@cldmv/slothlet 3.13.0 → 3.13.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -6
- package/devcheck.mjs +11 -7
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -43,19 +43,17 @@ Every feature has been hardened with a comprehensive test suite - over **5,300 t
|
|
|
43
43
|
|
|
44
44
|
## ✨ What's New
|
|
45
45
|
|
|
46
|
-
### Latest: v3.13.
|
|
46
|
+
### Latest: v3.13.1 (August 2026)
|
|
47
47
|
|
|
48
|
-
- **
|
|
49
|
-
-
|
|
50
|
-
- **Module-private exports + injectable importer (#269, #267)** — with permissions enabled, `_`/`__`-prefixed exports are enforced as private to their own module (host default-deny, opt-out `permissions.private.host: "allow"`) and reserved-named files/exports are refused at load; separately, `slothlet({ import })` routes leaf loads through a consumer's test runner so leaf execution attributes correctly in coverage.
|
|
51
|
-
- [View full v3.13.0 Changelog](./docs/changelog/v3/v3.13.0.md)
|
|
48
|
+
- **Dev-environment detection fix (#270)** — `./devcheck` now reads the CLI form `node --conditions=slothlet-dev` from `process.execArgv` (the same channel vitest uses to pass conditions to its workers), and treats a package installed under any `node_modules` path segment as installed. A correctly-configured dev run against `src/` no longer aborts with a false `process.exit(1)`, and a git or tarball install — which ships `src/` without a built `dist/` — no longer self-terminates inside a consuming project.
|
|
49
|
+
- [View full v3.13.1 Changelog](./docs/changelog/v3/v3.13.1.md)
|
|
52
50
|
|
|
53
51
|
### Recent Releases
|
|
54
52
|
|
|
53
|
+
- **v3.13.0** (August 2026) — Sync/async-transparent hook dispatch, `api.slothlet.api.leaves()` for module-scoped path enumeration, and permission-enforced module-private (`_`/`__`) exports plus an injectable importer that attributes leaf execution in consumer coverage ([Changelog](./docs/changelog/v3/v3.13.0.md))
|
|
55
54
|
- **v3.12.3** (August 2026) — Composition & attribution correctness: every read/call attributed to the responsible module (identity survives `await`, per-flow concurrency, redacted enumeration), `apiPath` matches the composed surface, faithful lazy resolution (thenable wrappers, deep chains, file+dir collisions), and collisions follow the documented `api.collision` table ([Changelog](./docs/changelog/v3/v3.12.3.md))
|
|
56
55
|
- **v3.12.2** (July 2026) — Type generation types both JS and TS leaves faithfully: generated `.d.ts` carries JSDoc `@param`/`@returns` types instead of `any` and compiles for TS leaves referencing local named types; plus a consumer-coverage testing guide ([Changelog](./docs/changelog/v3/v3.12.2.md))
|
|
57
56
|
- **v3.12.1** (July 2026) — Security patch: nested values of `scope({ protect, owners })` context keys are now guarded to depth — `context.auth.userId = …` throws `CONTEXT_KEY_PROTECTED` with the full path — plus the `./devcheck` export now ships the file the npm whitelist never included ([Changelog](./docs/changelog/v3/v3.12.1.md))
|
|
58
|
-
- **v3.12.0** (July 2026) — Security-and-observability: permission enforcement fails closed on an absent/forged caller (opt-out `permissions.failOpenOnAbsentCaller`), inter-module construction + class-instance methods are permission-checked, the engine-internal `handlers/`/`factories/` subpaths leave `exports`, an opt-in control-surface `seal()`, owner-locked/write-protected context keys via `scope({ protect, owners })`, `impl:warning`/`impl:error` diagnostic lifecycle events, and nested `shutdown`/`destroy` leaves no longer dropped ([Changelog](./docs/changelog/v3/v3.12.0.md))
|
|
59
57
|
|
|
60
58
|
📚 **For complete version history and detailed release notes, see [docs/changelog/](./docs/changelog/) folder.**
|
|
61
59
|
|
package/devcheck.mjs
CHANGED
|
@@ -34,15 +34,19 @@ const isCI = !!(
|
|
|
34
34
|
|
|
35
35
|
if (existsSync(srcPath) && !existsSync(distPath) && !isCI) {
|
|
36
36
|
const nodeEnv = process.env.NODE_ENV?.toLowerCase();
|
|
37
|
-
|
|
37
|
+
// Dev resolver conditions arrive either via NODE_OPTIONS (env) or on the CLI, where Node puts
|
|
38
|
+
// them in process.execArgv — which is also how vitest passes conditions to its workers. Fold
|
|
39
|
+
// both into one haystack so the CLI/worker form is detected, not just the env form. (#270)
|
|
40
|
+
const conditionFlags = (process.env.NODE_OPTIONS || "") + " " + process.execArgv.join(" ");
|
|
38
41
|
|
|
39
|
-
//
|
|
40
|
-
|
|
41
|
-
|
|
42
|
+
// Detect an installed copy by a `node_modules` segment anywhere above this file. Matching only
|
|
43
|
+
// basename(dirname(__dirname)) misses a scoped install — node_modules/@cldmv/slothlet, whose
|
|
44
|
+
// parent is the `@cldmv` scope dir, not `node_modules`. (#270)
|
|
45
|
+
const isInstalledPackage = __dirname.split(path.sep).includes("node_modules");
|
|
42
46
|
|
|
43
|
-
// Parse conditions from NODE_OPTIONS
|
|
44
|
-
const hasSlothletDev =
|
|
45
|
-
const hasGenericDev =
|
|
47
|
+
// Parse conditions from NODE_OPTIONS / execArgv
|
|
48
|
+
const hasSlothletDev = conditionFlags.includes("slothlet-dev");
|
|
49
|
+
const hasGenericDev = conditionFlags.includes("--conditions=development") || conditionFlags.includes("--conditions development");
|
|
46
50
|
const hasDevEnv = nodeEnv === "dev" || nodeEnv === "development";
|
|
47
51
|
|
|
48
52
|
// Only check if we're in the slothlet repo (not installed in node_modules)
|