@diy-accounting-uk/diya-gl 1.2.1 → 1.2.2

package/dist/app/data/releases.json

@@ -259,6 +259,32 @@
           "scorecard": "101279 passed, 0 warnings, 0 failed"
         }
       }
+    },
+    {
+      "tag": "diya-gl-v1.2.1",
+      "date": "2026-09-10",
+      "formatVersion": "diya-gl/1",
+      "engineVersion": "1.2.1+411866032aec",
+      "taxDataHash": "6a9c036b5f9c",
+      "reconciledCommit": "320b4b8a1585e16fa170c2d312c14df38d0bcf5b",
+      "templates": {
+        "bst": {
+          "hash": "0d003e10e00c",
+          "scorecard": "810 passed, 0 warnings, 0 failed"
+        },
+        "taxi": {
+          "hash": "1ff69654d64d",
+          "scorecard": "686 passed, 0 warnings, 0 failed"
+        },
+        "se": {
+          "hash": "c6a50059cc90",
+          "scorecard": "7679 passed, 0 warnings, 0 failed"
+        },
+        "ltd": {
+          "hash": "0c18ceeaced4",
+          "scorecard": "101279 passed, 0 warnings, 0 failed"
+        }
+      }
     }
   ]
 }

package/dist/app/lib/app-resources.js

@@ -33,11 +33,11 @@ const SCHEMA_ROOT_FROM_APP = ["..", "web", "spreadsheets.diyaccounting.co.uk", "
 // serves the templates the DIYA-GL pages use, and keeps it in a user cache so
 // every later run works with no network.
 //
-// This stays on /books/ while the site still serves the pages there. Every
-// published version fetches this URL, so it moves only once the live site
-// redirects it, and the redirect keeps the older versions working after that.
+// Both the current /diya-gl/ and legacy /books/ paths resolve — the old one
+// through a redirect — so published versions built before the path moved keep
+// working.
 const TEMPLATE_PREFIX = "templates/";
-const DEFAULT_TEMPLATE_SOURCE = "https://spreadsheets.diyaccounting.co.uk/books/assets/";
+const DEFAULT_TEMPLATE_SOURCE = "https://spreadsheets.diyaccounting.co.uk/diya-gl/assets/";
 
 let templateTermsAnnounced = false;
 

package/dist/app/lib/calculators/se-derivations.js

@@ -58,8 +58,19 @@ function primaryField(boxes, boxNumber) {
   return fieldsOf(boxEntry(boxes, boxNumber))[0];
 }
 
-function setPath(target, path, value) {
+// "__proto__", "constructor" and "prototype" are not field names, they are
+// the prototype chain -- a path carrying one would write onto Object.prototype
+// rather than the object this call meant to build. Every path here comes from
+// sa103-mtd-mapping.json's own "field" column, so a segment like this is a
+// defect in that mapping file and must fail loudly rather than land quietly
+// on some other object.
+const UNSAFE_PATH_SEGMENTS = new Set(["__proto__", "constructor", "prototype"]);
+
+export function setPath(target, path, value) {
   const parts = path.split(".");
+  for (const part of parts) {
+    if (UNSAFE_PATH_SEGMENTS.has(part)) throw new Error(`setPath: "${part}" is not a field name, in path "${path}"`);
+  }
   let node = target;
   for (let i = 0; i < parts.length - 1; i++) node = node[parts[i]] ||= {};
   node[parts[parts.length - 1]] = value;

package/dist/app/lib/provenance-data.js

@@ -12,7 +12,7 @@
 
 export const PROVENANCE_DATA = {
   "formatVersion": "diya-gl/1",
-  "engineVersion": "1.2.1+411866032aec",
+  "engineVersion": "1.2.2+f31df0f7451c",
   "taxDataHash": "6a9c036b5f9c",
   "reconciledCommit": "320b4b8a1585e16fa170c2d312c14df38d0bcf5b",
   "templates": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diy-accounting-uk/diya-gl",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "type": "module",
   "description": "Recalculate, read and write DIYA-GL books from the command line",
   "license": "Apache-2.0",