npm - @meada/meada - Versions diffs - 1.2.0 → 1.3.0 - Mend

@meada/meada 1.2.0 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -6,6 +6,710 @@ All notable changes to Meada are recorded here. The format follows
 ## [Unreleased]
+## [1.3.0] - 2026-11-11
+A minor release on the [1.x stability promise](https://github.com/ClaudioMascaro/meada/blob/main/docs/site/en/stability.md):
+infrastructure joins the graph. Config values and IaC nodes (ADR 0025) are read from Terraform and
+OpenTofu (HCL and JSON, with static evaluation of names), Compose, CloudFormation and SAM,
+Serverless Framework, Kubernetes with Kustomize, and Crossplane, and answer to the new `search`
+kinds `value` and `iac` (`image` and `alert` join for their contracts). Infrastructure contracts (ADR 0026) link the code that uses a queue, a
+topic, a bucket, a table, a parameter or a secret to what provisions it on AWS, GCP and Azure,
+through SDK use sides in TypeScript, JavaScript, Python, Java, Go and C#, with orphan reports in
+`meada status`. Image contracts link builders to runners, workloads carry their environments to the
+code they run, alert contracts link rule labels to Alertmanager routes and Datadog
+monitor tags to OpsGenie routing, and HTTP gains route
+providers declared in IaC and base URLs followed through Kubernetes Services, Ingresses and Compose.
+The console graph shows the new roles, a refresh reads unchanged values from a cache beside the
+index (`values.db`, ADR 0027), and `meada mcp` answers calls sent without waiting for each reply
+(#704). The index schema changes, so existing indexes are rebuilt once on first use; export format
+stays 1 and gains optional fields. `meada-core` 1.3.0 gives `ids::VersionEntry` a sixth element and
+`ids::NON_BLOCK_KEYS` a fifth key (`added_by_time`, #454), `authorize::compose_entries` a `now`
+parameter, `manifest::EntryFile` an `added_by_time` field and the export structs new fields.
+Postgres migration 10 needs `meada postgres migrate` before 1.3.0 starts, and 1.2.0 binaries
+refuse the migrated schema. The
+entries below that name a release level were written while this release was in development. The
+tree, the `meada-core` pin, the Dockerfile, the compose defaults and the Helm chart declare `1.3.0`,
+and the `v1.3.0` tag goes on the `release/1.3` branch, cut from this entry's merge on main.
+Publication (crates, the staged npm package, the GitHub draft release) belongs to the maintainer.
+Release notes are available in
+[pt-BR](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.3.0.md),
+[English](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.3.0.en.md) and
+[Spanish](https://github.com/ClaudioMascaro/meada/blob/main/docs/releases/1.3.0.es.md).
+### Added
+- DynamoDB transactions in Java, Go and C# (#719): `TransactWriteItems` and `TransactGetItems`
+  give sides as they do in JavaScript and Python. Each `Put`, `Update` and `Delete` entry
+  writes its own table, each `ConditionCheck` and `Get` entry reads its own, with the literal
+  and environment rules of the other names. A list or an array of entries held in a name (in
+  Go and C#, a request, an item or an entry too) gives its tables only when its function
+  mentions the name twice, where it is declared and where the request reads it: any other
+  mention may change it, and one that comes in a parameter (in Java, a single entry too) gives
+  none. Every Java, Go and .NET AWS operation now has a test. Included in the 1.3.0 minor
+  release.
+- Curated operators and private IaC mappings (#671): 43 explicit Strimzi, RabbitMQ Queue,
+  ACK, Config Connector and Crossplane AWS/GCP/Azure types provision existing contracts.
+  RabbitMQ Exchange/Binding topology routes real publishes to queues without inventing an
+  exchange channel. Six terraform-aws-modules sources read declared resource and Lambda/ECS
+  workload inputs; `meada.toml` maps exact/private source prefixes and custom group/kind key
+  paths to curated entries. Unknown identities and creation controls remain conservative.
+  This joins the existing 1.3.0 minor development release.
+- IaC HTTP route providers (#666): Terraform/OpenTofu API Gateway HTTP/REST and explicit quick
+  create, SAM Api/HttpApi and Serverless http/httpApi events resolve to local handler symbols
+  or the repository, with normalized parameters, cross-repository HTTP links and stored
+  path/target evidence. Included in the meada/meada-core 1.3.0 minor release.
+- Azure SDK sides in JavaScript/TypeScript, Python, Java, Go and C# (#670): verified
+  constructors connect Service Bus and Event Hubs sends/receives, Blob container reads/writes
+  and Key Vault secret reads to physical contracts. New subscription receivers retain their
+  topic and subscription through exact factories and scoped workload environments. Existing
+  C# Service Bus forms keep their identities; resource readers retain each operation site.
+  The bounded inventory joins the shared meada/meada-core 1.3.0 minor release.
+- GCP SDK use sides in JavaScript/TypeScript, Python, Java, Go and C# (#668): verified client
+  constructors connect Pub/Sub publish and subscription receive, Cloud Storage reads/writes
+  and Secret Manager access to their physical contracts. Subscription identities remain
+  distinct from topics through scoped workload environment resolution. The documented
+  operation inventory ships in the shared meada 1.3.0 minor release. Scoped request mutations
+  leave stale names unresolved, typed helpers retain their resource kind through factories,
+  and asynchronous factories preserve await state.
+- The console graph has image builder-to-runner and alert emitter-to-matcher views, including
+  links within a repository, alongside provisioner sides and provisioning links with roots,
+  levels and reasons. A bilingual legend explains each role and keyboard navigation. The
+  playground exposes `value`, `iac` and `alert` searches. Release level: minor, included in
+  meada and meada-core 1.3.0 (#675).
+- Datadog Terraform monitor tags join OpsGenie routing conditions through known tag
+  forwarding. Selected Alertmanager receivers explicitly transform grouped rule labels
+  into OpsGenie tags or PagerDuty v2 custom details; native PagerDuty PCL conditions keep
+  their field paths. Equality is exact; regex, prefix and containment are inferred.
+  Missing or unread forwarding yields no link, and matching never predicts final team
+  delivery. Included in the existing meada/meada-core 1.3.0 minor release (#673).
+- AWS workload execution and environments (#664): Terraform/OpenTofu Lambda images and local
+  code/archive inputs, SAM CodeUri/Handler/ImageUri with Globals overrides, Serverless handlers
+  with provider/function environments, and encoded ECS container images/environments. Known
+  resource references retain typed identities; secret and dynamic contents remain unread.
+  Context, bidirectional traces and scope-aware image orphans include these workloads; new
+  local paths refuse absolute paths, every parent component and symbolic links. Included in
+  the minor development release of meada and meada-core 1.3.0.
+- Terraform/OpenTofu JSON (`.tf.json`, `.tofu.json`) now creates IaC nodes with source spans,
+  references, evaluated names and local module instances. JSON expression and literal rules
+  share the HCL evaluator, provisioners and subscriptions; declared resource `via` addresses
+  resolve to JSON nodes and refresh when sources change. Sensitive defaults, tfvars and SSM
+  SecureString values also stay redacted in JSON block arrays, a root array of bodies included,
+  and a JSON `dynamic` property merges as the types it names (#642, #649).
+- Azure Terraform/OpenTofu contracts (#669): Service Bus queues, topics and topic-qualified
+  subscriptions with filter routing, Event Hubs, Storage accounts and blob containers as
+  distinct kinds, and Key Vault secrets. ARM identifiers and supported blob/vault URLs give
+  exact config uses; provider-specific typed keys remain inferred. Linux Functions run
+  evaluated container images; Linux and Windows Functions run safe local deployment archives, with scoped
+  app settings and unresolved Key Vault references. Existing C# topic processors retain
+  their topic identity. This shares the 1.3.0 development release.
+- HTTP base URLs follow Kubernetes Service DNS names and Compose service names through their
+  workloads to the repositories running the providers. Ingress hosts and literal prefixes
+  carry public URLs to their Services; rewrites remain unread mounts. Links are inferred and
+  name the Service, with workload environment provenance when applicable. A Service or
+  Ingress that reaches no code leaves a host to `[serve] hosts`, which still links it `exact`.
+  Included in the minor development release of meada and meada-core 1.3.0 (#665).
+- GCP infrastructure contracts (#667): Terraform/OpenTofu Pub/Sub topics and distinct
+  subscription targets, Cloud Storage buckets, Cloud SQL instances and instance-qualified
+  databases, and Secret Manager secrets. Structured GCP configuration identifiers are exact;
+  provider-specific typed keys remain inferred. Cloud Run v1/v2 services and v2 jobs retain
+  container images and scoped environment targets. Provisioning, subscriptions, context,
+  trace, scope-aware orphans and export include these kinds and runners. Release level: minor,
+  included in meada and meada-core 1.3.0.
+- Declared resource `via` locations now accept IaC addresses in every indexed format and
+  `<file>#<key path>` with list selectors (`[key=value]`). Sides retain their precise node or
+  key for context and trace; removed locations produce the existing stale status diagnostics.
+  Release level: minor, included in meada and meada-core 1.3.0 (#641).
+- Resolve environment reads through the workloads running their code, including Kubernetes ConfigMap references and Compose defaults, with inferred provenance and redacted Secret targets (#663).
+- Alert contracts join Prometheus, Loki, PrometheusRule and Grafana rule labels to Alertmanager
+  route matchers, including AlertmanagerConfig. Equality is exact and regular expressions are
+  inferred; a negated condition only filters its route, without linking the value it refuses.
+  Route context includes the receiver, trace walks both ways, and export and scope-aware
+  orphan reports carry the kind. Helm values are not alert emitters. Included in the minor
+  development release of meada and meada-core 1.3.0 (#672).
+- Anchored unresolved names across channel, resource and image contracts (#674): only
+  literal counterparts with sufficient anchor evidence and whole-segment wildcards link.
+  Several names remain ambiguous open items; human or optional decider choices replay through
+  `meada.decisions.toml`, including provisioning links and stale-choice reporting. Release
+  level: minor, included in meada and meada-core 1.3.0.
+- Constructor-backed AWS SDK sides in Java 2.x, Go v2 and .NET: SQS, SNS, EventBridge, Kinesis,
+  S3, DynamoDB, SSM Parameter Store and Secrets Manager. Literal names and ARNs join
+  infrastructure contracts; environment reads retain their variable without a guessed name.
+  Every batch name is kept. Exact factories and aliases are followed, hidden bindings and
+  incomplete origins are rejected, and injected types alone create no SDK side, except SQS,
+  whose declared client types keep its earlier forms. .NET named requests and its S3 metadata
+  spelling are supported. SDK resource links are exact while declarations remain declared;
+  hierarchy queries stay unresolved. Release level: minor, meada and meada-core 1.3.0 (#660).
+- AWS SDK use sides in TypeScript, JavaScript (SDK v3) and Python (boto3): SNS publishes,
+  EventBridge event entries and Kinesis record writes produce channel sides; S3 and DynamoDB
+  operations write or read resource sides; SSM and Secrets Manager operations read resources. Batch
+  and transaction inputs retain each named resource. Both client and operation origins must be the
+  SDK's; name-matched hops and hidden client names produce no side. Complete Python factory evidence
+  rejects opaque or missing returns and unawaited coroutine or generator objects, preserves exact
+  arguments, class fields and awaited aliases, and shares bounded constructor traversal with
+  existing message clients (#659).
+- AWS SDK use sides: literal names and supported ARNs join provisioners at `exact`; environment
+  reads stay unresolved and name their variable through `via: env:NAME`, without reading the process
+  environment. SDK providers gain an optional `via`, absent on existing providers; format remains 1.
+  Existing declared resource sides retain `declared`. Older indexes rebuild. Release level: minor,
+  meada and meada-core 1.3.0 (#659).
+- Config values naming AWS resources become directionless use sides (#661): recognized ARNs,
+  SQS queue URLs and S3 URIs are exact; plain names under final `queue`, `topic`, `bucket` and
+  `table` keys are inferred. Each key links only to provisioners and counts for scoped orphans;
+  bare equal values, redacted/cut values and provisioner name definitions create no use.
+  Search, context, trace, export's optional `uses` and the console retain key locations
+  without adding producer/consumer or writer/reader links. Release level: minor, meada and
+  meada-core 1.3.0.
+- Image contracts (#662): normalized `image::<registry>/<repository>` names connect builders
+  in GitHub Actions, Compose, Skaffold, ko and Jib to Kubernetes, Compose and Helm runners,
+  including Kustomize image overrides. Context shows builders, trace crosses into code and
+  back, and status reports image orphans only in scopes with both roles. A Compose build runs
+  same-repository code directly at `exact`, without following symlinks: the paths its Dockerfile
+  takes from the context (`COPY`, `ADD` and `RUN` bind mounts, in every stage), not the whole of
+  it, and `inferred` when it cannot read one; editing the Dockerfile makes the index stale and an
+  upward `trace` writes each workload once (#744). Export format 1 adds optional builder `at`
+  locations and direct `executions`; the console graph displays both. Release level: minor for
+  meada and meada-core, included in synchronized 1.3.0.
+- AWS infrastructure contracts: Terraform/OpenTofu SNS, EventBridge and Kinesis channels;
+  DynamoDB, RDS instances and clusters, ElastiCache clusters and replication groups, SSM and
+  Secrets Manager resources, including ARN name extraction. SNS-to-SQS subscriptions and
+  EventBridge rules/targets link queue consumers to source producers, exact without a filter
+  and inferred with one. Context, trace, export and scoped orphan reporting cover all kinds;
+  SSM SecureString values are redacted, including Terraform/OpenTofu JSON. The schema adds subscription summaries and older
+  indexes rebuild. Release level: minor, meada and meada-core 1.3.0 (#658).
+- Orphan infrastructure contracts (#657): `meada status` lists provisioners without uses and
+  uses without provisioners only for a contract kind and broker or resource kind with both
+  sides in the visible scope. Otherwise `search` and `context` mark the side with
+  `no provisioner in the workspace` or `no use in the workspace`, without orphan status noise.
+  Matching follows provisioning links, including patterns and root labels. Release level:
+  minor for both meada and meada-core in the next release.
+- Terraform provisioners (ADR 0026): `aws_sqs_queue` and `aws_s3_bucket` join the SQS channel
+  and S3 resource contracts by physical name, using an embedded, documented type table. Every
+  producer, consumer, writer and reader links to each root's provisioner; overridable names
+  link at `inferred` with their variables in the reason. `context` lists the sides and
+  provisioners, and `trace` crosses provisioning links both ways. Bounded name patterns link
+  literal names at `inferred` (several names: `ambiguous`); the console graph lists provisioner
+  sides and provisioning links. Export format 1 gains optional
+  `iac_nodes`, `provisioners` and `provisions` arrays. The stored-name sample changes the schema,
+  rebuilding older indexes. Release level: minor for both meada and meada-core (#656).
+- Config values (ADR 0025): every scalar of every `*.yaml`, `*.yml` and `*.json` file the walk
+  visits, and of the YAML and JSON files under the CI configuration at the root (`.github/`,
+  `.gitlab-ci.yml`, `.gitlab/`, `.circleci/`, `.buildkite/`, `.drone.yml`), is indexed with its
+  file, key path (jq style, the document index first in a file of several documents), value, type
+  and line. `search` finds them with the new kind `value` (exact, then prefix, then substring, over
+  values and key paths), and the default search answers with them only when no symbol and no
+  contract matches (#639).
+- Config values: a value over 1 KiB is stored cut, marked `(cut)`; a Kubernetes `Secret`'s `data`
+  and `stringData` are stored as `redacted`. Lockfiles and files that do not parse are skipped, and
+  `meada status` counts the config files read and skipped and the values redacted. Values stay out
+  of `meada export`. The index schema changes, so existing indexes are rebuilt (#639).
+- `search` with the kind `value` serves substring matches from an FTS5 trigram table beside the
+  B-trees that already serve exact and prefix matches, instead of scanning every row; a query
+  under three characters still scans, with the same answer. The table holds about four times the
+  text of the key paths and values (21 MB for 5 MB on this repository). The index schema
+  changes, so existing indexes are rebuilt (#647).
+- Terraform and OpenTofu config values (ADR 0025): `*.tf`, `*.tofu`, `*.tfvars` and `*.auto.tfvars`
+  files are read with `hcl-edit` and `hcl-rs`, and `*.tf.json`, `*.tofu.json` and `*.tfvars.json`
+  through the JSON reader, so `search` with the kind `value` finds a team name in an OpsGenie
+  routing rule or a queue name in Terraform. The key path runs over the block's type and labels and
+  the attribute's name (`resource.aws_sqs_queue.orders.name`), a repeated block `[n]`; a literal
+  keeps its type, and an expression or a template is stored as written under the type `expression`
+  or `template`. A `.tofu` file shadows the `.tf` file of the same name (#640).
+- Terraform and OpenTofu config values: the `default` of a `variable` with `sensitive = true` (or
+  `"true"`) and every value a `.tfvars` file gives a variable of that name are stored as `redacted`,
+  and so is a default another file of its directory marks sensitive when that directory holds an
+  override file (`override.tf`, `*_override.tf`), which Terraform merges into the others; such a
+  default never reaches the index, also when only the override file changes. There, a `.tf` file a
+  `.tofu` one hides counts as one that does not parse, since Terraform reads it. A file that does
+  not parse is skipped and counted by `meada status` (#640).
+- A Go struct field that keeps a base URL (`c.base`) carries the environment read every
+  composite literal of the repository that sets it gives it, directly or through a constructor's
+  parameter whose callers in the repository all pass that read, so a method that reads the field,
+  directly or through a request wrapper, links through `base_url_env` like the same read written
+  inline. Two different reads, a literal by position or of an alias, no literal, a write through
+  a selector (`c.base = x`), a constructor with no caller or that a call may reach by a name
+  match or through an interface (a method another definition shares the name of), and a literal
+  string leave the field
+  unknown, as before (#687).
+- A TypeScript class field that is `readonly`, `private` or `#x` and written once, by its
+  initializer or by one plain `this.f = v` in the constructor body, is a constant of the class:
+  `this.f` in a method folds to it, so `` fetch(`${this.baseUrl}/orders`) `` gets the base URL
+  the constructor reads, a Backstage `config.getString` through `app-config*.yaml` included, and
+  links through `base_url_env`. A public mutable field, a second or conditional write, a write
+  outside the constructor, a constructor parameter and a JavaScript file stay unknown (#688).
+- Backstage's `app-config*.yaml` follows `$include` and reads `$env`: a block moved to a partial (`{
+  $include: ./partials/acme.yaml }`, or `./partials/acme.yaml#api` for one key path of it) and a
+  value written `{ $env: API_URL }` are read as if inline, so a `config.getString` through them
+  links through `base_url_env`. The path resolves against the including file's directory, only
+  `.json`, `.yaml` and `.yml` files are read, and includes nest from their own directory. A partial
+  is a config input of the index, so editing it alone changes the answer on the next refresh. The
+  index schema golden changes (it now lists the stored roles), so existing indexes are rebuilt
+  (#689).
+- Backstage `$include` limits: an absolute path, one that leaves the repository, a symbolic link, a
+  `${` in the path, another extension, a missing file or key path, a sibling key, a cycle, a depth
+  past 8, more than 64 includes from one root, more than 1 MiB grafted into one root and more than 4
+  MiB parsed for all the roots of a repository (its files named `app-config.yaml` first, then the
+  others in path order; an include counting its file's bytes, or its value's size when YAML aliases
+  make it larger, an include past its root's limit included) are not followed (#689).
+- Backstage partials that do not parse: such a partial is parsed once per reading, charged its bytes
+  or, holding several documents, what reading them built: their keys stay unread and `meada status`
+  names each include with its reason. `$file` stays unread, and a config file past 1 MiB is dropped,
+  not parsed by half (#689).
+- Backstage proxy endpoints are read wherever Backstage's proxy backend reads them: under
+  `proxy.endpoints`, and, when no `app-config*.yaml` has that key, as the keys of `proxy` that
+  start with `/` (the legacy shape, accepted from before Backstage 1.17). A string value is
+  `{ target }` in either shape, with the default `pathRewrite`, and `ignorePath`, `prependPath`
+  and `pathRewrite` another file gives the same endpoint apply to it. An endpoint inside an
+  included partial counts as if inline. With both shapes, in one file or across files, only
+  `endpoints` is read. A `getBaseUrl('proxy')` call plus `/inventory/clusters` through any of
+  them is `http::GET::/clusters`, linked through `base_url_env` like an object `target`. A
+  minor bump (#690).
+- IaC nodes (ADR 0025): every Terraform and OpenTofu `resource`, `data` block and `module` call of a
+  `*.tf` or `*.tofu` file is a node with an address (`<type>.<name>`, `data.<type>.<name>`,
+  `module.<name>`), a type, a file, its lines and the root module that roots its evaluation (a
+  directory no other one calls as a local module). A local module's blocks are instantiated once per
+  call under the call's address (`module.orders.aws_sqs_queue.this`), and a literal `count` or
+  `for_each` gives one node per `[key]`. Override files (`override.tf`, `*_override.tf`) merge into
+  the blocks of their directory, as Terraform applies them (#649).
+- IaC nodes: the references between nodes are stored like calls, followed through `var`, `local` and
+  module outputs. `search` finds the nodes with the new kind `iac` (by address, type or physical
+  name; the default search leaves them out), `context` on an address shows the type, the physical
+  name, the references both ways and the config values, and `trace` walks the references down and
+  up. Nodes stay out of `meada export`; the index schema changes, so existing indexes are rebuilt
+  (#649).
+- Compose services as IaC nodes: a Compose file (`compose.yaml`, `compose.yml`,
+  `docker-compose.yaml`, `docker-compose.yml`) with its override file in the same directory is one
+  evaluation unit, rooted at the directory, and each service is a node `services.<name>` of type
+  `service`. `depends_on`, `links` and shared networks are references (`via depends_on`, `via
+  links`, `via networks.<name>`). `${VAR:-default}` resolves to its default and is marked
+  overridable; `${VAR}` stays an unresolved part. A service records its image and its build
+  context (a path inside the repository, from its root) for the image contract, and `context`
+  shows both. `search` kind `iac`, `context` and `trace` answer for them. The index schema
+  changes, so existing indexes are rebuilt; release level minor (#652).
+- CloudFormation and SAM templates as IaC nodes (ADR 0025): a YAML file (the short-form tags `!Ref`,
+  `!Sub`, `!GetAtt`, `!Join` and the rest are read) or a JSON file with a `Resources` mapping that
+  carries `AWSTemplateFormatVersion` or the SAM transform (`AWS::Serverless-2016-10-31`) is one
+  evaluation unit, rooted at the template's path, and each resource is a node addressed by its
+  logical id, its type (`AWS::SQS::Queue`, `AWS::Serverless::Function`) the node's type. `Ref`,
+  `Fn::GetAtt` (with the attribute in the `via`), the variables of `Fn::Sub` and `DependsOn` are
+  references. `search` kind `iac`, `context` and `trace` answer for them; a changed template is
+  evaluated again alone. The index schema changes, so existing indexes are rebuilt; release level
+  minor (#653).
+- CloudFormation and SAM physical names: the physical name of the types the contract kinds will read
+  (queues, topics, buckets, tables, functions, streams, secrets and a few more) is evaluated within
+  the template: a parameter's default (marked overridable), `Ref`, `Fn::Sub`, `Fn::GetAtt` and
+  `Fn::Join`; a pseudo parameter, an import and any other function are unresolved parts and the name
+  a pattern. A parameter with `NoEcho` has its default stored as `redacted` among the config values
+  and used for no name (#653).
+- Serverless Framework services as IaC nodes (ADR 0025): a `serverless.yml`, `serverless.yaml` or
+  `serverless.json` with a `service` is one evaluation unit, rooted at its path. Each function is a
+  node `functions.<name>` of type `Serverless::Function`, named by its `name` or
+  `<service>-<stage>-<function>`, with its handler and events (`http GET /orders`, `sqs Queue.Arn`,
+  `schedule rate(5 minutes)`) recorded and shown by `context`, and a reference to each resource its
+  body names with `Ref`, `Fn::GetAtt` or `Fn::Sub`. The `resources` section is read as
+  CloudFormation: each resource is a node at its logical id (#654).
+- Serverless Framework variables: `${self:...}` resolves to the value at its path and the default of
+  `${opt:...}` resolves and is marked overridable; `${env:...}`, `${ssm:...}` and the other sources
+  are unresolved parts, a `*` in a name and `${...}` in a recorded text. `search` kind `iac`,
+  `context` and `trace` answer for them; a changed service is evaluated again alone. The index
+  schema changes, so existing indexes are rebuilt; release level minor (#654).
+- Kubernetes objects and Kustomize overlays as IaC nodes (ADR 0025): every YAML or JSON document
+  with an `apiVersion`, a `kind` and a `metadata.name` is a node addressed
+  `<Kind>[.<group>]/<namespace>/<name>` (no namespace for a cluster-scoped kind). Each directory
+  with a `kustomization.yaml` that no other names as a base is an overlay and an evaluation unit:
+  its `resources`, `bases` and `components` inside the repository are instantiated under it, each
+  node labelled by the overlay, with `namePrefix`, `nameSuffix`, `namespace` and `images` applied
+  (#651).
+- Kustomize bases and Kubernetes references: a base stays inside the repository (a `..` that stays
+  inside is followed; a remote base, one above the root, through a symlink, in a cycle or past 16
+  levels is not), and `meada status` counts the entries not followed. A Service references the
+  workloads its selector matches, a workload the ConfigMaps and Secrets of its `env`, `envFrom` and
+  volumes and its service account, an Ingress its backend Services, in one namespace and one unit.
+  `search` with the kind `iac`, `context` (with the images of a workload) and `trace` answer for
+  them as for Terraform's nodes. The index schema changes, so existing indexes are rebuilt (#651).
+- Crossplane compositions, claims and managed resources (ADR 0025): among the Kubernetes nodes,
+  `context` names what each object is to Crossplane on a new `role:` line (a composite resource
+  definition, a composition, a claim or a composite resource of a kind an XRD of the repository
+  defines, a managed resource with `spec.forProvider`, a composed resource), and Crossplane's own
+  kinds have no namespace. Each resource a composition creates from a literal `base`
+  (`spec.resources`, or a function patch-and-transform pipeline step) is a node
+  `<composition>/<resource>` of the base's kind, named by its `crossplane.io/external-name`
+  annotation or `metadata.name`; a managed resource is named by its external name (#655).
+- Crossplane references, in one unit: a claim to the XRD of its composite kind, a composite resource
+  to its XRD, a `compositionRef` to its composition, an XRD to its default and enforced composition,
+  a composition to the XRD it composes and to each resource it creates, and a created or managed
+  resource to the XRD or `CustomResourceDefinition` of its kind. Patches and functions are not
+  evaluated: a name a patch sets, or a base with no name, is the pattern `*`, and a step running any
+  other function creates no node. The index schema changes, so existing indexes are rebuilt; release
+  level minor (#655).
+- Static evaluation of Terraform names (ADR 0025): an IaC node's physical name (its `name` argument)
+  and each `count` and `for_each` are evaluated with `hcl-rs`'s evaluator and Meada's pure functions
+  (string, collection and conversion functions and `jsonencode`), from variable defaults, the root's
+  `terraform.tfvars`, `*.auto.tfvars` and their JSON forms, locals, local module inputs and outputs
+  per call, `each` and `count.index`, without running Terraform or reaching the network, so a
+  `for_each` over a variable gives one node per instance. `context` lists under `overridable:` the
+  root variables a name went through, by their default or a var file. A changed Terraform file or
+  var file evaluates again only the root modules whose unit holds it. The index schema changes, so
+  existing indexes are rebuilt (#650).
+- Terraform names never evaluated: data sources, resource attributes, registry modules,
+  `terraform.workspace`, `-var`, `-var-file`, `TF_VAR_` and sensitive variables (marked by any of
+  their blocks, override files included, and every variable of a directory holding an override file
+  and a Terraform file that does not read or a `.tofu` file hides): such a part of a name is a `*`
+  and the name a pattern, shown as `pattern "orders-*"` by `search` and `(pattern)` by `context`,
+  and linked by nothing yet. A value over 64 KiB, an expression that could make over 1 MiB and a
+  root's evaluation past 64 MiB stay unresolved (#650).
+- TypeScript consumers through `new URL(x)`: `new URL(x)` with one argument is `x` (unless the file
+  declares a `URL` or imports one from a relative path), and `u.toString()`, `u.href`, `String(u)`
+  and `` `${u}` `` pass the URL through, in a constant or built in place, so a `fetch` or a client
+  wrapper called with one links to its route and a base URL read from the environment shows its
+  `via`. A change through `u.searchParams`, `u.search` or `u.hash` keeps the path; a write to any
+  other member of a `new URL` constant, written in parentheses or a type assertion too, leaves it
+  unresolved, also through a destructuring or `for (.. of ..)` target, `++`, `Object.assign` or
+  another name holding it, or with the target in parentheses or an assertion, as does such a
+  write to a sealed field set where it is declared or in its constructor
+  (`this.url.pathname = ..`) (#685).
+- TypeScript consumers through `new URL(reference, base)`: the two arguments read as the join the
+  WHATWG URL Standard defines (RFC 3986 section 5.2 for these references), so an absolute reference
+  is itself, `//host/x` takes its host, `/orders` replaces the base's path and `orders` joins the
+  base's directory (`https://h/api/` keeps `api`, `https://h/api` does not). Over a base read from
+  the environment (or a hole) an absolute path keeps the base as its lead, so `/orders` is
+  `http::GET::/orders` with `via env:API_URL`; a relative reference, one that starts with a read,
+  and a query or a fragment alone stay unresolved, and a parameter on either side is resolved at the
+  call sites (#686).
+- `new URL(reference, base)` bases: a base is placed only when its scheme leads it, so a proxy's
+  `${X}/fetch/https://api.example.com/` is an opaque base, not a link to that host, and every
+  reference loses its dot segments. Swift's `URL(string:relativeTo:)` over a literal base goes
+  through the same resolver and follows the same rules; over a base read from the environment it
+  stays unresolved (#686).
+### Changed
+- Development and test builds optimize the main `meada` package at level 1 to reduce the
+  resident code footprint of the expanded indexing and contract readers (#711).
+- Kotlin: a name read or called in a lambda looks for a local or local function of the code
+  around it in one climb, not one from every enclosing lambda: a file of 300 nested `apply`
+  blocks indexes in about 12 s instead of over 100 s (debug build), with the same answers (#711).
+- A refresh reads the values of the files it did not change from a values cache beside the index
+  (`values.db`, ADR 0027) instead of parsing them again: on this repository, a one-line edit of a
+  Rust file refreshes in 1.4 s instead of 3.4 s. The refreshed index still equals a cold one, and
+  deleting the cache costs only time (#611).
+- A refresh builds no resolver for a group it keeps, resolves each call of a changed group once,
+  writes communities again only when the call graph moved, and the actix-web reader skips the
+  lookups whose answer it does not use: on this repository a one-line edit of a Rust file
+  refreshes in 1.0 s instead of 1.5 s, with the same index (#610).
+- A refresh summarizes a contract configuration again only when its bytes, the IaC nodes it
+  read or a path it looked at changed: 60 ConfigMaps of 290 KB refresh with no change in 0.01 s
+  instead of 4.5 s (debug build), and a removed or added Lambda handler or Compose build path
+  still moves its answer (#711).
+- `search` with the kind `value` reads the value of only the rows its answer shows (each match
+  keeps just its sort key), so a broad query such as `e` no longer formats every matching value
+  before the budget cuts it (#711).
+### Fixed
+- A Java AWS SDK request no longer names a table, topic, bucket or queue its builder had before
+  the builder changed (#719). A builder changes in place, so a name is `exact` only when every
+  mention of the builder is a form the reader follows: a setter, `.build()`. Any other mention
+  leaves the side unresolved: the builder handed to a call or captured, `applyMutation`,
+  `copy(consumer)`, an alias at any depth, and a use the reader does not model (a cast, a
+  ternary). A value built first keeps its name, as an immutable copy does, except in a loop the
+  builder outlives. A request is judged whole: one such entry leaves the others unresolved.
+  The check reads a file once, so its cost is linear in the calls.
+- A Java AWS SDK request built by a lambda or a class that runs after its builder changed, one
+  its helper assigns again as a parameter, one a caller passes on after its builder changed, a
+  builder field hidden by a local, one set from an initializer or another file, one handed to
+  caller code by `applyMutation` and a request type another type or an import shadows name no
+  table either (#719).
+- A Java AWS SDK request whose builder is set again in a loop around the one its value is built
+  in, or inside the request's own expression, names no table either (#719).
+- Terraform static evaluation charges the template text `hcl-rs` parses again at each
+  evaluation in a `for`, not only the bytes an expression makes: a template in a `for` over
+  thousands of elements is unresolved (`*`) before it runs, where one 24 KB root took seconds
+  per resource and minutes in all. A read such as `var.x[0]` in a `for` is charged the copy of
+  `var` it makes each time. A refused expression spends the bytes it went through (its text and
+  the roots it read), at most the 1 MiB each one spent before, and a literal name that fits one
+  value stays exact once the work is spent. A short template (`"${a}-x"`) in a `for` over 2,000
+  elements still resolves; one of 40 interpolations resolves over 100 elements, no longer over
+  200 (#714).
+- `meada mcp` over stdio answers calls a client sends without waiting for each reply (#704).
+  Each call refreshes the index, and a refresh failed at its first write with `database is
+  locked` when another call was writing. Now the calls of one server run one refresh at a time
+  and wait for it with no timer, sharing the next run; a call that meets its lock elsewhere
+  (opening the index, querying it) waits for the refresh too, past the 10 s busy timeout. A
+  batch after a change costs about one refresh more than an unchanged one (debug build, Meada's
+  own checkout: 50 calls 21 s against 15 s). Across processes, a refresh with nothing to write
+  takes no write lock and one that meets another process's writer waits for its commit and
+  starts over; a wait past 10 s there still answers `database is locked`, and that server's
+  calls wait behind its refresh as long as it takes.
+- Terraform: a `for` binding a key over a set held in a local or a variable (`local.s` from
+  `toset(...)`, a chain of locals, a variable declared `type = set(...)`) is unresolved
+  instead of answering the index as an exact key, as it already was over a written `toset(...)`
+  (#720). A set reached through an attribute, an index or another call stays a ceiling (#717).
+- Terraform: a value that enters a variable declared `set(T)` (its default, a var file's value, a
+  module argument, an override's default) is converted to elements of type `T`, then sorted and
+  deduplicated as cty does, so `tolist(var.s)`, `length(var.s)` and `join` over `["b", "a", "a"]`
+  see `a`, `b`, and a `set(string)` of `[10, 9]` keeps the strings `"10"` and `"9"` in string
+  order. An element Meada cannot convert with certainty leaves the value unresolved (#720).
+- Terraform: an override file that replaces the `type` of a variable whose own block declares a
+  set type is now converted as Terraform converts it: the default is converted to the set first,
+  then to the new type (`list(string)` gives the set's elements in set order, `any` and `set(string)`
+  keep the set; a default an earlier override gave is converted the same way when a later
+  one retypes it), and one Terraform rejects (a tuple) gets no exact name. OpenTofu 1.13 and later convert the default
+  once, to the final type, and name other instances; Meada follows Terraform (#740), except for a
+  variable with a block in a `.tofu` or `.tofu.json` file, which Terraform does not read: it is
+  unresolved where the two conversions differ. Known gap: indexed end to end, the four cases tried
+  of a `for_each` over a variable retyped to a list got one pattern name where Terraform creates an
+  instance per element, and none got a wrong exact name; the cause is open (#783).
+- An Alertmanager configuration with a matcher regex Go's `regexp` refuses (an unclosed
+  group, a leading `*`, a backward range, a lookahead) is unreadable, as Alertmanager refuses
+  to load it: it gives no alert side or link, where its valid routes kept an `exact` link,
+  and `meada status` counts the file under `unreadable`. Only a syntax error established as
+  a `regexp/syntax` error code counts; an expression past Meada's own budgets or syntax it
+  does not read stays unmatched with the other routes linked (#718).
+- AWS SDK forms in Java, Go and C# follow the ADR 0026 rule TypeScript and Python already
+  followed: an EventBridge entry without `EventBusName` produces to `default`, and an SNS
+  publish to a phone number or endpoint names no topic. A request Meada cannot see whole (a
+  builder from `toBuilder()` or from a factory of the repository's own, a helper's result) keeps
+  its unresolved side. TypeScript and
+  Python now read the S3, SSM and Secrets Manager operations Java, Go and C# read
+  (`DeleteObject`, `HeadObject`, `ListObjects`, `ListObjectsV2`, `PutParameter`,
+  `DeleteParameter`, `DeleteParameters`, `PutSecretValue`, `UpdateSecret`, `CreateSecret`,
+  `DeleteSecret`); DynamoDB transactions stay TypeScript and Python only (#660).
+- `snapshot publish` no longer publishes the old graph under a new commit when only a contract
+  configuration or a path its summary looked at changed (a removed Lambda `worker.zip`, a
+  Compose build context): the index is fresh only while all of them are as it read them (#711).
+- An image's Helm values file is any YAML file with a `values` word in its name, as for alerts,
+  so `prod-values.yaml` declares image consumers, as `values.prod.yml` already did, and
+  `valuesets.yaml` does not (#711).
+- Python: an import inside a function names its library in that function again, so
+  `from requests import get` and `import requests as r` there are HTTP consumers, and
+  `import json as requests` there hides the module's `requests` (#668).
+- Python framework and Go router tables retain stable identities in optimized builds, so
+  Flask blueprints keep their mounted routes and standard Go mux matching stays consistent (#711).
+- TypeScript and JavaScript URL consumers respect lexical bindings and writes of `String`
+  (#683). A callback named `String` no longer invents a route or host, and a local binding
+  leaves the global conversion in other scopes intact. Non-strict block functions follow
+  Annex B's enclosing binding; modules, classes and strict prologues retain block scope.
+- Image runners and links retain each evaluation root when Kustomize overlays reuse the same
+  workload and normalized image. Repeated image evidence within one workload and root still
+  collapses to one side (#711).
+- A symbol's `context` shows the level, reason and provider of inferred HTTP call links whose
+  recorded environment base selects a declared `base_url_env` peer, including through fields
+  and Backstage config partials. Editing only a partial refreshes that explanation (#683).
+- Resource SDK reader call sites retain their identities while traces follow writer-to-reader
+  data flow and its reverse, show the actual function/location, and continue through the
+  reader's body. Shared partial reads and process membership use the same direction; HTTP
+  and package calls keep their existing behavior (#659, #660).
+- Terraform and OpenTofu config values redact an `aws_ssm_parameter` resource's `value` when
+  its literal `type` is `SecureString`, in HCL and Terraform JSON, regardless of attribute order.
+  Ordinary `String` parameters keep their values (#709).
+- TypeScript and JavaScript URL folding requires the runtime global or the named `URL` export
+  of `url` or `node:url`. Unknown imports, repository aliases, other exports and shadowed
+  CommonJS loaders no longer invent HTTP consumers or links (#709).
+- CloudFormation nodes and references survive cold indexing and warm refreshes when a qualifying
+  template is named `compose.yaml`: its resource types decide ownership before its filename,
+  without changing real Compose ownership (#709).
+- A YAML document whose anchors and aliases expand past the nesting limit (128 levels) is
+  reported unreadable and skipped, where it could abort meada (#646).
+- Crafted IaC and YAML files no longer exhaust memory or time while indexing: long
+  CloudFormation parameter defaults joined or substituted many times, names built through more
+  than 32 Terraform variables or CloudFormation parameters (now unresolved), YAML anchors nested
+  around a large node, Kustomize files listed many times or reached through a diamond of bases,
+  thousands of `images` rules, Ingress hosts past 253 bytes and volume names past 63 (now left
+  out), an `Fn::Sub` that names its variable twice at every level, Terraform objects of
+  thousands of keys (a file whose objects pass 2^24 key comparisons is now unreadable), costly
+  `.tfvars` values (now given but unresolved) and long `trim` and `toset` arguments (#646, #649,
+  #651, #653).
+- An Alertmanager route expression of case-insensitive Unicode classes (`(?i)\p{Any}` written
+  hundreds of times) no longer takes minutes to compile on every `export` and `status`, nor do
+  hundreds of route configurations compile a megabyte automaton each: the expressions of one
+  linking pass share 2^22 code points of case folding (counted only in ranges that hold a cased
+  letter, a bracket's classes as folding leaves them), 4096 Unicode classes and 16 MiB of
+  automata, in equal parts per routing scope and expression, so what links does not depend on
+  the repository asking. Past its part an expression stays unmatched (`status` shows its matcher
+  as an orphan, not a limit), and the same expression in route configurations of as many
+  expressions is compiled once (#672).
+- A long label matched by an Alertmanager route expression of many automaton positions no longer
+  runs the expression over it for every route: `.*a.{1000}a.*` against a label of 300,000 bytes
+  took 43 s for each route (debug). Before reading a value, each condition is charged a step per
+  automaton position (a state that reads nothing, such as an assertion or an empty capture,
+  included) and byte offset it may start at, or the bytes it reads for a comparison, against a
+  ceiling of 2^26 steps per pass apart from the evaluation ceiling, so that label stops before
+  matching and `status` reports the evaluation limit, while route visits and evaluations count as
+  before (#711).
+- Alerts: a regular expression Go refuses for a repetition operator stacked on another (`a**`,
+  `a{2}*`) no longer links (#711).
+- Alerts: an AlertmanagerConfig route links `inferred`, since prometheus-operator also matches
+  the alert's namespace, which Meada does not read (its consumers say `(AlertmanagerConfig
+  namespace)`); a Grafana rule group repeated with `count` or `for_each` declares no rule (it may
+  be made zero times); a file with a `values` word in its name (`prod-values.yaml`,
+  `values.prod.yaml`) is Helm input, not just one starting with `values`; a quoted matcher value
+  reads Alertmanager's escapes (`\n`, `\"`, `\\`), so `"a\.b"` keeps its backslash instead of
+  invalidating the route and its siblings; and the 4 MiB file ceiling charges the text a rule or
+  route stores, so 2,000 small rules (187 KB) are no longer dropped (#672).
+- A Python file of thousands of AWS SDK operations on clients a factory function returns no
+  longer takes minutes to index: the operations one reader asks about in a file keep the answers
+  no limit cut and share a budget of 2^18 steps, one operation taking up to all that is left
+  (each still taking 16 once it is spent, so five factories of 2,000 returns resolve on their
+  first operation), and a call passing thousands of clients to one function, or forwarding them
+  through a wrapper to the Google Cloud and Azure readers, no longer copies them for every value
+  it reads (#660, #668, #669).
+- Terraform: an object written after a `-`, a number or a `/`, or after a quote or heredoc end
+  inside a template directive's body, now counts toward the 2^24 key comparisons a file may
+  hold, where a file of them could take minutes to parse; a file with a heredoc whose first
+  line starts with its identifier is now unreadable, since the parser read it otherwise than
+  Terraform and could hide such objects behind it (#640); a JSON
+  var file of tens of thousands of keys reads in linear time, where it took over half a minute;
+  and a var file Terraform loads that does not read (broken, too wide or past 1 MiB) leaves the
+  variables it may give unresolved, where their defaults stood in (#650).
+- Backstage proxy: a `proxy.endpoints`, a whole `proxy` or a root behind an `$include` Meada
+  does not follow counts as the endpoints table, as Backstage reads (or refuses) whatever the
+  include gives, so the legacy `proxy['/<ep>']` keys beside it or in another file no longer link
+  a call; an include whose `#` key path's last key is absent does not, since Backstage leaves that
+  key out (#709).
+- Backstage `$include`: an `app-config*.yaml` that is one `$include` is the file it names, a root
+  or a partial of more than one YAML document is unreadable, and an include of the file and key
+  path being read keeps its `$include` as written rather than being a cycle, all as Backstage's
+  config loader reads them (#709).
+- Serverless: a function with no `name` is named after `--stage` first, so `context` lists its
+  name as overridable through `opt:stage` (at `provider.stage`'s line, or the function's when the
+  file has no stage) and the name links `inferred`; `${self:provider.stage}` still reads the file
+  and is no override (#709).
+- Authorization: an `added_by` a team operator wrote while no GitHub grant provider was
+  configured no longer decides eligibility once `[oidc.github]` is enabled. Under the provider the
+  console stamps each `added_by` it writes with `added_by_time` (its own clock, never the
+  submitted text; part of the version id), and without it writes none; Postgres migration 10
+  keeps the time the provider's first permissions set started (`<schema>.permission_state`), and `meada github-app roles` reports an addition on the
+  host whose `added_by` has no time, or one no later than that set's second, `unattributed` and
+  excludes it whatever its roles. Entries saved before this version carry no time, so under the
+  provider their additions are excluded until the global operator writes a reviewed
+  `added_by_time` or a team operator adds them again; `composeEntries` takes the time as its
+  fourth argument (#454).
+- A query no longer reopens each peer's index: the engine refreshes and reads the connection it
+  holds, so a peer is never refreshed in one file and read from another (#443).
+- GitHub App: a 403 `Resource not accessible by integration` with quota left (no `retry-after`,
+  `x-ratelimit-remaining` above 0) is a permission failure, not a throttle: `github-app roles`
+  passes it to the next installation unmarked, records the repository as `forbidden` (no rows, a
+  warning) when every installation answers so, and the installations stay eligible for the role
+  check and keep minting. A 403 or 429 with `retry-after` or an empty quota still
+  throttles, as does any 403 outside the role check's collaborators listing (ADR 0013 amended,
+  #452).
+- prove-meada scripts: the console page checks sign in again when a route lands on the sign-in page
+  and fail the route that stays there, the Helm overlays `values-identity.yaml` and
+  `values-workspaces.yaml` render in their stack (as `scripts/helm-check` does) instead of failing
+  alone, and `console.py start --bin` resolves a relative path against the caller's directory (#679).
+- `meada export`, `meada status` and the other commands that print their result once done no
+  longer panic when the reader closes its end early (`meada export | head -1`, `| true`): the rest
+  of the output is dropped and the command ends as it would, where it panicked with "failed
+  printing to stdout: Broken pipe (os error 32)" and exited 101. `meada decide` and `meada mcp`,
+  which never panicked, still stop with a "Broken pipe" error and exit 1 (#711).
+- Kustomize: with two bases of their own `namePrefix` that write the same names, a Deployment no
+  longer references the other base's ServiceAccount, nor an Ingress the other base's Service. A
+  Service reference, and a `serviceAccountName` of the kinds Kustomize renames (Pod, Deployment,
+  StatefulSet, DaemonSet, ReplicationController, Job, CronJob), resolve as Kustomize's name
+  reference does once the tree is built: among the objects of the referrer's namespace (none and
+  `default` alike) a stage renamed or moved from the name as written, the only one, else those
+  whose prefix and suffix stages end as the referrer's; with none left, the object called by the
+  name as written, a final name included, and with several (a tree Kustomize refuses), none.
+  Another kind's account, or the deprecated `serviceAccount`, which Kustomize leaves alone, names
+  the account called so. An empty `namespace` in a kustomization no longer sets one (#711).
+- Ingress: a path Meada cannot read as a literal prefix (`/store/(.*)`, `/api/*`) no longer drops
+  out of the routing table, where a shorter rule then claimed its URLs; it is an unread mount at
+  its literal head cut at its last slash. A `use-regex` annotation or a missing `pathType` also
+  leaves the path unread, and so does a path left out (an ImplementationSpecific catch-all); a
+  table past its ceilings (64 rules, read or not) leaves every host of the Ingress unread, not
+  only the hosts read before the cut (#711).
+- Kustomize `components` change what the kustomization that lists them holds, its bases'
+  objects included, as Kustomize applies them; they were instantiated as one more base, so a
+  component's `images` rule never retagged the overlay's workloads. Each object a component is
+  handed counts against the 50,000 entries one overlay walks, so components reaching one another
+  along many paths, or many objects through a long list of them, stop there (#711).
+- HTTP: overlays that repeat one Ingress or Service per environment no longer make a route to a
+  single provider `ambiguous`; distinct providers, or a route as long that reaches no code,
+  still do. A decision recorded for such a route is now stale; `meada decide --prune` removes it (#711).
+- Images: a module run from a local path (an archive or a directory) in one root no longer drops
+  the image another root runs it from, with its environment and provisions; only that root runs
+  code without an image (#711).
+- Terraform: `split(",", "")` gives one empty element (a `count` over its length made no node), and
+  an IaC name pattern needs three letters or digits besides its wildcards (`*.*.*.*` matched any
+  dotted name) (#711).
+- Terraform: an object walks its keys in lexical order, whether a variable or local binds it or the
+  expression builds it (a literal, a `merge`): a `for` over it or a `jsonencode` of it gave an
+  `exact` name in written order, and a `for` whose collection contains an object whose keys are
+  known only once evaluated (a computed key, a comprehension) is now `*` (#711).
+- Terraform: integer arithmetic is exact, as Terraform's: a result past `u64` or below `i64` (`0 -
+  18446744073709551615`), a division by zero or with a remainder (`7 / 2`) and arithmetic on a
+  fraction leave that part of the name `*`, also on a `for` variable, where the evaluator printed a
+  cast, wrapped or floating-point value as an `exact` name. So do a number literal or `tonumber`
+  past them, with more digits than a float holds or that a float writes with an exponent
+  (`18446744073709551616` printed `1.8446744073709552e19`), a JSON number written with a fraction or
+  an exponent and a negative zero (`-0`, `0 * -1` printed `0`). Such a value in a var file is given
+  but unresolved, so the variable's default no longer stands in for it (#711).
+- Terraform: `toset` orders its elements as Terraform does (numbers by value, `false` before
+  `true`, a null last, strings with numbers or bools as strings), where it kept a number's or a
+  bool's first order: `tolist(toset([10, 9]))[0]` was an `exact` `10` for Terraform's `9`. A set of
+  collections, in Terraform's hash order, and a set of numbers and bools, which Terraform refuses,
+  are `*` (#711).
+- Terraform: a null or a collection interpolated into a name (`"q-${null}"`, `"q-${[1]}"`), which
+  Terraform refuses, is `*`, where it gave the `exact` names `q-null` and `q-[\n  1\n]` (#711).
+- Terraform: arithmetic on a `for` variable in a `.tfvars` file (`[for x in [1, 2] : x * 2][1]`)
+  resolves, as Terraform evaluates it, where the value was given but unresolved (#711).
+- Terraform: a `%{ for }` directive's collection is read as any other expression, where its keys
+  kept their written order and a number its float text (`%{for k, v in {b = 1, a = 2}}` gave
+  `b1a2`, Terraform `a2b1`); a negative zero there is `*`. An object of several keys inside a var
+  file's template, with or without line comments, no longer drops the value for the default (#711).
+- Terraform: `tolist` and `tomap` convert their elements to one type, as Terraform does, where
+  they kept each element's type: `jsonencode(tolist(["a", 1]))` gave an `exact` `["a",1]` for
+  Terraform's `["a","1"]`; collections unify as cty does (`[[1], ["a"]]` to `[["1"],["a"]]`). A
+  number with a bool and a list's null beside a collection, which Terraform refuses, are `*` (#711).
+- Terraform: a `for` over `tolist`, `toset` or `tomap` (`{for o in tolist(var.items) : o.name =>
+  o}`) costs as a `for` over its argument, so forty objects from a var file expand where the
+  estimate, the argument's size squared, left the resource `*` past about a kilobyte (#711).
+- Terraform: a `for` or `%{ for }` binding a key over `toset(...)` (`for k, v in toset(x)`) is
+  `*`, where the key was the index (`q-0`) and Terraform's is the element (#711).
+- Images: a direct path that went through a value a deployer can override (`${CTX:-./app}`)
+  runs code `inferred`, not `exact`; a repository's literal image and its own pattern matching
+  the same runner are one link, not two `ambiguous` ones; a Helm `image.registry` prefixes
+  `image.repository` (a templated one as an unresolved segment), where the runner named a Docker
+  Hub image; and an unresolved image name (`image::*`, from `docker/metadata-action`) is no
+  `status` orphan (#711).
+- Compose: an override file's `build` with no `context` keeps the base service's context, where
+  it built from the override's directory, and the `!reset` and `!override` tags clear or replace a
+  base value. A `build` context Docker reads as a git repository (`git@github.com:a/b.git`,
+  `github.com/a/b`) is no local directory, so it runs no code of the repository. SAM: a
+  function with no `CodeUri` of its own takes `Globals.Function.CodeUri`. Kustomize: a
+  `bitbucket.org/` base is remote, as `github.com/` and `gitlab.com/` ones are, where one without
+  `?ref` counted as missing (#711).
+- SDK names (GCP and Azure, and AWS in TypeScript): a request field written through a computed
+  key (`{['name']: ..}`) or a spread of another object (a spread of a spread too), or written
+  after the call inside a loop statement that also holds the call, leaves the name unresolved;
+  each gave an `exact` link to the name first written (#711).
+- AWS SDK: a request changed after it is made names no resource: a TypeScript command input
+  (SQS's too) whose field is assigned again before the `send`; a Java builder held in a local or
+  a `final` field that is set again or handed to another call, itself, through a chain off it or
+  through a local holding it (`b.topicArn(..)` before `client.publish(b.build())`), also for SQS and Azure Service Bus and Event Hubs builders; and
+  a named entry an inline request holds (an EventBridge entry in C# or Go, an entry builder in
+  Java); and a Go request replaced whole through its pointer (`*input = sqs.SendMessageInput{..}`).
+  Each gave an `exact` link and provision to the name first written. A TypeScript field
+  read off a local object (`{Bucket: cfg.bucket}`) now names its bucket (#711).
+- TypeScript and JavaScript: a generator (`function*` and `async function*`, declared or as an
+  expression, a `*method()` of a class or an object) returns its iterator, so a `return new
+  Storage()` in one no longer makes it a client factory; it gave an SDK resource (Pub/Sub, Cloud
+  Storage, Azure Service Bus and Blob) and an `exact` provision to code that never holds the
+  client (#711).
 ## [1.2.0] - 2026-11-04
 A minor release on the [1.x stability promise](https://github.com/ClaudioMascaro/meada/blob/main/docs/site/en/stability.md):
@@ -1297,7 +2001,8 @@ and `trace` from the two longest processes. The spec adds about 0.3 MB and 0.03
 The rise of the single-file reindex since 2026-10-14 predates it (specs #22 and #23), and at
 692 files it is close to its target.
-[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v1.2.0...HEAD
+[Unreleased]: https://github.com/ClaudioMascaro/meada/compare/v1.3.0...HEAD
+[1.3.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.3.0
 [1.2.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.2.0
 [1.1.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.1.0
 [1.0.0]: https://github.com/ClaudioMascaro/meada/releases/tag/v1.0.0

package/README.md CHANGED Viewed

@@ -18,7 +18,7 @@ Escolha a linha que combina com o que você já tem. Todos os canais entregam o
 | Rust | `cargo install meada` | `meada mcp` |
 | Linux ou macOS | o instalador de shell abaixo | `meada mcp` |
 | Qualquer sistema | o arquivo do seu sistema nas [releases do GitHub](https://github.com/ClaudioMascaro/meada/releases), com `meada` no `PATH` | `meada mcp` |
-| Docker | `docker pull ghcr.io/claudiomascaro/meada:1.2.0` | a linha `docker run` em [Conectar um agente](#conectar-um-agente-mcp) |
+| Docker | `docker pull ghcr.io/claudiomascaro/meada:1.3.0` | a linha `docker run` em [Conectar um agente](#conectar-um-agente-mcp) |
 ```sh
 # Instalador de shell (Linux e macOS)
@@ -75,7 +75,7 @@ Com Docker (Linux e macOS):
   "mcpServers": {
     "meada": {
       "command": "sh",
-      "args": ["-c", "exec docker run -i --rm --network none --user \"$(id -u):$(id -g)\" -v \"${PWD%/*}:${PWD%/*}\" -w \"$PWD\" ghcr.io/claudiomascaro/meada:1.2.0 mcp"]
+      "args": ["-c", "exec docker run -i --rm --network none --user \"$(id -u):$(id -g)\" -v \"${PWD%/*}:${PWD%/*}\" -w \"$PWD\" ghcr.io/claudiomascaro/meada:1.3.0 mcp"]
     }
   }
 }
@@ -97,7 +97,7 @@ ler os níveis de uma resposta. No Claude Code:
 ```sh
 mkdir -p ~/.claude/skills/meada
-curl -fsSL https://raw.githubusercontent.com/ClaudioMascaro/meada/v1.2.0/skills/meada/SKILL.md -o ~/.claude/skills/meada/SKILL.md
+curl -fsSL https://raw.githubusercontent.com/ClaudioMascaro/meada/v1.3.0/skills/meada/SKILL.md -o ~/.claude/skills/meada/SKILL.md
 ```
 Outros agentes: veja [Agentes e MCP](https://claudiomascaro.github.io/meada/mcp/#skill-para-agentes).

package/npm-shrinkwrap.json CHANGED Viewed

@@ -19,7 +19,7 @@
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "name": "@meada/meada",
-      "version": "1.2.0"
+      "version": "1.3.0"
     },
     "node_modules/detect-libc": {
       "engines": {
@@ -48,5 +48,5 @@
     }
   },
   "requires": true,
-  "version": "1.2.0"
+  "version": "1.3.0"
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/ClaudioMascaro/meada/releases/download/v1.2.0"
+    "https://github.com/ClaudioMascaro/meada/releases/download/v1.3.0"
   ],
   "bin": {
     "meada": "run-meada.js"
@@ -89,7 +89,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "1.2.0",
+  "version": "1.3.0",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"