@stratal/feature-flags 0.0.27 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +118 -0
  2. package/package.json +7 -7
package/CHANGELOG.md ADDED
@@ -0,0 +1,118 @@
1
+ # @stratal/feature-flags
2
+
3
+ ## 0.1.0
4
+
5
+ ### Patch Changes
6
+
7
+ - a753e55: Release alongside the rest of the packages; nothing changed in this one.
8
+
9
+ Every Stratal package is versioned as one fixed group, so `@stratal/feature-flags` is republished at the same version as the packages it builds on rather than being left behind. Its peer ranges are open-ended, so an existing install keeps resolving — upgrade only to keep one aligned set of versions across the framework.
10
+
11
+ - Updated dependencies [a753e55]
12
+ - Updated dependencies [a753e55]
13
+ - stratal@0.1.0
14
+ - @stratal/inertia@0.1.0
15
+
16
+ ## 0.0.27
17
+
18
+ ### Patch Changes
19
+
20
+ - 41a9140: Make feature flag evaluation resilient to runtime failures
21
+
22
+ Flag evaluation now returns the fallback value and logs a warning if a lookup throws — for example when a remote-binding dev tunnel drops — rather than failing the request. Detail methods return an `ERROR` reason with the fallback in these cases.
23
+
24
+ - Updated dependencies [41a9140]
25
+ - stratal@0.0.27
26
+ - @stratal/inertia@0.0.27
27
+
28
+ ## 0.0.26
29
+
30
+ ### Patch Changes
31
+
32
+ - Updated dependencies [ab95f52]
33
+ - Updated dependencies [ab95f52]
34
+ - Updated dependencies [bb6d3b9]
35
+ - stratal@0.0.26
36
+ - @stratal/inertia@0.0.26
37
+
38
+ ## 0.0.25
39
+
40
+ ### Patch Changes
41
+
42
+ - Updated dependencies [e93db60]
43
+ - Updated dependencies [e93db60]
44
+ - stratal@0.0.25
45
+ - @stratal/inertia@0.0.25
46
+
47
+ ## 0.0.24
48
+
49
+ ### Patch Changes
50
+
51
+ - Updated dependencies [10cf223]
52
+ - @stratal/inertia@0.0.24
53
+ - stratal@0.0.24
54
+
55
+ ## 0.0.23
56
+
57
+ ### Patch Changes
58
+
59
+ - 13b0e8d: Add `@stratal/feature-flags` — Cloudflare Flagship feature flags via the native Worker binding API.
60
+ - `FeatureFlagModule.forRoot({ apps: [{ binding, flags }], default, context })` with a declare-once flag manifest, manifest defaults, a per-request evaluation-context resolver, and multi-app support via `FeatureFlagService.use(binding)`.
61
+ - `FeatureFlagShareMiddleware` shares evaluated flags to Inertia pages as the `featureFlags` prop; register it yourself (scoped to page controllers via `router.middleware(...)` or app-wide via `router.use(...)`) so a stalled Flagship binding can't block unrelated routes. Typed `useFlag` / `useFeatureFlags` hooks on `@stratal/feature-flags/react`. No runtime dependency on `@stratal/inertia`.
62
+ - `@stratal/inertia`: expose a generic `ctx.share(key, value)` macro on `RouterContext` so middleware and packages can contribute per-request shared props.
63
+ - `@stratal/framework`: add a `ctx.user()` macro on `RouterContext` (shorthand for `AuthContext.requireUser()`).
64
+
65
+ - 13b0e8d: Fix correctness and security issues found in review.
66
+
67
+ Queue:
68
+ - Retry the correct binding: dispatch stamps the producer binding into message metadata and failed jobs record it, so `queue:retry` re-enqueues through the Cloudflare binding instead of the queue name (which is not a valid binding key and broke retry whenever the two differed). A message with no binding metadata is logged and acked rather than stored as an unretryable job.
69
+ - Honor the documented retry budget: `maxRetries` now counts retries correctly against Cloudflare's 1-based `message.attempts` (previously gave one fewer retry than configured).
70
+ - Derive idempotency keys from an order-stable serialization of `type` + `payload`, so payloads that differ only in key order dedupe correctly.
71
+ - `queue:retry --all` / `queue:purge --all --queue` collect matching keys before deleting, so cursor pagination no longer skips jobs; `queue:failed --queue --limit` now counts matching jobs rather than scanned keys.
72
+ - Documented that delivery is at-least-once with best-effort de-duplication (not exactly-once), since the processed marker is written only after a handler succeeds and KV is eventually consistent — handlers must be idempotent.
73
+
74
+ Email (SMTP):
75
+ - Upgrade STARTTLS onto the socket `startTls()` returns: the original socket is closed by the runtime, so the post-upgrade reader/writer are re-derived from the new secure socket and any pre-handshake bytes are discarded (fixes a broken `smtp://` STARTTLS path on real Workers and closes the STARTTLS plaintext-injection vector).
76
+ - Refuse to send credentials over an unencrypted connection: an `smtp://` server that doesn't offer STARTTLS now fails loudly instead of leaking the password (blocks STARTTLS-stripping downgrades). Credential-free connections (e.g. local Mailpit) are unaffected.
77
+ - AUTH is gated on the server's advertised mechanisms and supports both `PLAIN` and `LOGIN`; usernames are percent-decoded like passwords.
78
+ - Add a response timeout so a hung SMTP server can't wedge the worker; QUIT/socket close are now best-effort and never mask a successful send.
79
+ - MIME builder strips CR/LF from headers, escapes/RFC 2231-encodes attachment filenames (prevents header injection), base64-encodes message bodies (fixes long-line corruption), and rejects envelope addresses containing whitespace or angle brackets (prevents `MAIL FROM`/`RCPT TO` desync).
80
+
81
+ Inertia SEO:
82
+ - `titleTemplate` substitutes every `%s` and treats `$`-sequences in the title literally.
83
+ - Inject head/body content via function replacements, so SEO/page content containing `$`-sequences (`$$`, `$&`, `` $` ``, `$'`) is no longer corrupted or able to splice a template placeholder back into the output.
84
+ - Drop unsafe attribute names — including inline event handlers (`on*`) — from custom `meta`/`link` entries (prevents tag breakout server-side, `setAttribute` errors during client head-sync, and developer-supplied event-handler attributes).
85
+
86
+ Feature flags:
87
+ - `FeatureFlagService.use()` binds the target app exactly once.
88
+
89
+ Database (framework):
90
+ - The reentrant `$transaction` proxy forwards the receiver for non-transaction property access.
91
+
92
+ Testing:
93
+ - `TestingModule.close()` drops the isolated per-file database even if shutdown throws; the stale-database sweep escapes LIKE metacharacters so a prefix containing `_` can't over-match.
94
+
95
+ DI:
96
+ - Construct singletons against the root container so they can never capture a request-scoped dependency (which would leak one request's state across every later request); an illegal singleton→request dependency now throws loudly.
97
+ - Detect circular dependencies and throw a clear error naming the cycle instead of overflowing the stack.
98
+ - `tryResolve` only swallows "no provider"; a registered provider that throws while constructing now surfaces the real error instead of injecting `undefined`.
99
+ - Request-cache invalidation tracks transitive constructor dependencies, so re-registering a value rebuilds cached services that depend on it through a transient intermediary.
100
+
101
+ Quarry dev runtime:
102
+ - Persist every durable plugin (KV, D1, R2, Durable Objects, cache) under `.wrangler/state/v3`, matching `wrangler dev` (previously only R2 was persisted); load `.env.local` / `.env.<env>.local` into `process.env` for full parity.
103
+ - The `cloudflare:sockets` STARTTLS shim re-attaches the stream error handler to the upgraded socket, so post-upgrade connection errors still surface.
104
+
105
+ - Updated dependencies [13b0e8d]
106
+ - Updated dependencies [13b0e8d]
107
+ - Updated dependencies [13b0e8d]
108
+ - Updated dependencies [13b0e8d]
109
+ - Updated dependencies [13b0e8d]
110
+ - Updated dependencies [13b0e8d]
111
+ - Updated dependencies [13b0e8d]
112
+ - Updated dependencies [13b0e8d]
113
+ - Updated dependencies [13b0e8d]
114
+ - Updated dependencies [13b0e8d]
115
+ - Updated dependencies [13b0e8d]
116
+ - Updated dependencies [be813bc]
117
+ - stratal@0.0.23
118
+ - @stratal/inertia@0.0.23
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@stratal/feature-flags",
3
- "version": "0.0.27",
3
+ "version": "0.1.0",
4
4
  "description": "Cloudflare Flagship feature flags for the Stratal framework — binding API wrapper with Inertia.js sharing",
5
5
  "type": "module",
6
6
  "license": "MIT",
@@ -30,7 +30,7 @@
30
30
  },
31
31
  "publishConfig": {
32
32
  "access": "public",
33
- "provenance": false
33
+ "provenance": true
34
34
  },
35
35
  "sideEffects": false,
36
36
  "files": [
@@ -59,11 +59,11 @@
59
59
  "peerDependencies": {
60
60
  "@inertiajs/core": ">=3",
61
61
  "@inertiajs/react": ">=3",
62
- "@stratal/inertia": ">=0.0.27",
62
+ "@stratal/inertia": ">=0.1.0",
63
63
  "hono": ">=4",
64
64
  "react": ">=19",
65
65
  "react-dom": ">=19",
66
- "stratal": ">=0.0.27"
66
+ "stratal": ">=0.1.0"
67
67
  },
68
68
  "peerDependenciesMeta": {
69
69
  "@inertiajs/core": {
@@ -86,16 +86,16 @@
86
86
  "@cloudflare/workers-types": "5.20260919.1",
87
87
  "@inertiajs/core": "^3.7.1",
88
88
  "@inertiajs/react": "^3.7.1",
89
- "@stratal/inertia": "workspace:*",
89
+ "@stratal/inertia": "0.1.0",
90
90
  "@types/node": "^26.6.2",
91
91
  "@types/react": "^19.3.0",
92
92
  "@types/react-dom": "^19.3.0",
93
93
  "hono": "^4.13.8",
94
94
  "react": "^19.3.0",
95
95
  "react-dom": "^19.3.0",
96
- "stratal": "workspace:*",
96
+ "stratal": "0.1.0",
97
97
  "tsdown": "^0.23.0",
98
98
  "typescript": "^7.0.2",
99
99
  "vitest": "~4.1.11"
100
100
  }
101
- }
101
+ }