0.5.0

What's Changed

🤖 Skills

• /hor-graphql-server-engine covers the WebSocket server an engine mounts, for @openreachtech/renchan 2.12.0 and later:
  • composeServerHookHash() returns the graphql-ws hooks, such as onSubscribe and onConnect
  • The graphqlServer config holds skipsWebSocket and connectionInitWaitTimeout
  • An onConnect example checks the Origin of a WebSocket connection

Change Log

Full Changelog: 0.4.0...0.5.0

0.4.0

What's Changed

🤖 Skills

• /hor-oidc-sign-in is a new skill for signing in through an OpenID Connect identity provider. It covers the environment, ID token verification, the resolvers and the stored state
• /hor-restfulapi-architecture adds credential-routes.md, where each route reads its own credential, and behind-iap.md, for a server behind an identity-aware proxy. It also states the one-directory-per-server rule
• /hor-multi-llm-provider separates the access route from the provider and adds Vertex AI with a service account and Bedrock with AWS credentials
• /hor-type-interface and /hor-graphql-schema put resolver types in types/graphql.d.ts, named under one graphql. namespace root. /hor-query-resolver and /hor-mutation-resolver follow
• /hor-graphql-server-engine states the engine, Share and env rules: the engine generates nothing, a getter calls no method, and only Share imports env
• /hor-resolver-validator names validate() and validateInput() in the BaseInputValidator contract

🐘 PostgreSQL

• /hor-database-design, /hor-sequelize-migration and /hor-query-resolver state collation and case sensitivity per database, and add a lower() unique index example
• /hor-sequelize-seeder passes the quoted identifier as the sequence name
• /hor-query-resolver and /hor-renchan-job-bullmq state the Number.MAX_SAFE_INTEGER limit for an integer-like id, and job-triple.md names the BullMQ version

🐛 Bug Fixes

• The ID token and IAP verifiers require the exp, iat and sub claims, and the IAP context logs a failed verification
• The HMAC example in credential-routes.md binds the method and the path
• The rawBody capture in /hor-graphql-server-engine keeps the request Buffer
• The stand-in issuers in /hor-build-e2e-test-environment match the real ones

Change Log

Full Changelog: 0.3.0...0.4.0

0.3.0

What's Changed

🛡️ Security Audit

• /hor-security-audit divides env files into production-facing — .env, .env.production, .env.prod, .env.staging — and local. Only a production-facing file must be ignored. A tracked local file is read, with values masked, and passes when it holds only values that reach the local machine.
• An auditor that may not read env files reports check 13 as blocked, never as passed.
• Check 14 no longer reports placeholder credentials in a local middleware compose published on 127.0.0.1 only, or in a CI or test database's config.
• /hor-build-e2e-test-environment holds the same line for the E2E stack's own env file.

💪 Error Codes

• The resolver skills name /hoc-error-codes for the shape of a code and its categories, and no longer restate them.
• /hor-mutation-resolver gives a credential that does not match 202, in place of 205. /hor-query-resolver no longer carries 205.

📦️ Dependencies

overrides:

New in this version. old version is what the tree resolved to before it.

package name	old version	new version	semver	note
js-yaml under @istanbuljs/load-nyc-config	3.15.2	^4.3.2	Major	Resolves an npm audit report. Contradicts the ^3.13.1 that @istanbuljs/load-nyc-config 1.1.0 declares, so it wants revisiting at that dependant's next major

Change Log

Full Changelog: 0.2.2...0.3.0

0.2.2

What's Changed

🛡️ Security

npm audit reports nothing. The three brace-expansion advisories, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 and GHSA-6j4f-fj2g-mc7p, are closed by the raises below. Every affected copy sat in the development tree. The package declares no runtime dependency, so nothing changes in what a consumer installs.

🧪 Test Samples

The test samples in three skills no longer hand jest.fn() to the code under test. They put a real function where the value goes and observe it with jest.spyOn().

Skill	Sample
hor-agent-loop	The stubs in references/testing.md
hor-external-api-client	The fetch stub in references/testing.md. It spies the native fetch that static get fetch () returns, and the test-only sub-class is gone
hor-post-worker	The dispatchJob stub in SKILL.md

The fetch sample spies globalThis. It relies on afterEach(() => jest.restoreAllMocks()) being in place, which hoc-jest puts in setup-after-env.js. Without it, the mock leaks into the next test.

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
jest	^30.5.1	^30.5.2	Patch

overrides:

brace-expansion@1 is new in this version. old version is what the tree resolved to before.

package name	old version	new version	semver	note
brace-expansion@1	1.1.18	^1.1.21	Patch	Closes GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 and GHSA-6j4f-fj2g-mc7p. Reached through eslint → minimatch@3, whose ^1.1.7 already admits the fix
brace-expansion@5	5.0.9	^5.0.12	Patch	Closes the same advisories

Change Log

Full Changelog: 0.2.1...0.2.2

0.2.1

What's Changed

🛡️ Security

npm audit reports nothing against this version. GHSA-2883-xcg3-v3hh — high, CVSS 7.5,
CWE-400 and CWE-407: maxTotalMergeKeys does not limit CPU use for empty merge sources —
stood against both copies of js-yaml the tree carried. Both were raised to the first version
outside the affected range.

package name	old version	new version	affected range
js-yaml	4.3.1	4.3.2	>=4.0.0 <4.3.2
js-yaml, under @istanbuljs/load-nyc-config	3.15.1	3.15.2	>=3.0.0 <3.15.2

Neither copy is declared in package.json, so the advisory was closed in package-lock.json
alone. Both sit in the development tree, so nothing a consumer of this package installs ever
resolved them.

📄 Documentation

Four statements the behaviour does not match were corrected. The command itself is unchanged —
what moved is what the text claims it does, so a reader on 0.2.0 was already getting the
behaviour described below.

• uninstall removes the skills this package installed into one directory, not every skill it
  has ever installed. --dir <path> is taken by install and uninstall alike, so a repository
  that installed into two directories takes two uninstall runs, and the record file goes when the
  last of them does. Corrected in the usage text hora-skills-ort-renchan help prints, and in the
  command table and the --dir line of README.md and README.ja.md
• The installation record is named after the package without its scope —
  .hora/hora-skills-ort-renchan.json
• An installation stopped by a symbolic link says which step it stopped at, changes nothing, and
  ends with a failing exit code. The previous wording described it as an installation that carries
  nothing, which is a different run

🛡️ Supply Chain

• dependencies: is empty, and stays empty. Installing this package adds nothing to the tree it
  is installed into
• The allowScripts gate was repointed from fsevents to @parcel/watcher. Raising jest
  dropped the first out of the tree and brought the second in, so the gate now names the package
  that is actually there. The decision it records is unchanged: the install script is denied, as
  unrs-resolver's is
• That same raise moved glob's copy of brace-expansion from 2.1.4 onto the 5.0.9 floor the
  standing brace-expansion@5 override sets

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
jest	^30.4.2	^30.5.1	Minor	Swaps fsevents for @parcel/watcher in jest-haste-map

overrides:

No entry is new in this version, so old version and new version are the declared ranges rather
than what was resolved. flatted resolved to 3.4.4 before and after: the floor moved, the tree
did not.

package name	old version	new version	semver	note
flatted	^3.4.2	^3.4.4	Patch	The install for jest had already resolved 3.4.4 under the old floor. The raise records what the project builds against rather than changing anything

Change Log

Full Changelog: 0.2.0...0.2.1

0.2.0

What's Changed

• Tidy up package

Change Log

Full Changelog: 0.1.0...0.2.0

0.1.0

What's Changed

• Tidy up Hora Kit

New Contributors

• @StewEucen made their first contribution in #34

Change Log

Full Changelog: 0.0.0...0.1.0

0.0.0

What's Changed

• 📦️ Fulfill package.json by @hieuguyen-ort in #2
• Env > Main 0.0.0 by @hieuguyen-ort in #4
• 🤖 Add the backend skills migrated from hora-skills by @hieuguyen-ort in #6
• 🧵 Ignore kit/ in eslint.config.js by @hieuguyen-ort in #8
• 🏗️ Add the flatten build and the skill-name audit by @hieuguyen-ort in #10
• 🛠️ Add the equip CLI migrated from hora-skills by @hieuguyen-ort in #12
• 🏷️ Check the skill names in CI by @hieuguyen-ort in #14
• 🔗 Check the document links under kit/ by @hieuguyen-ort in #16
• 📄 Setup LICENSE as Apache-2.0 by @hieuguyen-ort in #18
• 🏷️ Rename the skill prefix to hor- by @hieuguyen-ort in #25
• 📦️ Rename the package to hora-skills-ort-renchan by @hieuguyen-ort in #27
• 📄 Add README by @hieuguyen-ort in #20
• [major] Release 0.0.0 by @hieuguyen-ort in #29

New Contributors

• @hieuguyen-ort made their first contribution in #2

Full Changelog: https://github.com/openreachtech/hora-skills-ort-renchan/commits/0.0.0