Release 0.9.4 · consetto/calmcp

Tasks and task comments for calm_create, display ids for calm_update, and the node-forge advisory fixed.

Features

calm_create creates tasks: project tasks (CALMTASK), user stories (CALMUS), sub-tasks (CALMST), requirements (CALMREQU), defects (CALMDEF) and risks (CALMRISK), with description, priority, assignee, dates, sprint, classification and the other fields of the Tasks API. Rules the spec states only in prose are checked before anything is sent: a sub-task needs parentId and carries no effort, risk fields apply to risks only, a classification and its sub-classifications must fit the task type, test classifications apply to user stories and requirements. Roadmap tasks, quality gates and checklist items are not created; they come from templates and the project setup. Needs calm-api.tasks.write (#41).
calm_create adds comments to tasks (task_comment), including defects and user stories. The task itself is left as it is (#41).
calm_create answers briefly: the new uuid (tasks and comments: id), the displayId and each field it set as Cloud ALM stored it, instead of the whole entity (about 70 fields for a task). A field stored with another value than was sent is listed in storedDiffersFromSent. calm_get returns the whole entity (#43, #49).
calm_update takes a display id (e.g. 6-132) as well as the uuid. A display id that matches no feature, or more than one, is refused (#42).

node-forge 1.4.2 fixes GHSA-86w9-cpqp-85rv (high), reached through the SAP Cloud SDK's keystore reader. The CI exception from 0.9.3 is removed (#47, #48).

Dependencies updated (#45, #46).
Tested against a Cloud ALM tenant: all six task types created and read back, every refused combination refused before sending with nothing created, task comments, feature update by display id and uuid, unknown and quoted display ids refused, audit log entries; the integration suite passes against the same tenant.