octwin-cli 0.8.5 → 0.8.7

package/CHANGELOG.md

@@ -5,6 +5,68 @@ Format: [Keep a Changelog](https://keepachangelog.com/) — newest first, bucket
 **Added · Changed · Deprecated · Removed · Fixed · Security**. The platform-wide view lives in the
 repo root [`CHANGELOG.md`](../../CHANGELOG.md); this file is the CLI-only cut that ships with the package.
 
+## [0.8.7] - 2026-09-06
+
+### Added
+- **`validate` now reads a map's KEYS, not only its values.** The declaration walker reported four
+  things — an unknown key, a missing `required` key, a wrong scalar type, a value outside a closed
+  `enum` — and every one of them is about a VALUE. But a map's keys carry meaning in several
+  declarations (`roles.yaml` grant resources and verbs, `xrm.yaml` entity names), and those keys had
+  no check at all. Rule 5 replays `propertyNames` — both the `enum` and the `pattern` form.
+
+  This is why publishing the RBAC vocabulary was worth doing. A pack author wrote `case:` where the
+  grant key is `record.case`, passed offline `validate` clean, and learned the truth one bad guess at
+  a time from `--remote` round-trips. They gave up on custom RBAC over it. The check now says
+  `not a valid key here — must be one of "record.case", …` before a deploy is attempted.
+
+  It stays inside the file's false-positive rule because it is a **faithful replay**: the same `enum`
+  membership and the same JS regex engine Zod itself runs, over a pattern the platform generated. A
+  pattern this engine cannot compile is treated like a combinator — walk away, do not guess.
+
+  Verified 2026-09-06 against the shipped binary: across all 23 marketplace packs rule 5 reports
+  **nothing**, with 10 of the 12 pulled declaration schemas carrying `propertyNames` (so the silence
+  is a result, not an unexercised branch). A deliberately broken key is caught on both branches — a
+  role named `Regional-Agent` against `^[a-z][a-z0-9_]*$`, and a grant key `case:` against an enum
+  vocabulary — each naming the file, the path and the rule it broke.
+
+### Fixed
+- **`deploy` had stopped printing its seed counts entirely.** `printDeploySuccess` read
+  `r.summary.records` / `.updated` / `.images` / `.rules` / `.failed`, but the deploy route's
+  `summary` is a run-log **string** (`"clinic v1.2.0 — {…}"`), not an object. So every field was
+  `undefined`, `parts` stayed empty, and the `if (parts.length)` guard turned *"I am reading the
+  wrong field"* into *"there was nothing to say"* — the block printed nothing and looked like a
+  deploy that simply seeded no rows. The counts have been on `r.seeded`, keyed by seed kind, and
+  `printSeedCounts` already renders them (filtering zeros, which is what makes a partial seed
+  legible). The dead block is gone and `printSeedCounts` is called instead.
+
+  Same shape as the bug 0.8.6 fixed in `validate`: *no data* and *no problem* rendering identically.
+  Two independent places in this CLI reached it within one week.
+
+## [0.8.6] - 2026-09-04
+
+### Changed
+- **`validate` can no longer print a `✓` for a check that did not run.** Each of the eight
+  checks now RETURNS an `Outcome` — `passed`, `findings`, or `not-run` — and a single printer
+  renders all of them, groups the skips by reason, and computes the exit code. Previously each
+  check printed its own `✓` inside the `if` that held its data, with a `skipped[]` array and a
+  `skipReasons` Map maintained alongside; it was correct because someone was careful, and the
+  next check added was one `if` away from lying again.
+
+  It had lied twice, in the same shape: the KB-dependent block once printed ONE `✓` above six
+  checks whose own `✓`s lived inside their `if`s (so a run with no pulled KB read as "one check,
+  passed", and an entire backlog batch reached production that way), and `yamlDocs()` once
+  dropped an unparseable file so `validate` printed all-green over a pack the platform's importer
+  then refused. **An unparseable file is not "no findings", it is "no idea", and those must never
+  print the same** — a check that returns nothing now cannot reach the `passed` branch at all.
+
+  Output is unchanged for a normal run. `passed` carries its own line, so the reserved-entity
+  check keeps the narrower wording it uses when the catalog rules are absent from an older pull.
+  `--require-kb` is now one line over the returned skip list.
+
+  Verified 2026-09-04: all 23 marketplace packs exit 0 with no findings; a pack with no pulled KB
+  prints zero `✓` for the six KB-dependent checks plus one grouped ⚠ naming all six, and
+  `--require-kb` exits 1; a duplicate YAML key still exits 1 naming the file.
+
 ## [0.8.5] - 2026-09-02
 
 ### Added