@zapier/kitcore 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # @zapier/kitcore
 
+## 0.15.0
+
+### Minor Changes
+
+- f0fe306: Add the API stability ladder: `PluginMeta.stability` (`"stable" | "beta" | "experimental"`) replaces the `experimental` boolean as the authored stability signal. The registry projection normalizes every entry to a concrete `FunctionRegistryEntry.stability`; the `experimental` boolean is deprecated but preserved as an input (`true` normalizes to `"experimental"`) and as a derived read (`stability === "experimental"` — literal by name; the not-stable warning duty lives in `stability` and the runtime notice). New exports: `STABILITY_LEVELS`, `STABILITY_TITLES`, `normalizeStability`, `applyStabilityLabel`, and the `StabilityLevel` type. The method boundary now reports every surface call of a beta / experimental method to `CoreOptions.logStabilityNotice` (default: once-per-process deduped `console.warn`), mirroring the deprecation signal — internal delegation never signals.
+
+## 0.14.0
+
+### Minor Changes
+
+- 5b4b976: Added an HTTP transport and a connection channel, so an SDK built on kitcore can
+  make authenticated requests without wiring a client of its own.
+
+  **Transport.** `sendHttpRequest` turns an `HttpRequest` into a native `Response`
+  through stages you wrap individually with `defineHook`: `initializeHttpRequest`,
+  then `attemptHttpRequest` around `prepareHttpRequest`, `authorizeHttpRequest`,
+  `dispatchHttpRequest`, and `receiveHttpResponse`. Skipping `next` replaces a
+  stage, which is how a proxy or a mock takes over `dispatchHttpRequest`. `fetch`
+  is the familiar `fetch(url, init)` over that pipeline and works with nothing else
+  composed; `url` takes a `string` or a `URL`.
+
+  Every stage receives `attempt.operation`, one per caller request and shared by
+  every retry of it. It carries the `operationId` and the caller's original
+  request, so a stage can still name the connection or the pre-routing url after
+  auth and routing rewrote their own copies.
+
+  **Retry, opt-in.** `retryHttpRequestPlugin` wraps `attemptHttpRequest`; nothing
+  retries by default. It honors `Retry-After` / `X-RateLimit-Reset`, falls back to
+  exponential backoff with jitter, and respects the caller's abort signal.
+  Defaults: 3 attempts, statuses 429/500/502/503/504, configurable through
+  `retryHttpRequestOptionsPluginRef`. It never resends a body that can only be
+  read once, which covers a `ReadableStream` and anything async-iterable such as
+  `fs.createReadStream(...)`, and retries 5xx only on idempotent methods. Between
+  attempts it cancels the body of the response it is dropping, so an unread one
+  does not hold its connection open.
+
+  `maxDelayMilliseconds` caps how long it will wait, and the two sources of a
+  delay are treated differently. Its own backoff is clamped to the ceiling. A
+  server directing a longer wait through `Retry-After` is a refusal, so it returns
+  that response instead of coming back sooner.
+
+  **Debugging.** Each stage is a method, so one `defineHook` observer sees all
+  seven with a name, arguments, duration, and any error, and nothing writes to a
+  console on your behalf. Pass a stage's request through `redactHttpRequest` before
+  printing it: it masks credential headers and `connection`, which is opaque to the
+  transport and may hold a credential. The url and the body are left as they are.
+
+  **Connections.** A caller passes an opaque reference, never a credential, and its
+  `<scheme>:<value>` prefix routes it to whichever provider claims that scheme.
+  `normalizeConnection` parses a reference, `defaultConnectionScheme` is where a
+  head decides what a bare one means (kitcore assigns nothing),
+  and `resolveConnectionPlugin` is the seam for discovering or defaulting one. An
+  auth wrap claims a reference by removing it from the request, and an unclaimed
+  one fails before the request is sent.
+
 ## 0.13.0
 
 ### Minor Changes