@feasibleone/blong-gogo 1.38.0 → 1.38.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.38.1](https://github.com/feasibleone/blong/compare/blong-gogo-v1.38.0...blong-gogo-v1.38.1) (2026-10-01)
+
+
+### Bug Fixes
+
+* error handling ([fc1af53](https://github.com/feasibleone/blong/commit/fc1af536ae814a88a661341936bd9f9c519b38d1))
+
 ## [1.38.0](https://github.com/feasibleone/blong/compare/blong-gogo-v1.37.0...blong-gogo-v1.38.0) (2026-09-29)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feasibleone/blong-gogo",
-  "version": "1.38.0",
+  "version": "1.38.1",
   "repository": {
     "url": "git+https://github.com/feasibleone/blong.git"
   },
@@ -88,11 +88,11 @@
     "@rushstack/heft-typescript-plugin": "^1.3.1",
     "@types/cacache": "^20.0.1",
     "@types/node": "^24",
-    "playwright": "^1.60.0",
+    "playwright": "^1.63.0",
     "tap": "^21.6.3",
     "typescript": "^6.0.3",
     "vite": "^8.2.1",
-    "@feasibleone/blong-dev": "1.7.1"
+    "@feasibleone/blong-dev": "1.8.0"
   },
   "scripts": {
     "browser-check": "node scripts/browser-compat-check.mjs",

package/src/Gateway.ts

@@ -14,7 +14,12 @@ import type {
     IPlatformApi,
 } from '@feasibleone/blong/types';
 import {Internal} from '@feasibleone/blong/types';
-import fastify, {type FastifyReply, type FastifyRequest, type RouteOptions} from 'fastify';
+import fastify, {
+    LogController,
+    type FastifyReply,
+    type FastifyRequest,
+    type RouteOptions,
+} from 'fastify';
 import os from 'os';
 import type {LevelWithSilent} from 'pino';
 import {Type, type TSchema} from 'typebox';
@@ -706,7 +711,12 @@ export default class Gateway extends Internal implements IGateway {
                 // both more than a reader needs and less than the flow records say.
                 // Nothing else depends on those two lines: the request has a flow, the
                 // flow has its calls, and both are recorded where they belong.
-                disableRequestLogging: true,
+                //
+                // Passed as a `LogController` instance rather than as fastify's own
+                // top-level `disableRequestLogging`, which is deprecated and warned
+                // about a line per process — one line per package in a CI run — for a
+                // flag whose replacement does exactly the same thing.
+                logController: new LogController({disableRequestLogging: true}),
                 ajv: {
                     customOptions: {
                         allErrors: true,

package/template/.storybook/preview.tsx

@@ -1,19 +1,13 @@
-import withBlong from '@feasibleone/blong-browser/storybook.tsx';
+import {defineBlongStorybookPreview} from '@feasibleone/blong-browser/storybook.tsx';
 // The composed entry, not `../browser.ts`: a model story needs the portal port
 // (blong-browser), which only the composed entry carries. A realm's composed
 // entry is `index.browser.ts`; a suite's `browser.ts` already is one.
 import browser from '../index.browser.ts';
 
-export default {
-    decorators: [withBlong(browser)],
-    parameters: {
-        actions: {argTypesRegex: '^on[A-Z].*'},
-        layout: 'fullscreen',
-        controls: {
-            matchers: {
-                color: /(background|color)$/i,
-                date: /Date$/,
-            },
-        },
-    },
-};
+// One line on purpose.  The factory owns the toolbar — backend (mock / live
+// JSON-RPC / live MLE), role, theme, language, direction — plus its persistence
+// and the decorators that apply them, so every realm's preview (and the kukum
+// template that generates it) is this same line.  `backend: true` adds the
+// Backend and Role items: these stories run on the loaded platform, so there is
+// a backend adapter to point at a gateway.
+export default defineBlongStorybookPreview(browser, {backend: true});

package/template/meta/dbTest/accessAuthorizationMerge.yaml

@@ -1,9 +1,12 @@
-# RBAC test seed — grants `$subject` capabilities to the existing `Admin` role.
+# RBAC test seed — grants `$subject` capabilities to the seeded roles.
 #
-# `testAdmin` / `testUser` (seeded by blong-access/meta/dbTest) hold the `Admin`
-# role, so adding the `$subjectManage` capability to `Admin` grants them every
-# `$subject` action. `testViewer` (role `Customer`) and `testGuest` (role
-# `Guest`) get none, which lets access-control tests assert 403 for them.
+# `testAdmin` / `testUser` hold the `Admin` role, so the `$subjectManage`
+# capability gives them every `$subject` action; `testManager` (role `Manager`)
+# gets read + edit but not remove; `testViewer` (role `Customer`) and
+# `testGuest` (role `Guest`) get read-only — which is what lets the Storybook
+# toolbar's Role item show a permission difference rather than three identical
+# screens, and what the access-control test relies on for its 403 (it calls
+# `add`, which none of the read-only roles holds).
 #
 # The file name is deliberately `accessAuthorizationMerge.yaml` (NOT
 # `$subject`-prefixed): the seed method is derived from the file name, so this
@@ -16,6 +19,11 @@
 # Capability names are the NON-dotted handler names (the default convention).
 role:
   Admin: $subjectManage
+  Manager: $subjectMaintain
+  Customer: $subjectView
+  Guest: $subjectView
 capability:
-  $subjectManage: $subject$ObjectAdd,$subject$ObjectFind,$subject$ObjectGet,$subject$ObjectEdit,$subject$ObjectRemove
+  $subjectManage: $subject$ObjectAdd,$subject$ObjectFind,$subject$ObjectGet,$subject$ObjectEdit,$subject$ObjectRemove,subject.object.schema
+  $subjectMaintain: $subject$ObjectAdd,$subject$ObjectFind,$subject$ObjectGet,$subject$ObjectEdit,subject.object.schema
+  $subjectView: $subject$ObjectFind,$subject$ObjectGet,subject.object.schema
 

package/template/meta/fixture/$subjectFixture.ts

@@ -9,12 +9,13 @@ import {handler} from '@feasibleone/blong';
  * that one describes mock OpenAPI subjects/dropdowns, a different shape.
  *
  * `browser.ts` globs this folder; a fixture the browser platform never loads
- * leaves every story empty. The sample names and statuses mirror
- * meta/dbTest/$subject$ObjectMerge.yaml, but the ids are this file's own: the
- * fixture feeds the Storybook mock path and the seed feeds the database path,
- * and the two are independent sources for the same sample records. The Open
- * story in src/stories/$Object.stories.tsx opens record 1, so keep a row whose
- * key is 1 here.
+ * leaves every story empty. The sample records mirror
+ * meta/dbTest/$subject$ObjectMerge.yaml — same ids, same names plus a
+ * `(fixture)` marker — because a story must load in both modes: the fixture
+ * feeds the Storybook mock path and the seed feeds the database path, and the
+ * marker is what makes the toolbar's Backend item visibly do something. The
+ * Open story in src/stories/$Object.stories.tsx opens record 101, so keep a
+ * row whose key is 101 here.
  */
 export default handler(
     () =>
@@ -22,13 +23,13 @@ export default handler(
             return {
                 '$subject.$object': [
                     {
-                        $objectId: 1,
-                        $objectName: 'Sample $Object One',
+                        $objectId: 101,
+                        $objectName: 'Sample $Object One (fixture)',
                         $objectStatus: 'draft',
                     },
                     {
-                        $objectId: 2,
-                        $objectName: 'Sample $Object Two',
+                        $objectId: 102,
+                        $objectName: 'Sample $Object Two (fixture)',
                         $objectStatus: 'sent',
                     },
                 ],

package/template/src/stories/$Object.stories.tsx

@@ -9,8 +9,10 @@ export default meta;
 
 /** Browse — the $Object list with its toolbar. */
 export const Browse = page('$subject.$object.browse');
-/** Open — record 1, which meta/fixture/$subjectFixture.ts carries. */
-export const Open = page('$subject.$object.open', 1);
+/** Open — record 101, the first row `meta/dbTest/$subject$ObjectMerge.yaml`
+ *  seeds and `meta/fixture/$subjectFixture.ts` mirrors, so it loads in both the
+ *  mock and the live backend mode. */
+export const Open = page('$subject.$object.open', 101);
 /** New — the empty create form. */
 export const New = page('$subject.$object.new');
 /** Report — the read-only view. */