@xeplr/actions 1.4.0 → 1.4.2

package/README.md

@@ -207,10 +207,18 @@ email.
 formulas and workflow's conditions, with the same functions. `where` and a
 computed column are the same language.
 
-**What `today()` means comes from the run's context**, not from the action:
-`context.formula` carries `today` and `fiscalYearStart`, so a workspace that
+**What "today" means comes from the run's context**, not from the action:
+`system.formula` carries `today` and `fiscalYearStart`, so a workspace that
 reckons days elsewhere and a run replayed from history agree on what
-`yesterday()` filtered. The action never calls `new Date()`.
+`ytd()` filtered. The action never calls `new Date()`.
+
+> `today()` and `yesterday()` are **not yet functions of
+> `@xeplr/expression-handler`**: a formula using them is refused, naming the
+> function. The example above shows where they will go.
+
+**It is called like every other action**: `execute({ input, system })`.
+Before 1.4.2 it took `(input, context)`, so through `runAction` (and so in
+every workflow step) `from` was undefined and the step returned no rows.
 
 **Only visible columns are rendered.** A column kept for the next step but
 marked `hidden` stays in `rows` and never reaches the table — an id the flow
@@ -470,6 +478,10 @@ await driver.query(pool, userSql, params)          // reads only
 | The system mail sender refuses `text`, `bcc`, `from`, `replyTo` rather than dropping them. | A silently lost bcc is a compliance problem found a year later. |
 | `email-send` returns both `accepted` and `rejected`. | SMTP accepts per recipient; a "success" can drop half of them. |
 
+## Dev-only overrides
+
+`package.json` overrides `@azure/msal-node` to `^7.1.0` for this repo's own install. `mssql` (a dev dependency here, for the SQL Server driver tests) pulls it in through `tedious` → `@azure/identity`, which still asks for `^6` — and every 6.x has GHSA-xcx6-jx8p-x3h5 (high). Overrides apply only to this repo's own install; an app using `@xeplr/actions` resolves its own `mssql` and should add the same override until `@azure/identity` moves to msal-node 7. Remove it once it does.
+
 ## Tests
 
 There is no `npm test` script. The tests use `node:test`; run a file directly:

package/lib/builtins/data-operation.js

@@ -109,7 +109,12 @@ module.exports = {
     { name: 'text', type: 'string', description: 'The same, as plain text, for a mail client that refuses HTML.' }
   ],
 
-  execute: async function(input, context) {
+  // The same call every action gets from runAction: { input, system }. It
+  // once took (input, context) — the runner's object landed in `input`,
+  // `from` was undefined, and every workflow step returned no rows.
+  execute: async function(call) {
+    var input = (call && call.input) || {};
+    var system = (call && call.system) || {};
     var given = input.from;
     // A list, always — one object is a list of one, and nothing is an empty
     // list rather than an error. The step after this one should not have to
@@ -120,7 +125,7 @@ module.exports = {
 
     // The run's own context decides what today is — and therefore what
     // yesterday is. See the note at the top.
-    var ctx = (context && context.formula) || {};
+    var ctx = system.formula || {};
 
     var keep = null;
     if (input.where && String(input.where).trim()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xeplr/actions",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Named-action registry with typed inputs and safe invocation — plus built-in actions for HTTP, DB, files, email, spawn",
   "main": "index.js",
   "files": [
@@ -130,5 +130,8 @@
     "pg": "^8.0.0",
     "saxes": "^6.0.0",
     "unzipper": "^0.12.0"
+  },
+  "overrides": {
+    "@azure/msal-node": "^7.1.0"
   }
 }