsProvider()`
+    plus the devtools route; deleting both leaves the rest of the app compiling
+    and running unchanged.
+  - `@beignet/next` cron and upload helpers resolve their instrumentation sink
+    with `resolveProviderInstrumentationPort(ctx.ports)` instead of hardcoding
+    `ports.devtools`.
+  - `beignet create` templates generate the decoupled shape.
+
+- 16cc113: Clarify the canonical route registration story and align generated starters on `app-context.ts`.
+- be85ab2: Document Next.js App Router server component, hydration, client component, and route handler patterns.
+- ac78cdf: Split the client `validate` config flag into `validateInput` (default false)
+  and `validateResponses` (default true). Client-side input validation failures
+  now throw a client-source `ContractError` with code `INPUT_VALIDATION_ERROR`
+  and no HTTP status instead of a synthetic 422 `VALIDATION_ERROR`. Setting
+  `validateResponses: false` returns success bodies as-is and classifies non-2xx
+  responses structurally while keeping `INVALID_JSON` transport errors.
+- cca08b1: Align generated apps and package docs around the canonical auth, policy, and AppContext model.
+- d6ad8bb: Standardize generated client helpers around `client/index.ts`, add a typed
+  React Query invalidation helper, and align package docs with the canonical app
+  client entrypoint.
+- a67c637: Add Beignet runtime boundary markers and extend `beignet lint` to catch client-safe roots that value-reach server-only code.
+- 7b0f708: Add first-class outbox instrumentation and devtools visibility for delivered, retried, and dead-lettered messages.
+- 493d23b: Add typed provider-contributed ports. `InferProviderPorts` (replacing
+  `ProvidedPortsOfList`) merges the ports a provider list contributes so apps can
+  type `ctx.ports` as `AppPorts & InferProviderPorts<typeof providers>` without
+  casts. The curried `definePorts<AppPorts>()({ bound, deferred })` form replaces
+  throwing stub boilerplate: deferred keys boot as descriptive placeholders and
+  `createServer(...)` fails startup with the unbound key list (configurable via
+  `onUnboundPorts: "error" | "warn" | "ignore"`). App-local providers can declare
+  required ports, app context, and service-context input through the curried
+  `createProvider<Requires, Context, ServiceInput>()` form, which types
+  `setup({ ports, createServiceContext })` and lifecycle contexts end to end.
+  CLI templates and `beignet make` generate and maintain the new forms.
+- 8063d38: Rename the contract front door to `defineContract`/`defineContractGroup`, rename operational commands to tasks (`@beignet/core/tasks`, `defineTasks`, `runTask`, `beignet task run`, `beignet make task`, `server/tasks.ts`, `features/<feature>/tasks/`, `paths.tasks`), and standardize context binding: context-free declarations stay top-level (`defineEvent`), while context-bound definitions come from per-capability factories (`createListeners`, `createJobs`, `createSchedules`, `createNotifications`, `createTasks`) called once in `lib/`. Top-level context-generic `defineListener`, `defineJob`, `defineSchedule`, and `defineNotification` are removed.
+- 192c6ad: Routes can bind a contract directly to a use case with `{ contract, useCase }` — status is inferred from a sole 2xx response, input defaults to merged path/query/body parts, and validated inputs are not re-parsed when the use case reuses the contract schema by reference. Full `handle` routes remain the escape hatch for headers, streaming, and multi-status responses.
+- Updated dependencies [8bcb31f]
+- Updated dependencies [d137044]
+- Updated dependencies [ac78cdf]
+- Updated dependencies [1a79090]
+- Updated dependencies [82c48dc]
+- Updated dependencies [303ba07]
+- Updated dependencies [493d23b]
+- Updated dependencies [89390fe]
+- Updated dependencies [e9c3209]
+- Updated dependencies [493d23b]
+- Updated dependencies [192c6ad]
+- Updated dependencies [255527d]
+  - @beignet/web@0.0.4
+
 ## 0.0.3
 
 ### Patch Changes