@meada/meada 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -6,6 +6,223 @@ All notable changes to Meada are recorded here. The format follows
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-11-04
+
+A minor release on the [1.x stability promise](https://github.com/ClaudioMascaro/meada/blob/main/docs/site/en/stability.md):
+package reading (PEP 440 specifiers, uv sources, Go `replace` by a held module, `fetch` URLs a
+function builds), resolution in the Rust, TypeScript and Gradle packs, the console's versions
+page for a named workspace, the proposal server in the Compose and Helm recipes, SCRAM channel
+binding to Postgres, CLI messages in Spanish, a generated first password for the console's
+default `admin` account instead of a published one (#579), a refresh that keeps the language
+groups no changed file touches (#391), Backstage and HTTP contract reading (tier d1, #613 to #621), and the fixes of tiers b6 to c5. The stored
+manifest summary changes, so existing indexes are rebuilt once on first use. `meada-core` 1.2.0 deprecates `msg::pt()` in
+favour of `msg::lang()` (`msg::lang() == msg::Lang::Pt`), types `effective::Diagnostic::code` as
+`DiagnosticCode` (the JSON is unchanged) and makes `named::message_problem("")` return `Some`;
+the new `msg::Lang` and `effective::DiagnosticCode` are `#[non_exhaustive]`, so a match on
+either needs a wildcard arm. A crate that declares `meada-core = "1.1"` meets the last two
+changes on `cargo update`, and `=1.1.0` stays on the old API. The tree, the `meada-core` pin, the
+Dockerfile, the compose defaults and the Helm chart declare `1.2.0`, and the `v1.2.0` tag goes
+on the `release/1.2` branch, cut from this entry's merge on main. Publication
+(crates, the staged npm package, the GitHub draft release) belongs to the maintainer.
+Release notes are available in
+[pt-BR](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.2.0.md),
+[English](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.2.0.en.md) and
+[Spanish](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.2.0.es.md).
+
+### Added
+
+- Backstage backends: the router a backend plugin gives its `httpRouter`
+  (`coreServices.httpRouter`) is served under `/api/<pluginId>` when `createBackendPlugin` writes
+  its `pluginId` as a literal or as a `const` of the file bound to one, so two plugins with the
+  same relative path no longer collide, and a URL
+  that starts with `discovery.getBaseUrl('<id>')` (held by a constant or written in place) starts
+  at `/api/<id>`, its link's reason naming the plugin's mount (as does a hostless call of a route
+  the plugin serves in its own repository). A plugin whose `pluginId` cannot be read stays at the
+  root, and `meada status` names it. TypeScript and JavaScript functions now give their `return`
+  values and an arrow's expression body to the value flow, so a router a factory returns
+  (`httpRouter.use(await createRouter())`) is followed (#615).
+- Backstage proxy: a TypeScript or JavaScript `fetch` whose URL starts with `/api/proxy/<endpoint>`
+  (also `discovery.getBaseUrl('proxy')` plus `/<endpoint>`) is a call to the `target` of that
+  endpoint in `proxy.endpoints` of an `app-config*.yaml`: a `${VAR}` target links through the
+  peer's `base_url_env` and a literal `http(s)://` target by host, the link's reason naming the
+  endpoint, and any other target leaves the call unlinked, which `meada status` says. A
+  `pathRewrite` that only strips the endpoint is followed; any other one, `ignorePath`,
+  `prependPath: false` and an endpoint the `app-config*.yaml` files disagree on leave the call
+  unlinked too (#616).
+- Go: a struct field tagged `env:"X"` (cleanenv, caarlos0/env) or `envconfig:"X"`
+  (kelseyhightower/envconfig) is the environment read `X` where the field is read
+  (`cfg.API.URL`), so `base_url_env` links such a call as `inferred` instead of `ambiguous`
+  (#618).
+
+- A Python pydantic-settings field is an environment read: a field `f` of a `BaseSettings`
+  subclass of the same file is the variable `<env_prefix><F>` (upper case), or its `alias` /
+  `validation_alias`, so the peer's `base_url_env` links `f"{settings.f}/orders"` as an
+  environment read does instead of leaving it `ambiguous`; other classes are unchanged (#619).
+- A TypeScript or JavaScript base URL read through Backstage's `config.getString('a.b')` or
+  `getOptionalString('a.b')` is the variable `VAR` when an `app-config*.yaml` of the repository
+  holds `a.b: ${VAR}`, so the peer's `base_url_env` links the call as an environment read does
+  instead of leaving it `ambiguous`; a literal value or a key no file holds leaves the base
+  unresolved (#617).
+- A PyPI version specifier is checked against the provider's version as PEP 440 says, as npm's
+  range is: `range mismatch` when the specifiers (`==`, `!=`, `<`, `<=`, `>`, `>=`, `~=`, `==X.*`
+  and `===`, joined by commas) reject the local version, nothing added when they accept it, and
+  `range unchecked` kept for a provider without a version and for a specifier it cannot read (a
+  Poetry `^1.2`, an unknown operator). A pre-release version is rejected unless a specifier
+  names one, and a mismatch removes no candidate (#534).
+- A TypeScript or JavaScript `fetch` whose URL a function of the repository builds is a consumer:
+  a call to a function whose body is one returned string (an arrow function's expression body, or
+  a lone `return`) folds to it with the call's arguments, at the `fetch` and through a constant,
+  across imports. A part that does not fold, such as a base read from `process.env`, leaves the
+  consumer unresolved (#536).
+- A Go `replace` by another module (`replace a => github.com/owner/repo`) keeps, among the providers
+  of the required module, the one in the workspace repository that path names, `exact`, for the
+  `require` and for the calls through its imports, instead of dropping the dependency; a
+  replacement no repository holds stays out (#532).
+- A PyPI dependency with a uv source in `[tool.uv.sources]` links to the one package it names,
+  `exact`, for the entry and for the calls through its imports: `workspace = true` the member of
+  the consumer's uv workspace (`[tool.uv.workspace] members` less `exclude`), `path` the package
+  at that path, `git` the workspace repository of its URL; a `url` or `index` source stays out.
+  An entry without a uv source keeps linking to every package of its name (#533).
+- The CLI messages (`--help`, `status`, `meada.toml` and index errors, and every other message of
+  the catalogs) are also in Spanish, selected when `LANG` starts with `es`; other values keep
+  falling back to English, and the MCP output stays English (#103).
+- The workspaces profiles run the proposal server: `compose.proposals.yaml` and
+  `proposals.workspace.toml` in Compose (its own pull and volume, the read role, TLS on
+  `127.0.0.1:8445`) and an opt-in `proposals` block in the Helm chart (Deployment, Service,
+  bootstrap and probes with `timeoutSeconds`, absent by default); `scripts/compose-check` and
+  `scripts/helm-check` assert both. The identity provider recipes say how a person or an agent
+  gets a token whose `aud` is `[proposals] audience` (Entra ID, Okta, Keycloak, local accounts; Okta
+  needs a second authorization server the chart cannot render), in pt-BR, English and Spanish (#504).
+- Over TLS, the Postgres client of the data layer authenticates with SCRAM channel binding
+  (`tls-server-end-point`, RFC 5929): it runs `SCRAM-SHA-256-PLUS` whenever the server offers
+  it, so a client that requires channel binding connects (#483). Loopback without TLS keeps plain
+  `SCRAM-SHA-256`.
+- The console's named workspace view gains a versions page (#503): the versions newest first,
+  paged with the server's cursor; one version's entries, manifest text and diff against the
+  current one as the route answers; the history for operators and the administrator (a viewer
+  has no history control); and applying a listed version, which is a rollback when it was
+  current before, through the editor's confirmation at the base the page read. A stale base and
+  a refused entry show the server's message and the page reads the versions again. In pt-BR and
+  English.
+- Gradle coordinate holes from `gradle.properties` and version catalogs (#467): a dependency
+  written `implementation(libs.models)` or with a `${name}` or `$name` the script leaves open
+  now links to the package providing its coordinate. `gradle.properties` of the repository root,
+  the settings file's directory and the module (the module's wins, and a name the script assigns
+  is never filled) feeds the same hole filler as the script's own declarations, and
+  `gradle/libs.versions.toml`, or a `*.versions.toml` a settings `from(files("..."))` names by a
+  relative path, maps `libs.<alias>` (dashes and underscores as dots) to `group:artifact` and
+  its version through `[libraries]` and `[versions]`; an alias the catalog lacks declares
+  nothing. Both files are bounded (`lang::MAX_BYTES`, 8192 entries) and have rows in the
+  manifest probes. `buildSrc`, convention plugins, included builds and build-time BOMs stay
+  unread. The stored manifest summary gains Gradle's `template` and catalog placeholders, so
+  existing indexes rebuild once (ADR 0004); the `conformance-java` export gained two links.
+- Rust item macros in associated-item position and by `crate::` (#505, after #398): an
+  invocation of a qualifying item macro among the items of an `impl` or a trait gives its
+  body's methods, associated consts and types to that block, under the same rules (first arm
+  only, the attributes on the invocation, the same `cfg` handling), and `crate::m! { .. }`
+  qualifies as `m!` does; `other::m!`, `self::m!` and `super::m!` stay unread. `meada decide
+  --decider` now parses a file under the setting the index stored for it, so a function from an
+  item macro body is function-like and its span is sent.
+- TypeScript and JavaScript: a `tsconfig.json` (or `jsconfig.json`) with `extends` naming a
+  relative path inside the repository takes the `paths` and `baseUrl` of the chain, the nearest
+  config that declares each option winning (#465), so the alias imports under a monorepo's
+  `packages/*` whose configs only extend the root's resolve. A package, a path outside the
+  repository, a chain of more than 8 configs after the nearest and a cycle are not followed (the
+  nearest config alone serves). Project `references` and a base not named `tsconfig.json` or
+  `jsconfig.json` are still not read.
+
+### Fixed
+
+- Go: a method named like a resty verb (`Get`, `Post`, `Put`, `Patch`, `Delete`, `Head`,
+  `Options`) called on a struct field that holds a repository, a Kubernetes client or a cache
+  client (`s.repo.Get(ctx, id)`) is no longer an HTTP consumer with an unresolved URL, so
+  `meada decide` lists no open item for it; a field holding a resty request or client keeps its
+  consumers (#621).
+- A route whose handler sits in a test file (`*_test.go`, `*.test.*`, `*.spec.*`, `test_*.py`,
+  `*_test.py`, a `tests` or `__tests__` directory, `src/test`) is no provider: a test's router
+  or fake upstream no longer shows in `search` and the export, and no longer makes the client
+  repository a candidate for the route it consumes, so those calls link to the only real server
+  instead of turning `ambiguous`. The test code stays indexed; `test_routes = true` in
+  `meada.toml` keeps the routes as providers (#620).
+- A comment inside a Go parameter list or argument list (`func NewRouter( //nolint:funlen`,
+  `NewRouter( // engine`) is no longer read as a parameter or an argument: it took position 0, so
+  a router handed to such a function reached none of its routes. The shared child walk of the
+  packs now skips comments, which also fixes the same shift in the TypeScript pack (#613).
+
+- Express routes registered on an `express-promise-router` router (the Backstage backend default)
+  are provided: its default import counts as a router factory under any local name (#614).
+- A refresh resolves a Swift file as a cold index does: the type parameters of a type or
+  function (`Page<Item>`) are kept in the index, so an `Item()` in an extension of `Page` in
+  another file is no construction of a type named `Item` after an edit to an unrelated Swift file
+  (the stored format changes, so an existing index is rebuilt once) (#609).
+- A Kotlin `private` constructor, primary (`class C private constructor(..)`) or secondary, is
+  called only from inside its class: a call from another class no longer resolves to it, one from
+  the class, its companion or a nested class stays `exact`. `internal` is still not enforced
+  (#455).
+- A Rust name two globs give (`use x::*; use y::*;`, which compiles only under `cfg`
+  alternatives) is `ambiguous` between them, not `exact` to the latest glob; an explicit item or
+  `use` beside the globs still wins (#439).
+- A Swift parameter written as a name from outside the repository (`Ext.CompletionHandler`, which
+  may be an alias of a function type) neither takes nor refuses a trailing closure with certainty:
+  a call that fits an overload only through it is `ambiguous` among its overloads (`inferred` when
+  it is the only one), no longer `exact` to a sibling overload that reads as a function type or
+  absent. A parameter written as a type the repository declares or a standard value type still
+  refuses it (#456).
+- TypeScript and JavaScript: `exports.y = function () {}` and `module.exports.y = ..` define the
+  symbol `exports.y` (exported as `y`), so a bare `y()` in the file no longer links to it and
+  `m.y()` through an import still does (#457).
+- A PyPI package in the consumer's own repository that no uv source names links `inferred`, not
+  `exact`, when it is the one package of the name, with the reason "no uv source names the local
+  package, the registry package is the likely provider": pip and uv install the registry's
+  package, so a same-named stub (uv's `anyio_local`) is only a candidate. A source naming it
+  (`workspace = true`, `path`) and a single provider in another repository stay `exact` (#535).
+- The `golden_diff` example exits with a message naming the range's refs and the `--range A...B`
+  flag when a merge-base cannot be found (a shallow or single-branch clone has no `origin/main`),
+  and with a usage error for `--range` without a value, instead of panicking (#592).
+- `[postgres] schema` starting with `pg_` (reserved by Postgres) is refused at manifest read with
+  Meada's own message, in pt-BR and English, instead of Postgres's raw error at `meada postgres
+  migrate` (#482).
+- The Helm node readiness probe sets `timeoutSeconds` (`readiness.timeoutSeconds`, default 8), so a
+  Postgres or Valkey that drops packets no longer exceeds the kubelet's 1 s default and marks every
+  node unready (#448).
+- The container build copies every top-level `tests/fixtures/*.json` in the UI stage with one
+  `COPY`, so a UI test importing a new fixture no longer breaks the image (#495).
+- The deploy fetch scripts (Compose `fetch-pulled.sh` and the chart `workspace.fetch`) read a
+  repositories manifest whose `repo` and `path` keys are written as quoted keys (`"repo" = ...`);
+  the shared awk program skipped them. Its test now takes the expected pairs of every case from the
+  `toml` crate instead of hand-written lists (#568).
+- Rust: a `crate::a::*` glob written inside `a` or below it sees what `use super::*` sees,
+  the ancestor's private `use` included, so `Def::new()` through it is `exact` instead of
+  unresolved (#438). A glob of a sibling module still takes public names only.
+
+### Changed
+
+- An Express app or router a TypeScript or JavaScript function returns now takes the prefixes of
+  the mounts it is given to: `app.use('/v1', makeRouter())` serves `makeRouter`'s routes under
+  `/v1/...`, where they were served at the root, and the links of consumers of those paths change
+  with them (#615).
+- A refresh keeps the rows of each group of language packs that resolve together (TypeScript and
+  JavaScript, Rust, Python, ...) when no file of the group changed and the config files,
+  manifests, file list and exports did not move: its contracts are not extracted again, its calls
+  are not resolved again and its files are not parsed again for their values. A one-line edit of
+  a Rust file of this repository refreshes in 3.3 s where it took 3.9 s (release build, median of
+  five); the export stays byte-identical to a cold one. A change of Meada's version re-extracts
+  every group once (#391).
+- The console no longer creates the default account `admin` with a published password: without
+  `admin_password_env` or `admin_password_file`, the start that creates it generates the first
+  password, stores it with a change required, and prints it once on stderr (`accounts: default
+  account admin created; first password: ...`, right after the listening line; `docker compose
+  logs console` in the Compose recipe). No later start prints it; a lost one is recovered with
+  `meada ui reset-admin`. The password policy's `default_password` rule goes with the published
+  password, and ADR 0024 is amended (#579).
+- The console asks `meada-core` through WebAssembly (`namedNameProblem`, `namedDescriptionProblem`,
+  `namedMessageProblem`, `resourceRoles`) whether a workspace name, description and version
+  message are valid and which resource roles exist, instead of keeping its own copy of the rule,
+  its bounds and the role list (#501). A version message is refused when empty by the same
+  function on the browser, the console API and `meada workspaces`: the empty-message refusal now
+  reads "a message is 1 to 500 characters, ..." instead of the request-body shape, and the
+  refusal of a too-long or control-bearing message reads "1 to 500" where it read "at most 500".
+
 ## [1.1.0] - 2026-11-02
 
 A minor release on the [1.x stability promise](https://github.com/ClaudioMascaro/meada/blob/main/docs/site/en/stability.md):
@@ -1080,7 +1297,8 @@ and `trace` from the two longest processes. The spec adds about 0.3 MB and 0.03
 The rise of the single-file reindex since 2026-10-14 predates it (specs #22 and #23), and at
 692 files it is close to its target.
 
-[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v1.2.0...HEAD
+[1.2.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.2.0
 [1.1.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.1.0
 [1.0.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.0.0
 [0.1.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v0.1.0

package/README.md

@@ -18,7 +18,7 @@ Escolha a linha que combina com o que você já tem. Todos os canais entregam o
 | Rust | `cargo install meada` | `meada mcp` |
 | Linux ou macOS | o instalador de shell abaixo | `meada mcp` |
 | Qualquer sistema | o arquivo do seu sistema nas [releases do GitHub](https://github.com/ClaudioMascaro/meada/releases), com `meada` no `PATH` | `meada mcp` |
-| Docker | `docker pull ghcr.io/claudiomascaro/meada:1.1.0` | a linha `docker run` em [Conectar um agente](#conectar-um-agente-mcp) |
+| Docker | `docker pull ghcr.io/claudiomascaro/meada:1.2.0` | a linha `docker run` em [Conectar um agente](#conectar-um-agente-mcp) |
 
 ```sh
 # Instalador de shell (Linux e macOS)
@@ -75,7 +75,7 @@ Com Docker (Linux e macOS):
   "mcpServers": {
     "meada": {
       "command": "sh",
-      "args": ["-c", "exec docker run -i --rm --network none --user \"$(id -u):$(id -g)\" -v \"${PWD%/*}:${PWD%/*}\" -w \"$PWD\" ghcr.io/claudiomascaro/meada:1.1.0 mcp"]
+      "args": ["-c", "exec docker run -i --rm --network none --user \"$(id -u):$(id -g)\" -v \"${PWD%/*}:${PWD%/*}\" -w \"$PWD\" ghcr.io/claudiomascaro/meada:1.2.0 mcp"]
     }
   }
 }
@@ -97,7 +97,7 @@ ler os níveis de uma resposta. No Claude Code:
 
 ```sh
 mkdir -p ~/.claude/skills/meada
-curl -fsSL https://raw.githubusercontent.com/ClaudioMascaro/meada/v1.1.0/skills/meada/SKILL.md -o ~/.claude/skills/meada/SKILL.md
+curl -fsSL https://raw.githubusercontent.com/ClaudioMascaro/meada/v1.2.0/skills/meada/SKILL.md -o ~/.claude/skills/meada/SKILL.md
 ```
 
 Outros agentes: veja [Agentes e MCP](https://claudiomascaro.github.io/meada/mcp/#skill-para-agentes).
@@ -111,7 +111,7 @@ Meada 1.0 entrega todo o escopo da v1 do [ADR 0003](docs/adr/0003-v1-scope-and-r
 - **Níveis**: um nível em cada ligação, cadeias que atravessam repositórios e decisões com
   decisor opcional (`meada decide`).
 - **Análises**: drift de forma, comunidades e processos.
-- **Linguagens no 1.0**: nove, TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, C# e
+- **Linguagens no 1.0**: nove: TypeScript, JavaScript, Python, Go, Rust, Java, Kotlin, C# e
   Swift (#26 a #29, ADR 0003).
 
 **Promessa de estabilidade.** A partir do 1.0 vale o semver: uma mudança incompatível em um

package/npm-shrinkwrap.json

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "name": "@meada/meada",
-      "version": "1.1.0"
+      "version": "1.2.0"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "1.1.0"
+  "version": "1.2.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/ClaudioMascaro/meada/releases/download/v1.1.0"
+    "https://github.com/ClaudioMascaro/meada/releases/download/v1.2.0"
   ],
   "bin": {
     "meada": "run-meada.js"
@@ -89,7 +89,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "1.1.0",
+  "version": "1.2.0",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"