apcore-cli 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to apcore-cli (TypeScript SDK) will be documented in this fi
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0] - 2026-05-18
+
+### Changed — BREAKING
+
+- **Removed graceful dynamic-import fallback for `apcore-toolkit` in `applyToolkitIntegration` (resolves 6.2).** `package.json` already declares `apcore-toolkit>=0.7.0` as a required peer dependency, but `main.ts:792-801` used a `try { await import("apcore-toolkit") } catch { logWarn(...); return }` pattern — self-contradiction between manifest and runtime behaviour. The fallback is gone; `BindingLoader` and `DisplayResolver` are now statically imported at the top of `main.ts`. A missing toolkit installation now fails at module load time with `ERR_MODULE_NOT_FOUND`, matching the peer-dep contract. `loadBindingDisplayOverlay` no longer takes a `toolkit: Record<string, unknown>` parameter (signature simplified).
+- **CLI-internal `Registry`, `Executor`, and `ModuleDescriptor` interfaces now match apcore-js >= 0.22.0 exactly (resolves "D9-W2 Known gap" in `src/cli.ts`).** Embedders may now pass an `apcore-js` `Registry` / `Executor` instance — and the `ModuleDescriptor` objects those instances return — directly to `createCli()` with no adapter or field remapping. Four surfaces aligned:
+  - **`Executor.execute(moduleId, input)` → `Executor.call(moduleId, input)`**. `execute` is removed entirely; `call` is the single required invocation method.
+  - **`Registry.listModules() → ModuleDescriptor[]` → `Registry.list() → string[]`**. `list()` returns module IDs only (matches apcore-js semantics). A new exported helper `listAllDefinitions(registry: Registry): ModuleDescriptor[]` performs the `list() + getDefinition()` iteration for call sites that need full descriptors.
+  - **`Registry.getModule(moduleId)` → `Registry.getDefinition(moduleId)`** (rename only — semantics identical).
+  - **`ModuleDescriptor.id: string` → `ModuleDescriptor.moduleId: string`**; **`ModuleDescriptor.name: string` → `ModuleDescriptor.name: string | null`** (matches apcore-js `name` nullability). All internal accesses (`approval`, `display-helpers`, `discovery`, `main`, `output`) updated. The generic `sortModulesByUsage<T>` helper in `system-usage.ts` accepts any of `{ moduleId, id, module_id }` for forward/backward compatibility with snake_case audit payloads.
+- **CLI JSON output preserves the `id` field name** for backward compatibility with downstream scripts (jq pipelines, log parsers). The output boundary in `output.ts` maps `descriptor.moduleId` → JSON `id` explicitly; emitted JSON shape is unchanged from 0.9.x.
+- **Migration for embedders** who provided custom Registry / Executor / ModuleDescriptor shims to `createCli()`:
+  ```ts
+  // Before (0.9.x):
+  const registry = { listModules: () => mods, getModule: (id) => mods.find(m => m.id === id) ?? null };
+  const executor = { execute: (id, input) => myInvoke(id, input) };
+  const mod = { id: "math.add", name: "math.add", description: "Add" };
+  // After (0.10.0):
+  const registry = { list: () => mods.map(m => m.moduleId), getDefinition: (id) => mods.find(m => m.moduleId === id) ?? null };
+  const executor = { call: (id, input) => myInvoke(id, input) };
+  const mod = { moduleId: "math.add", name: "math.add", description: "Add" };
+  ```
+  Embedders using apcore-js's own `Registry` / `Executor` (the common case via `APCore` client) need no code change — those instances and their descriptors already satisfy the new shim shape verbatim.
+
+## [0.9.1] - 2026-05-13
+
+### Fixed
+
+- **Pre-execute schema validation missing in `buildModuleCommand`** — before calling `executor.execute()`, the CLI now validates the merged input against the module's JSON Schema (required fields + scalar types). Previously, a missing required field (e.g. `--url` not supplied) propagated as `undefined` into the executor and produced an opaque `TypeError`. Now exits 45 with a human-readable message (`Validation failed: 'url' is required`) matching Python's `jsonschema.validate` and Rust's `validate_against_schema` pre-execute behaviour. Validation is skipped in `--dry-run` mode (executor preflight handles that path). `src/main.ts:177-208` (`validateInputSchema`), call site `src/main.ts:1127-1133`.
+- **`SchemaValidationError` emitted `"code":"UNKNOWN"` in JSON error output** — `emitErrorJson` reads `err.code` to populate the `"code"` field; `SchemaValidationError` had no `.code` property, so exit-45 validation errors always emitted `"code":"UNKNOWN"`. Added `readonly code = "SCHEMA_VALIDATION_ERROR"` to the class. `src/errors.ts:52`.
+
+### Changed
+
+- **Step comment numbering in `buildModuleCommand` action handler corrected** — inserting the schema-validation step left two "3." labels in the try block. Renumbered: 3 = schema validation, 4 = check approval, 5 = execute, 6 = format, 7 = audit. `src/main.ts`.
+
+### Tests
+
+- Renamed test 4 in the pre-execute schema-validation suite from `"exits 45 with type error message when field has wrong type"` (which actually tested the required-field path) to `"exits 45 when required field is missing (integer schema)"`.
+- Added test 5: `"exits 45 with type-mismatch message when integer field receives string via --input"` — supplies `{"count":"not-a-number"}` via `--input <file>` to exercise the scalar type-check branch (`validateInputSchema` lines 198-206) that had zero coverage.
+
+---
+
 ## [0.9.0] - 2026-05-13
 
 ### Fixed (2026-05-13 — cross-SDK audit D10/D11/D1)