stkit 17.2.3__tar.gz → 17.2.4__tar.gz

{stkit-17.2.3 → stkit-17.2.4}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v17.2.4 (2026-10-31)
+
+No migration required.
+
+- Notifications are opt-in, like uploads and MCP: add `stk.notification` to the app's extensions for the `/api/notifications` routes and the layout's bell. From 17.2.0 to 17.2.3 stk registered those routes in every app, and because the first matching route answers, an app's own `/api/notifications` was silently never reached. `notify()` still stores rows without it (Background Work).
+- `stk verify` fails when two endpoints register the same path and method, naming both, so a shadowed route can no longer ship silently.
+- Apps made by `stk init`, and the example app, list `stk.notification`.
+
+### Upgrade considerations
+
+- An app that uses stk's bell adds `import stk.notification` and puts `stk.notification` in its `extensions` list, or the bell disappears and `/api/notifications` returns 404.
+
 ## v17.2.3 (2026-10-31)
 
 Run `uv run stk db upgrade`.

{stkit-17.2.3 → stkit-17.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.2.3
+Version: 17.2.4
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk

{stkit-17.2.3 → stkit-17.2.4}/examples/minimal/minimal/app.py

@@ -1,9 +1,10 @@
+import stk.notification
 from stk import Stk
 
 from minimal import note
 from minimal.settings import Config
 
 # Each extension is a package with init_app(app); order is precedence.
-extensions = [note]
+extensions = [stk.notification, note]
 
 app = Stk(__name__, config=Config, extensions=extensions)

{stkit-17.2.3 → stkit-17.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.2.3"
+version = "17.2.4"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}

{stkit-17.2.3 → stkit-17.2.4}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.2.3"
+__version__ = "17.2.4"
 
 
 def __getattr__(name):

{stkit-17.2.3 → stkit-17.2.4}/stk/app.py

@@ -27,7 +27,6 @@ from werkzeug.security import safe_join
 import stk.extensions as ext
 from stk.agent_login import agent_login_enabled, bp_agent_login
 from stk.extensions import session
-from stk.notification.views import bp_notification
 from stk.portal.views import portal
 from stk.public.views import public
 from stk.settings import Config
@@ -206,7 +205,6 @@ def register_blueprints(app):
     app.register_blueprint(bp_user)
     app.register_blueprint(public)
     app.register_blueprint(portal)
-    app.register_blueprint(bp_notification)
     app.register_blueprint(ws_bp)
     if agent_login_enabled(app):
         app.register_blueprint(bp_agent_login)

{stkit-17.2.3 → stkit-17.2.4}/stk/checks.py

@@ -295,6 +295,28 @@ def check_admin_reset_route(app):
     )
 
 
+@check("No route is registered twice")
+def check_unique_routes(app):
+    # Werkzeug answers with the first matching rule, so an app route that repeats
+    # a core one (or another extension's) is never reached, with no error at all.
+    owners = {}
+    for rule in app.url_map.iter_rules():
+        # stk's own blueprints share /static on purpose: one folder, one answer.
+        if rule.endpoint == "static" or rule.endpoint.endswith(".static"):
+            continue
+        for method in rule.methods - {"HEAD", "OPTIONS"}:
+            owners.setdefault((method, rule.rule), []).append(rule.endpoint)
+    clashes = [
+        f"{method} {path}: {' and '.join(endpoints)}"
+        for (method, path), endpoints in sorted(owners.items())
+        if len(endpoints) > 1
+    ]
+    assert not clashes, (
+        "only the first endpoint ever answers; rename one route or drop the"
+        " extension that adds it:\n    " + "\n    ".join(clashes)
+    )
+
+
 @check("GET / answers 200, after any redirects")
 async def check_http_index(app):
     # An app may send / to its sign-in or home page; what it lands on must work.

{stkit-17.2.3 → stkit-17.2.4}/stk/notification/__init__.py

@@ -1,4 +1,8 @@
-"""Stored, per-user notifications. The row is the truth; the socket push is a nudge."""
+"""Stored, per-user notifications. The row is the truth; the socket push is a nudge.
+
+Opt in with `extensions=[stk.notification, ...]` for the `/api/notifications`
+routes and the layout's bell; `notify()` stores rows either way.
+"""
 
 import stk.extensions as ext
 from stk.notification.models import Notification
@@ -27,3 +31,11 @@ async def notify(user_id, title, link=None, kind=None, body=None):
         await db.commit()
     await broadcast({"type": "notification", **row.to_dict()}, user_id)
     return row
+
+
+def init_app(app):
+    from stk.notification.views import bp_notification
+
+    app.extensions["stk.notification"] = True
+    app.jinja_env.globals["stk_notifications"] = True
+    app.register_blueprint(bp_notification)

{stkit-17.2.3 → stkit-17.2.4}/stk/scaffold/app/__app__/app.py

@@ -1,8 +1,9 @@
+import stk.notification
 from stk import Stk
 
 from __app__.settings import Config
 
 # Each extension is a package with init_app(app); order is precedence.
-extensions = []
+extensions = [stk.notification]
 
 app = Stk(__name__, config=Config, extensions=extensions)

{stkit-17.2.3 → stkit-17.2.4}/stk/templates/layout.html

@@ -48,8 +48,10 @@
             <!-- Theme Switcher -->
             <theme-switcher></theme-switcher>
 
-            <!-- Notifications -->
+            {% if stk_notifications %}
+            <!-- Notifications: only with stk.notification in the app's extensions -->
             <notification-dropdown ref="notifications"></notification-dropdown>
+            {% endif %}
 
             <!-- Connection Status -->
             <v-tooltip :text="wsConnected ? 'Real-time connected' : 'Reconnecting...'" location="bottom">

{stkit-17.2.3 → stkit-17.2.4}/tests/test_notifications.py

@@ -5,6 +5,7 @@ import unittest
 from quart_security import hash_password
 
 import stk.extensions as ext
+import stk.notification
 from stk.app import Stk
 from stk.extensions import Base
 from stk.notification import notify
@@ -14,7 +15,7 @@ from stk.user.models import User
 
 class NotificationTests(unittest.IsolatedAsyncioTestCase):
     async def asyncSetUp(self):
-        self.app = Stk(__name__, config=TestingConfig)
+        self.app = Stk(__name__, config=TestingConfig, extensions=[stk.notification])
         async with ext.engine.begin() as conn:
             await conn.run_sync(Base.metadata.create_all)
         async with ext.async_session_factory() as db:

stkit-17.2.4/tests/test_route_collisions.py

@@ -0,0 +1,41 @@
+"""An app route that repeats a core one is never reached; verify must say so."""
+
+import contextlib
+import io
+import unittest
+
+from quart import Blueprint
+
+import stk.notification
+from stk import checks
+from stk.app import Stk
+from stk.checks import check_unique_routes
+from stk.settings import TestingConfig
+
+
+class RouteCollisionTest(unittest.IsolatedAsyncioTestCase):
+    async def test_core_routes_are_unique(self):
+        app = Stk(__name__, config=TestingConfig, extensions=[stk.notification])
+        with contextlib.redirect_stdout(io.StringIO()):
+            self.assertTrue(await check_unique_routes(app))
+
+    async def test_an_app_route_shadowed_by_a_core_route_fails(self):
+        app = Stk(__name__, config=TestingConfig, extensions=[stk.notification])
+        inbox = Blueprint("inbox", __name__)
+
+        @inbox.get("/api/notifications")
+        async def own_notifications():
+            return {"items": []}
+
+        app.register_blueprint(inbox)
+        with contextlib.redirect_stdout(io.StringIO()):
+            self.assertFalse(await check_unique_routes(app))
+        detail = checks.RESULTS[-1]["detail"]
+        self.assertIn("GET /api/notifications", detail)
+        self.assertIn("inbox.own_notifications", detail)
+
+    async def test_without_stk_notification_the_app_owns_the_path(self):
+        app = Stk(__name__, config=TestingConfig)
+        rules = {r.rule for r in app.url_map.iter_rules()}
+        self.assertNotIn("/api/notifications", rules)
+        self.assertNotIn("stk_notifications", app.jinja_env.globals)

{stkit-17.2.3 → stkit-17.2.4}/tests/test_scaffolder.py

@@ -321,7 +321,7 @@ class InitAndNewTests(unittest.TestCase):
             ast.parse((self.app / "acme" / "widget" / name).read_text())
         app_module = (self.app / "acme" / "app.py").read_text()
         self.assertIn("from acme import gadget, widget", app_module)
-        self.assertIn("extensions = [widget, gadget]", app_module)
+        self.assertIn("extensions = [stk.notification, widget, gadget]", app_module)
 
     def test_new_starts_the_app_lineage_after_stk(self):
         (revision,) = (self.app / "acme" / "migrations").glob("*.py")