pipework 0.118.0 → 0.120.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.120.0
+
+- **Added: `surface.http({ onInternalError })`** (#609). An HTTP surface now takes the same `onInternalError` hook as `ServerConfig` (#584), so `alerts.requestFaults(handle)` works for surface-built apps, `pipework serve` included. It runs for each internal 5xx under `surface.start` and `.test()` alike; before, the surface dropped it.
+
+## 0.119.0
+
+- **Fixed: a test-harness savepoint could reset a tenant it did not set** (#605). On release, a `pipe.transaction` savepoint under the vitest harness put back every setting that differed from its start, including one sent on the shared test connection by another task while it was open. So a `withFlow({ tenant })` that ran while an earlier task held a savepoint lost `pipework.tenant_id` (read as `''`, refusing RLS writes) when that savepoint released. A release now puts back only the settings and role changed by statements sent from inside its own block. Test-only; requests and jobs were not affected.
+
 ## 0.118.0
 
 - **Added: `awsCredentials()`, the default AWS credential provider** (#604). Environment keys (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`), re-read on every call; else the ECS task role through the container credentials endpoint (`AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`, or `_FULL_URI` with `AWS_CONTAINER_AUTHORIZATION_TOKEN[_FILE]`); else EC2 instance metadata (IMDSv2; `AWS_EC2_METADATA_DISABLED=true` skips it). Endpoint credentials are cached until five minutes before `Expiration`, concurrent calls share one fetch, and a failed refresh keeps serving unexpired credentials. Every fetch has a timeout. Nothing found throws an error listing each source looked at; a configured container endpoint that fails is an error, not a fall-through. Profiles and SSO are not read.

package/REFERENCE.md

@@ -678,6 +678,8 @@ Surface namespace — declarative entry points that define how the app runs (HTT
 
 Creates an HTTP surface — a Fastify server with routes, middleware, and production validation. Returns an HttpSurfaceBuilder with a .test() method for inject()-based integration tests.
 
+It accepts `onInternalError` (and so `alerts.requestFaults(...)`) as `ServerConfig` does; it runs for each internal 5xx under `.test()` and `start` alike.
+
 ### `surface.worker`
 
 Creates a worker surface — a long-running process that claims and executes jobs from queues.
@@ -1517,7 +1519,7 @@ Pass in `sources`; each raises with a fixed key on a tick and, where it can tell
 
 `table` is the jobs table, default `pipework_jobs`. A custom source is `{ name, evaluate(): Promise<{ key, severity, message, subject? }[]>, owns?(key) }`; with `owns`, an open alert it owns that `evaluate` no longer returns is resolved.
 
-`alerts.requestFaults(handle, { owner?, runbook?, severity? = 'error' })` returns a hook for the HTTP server's `onInternalError`: each internal 5xx raises `request-fault:<METHOD> <route pattern>` with message `<METHOD> <route>: <error message>`, context `{ method, route, requestId, traceId, message }` and the request's tenant as subject; repeats on one route group into one alert. Pass it as `createServer(m, { onInternalError: alerts.requestFaults(ops, { owner: 'platform' }) })`.
+`alerts.requestFaults(handle, { owner?, runbook?, severity? = 'error' })` returns a hook for the HTTP server's `onInternalError`: each internal 5xx raises `request-fault:<METHOD> <route pattern>` with message `<METHOD> <route>: <error message>`, context `{ method, route, requestId, traceId, message }` and the request's tenant as subject; repeats on one route group into one alert. Pass it as `createServer(m, { onInternalError: alerts.requestFaults(ops, { owner: 'platform' }) })` or `surface.http({ onInternalError: ... })`.
 
 ```ts
 const sink = alerts.webhook({ url: process.env.OPS_HOOK!, secret: process.env.OPS_SECRET! })