@checkstack/announcement-backend 0.3.12 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # @checkstack/announcement-backend
 
+## 0.4.0
+
+### Minor Changes
+
+- 9dcc848: Align workspace dependency versions and migrate React Router to v7.
+
+  BREAKING CHANGES (React Router v7): All frontend packages now depend on `react-router-dom@^7.16.0`. Previously the workspace declared four divergent ranges (`^6.20.0`, `^6.22.0`, `^7.1.1`, `^7.14.2`), which resolved both `react-router@6` and `react-router@7` into a single bundle. Everything is now unified on v7. The public imports the app uses (`BrowserRouter`, `Routes`, `Route`, `Link`, `NavLink`, `MemoryRouter`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`) are unchanged between v6 and v7, so no source rewrites were required - but any out-of-tree plugin still on react-router v6 should upgrade to v7 (see the React Router v6 -> v7 upgrade guide) to share the host's single router instance via the import map.
+
+  Other unified ranges (no API change): `react` -> `^18.3.1`, the `@orpc/*` family (`contract`, `server`, `client`, `tanstack-query`, `openapi`, `zod`) -> `^1.14.4`, and `better-auth` -> `^1.6.13`.
+
+  Removed the pre-rename `@orpc/react-query` leftover from `@checkstack/frontend-api`; its `createRouterUtils` / `RouterUtils` / `ProcedureUtils` now come from `@orpc/tanstack-query` (the package already in use).
+
+  Stale in-range runtime deps pulled up to current published versions: `hono` `^4.12.23`, `@tanstack/react-query` (+devtools) `^5.100.14`, `date-fns` `^4.4.0`, `jose` `^6.2.3`, `tar` `^7.5.16`, `semver` `^7.8.1`, `@xyflow/react` `^12.11.0`.
+
+### Patch Changes
+
+- 9dcc848: Assorted bug fixes and small hardening across the platform.
+
+  - announcement-backend: `updateAnnouncement` now invalidates the active-announcements and admin-list caches (it was missing the `invalidateAllActive` / `invalidateListAll` calls), so an edited announcement no longer stays stale up to the 45s TTL.
+  - anomaly-backend: anomaly/drift state transitions (confirmations, recoveries, self-resolutions) now log at `debug` instead of info/warn - they are already surfaced via the `ANOMALY_STATE_CHANGED` signal, so logging them louder just added noise; genuine failure paths stay `warn`.
+  - backend: the `/api/:pluginId/*` dispatcher now populates `requestHeaders` on the per-request RPC context, so a handler that re-enters the router as the originating user (e.g. an AI tool's user-scoped client) can forward the caller's session cookie / bearer - previously the loopback failed with "Authentication required". Guarded by a real end-to-end integration test. The HTTP server idle timeout is also raised (default 255s, configurable via `CHECKSTACK_SERVER_IDLE_TIMEOUT_SECONDS`, clamped 0-255, reset on each streamed chunk) so long AI chat SSE turns are not severed mid-stream.
+  - backend: a request for an unknown plugin id (`/api/<unknown>/...`) now returns `404 Not Found` instead of `500` (and logs at warn, not error, since it is a client request) - an unknown _procedure_ on a known plugin already 404'd. The in-app docs namespace `/checkstack/*` now serves Starlight's own `404.html` with a real 404 status for a missing doc, instead of falling through to the SPA catch-all and 200-ing the app shell. Both guarded by tests.
+  - automation-common: remove polynomial-time backtracking from `toShellEnvKey`'s underscore-trim (CodeQL `js/polynomial-redos`); a negative look-behind anchors the trailing run, keeping the trim linear.
+  - common + script-packages-common: the pure transport-safe sandbox-policy schema (`sandboxPolicySchema` and its sub-schemas + inferred types) moved to `@checkstack/common` (the neutral base), removing two inverted deps that existed only to reach the shape; `@checkstack/backend-api` continues to re-export it. The schema is no longer exported from `@checkstack/script-packages-common`. Pure refactor, no behavior change.
+  - catalog-backend: reject duplicate system names (a `CONFLICT` on create/rename, enforced by a pre-write check AND a new DB unique index on `systems.name`, migration 0004 which first resolves pre-existing duplicates by suffixing).
+  - catalog-frontend: detail-page cleanups (use `<NotFound />` not `<AccessDenied />` on the not-found branch, a readable key/value metadata list via `normalizeMetadata`, runtime locale via `formatDate`); and stop the browse view re-rendering on every health report (adopt a new statuses report only when a value actually changed, via `healthStatusesEqual`, so rows stay stable and interactive).
+  - healthcheck-backend: fix the daily-rollup retention step failing with an `ON CONFLICT` mismatch (SQLSTATE 42P10) after `environmentId` joined the `health_check_aggregates` unique constraint - the rollup now groups by (day, environmentId, sourceId) and uses a single exported conflict-target constant (`DAILY_AGGREGATE_CONFLICT_TARGET`) kept in lock-step with the schema by a unit test.
+  - automation-frontend: the service-account picker's "Learn more" links are now absolute URLs to the deployed Astro docs site (they 404ed as in-app relative paths). The Monaco script editor double-init crash is fixed (serialized cold init, a guarded `monacoGuard` accessor, theme/type effects gated on `apiReady`).
+  - auth-frontend: bound the desktop user-menu popover height (`max-h-[var(--radix-popover-content-available-height)]` + `overflow-y-auto`) so it no longer clips on short viewports, and fold the standalone `Account > Profile` item into a focusable name/email header (`profileHref` on `UserMenu`); the now-empty `Account` group no longer renders.
+  - satellite-frontend: picked up via the sidebar-nav migration (account-only user menu).
+
+  (Related UI fixes - the Monaco editor following the app theme, the `DynamicOptionsField` no-flash fix, the shared `Spinner`, GFM tables, and the user-menu popover bound - land their `@checkstack/ui` bump in the UI/perf changesets where `@checkstack/ui` is already minored.)
+
+  This is a beta patch.
+
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+  - @checkstack/auth-backend@0.5.0
+  - @checkstack/backend-api@0.21.0
+  - @checkstack/common@0.13.0
+  - @checkstack/announcement-common@0.5.0
+  - @checkstack/command-backend@0.2.0
+  - @checkstack/cache-api@0.3.9
+  - @checkstack/signal-common@0.2.6
+  - @checkstack/cache-utils@0.2.14
+
+## 0.3.13
+
+### Patch Changes
+
+- Updated dependencies [a57f7db]
+  - @checkstack/backend-api@0.20.0
+  - @checkstack/auth-backend@0.4.33
+  - @checkstack/cache-api@0.3.8
+  - @checkstack/command-backend@0.1.33
+  - @checkstack/cache-utils@0.2.13
+
 ## 0.3.12
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/announcement-backend",
-  "version": "0.3.12",
+  "version": "0.4.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -14,22 +14,22 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.18.0",
-    "@checkstack/cache-api": "0.3.6",
-    "@checkstack/cache-utils": "0.2.11",
+    "@checkstack/backend-api": "0.20.0",
+    "@checkstack/cache-api": "0.3.8",
+    "@checkstack/cache-utils": "0.2.13",
     "@checkstack/announcement-common": "0.4.2",
-    "@checkstack/auth-backend": "0.4.31",
-    "@checkstack/command-backend": "0.1.31",
+    "@checkstack/auth-backend": "0.4.33",
+    "@checkstack/command-backend": "0.1.33",
     "@checkstack/common": "0.12.0",
     "@checkstack/signal-common": "0.2.5",
     "drizzle-orm": "^0.45.0",
     "zod": "^4.2.1",
-    "@orpc/server": "^1.13.2"
+    "@orpc/server": "^1.14.4"
   },
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.5",
     "@checkstack/scripts": "0.3.4",
-    "@checkstack/test-utils-backend": "0.1.31",
+    "@checkstack/test-utils-backend": "0.1.33",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
     "drizzle-kit": "^0.31.10",

package/src/router.test.ts

@@ -345,6 +345,43 @@ describe("Announcement Router", () => {
       );
     });
 
+    it("invalidates both active and list-all caches after a successful update", async () => {
+      const context = createMockRpcContext({ user: adminUser });
+
+      const invalidateAllActiveSpy = mock(() => Promise.resolve(0));
+      const invalidateListAllSpy = mock(() => Promise.resolve());
+
+      const spyCache: AnnouncementCache = {
+        ...passthroughCache,
+        invalidateAllActive: invalidateAllActiveSpy,
+        invalidateListAll: invalidateListAllSpy,
+      };
+
+      const routerWithSpyCache = createAnnouncementRouter(
+        mockDb as never,
+        mockSignalService,
+        spyCache,
+      );
+
+      const updatedRow = { ...sampleAnnouncement, active: false };
+      mockDb.update.mockReturnValueOnce({
+        set: mock(() => ({
+          where: mock(() => ({
+            returning: mock(() => Promise.resolve([updatedRow])),
+          })),
+        })),
+      } as never);
+
+      await call(
+        routerWithSpyCache.updateAnnouncement,
+        { id: "ann-1", active: false },
+        { context },
+      );
+
+      expect(invalidateAllActiveSpy).toHaveBeenCalledTimes(1);
+      expect(invalidateListAllSpy).toHaveBeenCalledTimes(1);
+    });
+
     it("throws NOT_FOUND for non-existent announcement", async () => {
       const context = createMockRpcContext({ user: adminUser });
 

package/src/router.ts

@@ -245,6 +245,11 @@ export function createAnnouncementRouter(
 
       const announcement = toAnnouncement(row);
 
+      await Promise.all([
+        cache.invalidateAllActive(),
+        cache.invalidateListAll(),
+      ]);
+
       await signalService.broadcast(ANNOUNCEMENT_UPDATED, {
         announcementId: announcement.id,
         action: "updated",