@haneinfo/assignment 0.4.1 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +4 -0
  2. package/agent-guide.md +4 -0
  3. package/package.json +8 -8
package/README.md CHANGED
@@ -27,3 +27,7 @@ GT/GTE/LT/LTE compare numbers, valid calendar dates (YYYY-MM-DD), or timezone-qu
27
27
  the same category. Dates use calendar order; datetimes compare UTC instants at millisecond precision.
28
28
  Invalid dates, mixed categories and empty operands yield false. EQ/NEQ/IN retain strict scalar equality;
29
29
  matching instants with different textual offsets are still unequal for those operators.
30
+
31
+ ## Instance privacy boundary
32
+
33
+ Task reads and responses first check task ownership and return identical TASK_NOT_FOUND/404 for another person's or a missing task. Every assignee receives a permanent state-machine reader grant on task creation, so the internal runtime snapshot read is restricted to an already authorized reader. `tasksOf` is a trusted internal API, not an HTTP/MCP instance lookup. USER transitions outside task responses apply state-machine's read-before-write checks; Assignment triggers keep their existing authorization.
package/agent-guide.md CHANGED
@@ -140,3 +140,7 @@ GT/GTE/LT/LTE compare numbers, valid calendar dates (YYYY-MM-DD), or timezone-qu
140
140
  the same category. Dates use calendar order; datetimes compare UTC instants at millisecond precision.
141
141
  Invalid dates, mixed categories and empty operands yield false. EQ/NEQ/IN retain strict scalar equality;
142
142
  matching instants with different textual offsets are still unequal for those operators.
143
+
144
+ ## Instance privacy boundary
145
+
146
+ Task reads and responses first check task ownership and return identical TASK_NOT_FOUND/404 for another person's or a missing task. Every assignee receives a permanent state-machine reader grant on task creation, so the internal runtime snapshot read is restricted to an already authorized reader. `tasksOf` is a trusted internal API, not an HTTP/MCP instance lookup. USER transitions outside task responses apply state-machine's read-before-write checks; Assignment triggers keep their existing authorization.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@haneinfo/assignment",
3
- "version": "0.4.1",
3
+ "version": "0.4.2",
4
4
  "private": false,
5
5
  "description": "Assignment mechanism: Assignment definitions (who must respond when a state machine enters a state) and the task runtime, registered with @haneinfo/definition-registry.",
6
6
  "files": [
@@ -38,13 +38,13 @@
38
38
  "./package.json": "./package.json"
39
39
  },
40
40
  "dependencies": {
41
- "@haneinfo/plugin-api": "1.11.0",
42
- "@haneinfo/form": "0.3.1"
41
+ "@haneinfo/plugin-api": "1.12.0",
42
+ "@haneinfo/form": "0.3.2"
43
43
  },
44
44
  "peerDependencies": {
45
45
  "@haneinfo/common": "^0.3.4",
46
46
  "@haneinfo/definition-registry": "^0.1.0",
47
- "@haneinfo/state-machine": "^0.6.0 || ^0.7.0",
47
+ "@haneinfo/state-machine": "^0.6.0 || ^0.7.0 || ^0.8.0",
48
48
  "@haneinfo/plugin-host-nest": "^2.0.0",
49
49
  "@nestjs/common": "^11.0.0",
50
50
  "@nestjs/core": "^11.0.0",
@@ -64,11 +64,11 @@
64
64
  "typescript": "^5.9.3",
65
65
  "vitest": "^4.1.11",
66
66
  "zod": "^4.4.0",
67
- "@haneinfo/definition-registry": "0.1.6",
67
+ "@haneinfo/state-machine": "0.8.0",
68
68
  "@haneinfo/common": "0.3.4",
69
- "@haneinfo/state-machine": "0.7.1",
70
- "@haneinfo/plugin-testkit": "2.3.0",
71
- "@haneinfo/plugin-host-nest": "2.1.0"
69
+ "@haneinfo/definition-registry": "0.1.7",
70
+ "@haneinfo/plugin-host-nest": "2.1.0",
71
+ "@haneinfo/plugin-testkit": "2.3.0"
72
72
  },
73
73
  "license": "UNLICENSED",
74
74
  "publishConfig": {