v0.1.10

Take back the version number nothing was published under

Two releases were cut on top of each other without either reaching the
registry: the first tag was never published, and the second incremented
past it instead of folding the work in and moving the tag. That burns a
version number and leaves a tag pointing at something nobody can install.

The registry is at the version below this one, so 0.1.10 is the next release —
one tag, one number, for everything since.

Lint this package the way its own repository will

biome's configuration lived only at the workspace root. This package is
built from its own repository, where that file does not exist and biome
falls back to its defaults — so lint in CI has been checking a different
set of rules from lint here, and the bans this project actually cares
about were never enforced where it counts.

The config is now the package's own, and says the same thing the root one
did.

Declare what CI has to install

Each package is its own repository: pnpm install there sees only this
file, so a dependency the workspace happened to hoist locally is simply
absent in CI. --coverage needs @vitest/coverage-v8 named here, and an
optional peer a test imports has to be a devDependency as well — optional
is exactly what keeps it from being installed.

Run the gates the package already declared, and declare the missing one

Three guard-rails were configured and never reached CI:

• tsconfig.json includes tests, but CI typechecked only
  tsconfig.build.json — every type a test relied on went unchecked.
• coverage was measured and reported, with no thresholds at all, so
  test:coverage could not fail whatever the suite stopped covering.
• lint pointed at src/ alone, so no test file was ever linted.

CI now runs pnpm typecheck, coverage, and a lint covering tests/.
The thresholds are a floor set just under what the suite covers today.

Refuse to mount an unauthenticated admin in production

With no working auth binding, every /admin/* route mounted with
authorizeAction answering true unconditionally: full CRUD on every
registered resource for anyone who can reach it. The only thing standing
between that and a production deployment was a console.warn.

It now refuses to start, unless station.requireAuth: false says the
deployment meant it — which is the same bet bay makes about a Redis
without LMOVE: losing a job, or opening an admin, is a choice a
deployment makes, not one a missing binding makes for it. Written down IS
the asking; defaulted is not, because defaulted means nobody decided.

NODE_ENV is read through the aliases people actually set: prod in a
Dockerfile answers "not production" verbatim, which would have taken the
guard back off. And the warning names production when the opt-out was
used — agreeing once in a config file is not the same as being reminded,
in the logs of an incident, that this is how the process was running.

Also drops a stale comment in the form view claiming CSRF enforcement was
still outstanding. It is not: all six write routes — create, update, the
_method router, destroy, login and logout — fail closed on
ctx.request.csrfProtected before any auth or DB work.

Reformat what the strictness pass reflowed

Two files-worth of blank lines and one long call the formatter wraps
differently now that a helper sits above them. CI resolves biome from a
caret range and installs a newer one than the lockfile pins.

Release 0.1.11

Turn on noUncheckedIndexedAccess

It was not missing here — it was explicitly false, in sixteen of the
seventeen tsconfigs. eon alone had it on, which is why nobody had seen
what it finds.

It stays a named deviation from upstream: @adonisjs/tsconfig sets
strictNullChecks and noImplicitAny but not this one. We keep it because
turning it on is what caught an as asserting a possibly-absent regex
group was a known value — the exact shape the flag exists to find. Doing
better than upstream is kept and written down, not reverted to parity.

Every site is restated rather than silenced: no !, no cast, no ?? 0
standing in for a branch that cannot happen. A reversed copy read by
value where an index walked a callback list backwards, the winner of a
scan kept as the value it found rather than its position, destructuring
where a length check was doing the proving, and an explicit break where a
loop condition already bounds the read.

Release 0.1.10

Say what container.make() returns for the tokens this package binds

ream declares ContainerBindings open on purpose: it registers its own
entries and expects each package to contribute the ones it owns — its
comment on the interface names auth (warden), logger (spectrum) and db
(atlas) as exactly this. None of them did, and every other package that
binds a string token was in the same state, so container.make('cache'),
make('mail'), make('hash') and the rest all answered unknown and
every call site had to assert a type it could not prove.

Loaded from the barrel AND from the provider, the second of which is where
AdonisJS puts its own (providers/redis_provider.ts carries the
declare module for redis, database_provider.ts for lucid.db).

Verified live rather than assumed: a declare module naming a specifier
that does not resolve is silently inert, so renaming the member has to
break the compile. It does.

Turn on noUnusedLocals/noUnusedParameters

---

Changes since v0.1.9.