@critical-path/svelte 0.16.2 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @critical-path/svelte
 
+## 0.17.0
+
+### Minor Changes
+
+- fd79762: **BREAKING:** strict request bodies, no identity in payloads, and CORS off by default.
+  
+  **@critical-path/core**
+  - Request schemas are strict: unknown keys, server-assigned fields and identity fields are rejected instead of stripped.
+  - Identity is never read from payloads. `updateTask` no longer reads `actorId`/`actorName`/`actorType`/`actor` from the update object; pass them as the third `options` argument or use `withActor`. `addComment`, `addCommentReaction`, `removeCommentReaction` and `createAttachment` take the actor from `withActor`, falling back to an optional `authorId`/`userId`/`uploaderId`, then `'system'`.
+  - Schemas export request body types (`CreateTaskBody`, `UpdateTaskBody`, ...).
+  
+  **@critical-path/server**
+  - Bodies containing unknown, server-assigned or identity fields return `400`.
+  - Every request runs as the `getContext` user, or `ANONYMOUS_ACTOR` (`anonymous`). Authors of comments, reactions, attachments and time entries are no longer accepted from bodies.
+  - `DELETE /comments/:id/reactions` takes `?emoji=` only.
+  - CORS is off by default (`cors: false`). Pass `cors: { origins: [...] }` to allow cross-origin browsers.
+  
+  **@critical-path/client**
+  - Method parameters use the server's body types, so identity fields no longer type-check. `addCommentReaction`/`removeCommentReaction` take `{ emoji }`; `addTodo`/`toggleTodo` drop the actor options argument.
+  - New `updateProject`, `deleteProject` and `addDependency`. `uploadAttachmentFile` base64-encodes binary data (previously it sent unusable JSON for `Uint8Array`/`ArrayBuffer`).
+  - CLI: `--author`, `--actor-id`, `--actor-name`, `--agent-name` and `CRITICAL_PATH_AUTHOR_ID`/`ACTOR_ID`/`AGENT_NAME` are removed; identity comes from the `--key` token via the server's `getContext`.
+  
+  **@critical-path/mcp**
+  - Tool arguments are strict: undeclared arguments return an `isError` result.
+  - `add_comment` no longer takes `authorId`. With an `engine`, writes are attributed to the new `actor` server option (default `DEFAULT_MCP_ACTOR`).
+  
+  **@critical-path/react / @critical-path/svelte**
+  - `addReaction`/`removeReaction` take `(commentId, emoji)`; comment and attachment inputs no longer accept `authorId`/`uploaderId`. Task, comment and deliverable update parameters use the schema body types.
+
+### Patch Changes
+
+- Updated dependencies [fd79762]
+  - @critical-path/core@0.25.0
+  - @critical-path/client@0.15.0
+  - @critical-path/mcp@0.10.0
+
+## 0.16.3
+
+### Patch Changes
+
+- b54e22c: Validate request bodies with shared zod schemas and publish an OpenAPI document.
+  
+  **@critical-path/core**
+  - New `@critical-path/core/schemas` subpath with create/update schemas for every resource and `parsePayload(schema, data)`. Kept off the package root so browser bundles do not include zod. `zod` is now a dependency of core.
+  - `ValidationError` carries an optional `issues: { path, message }[]`.
+  
+  **@critical-path/server**
+  - All request bodies are validated. Invalid bodies return `400` with `issues`. Server-assigned fields (`id`, `createdAt`, `updatedAt`, task `key`, owning `projectId` on updates) and unknown keys are stripped, so a `PATCH` can no longer move a task to another project.
+  - Comments, reactions and attachments require an author unless `getContext` resolves the caller. Attachment `mimeType` and `sizeBytes` default to `application/octet-stream` and `0` for linked files.
+  - New `GET /openapi.json` and `buildOpenApiDocument()` (OpenAPI 3.1, request bodies generated from the validation schemas).
+  
+  **@critical-path/mcp**
+  - Tool `inputSchema`s are generated from their zod schemas via the new `defineTool`, removing the hand-written JSON copies.
+  
+  **@critical-path/svelte**
+  - Rebuilt with the bundled `@critical-path/mcp` changes.
+- Updated dependencies [b54e22c]
+  - @critical-path/core@0.24.0
+  - @critical-path/mcp@0.9.0
+  - @critical-path/client@0.14.9
+
 ## 0.16.2
 
 ### Patch Changes

package/README.md

@@ -102,8 +102,8 @@ Combines threaded comments with inline attachments (`attachment.commentId === co
 
   async function handleSend(text: string, fileUrl?: string) {
     await activityState.addComment(
-      { content: text, authorId: 'user_1', authorType: 'user' },
-      fileUrl ? [{ filename: 'upload.png', url: fileUrl, uploaderId: 'user_1', mimeType: 'image/png', sizeBytes: 1024 }] : []
+      { content: text },
+      fileUrl ? [{ filename: 'upload.png', url: fileUrl, mimeType: 'image/png', sizeBytes: 1024 }] : []
     );
   }
 </script>
@@ -123,8 +123,8 @@ Combines threaded comments with inline attachments (`attachment.commentId === co
 
     <!-- Emoji Reactions -->
     <div class="reactions">
-      <button on:click={() => activityState.addReaction(thread.id, '👍', 'user_1')}>👍</button>
-      <button on:click={() => activityState.addReaction(thread.id, '🚀', 'user_1')}>🚀</button>
+      <button on:click={() => activityState.addReaction(thread.id, '👍')}>👍</button>
+      <button on:click={() => activityState.addReaction(thread.id, '🚀')}>🚀</button>
       <span>{thread.reactions?.length || 0} reactions</span>
     </div>
 

package/dist/activity-state.svelte.d.ts

@@ -1,3 +1,4 @@
+import type { CreateAttachmentBody, CreateCommentBody } from '@critical-path/core/schemas';
 import type { CriticalPathClient } from '@critical-path/client';
 import type { Comment, Attachment } from '@critical-path/core';
 export interface ThreadedCommentWithAttachments extends Comment {
@@ -15,21 +16,15 @@ export declare class TaskActivityState {
     standaloneAttachments: Attachment[];
     constructor(client: CriticalPathClient, taskId?: string | undefined);
     fetch(taskId?: string): Promise<void>;
-    addComment(input: Omit<Comment, 'id' | 'taskId' | 'createdAt' | 'updatedAt'>, attachmentInputs?: Array<Omit<Attachment, 'id' | 'taskId' | 'commentId' | 'createdAt' | 'updatedAt'>>): Promise<{
+    addComment(input: Omit<CreateCommentBody, 'taskId'>, attachmentInputs?: Array<Omit<CreateAttachmentBody, 'taskId' | 'commentId'>>): Promise<{
         comment: Comment;
         attachments: Attachment[];
     }>;
     addAttachment(input: Omit<Attachment, 'id' | 'taskId' | 'createdAt' | 'updatedAt'>): Promise<Attachment>;
     deleteComment(id: string): Promise<void>;
     deleteAttachment(id: string): Promise<void>;
-    addReaction(commentId: string, reactionOrEmoji: {
-        emoji: string;
-        userId: string;
-    } | string, maybeUserId?: string): Promise<Comment>;
-    removeReaction(commentId: string, reactionOrEmoji: {
-        emoji: string;
-        userId: string;
-    } | string, maybeUserId?: string): Promise<Comment>;
+    addReaction(commentId: string, emoji: string): Promise<Comment>;
+    removeReaction(commentId: string, emoji: string): Promise<Comment>;
 }
 export declare function createTaskActivityState(client: CriticalPathClient, taskId?: string): TaskActivityState;
 //# sourceMappingURL=activity-state.svelte.d.ts.map

package/dist/activity-state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-state.svelte.d.ts","sourceRoot":"","sources":["../src/activity-state.svelte.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,WAAW,8BAA+B,SAAQ,OAAO;IAC7D,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,qBAAa,iBAAiB;IA6ChB,OAAO,CAAC,MAAM;IAA6B,MAAM,CAAC,EAAE,MAAM;IA5CtE,QAAQ,YAAyB;IACjC,WAAW,eAA4B;IACvC,OAAO,UAA0B;IACjC,KAAK,eAA8B;IAEnC,OAAO,mCAiCJ;IAEH,qBAAqB,eAElB;gBAEiB,MAAM,EAAE,kBAAkB,EAAS,MAAM,CAAC,EAAE,MAAM,YAAA;IAEhE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM;IAwBrB,UAAU,CACd,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC,EACjE,gBAAgB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC;;;;IAiCjG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;IAelF,aAAa,CAAC,EAAE,EAAE,MAAM;IAaxB,gBAAgB,CAAC,EAAE,EAAE,MAAM;IAa3B,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC3D,WAAW,CAAC,EAAE,MAAM;IAiBhB,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC3D,WAAW,CAAC,EAAE,MAAM;CAgBvB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAEtG"}
+{"version":3,"file":"activity-state.svelte.d.ts","sourceRoot":"","sources":["../src/activity-state.svelte.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE/D,MAAM,WAAW,8BAA+B,SAAQ,OAAO;IAC7D,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,qBAAa,iBAAiB;IA6ChB,OAAO,CAAC,MAAM;IAA6B,MAAM,CAAC,EAAE,MAAM;IA5CtE,QAAQ,YAAyB;IACjC,WAAW,eAA4B;IACvC,OAAO,UAA0B;IACjC,KAAK,eAA8B;IAEnC,OAAO,mCAiCJ;IAEH,qBAAqB,eAElB;gBAEiB,MAAM,EAAE,kBAAkB,EAAS,MAAM,CAAC,EAAE,MAAM,YAAA;IAEhE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM;IAwBrB,UAAU,CACd,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EACxC,gBAAgB,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,WAAW,CAAC,CAAC;;;;IAiCxE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;IAelF,aAAa,CAAC,EAAE,EAAE,MAAM;IAaxB,gBAAgB,CAAC,EAAE,EAAE,MAAM;IAa3B,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM;IAcT,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM;CAahB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAEtG"}

package/dist/comment-state.svelte.d.ts

@@ -1,3 +1,4 @@
+import type { CreateCommentBody, UpdateCommentBody } from '@critical-path/core/schemas';
 import type { CriticalPathClient } from '@critical-path/client';
 import type { Comment } from '@critical-path/core';
 export interface ThreadedComment extends Comment {
@@ -12,17 +13,11 @@ export declare class CommentState {
     threads: ThreadedComment[];
     constructor(client: CriticalPathClient, taskId?: string | undefined);
     fetch(taskId?: string): Promise<void>;
-    addComment(input: Omit<Comment, 'id' | 'taskId' | 'createdAt' | 'updatedAt'>): Promise<Comment>;
-    updateComment(id: string, updates: Partial<Comment>): Promise<Comment>;
+    addComment(input: Omit<CreateCommentBody, 'taskId'>): Promise<Comment>;
+    updateComment(id: string, updates: UpdateCommentBody): Promise<Comment>;
     deleteComment(id: string): Promise<void>;
-    addReaction(commentId: string, reactionOrEmoji: {
-        emoji: string;
-        userId: string;
-    } | string, maybeUserId?: string): Promise<Comment>;
-    removeReaction(commentId: string, reactionOrEmoji: {
-        emoji: string;
-        userId: string;
-    } | string, maybeUserId?: string): Promise<Comment>;
+    addReaction(commentId: string, emoji: string): Promise<Comment>;
+    removeReaction(commentId: string, emoji: string): Promise<Comment>;
 }
 export declare function createCommentState(client: CriticalPathClient, taskId?: string): CommentState;
 //# sourceMappingURL=comment-state.svelte.d.ts.map

package/dist/comment-state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-state.svelte.d.ts","sourceRoot":"","sources":["../src/comment-state.svelte.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,qBAAa,YAAY;IAyBX,OAAO,CAAC,MAAM;IAA6B,MAAM,CAAC,EAAE,MAAM;IAxBtE,IAAI,YAAyB;IAC7B,OAAO,UAA0B;IACjC,KAAK,eAA8B;IAEnC,OAAO,oBAkBJ;gBAEiB,MAAM,EAAE,kBAAkB,EAAS,MAAM,CAAC,EAAE,MAAM,YAAA;IAEhE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM;IAkBrB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAC;IAe5E,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;IAYnD,aAAa,CAAC,EAAE,EAAE,MAAM;IAaxB,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC3D,WAAW,CAAC,EAAE,MAAM;IAiBhB,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAC3D,WAAW,CAAC,EAAE,MAAM;CAgBvB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAE5F"}
+{"version":3,"file":"comment-state.svelte.d.ts","sourceRoot":"","sources":["../src/comment-state.svelte.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,qBAAa,YAAY;IAyBX,OAAO,CAAC,MAAM;IAA6B,MAAM,CAAC,EAAE,MAAM;IAxBtE,IAAI,YAAyB;IAC7B,OAAO,UAA0B;IACjC,KAAK,eAA8B;IAEnC,OAAO,oBAkBJ;gBAEiB,MAAM,EAAE,kBAAkB,EAAS,MAAM,CAAC,EAAE,MAAM,YAAA;IAEhE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM;IAkBrB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC;IAenD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB;IAYpD,aAAa,CAAC,EAAE,EAAE,MAAM;IAaxB,WAAW,CACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM;IAcT,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM;CAahB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAE5F"}

package/dist/deliverable-state.svelte.d.ts

@@ -1,3 +1,4 @@
+import type { UpdateDeliverableBody } from '@critical-path/core/schemas';
 import type { CriticalPathClient } from '@critical-path/client';
 import type { Deliverable, DeliverableSummary, CreateDeliverableInput } from '@critical-path/core';
 export declare class DeliverableState {
@@ -9,7 +10,7 @@ export declare class DeliverableState {
     constructor(client: CriticalPathClient, projectId?: string | undefined);
     fetch(projectId?: string): Promise<void>;
     createDeliverable(input: CreateDeliverableInput): Promise<Deliverable>;
-    updateDeliverable(id: string, updates: Partial<Deliverable>): Promise<Deliverable>;
+    updateDeliverable(id: string, updates: UpdateDeliverableBody): Promise<Deliverable>;
     deleteDeliverable(id: string): Promise<void>;
     getSummary(deliverableId: string): Promise<DeliverableSummary>;
 }

package/dist/deliverable-state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deliverable-state.svelte.d.ts","sourceRoot":"","sources":["../src/deliverable-state.svelte.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEnG,qBAAa,gBAAgB;IAKf,OAAO,CAAC,MAAM;IAA6B,SAAS,CAAC,EAAE,MAAM;IAJzE,IAAI,gBAA6B;IACjC,OAAO,UAA0B;IACjC,KAAK,eAA8B;gBAEf,MAAM,EAAE,kBAAkB,EAAS,SAAS,CAAC,EAAE,MAAM,YAAA;IAEnE,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM;IAiBxB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB;IAY/C,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC;IAe3D,iBAAiB,CAAC,EAAE,EAAE,MAAM;IAa5B,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAGrE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAE9G"}
+{"version":3,"file":"deliverable-state.svelte.d.ts","sourceRoot":"","sources":["../src/deliverable-state.svelte.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAEnG,qBAAa,gBAAgB;IAKf,OAAO,CAAC,MAAM;IAA6B,SAAS,CAAC,EAAE,MAAM;IAJzE,IAAI,gBAA6B;IACjC,OAAO,UAA0B;IACjC,KAAK,eAA8B;gBAEf,MAAM,EAAE,kBAAkB,EAAS,SAAS,CAAC,EAAE,MAAM,YAAA;IAEnE,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM;IAiBxB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB;IAY/C,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB;IAe5D,iBAAiB,CAAC,EAAE,EAAE,MAAM;IAa5B,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAGrE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAE9G"}