@checkstack/dependency-backend 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,89 @@
 # @checkstack/dependency-backend
 
+## 1.4.0
+
+### Minor Changes
+
+- 9dcc848: Plugin-owned AI tools: every domain plugin contributes its own AI tools (chat assistant + automation AI action), and `ai-backend` is platform-only.
+
+  Every plugin-specific AI tool is owned by the plugin whose domain it acts on, registered via that plugin's own `aiToolExtensionPoint` / `aiToolProjectionExtensionPoint` from its init - the same path an external plugin author uses. `ai-backend` no longer imports or depends on any capability plugin's `*-common`; the dependency direction is strictly plugin -> ai-platform. Pure helpers (`computeFieldDiff`, capability-summary, `ScriptContextKind`) live in `@checkstack/ai-common`.
+
+  Tools shipped:
+
+  - Health checks and automations: full CRUD - `healthcheck.propose` / `automation.propose` and `*.update` (`mutate`, deep-validated) and `*.delete` (`destructive`, always confirm-gated). `healthcheck.propose`'s dry-run calls the new deep `validateConfiguration` so propose-time validation matches apply-time. Assertions are validated against the collector's result schema and the canonical operator vocabulary. Capability-catalog tools (`ai.listCapabilities`, `ai.getCapabilitySchema`), script context tools (`ai.getScriptContext`, `ai.testScript`), and notify-subscriber tools (`healthcheck.notifySystemSubscribers` / `...GroupSubscribers`).
+  - Catalog: `catalog.createSystem` / `updateSystem` / `createGroup` / `updateGroup` (`mutate`), `catalog.deleteSystem` / `deleteGroup` (`destructive`), membership tools (`mutate`), plus `catalog.listSystems` / `listGroups` read projections.
+  - Incident: `incident.create` / `update` / `addUpdate` / `resolve` / `addLink` (`mutate`), `incident.delete` / `removeLink` (`destructive`), and `incident.get` / `incident.list` read projections.
+  - Maintenance: `maintenance.create` / `update` / `addUpdate` / `close` / `addLink` (`mutate`), `maintenance.delete` / `removeLink` (`destructive`), and `maintenance.list` / `get` read projections.
+  - Read projections for SLO (`slo.listObjectives`), dependency (`dependency.list`), incident (`incident.list`), healthcheck (`healthcheck.status`), and anomaly (`anomaly.explain`), each gated by the source procedure's own access rule and routed as the principal.
+  - Documentation grounding: `ai.searchDocs` / `ai.getDoc` over a build-time bundled docs index (BM25-ish ranking), so the assistant grounds how-to answers in Checkstack's own docs offline.
+  - URL introspection: `ai.probeUrl`, an SSRF-guarded read tool the assistant uses to inspect a real endpoint before drafting a health check. Update tools compute a before -> after field diff rendered on the confirm card (approve mode) or an "Applied" card (auto mode), so a change is never silent.
+
+  `ai_analyze` automation action (automation-backend, with an editor connection picker + audited tool calls): runs a bounded AI agent on the run context as the automation's `runAs` service account, so it can never exceed that identity's permissions; destructive tools are never offered; mutating tools auto-apply through the service account's client. Produces an `automation.analysis` artifact downstream actions can branch on. The agent loop is exposed as a headless `aiAgentRunnerRef` service so automation-backend can drive it without depending on ai-backend.
+
+  `notification.notifyForSubscription` is now callable by user / application principals holding `notification.send` (previously service-only). Every tool routes through the user-scoped client, so handler-side authorization is enforced exactly as a direct UI/RPC action; the resolver gate plus the propose/apply re-check at propose AND apply are the additional authority. A systemic authz regression test asserts every registered tool falls into exactly one safe authorization category.
+
+  A new `ai_transport` enum value `automation` records the AI action's tool calls in the `ai_tool_calls` audit log. No new durable state beyond that; each tool is a thin, deterministic wrapper over an existing RPC, so every pod behaves identically.
+
+  This is a beta minor.
+
+- 9dcc848: Align workspace dependency versions and migrate React Router to v7.
+
+  BREAKING CHANGES (React Router v7): All frontend packages now depend on `react-router-dom@^7.16.0`. Previously the workspace declared four divergent ranges (`^6.20.0`, `^6.22.0`, `^7.1.1`, `^7.14.2`), which resolved both `react-router@6` and `react-router@7` into a single bundle. Everything is now unified on v7. The public imports the app uses (`BrowserRouter`, `Routes`, `Route`, `Link`, `NavLink`, `MemoryRouter`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`) are unchanged between v6 and v7, so no source rewrites were required - but any out-of-tree plugin still on react-router v6 should upgrade to v7 (see the React Router v6 -> v7 upgrade guide) to share the host's single router instance via the import map.
+
+  Other unified ranges (no API change): `react` -> `^18.3.1`, the `@orpc/*` family (`contract`, `server`, `client`, `tanstack-query`, `openapi`, `zod`) -> `^1.14.4`, and `better-auth` -> `^1.6.13`.
+
+  Removed the pre-rename `@orpc/react-query` leftover from `@checkstack/frontend-api`; its `createRouterUtils` / `RouterUtils` / `ProcedureUtils` now come from `@orpc/tanstack-query` (the package already in use).
+
+  Stale in-range runtime deps pulled up to current published versions: `hono` `^4.12.23`, `@tanstack/react-query` (+devtools) `^5.100.14`, `date-fns` `^4.4.0`, `jose` `^6.2.3`, `tar` `^7.5.16`, `semver` `^7.8.1`, `@xyflow/react` `^12.11.0`.
+
+### Patch Changes
+
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+- Updated dependencies [9dcc848]
+  - @checkstack/ai-backend@0.1.0
+  - @checkstack/backend-api@0.21.0
+  - @checkstack/healthcheck-backend@1.6.0
+  - @checkstack/healthcheck-common@1.5.0
+  - @checkstack/automation-backend@0.5.0
+  - @checkstack/catalog-backend@1.4.0
+  - @checkstack/notification-common@1.3.0
+  - @checkstack/catalog-common@2.3.0
+  - @checkstack/common@0.13.0
+  - @checkstack/dependency-common@1.2.0
+  - @checkstack/gitops-backend@0.5.0
+  - @checkstack/gitops-common@0.6.0
+  - @checkstack/incident-common@1.4.0
+  - @checkstack/maintenance-common@1.4.0
+  - @checkstack/signal-common@0.2.6
+
+## 1.3.1
+
+### Patch Changes
+
+- Updated dependencies [a57f7db]
+- Updated dependencies [0d9e5d8]
+  - @checkstack/backend-api@0.20.0
+  - @checkstack/healthcheck-backend@1.5.0
+  - @checkstack/automation-backend@0.4.0
+  - @checkstack/catalog-backend@1.3.1
+  - @checkstack/gitops-backend@0.4.1
+
 ## 1.3.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/dependency-backend",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -15,28 +15,30 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.18.0",
-    "@checkstack/automation-backend": "0.2.0",
+    "@checkstack/backend-api": "0.20.0",
+    "@checkstack/ai-backend": "0.0.0",
+    "@checkstack/automation-backend": "0.4.0",
     "@checkstack/dependency-common": "1.1.3",
     "@checkstack/catalog-common": "2.2.3",
-    "@checkstack/catalog-backend": "1.2.0",
-    "@checkstack/healthcheck-common": "1.3.0",
-    "@checkstack/healthcheck-backend": "1.3.0",
-    "@checkstack/maintenance-common": "1.2.3",
+    "@checkstack/catalog-backend": "1.3.1",
+    "@checkstack/healthcheck-common": "1.4.0",
+    "@checkstack/healthcheck-backend": "1.5.0",
+    "@checkstack/maintenance-common": "1.3.0",
     "@checkstack/incident-common": "1.3.1",
     "@checkstack/notification-common": "1.2.1",
     "@checkstack/signal-common": "0.2.5",
-    "@checkstack/gitops-backend": "0.3.7",
-    "@checkstack/gitops-common": "0.4.2",
+    "@checkstack/gitops-backend": "0.4.1",
+    "@checkstack/gitops-common": "0.5.0",
     "@checkstack/common": "0.12.0",
     "drizzle-orm": "^0.45.0",
     "zod": "^4.2.1",
-    "@orpc/server": "^1.13.2"
+    "@orpc/contract": "^1.14.4",
+    "@orpc/server": "^1.14.4"
   },
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.5",
     "@checkstack/scripts": "0.3.4",
-    "@checkstack/test-utils-backend": "0.1.31",
+    "@checkstack/test-utils-backend": "0.1.33",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
     "drizzle-kit": "^0.31.10",

package/src/ai/dependency.projection.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from "bun:test";
+import {
+  buildProjectedTool,
+  deferredProjectionExecute,
+} from "@checkstack/ai-backend";
+import {
+  dependencyContract,
+  pluginMetadata,
+} from "@checkstack/dependency-common";
+
+// Build the projected tool with the SAME inputs the plugin exposes via
+// aiToolProjectionExtensionPoint in `index.ts`, and assert the resulting tool
+// carries the source procedure's contract access rules - NOT the chat
+// transport's `ai.chat.read` gate.
+describe("dependency.list projection", () => {
+  const tool = buildProjectedTool({
+    procedure: dependencyContract.getAllDependencies,
+    sourcePluginMetadata: pluginMetadata,
+    procedureKey: "getAllDependencies",
+    name: "dependency.list",
+    description:
+      "List all cross-system dependencies (the dependency graph). Read-only.",
+    effect: "read",
+    execute: deferredProjectionExecute,
+  });
+
+  test("uses the overridden tool name", () => {
+    expect(tool.name).toBe("dependency.list");
+  });
+
+  test("is classified as a read-only effect", () => {
+    expect(tool.effect).toBe("read");
+  });
+
+  test("inherits the source procedure's qualified read access rule", () => {
+    // qualifyAccessRuleId: `${pluginId}.${rule.id}` where rule.id = `dependency.read`.
+    expect(tool.requiredAccessRules).toEqual(["dependency.dependency.read"]);
+  });
+});

package/src/automations.test.ts

@@ -2,7 +2,7 @@
  * Behaviour tests for the dependency automation triggers + actions.
  */
 import { describe, expect, it, mock } from "bun:test";
-import type { Logger } from "@checkstack/backend-api";
+import type { Logger, RpcClient } from "@checkstack/backend-api";
 import { createMockLogger } from "@checkstack/test-utils-backend";
 
 import {
@@ -26,6 +26,7 @@ const ctxBase = {
   getService: async <T,>(): Promise<T> => {
     throw new Error("not used");
   },
+  rpcClient: { forPlugin: () => ({}) } as unknown as RpcClient,
 };
 
 describe("dependency triggers", () => {

package/src/index.ts

@@ -1,5 +1,9 @@
 import * as schema from "./schema";
 import type { SafeDatabase } from "@checkstack/backend-api";
+import {
+  aiToolProjectionExtensionPoint,
+  deferredProjectionExecute,
+} from "@checkstack/ai-backend";
 import {
   dependencyAccessRules,
   pluginMetadata,
@@ -128,6 +132,20 @@ export default createBackendPlugin({
       },
     });
 
+    // Expose this plugin's read-only AI projection (`dependency.list`) via
+    // the AI projection extension point. ai-backend collects its routing in
+    // afterPluginsReady and never imports dependency-common.
+    env.getExtensionPoint(aiToolProjectionExtensionPoint).expose({
+      procedure: dependencyContract.getAllDependencies,
+      sourcePluginMetadata: pluginMetadata,
+      procedureKey: "getAllDependencies",
+      name: "dependency.list",
+      description:
+        "List all cross-system dependencies (the dependency graph). Read-only.",
+      effect: "read",
+      execute: deferredProjectionExecute,
+    });
+
     env.registerInit({
       schema,
       deps: {

package/tsconfig.json

@@ -4,6 +4,9 @@
     "src"
   ],
   "references": [
+    {
+      "path": "../ai-backend"
+    },
     {
       "path": "../automation-backend"
     },