Boundra v0.6.0

Boundra v0.6.0

Release Summary

Boundra v0.6.0 adds manifest-backed nested domain discovery and extends boundary
analysis to understand local aliases declared in the root package.json#imports
field.

Teams can now organize domains below grouping directories such as
domains/commerce/order without changing the domain's manifest identity.
Boundary checks, generation, dependency updates, graphing, and coverage reporting
all use the discovered physical domain root.

Highlights

• Recursively discovers the configured domain manifest below paths.domains.
• Keeps the manifest name as the stable domain identity across directory moves.
• Adds create-domain <name> --path <parent-path> for nested scaffolding.
• Rejects duplicate manifest names with deterministic root information.
• Uses discovered roots for BR-001 through BR-006, generation, dependency updates,
  and analyzed-domain coverage.
• Supports exact and single-wildcard local string mappings from root
  package.json#imports.
• Prevents exact aliases from matching similarly prefixed imports accidentally.
• Rejects local package alias targets that escape the workspace.
• Rejects symlinked child paths during nested domain creation while allowing the
  configured paths.domains root itself to resolve canonically.

Installation

Install or update Boundra on Node.js 20 or later:

pnpm add boundra@0.6.0 zod
pnpm exec boundra check-boundaries

Create a nested domain:

pnpm exec boundra create-domain order --path commerce

The native CLI can also be installed from the tagged Rust source:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.6.0 boundra-cli

Breaking Changes

Directories directly below paths.domains are no longer treated as domains when
they do not contain the configured manifest file. Domain discovery is now
manifest-backed at every nesting depth.

To migrate an implicit domain, add the configured manifest file to its root and
ensure its name matches the leaf directory name. Existing manifest-backed flat
domains continue to work unchanged.

Known Limitations

• Conditional objects and arrays in package.json#imports remain owned by the
  Node.js runtime and are not resolved by the current static analyzer.
• Alias resolution validates Boundra architecture boundaries but does not prove
  that a deployment platform includes raw source files in its server artifact.
  Server deployments should retain an artifact-level smoke test.
• The manifest name must match the leaf domain directory name; grouping
  directories are organizational and do not become part of domain identity.

Verification

• Rust workspace tests and Clippy with warnings treated as errors
• nested flat/mixed/custom-manifest domain discovery fixtures
• duplicate identity and unsafe path regression tests
• BR-004 and BR-005 checks against discovered nested roots
• exact, wildcard, conditional, prefix-overmatch, and escaping package alias fixtures
• TypeScript workspace and example type checks
• runtime, config, UI, Vite, and clean-room package tests
• Node.js 20, 22, and 24 runtime verification
• Linux x64, macOS x64/arm64, and Windows x64 native CLI release builds
• boundary-analysis benchmark smoke verification

Boundra v0.5.0

Boundra v0.5.0

Release Summary

Boundra v0.5.0 introduces a typed configuration authoring surface for TypeScript applications while keeping the native CLI configuration model deterministic and runtime-independent.

The new boundra/config export provides BoundraConfig and defineConfig(), giving editors and TypeScript projects a public, package-backed source of truth for the configuration fields currently supported by Boundra's Rust project model.

This release intentionally keeps native config discovery on boundra.config.json. The TypeScript helper is an authoring and inference surface rather than a new executable configuration format, so the CLI does not need to start a Node.js runtime to load project configuration.

Highlights

• Added the public boundra/config package subpath.
• Added the BoundraConfig TypeScript type for currently supported project configuration.
• Added defineConfig() for typed configuration authoring with literal inference preserved.
• Added typed configuration for project roots, workspace paths, domain public APIs, boundary scan extensions, ignore paths, capability classification, and shared-layer capability policy.
• Kept unsupported or not-yet-consumed configuration fields out of the public TypeScript contract so editor support matches actual CLI behavior.
• Added dedicated config type and runtime tests.
• Extended clean-room package verification to install the packed npm tarball and import defineConfig from boundra/config.
• Added configuration authoring documentation and updated package and architecture documentation.

Installation

Install or update Boundra on Node.js 20 or later:

pnpm add boundra@0.5.0 zod
pnpm exec boundra check-boundaries

TypeScript applications can import the new configuration authoring surface:

import { defineConfig, type BoundraConfig } from "boundra/config";

const config = defineConfig({
  paths: {
    apps: "apps",
    domains: "domains",
    packages: "packages",
    crates: "crates",
  },
  checkBoundaries: {
    capabilities: {
      external: {
        react: ["ui"],
        "node:*": ["runtime"],
      },
      packages: {
        db: ["database"],
      },
      apps: ["runtime"],
    },
    policy: {
      shared: {
        denyCapabilities: ["ui", "database", "runtime"],
      },
    },
  },
});

const typedConfig: BoundraConfig = config;

The native CLI continues to discover project configuration from boundra.config.json.

The native CLI can also be installed from the tagged Rust source:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.5.0 boundra-cli

Breaking Changes

None.

Existing boundra.config.json files, CLI commands, Vite integration, runtime APIs, error-view APIs, boundary diagnostics, and default BR-003 behavior remain compatible.

Known Limitations

• boundra.config.ts is not a native CLI configuration format in this release. The CLI continues to load boundra.config.json.
• defineConfig() is an identity helper for TypeScript authoring and inference; filesystem-aware and project-aware validation remains owned by the native CLI.
• The public BoundraConfig type intentionally covers only configuration fields currently consumed by the Rust project model. Future configuration features will be added as their runtime behavior becomes supported.
• The TypeScript config surface does not change the native CLI's runtime requirements and does not cause the CLI to execute user TypeScript or JavaScript during configuration loading.

Verification

• TypeScript workspace and example type checks
• dedicated boundra/config type and runtime verification
• clean-room npm tarball installation with boundra/config named-export verification
• Rust workspace tests and Clippy with warnings treated as errors
• runtime, UI, and Vite tests
• configurable BR-003 integration tests and parser correctness corpus
• npm package build and pack verification
• Node.js 20, 22, and 24 runtime verification
• Linux x64, macOS x64/arm64, and Windows x64 native CLI release builds
• boundary-analysis benchmark smoke verification

Boundra v0.4.0

Boundra v0.4.0

Release Summary

Boundra v0.4.0 makes development diagnostics reusable beyond the built-in Vite integration while improving the accuracy and configurability of domain boundary enforcement.

The development error view is now available through the framework-neutral boundra/ui export, so Next.js and other browser hosts can render the same normalized runtime and boundary diagnostics without depending on the Vite adapter.

This release also replaces BR-003's stack-specific dependency checks with a configurable capability policy while preserving the previous behavior by default, and adds a fixture-driven parser correctness suite to reduce both false positives and missed imports.

Highlights

• Added a reusable browser development error view through boundra/ui.
• Reused the same diagnostic renderer across the Vite adapter and custom browser integrations.
• Added APIs to report, replace, clear, and dispose runtime and boundary diagnostics.
• Added optional editor navigation for hosts outside the Vite integration.
• Made BR-003 capability classification configurable for external dependencies, workspace packages, and application paths.
• Added configurable shared-layer denied capabilities while keeping the existing UI, database, and runtime restrictions as defaults.
• Improved Svelte import scanning by preserving script blocks while masking markup.
• Improved detection of multiple require() and dynamic import() calls on the same line.
• Reduced parser false positives around comments, strings, method-like calls, non-literal imports, escaped paths, and UTF-8 source text.
• Added a fixture-driven parser correctness corpus that validates exact source file, line, and import-path results.

Installation

Install or update Boundra on Node.js 20 or later:

pnpm add boundra@0.4.0 zod
pnpm exec boundra check-boundaries

Vite applications can continue using the existing integration:

import { boundra } from "boundra/vite";
import { defineConfig } from "vite";

export default defineConfig({
  plugins: [boundra()],
});

Next.js and other browser hosts can create the development error view directly:

import { createBoundraErrorView } from "boundra/ui";

const view = createBoundraErrorView();
view.reportRuntime(error.toJSON());

The native CLI can also be installed from the tagged Rust source:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.4.0 boundra-cli

Breaking Changes

None.

Existing Vite integration, runtime error JSON, CLI commands, boundary diagnostic output, and default BR-003 behavior remain compatible. Projects that do not configure checkBoundaries.capabilities or checkBoundaries.policy continue to use the previous built-in classifications.

Known Limitations

• Automatic capture of unhandled browser BoundraRuntimeError values is currently provided by the Vite adapter. Other browser hosts must explicitly forward normalized diagnostics to boundra/ui.
• Next.js integrations must keep the error view in a Client Component and should pass only normalized error.toJSON() data across server/client boundaries.
• Automatic editor navigation is configured by the Vite development server. Other hosts must provide their own openInEditor callback.
• The error view intentionally renders only normalized diagnostic fields and does not expose raw contract inputs, results, schema-provider errors, or causes.
• The parser correctness corpus covers Boundra's supported import-extraction surface, but broader differential validation against a full AST parser remains future work.

Verification

• Rust workspace tests and Clippy with warnings treated as errors
• parser correctness corpus and configurable BR-003 integration tests
• TypeScript workspace and example type checks
• runtime, UI, and Vite tests
• clean-room package verification including the boundra/ui export
• npm package build and pack verification
• Node.js 20, 22, and 24 runtime verification
• Linux x64, macOS x64/arm64, and Windows x64 native CLI release builds

Boundra v0.3.0

Boundra v0.3.0

Release Summary

Boundra v0.3.0 expands the Vite development error view so contract validation failures and domain boundary violations can be investigated from a single interface. The previous first-error-only limitation is removed, and normalized safe diagnostics can now be explored and copied for application debugging and issue reporting.

Highlights

• Displays all runtime validation issues and boundary violations as navigable lists.
• Adds separate Runtime and Boundaries tabs while keeping the state of each diagnostic source independent.
• Shows contract, validation phase, issue code, field path, file, line, and import details.
• Copies a text report containing only normalized safe diagnostic fields to the clipboard.
• Opens files referenced by boundary diagnostics in the editor through the Vite development server.
• Supports Escape dismissal, keyboard focus, mobile layouts, and reduced-motion preferences.

Installation

Install or update on Node.js 20 or later:

pnpm add boundra@0.3.0 zod
pnpm exec boundra check-boundaries

Enable the development error view in a Vite application:

import { boundra } from "boundra/vite";

export default {
  plugins: [boundra()],
};

Native archives and Rust source installation are also supported:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.3.0 boundra-cli

Breaking Changes

None. Existing runtime error JSON, Vite plugin configuration, boundary JSON output, and CLI interfaces remain compatible.

Known Limitations

• The development error view is currently limited to the Vite development server; a Next.js adapter is not provided in this release.
• Runtime errors whose lifecycle cannot be determined automatically must be dismissed manually with the close button or Escape. Boundary diagnostics are removed automatically after a clean re-check.
• The error view captures unhandled BoundraRuntimeError values. Errors handled by the application must be surfaced by the application itself.
• Editor navigation requires the Vite development server and a local editor integration.
• Original contract inputs and results, schema-provider error objects, and causes are never displayed or copied in order to protect private or secret data.

Verification

• Node.js 20, 22, and 24 runtime builds and runtime tests
• Vite plugin injection and full issue/violation safe-summary tests
• TypeScript workspace type checking and runtime package build
• full Rust workspace tests and Clippy with -D warnings
• packed npm runtime and native CLI clean-room verification
• Linux x64, macOS x64/arm64, and Windows x64 release workflow

Boundra v0.2.2

Boundra v0.2.2

Release Summary

Boundra v0.2.2 is a patch release that fixes integration issues in boundary checks, code generation, and HTTP error handling discovered while dogfooding a real single-app repository. Generated contracts no longer conflict with the default boundary rules, and applications can handle scan coverage and transport failures more safely and structurally.

Highlights

• Prevents generated shared-contract imports of boundra and the schema provider from being incorrectly reported as BR-003 when paths.apps is ..
• Adds scanned_file_count and analyzed_domain_count to check-boundaries --format json.
• Adds text-output warnings when zero source files or zero domains are analyzed.
• Makes query, mutation, and resource generators export client adapters into client/public.ts idempotently.
• Rolls back generated files, manifest changes, and barrel updates if public API updates fail.
• Preserves non-2xx responses as BoundraHttpError with status, a safe header allowlist, and a bounded response body.

Installation

Install or update on Node.js 20 or later:

pnpm add boundra@0.2.2 zod
pnpm exec boundra check-boundaries

Native archives and Rust source installation are also supported:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.2.2 boundra-cli

Breaking Changes

None. Existing contract, transport, generator command, and boundary JSON fields remain compatible; this release only adds coverage metadata and structured HTTP error information.

Known Limitations

• analyzed_domain_count counts domains that contain source files included in the configured scan; it does not represent runtime usage or graph connectivity.
• HTTP error bodies are preserved up to 64 KiB by default and truncated beyond that limit.
• BoundraHttpError.headers exposes only content-type, retry-after, etag, x-request-id, and x-correlation-id.
• On first npm CLI execution without a cache, GitHub Release access and Unix tar or Windows PowerShell are required.

Verification

• full Rust workspace tests and Clippy with -D warnings
• BR-003 root-app regression and real domain-scan coverage tests
• generator client-barrel idempotency, rollback, and retry tests
• TypeScript type checking and structured HTTP error runtime tests
• Vite integration and example boundary checks
• packed npm runtime and native CLI clean-room verification
• Linux x64, macOS x64/arm64, and Windows x64 release workflow

Boundra v0.2.1

Boundra v0.2.1

Release Summary

Boundra v0.2.1 is a patch release driven by dogfooding in a real Presence application, improving request cancellation and reducing structural friction for small domains. Per-call cancellation signals now reach user-defined transports, while domains with only one public API layer can use a more compact root layout without giving up boundary protection.

Highlights

• Adds optional BoundraCallOptions to query and mutation calls.
• Propagates AbortSignal through custom transports and the HTTP transport's fetch call.
• Preserves explicitly cancelled requests instead of converting them into RUNTIME-003.
• Allows domains with exactly one public API layer to place public.ts and implementation files directly at the domain root.
• Applies the same client/server/shared boundary rules to root files in the compact layout.
• Generated query, mutation, and resource client adapters now forward per-call options.

Installation

Install or update on Node.js 20 or later:

pnpm add boundra@0.2.1 zod
pnpm exec boundra check-boundaries

Native archives and Rust source installation are also supported:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.2.1 boundra-cli

Breaking Changes

None. Existing two-argument query/mutation calls and the standard client, server, and shared directory layout remain supported.

Known Limitations

• The compact layout is available only when exactly one of the manifest's client, server, or shared public APIs is non-empty.
• Compact-layer inference applies only to files directly under the domain root. Tests should remain under tests/, and adding a second runtime layer requires migration to explicit layer directories.
• Code generation continues to produce the standard shared/contracts and layer-specific public API layout.
• On first npm CLI execution without a cache, GitHub Release access and Unix tar or Windows PowerShell are required.

Verification

• full Rust workspace tests and compact-layout boundary regression tests
• TypeScript type checking and runtime contract tests
• custom and HTTP transport cancellation propagation tests
• generated query, mutation, and resource adapter tests
• Svelte Vite integration and example boundary checks
• packed npm runtime and native CLI clean-room verification
• Linux x64, macOS x64/arm64, and Windows x64 release build workflow

Boundra v0.2.0

Boundra v0.2.0

Release Summary

Boundra v0.2.0 is a public preview focused on treating framework-specific workspace layouts and the real domain dependency graph as part of the same architecture contract. Boundary rules now behave consistently across custom paths such as SvelteKit projects, while Boundra also catches drift between cross-domain imports in source code and dependsOn declarations in domain manifests.

Highlights

• Applies paths.apps, paths.domains, and paths.packages consistently across boundary decisions.
• Includes .svelte files in the default scan and re-runs boundary diagnostics on Vite source updates.
• Resolves relative-path tsconfig extends chains, JSONC, baseUrl, and child alias overrides.
• Adds BR-006 to block cross-domain public API imports that are not declared in the source domain manifest.
• Rejects cyclic domain dependencies during project loading and add-dependency.

Installation

Install or update on Node.js 20 or later:

pnpm add boundra@0.2.0 zod
pnpm exec boundra check-boundaries

Native archives and Rust source installation are also supported:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.2.0 boundra-cli

Breaking Changes

• A source domain importing another domain's public API must declare the target domain in dependsOn. Missing declarations now produce BR-006.
• Cyclic dependsOn graphs are treated as project configuration errors and the CLI exits with code 2.

Existing cross-domain imports can be declared explicitly with:

pnpm exec boundra add-dependency <source-domain>/<target-domain>

Known Limitations

• Boundra does not yet resolve package-name-based tsconfig extends; those remain owned by the TypeScript toolchain. Only relative-path extends are supported.
• The Vite integration still performs a full boundary scan on each source update and does not yet use an incremental cache.
• On first npm CLI execution without a cache, GitHub Release access and Unix tar or Windows PowerShell are required.

Verification

• 74 Rust workspace tests
• TypeScript type checking and runtime contract tests
• Svelte Vite hot-update integration tests
• configured framework-path and extended-tsconfig fixtures
• BR-001 through BR-006 and dependency-cycle regression tests
• packed npm runtime and native CLI clean-room verification
• Linux x64, macOS x64/arm64, and Windows x64 release build workflow

Boundra v0.1.2

Boundra v0.1.2

Release Summary

Boundra v0.1.2 strengthens the public preview after the first external CRUD dogfooding exposed gaps in installation, boundary enforcement, runtime errors, repetitive code, and performance measurement. The boundra npm package now supports both the runtime and native CLI flow, from project initialization through Vite development diagnostics.

Highlights

• Adds non-destructive workspace initialization through pnpm exec boundra init.
• Adds an npm CLI launcher that downloads the platform-specific Rust binary, verifies its SHA-256 checksum, and runs it from a versioned user cache.
• Adds BR-005 to block imports from apps/** that bypass a domain public API and reach domain-internal paths.
• Extends BoundraRuntimeError with field paths, provider-neutral validation issues, and a safe toJSON() representation.
• Adds boundra/vite to surface runtime contract and boundary errors in a development overlay.
• Adds createHttpTransport and generate resource to reduce HTTP and CRUD contract boilerplate.
• Adds 1,000/10,000-source-file benchmarks and a CI smoke gate to track CLI performance regressions.

Installation

Install on Node.js 20 or later:

pnpm add boundra@0.1.2 zod
pnpm exec boundra init --name my-app
pnpm exec boundra create-domain tasks
pnpm exec boundra generate resource tasks/task
pnpm exec boundra check-boundaries

Native archives and Rust source installation remain supported:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.1.2 boundra-cli

Breaking Changes

None. This is an additive release compatible with the v0.1.1 runtime and existing route/query/mutation contract APIs.

Known Limitations

• On first npm CLI execution without a cache, GitHub Release access and Unix tar or Windows PowerShell are required. Controlled or offline environments can use BOUNDRA_CLI_PATH.
• The Vite integration still performs a full boundary scan on each source update and does not yet use an incremental cache.
• Domain field schemas generated by generate resource start as safe empty objects and must be completed by the application.
• createHttpTransport provides the protocol client only; the server router adapter remains the responsibility of the application or framework integration.

Verification

• Node.js 20, 22, and 24 runtime CI
• Linux x64, macOS x64/arm64, Windows x64 CLI and npm launcher CI
• 59 Rust tests plus runtime, Vite integration, and generated example execution
• packed boundra@0.1.2 online/offline clean-room installation and TypeScript type checking
• BR-001 through BR-005 boundary and domain graph verification
• 1,000-file benchmark CI gate and 10,000-file local baseline
• npm OIDC trusted publishing and GitHub Release SHA-256 artifact pipeline

Boundra v0.1.1

Boundra v0.1.1

Release Summary

Boundra v0.1.1 is the first usable public preview. TypeScript applications can use the schema-backed runtime from the boundra npm package, while the Rust-based CLI handles domain creation, contract code generation, boundary checks, and dependency graph inspection.

Highlights

• Statically analyzes client/server/shared/cross-domain boundaries through BR-001 to BR-004.
• Provides create-domain, add-dependency, generate route/query/mutation, check-boundaries, and graph-domains CLI workflows.
• Generated contracts validate inputs and results at runtime through Zod schemas and the boundra runtime.
• Diagnostics include stable error codes, file and line context, fix suggestions, and JSON output.
• Verifies the npm runtime and native CLI artifacts for Linux, macOS Intel/Apple Silicon, and Windows through clean-room and platform CI.

Installation

Install the TypeScript runtime and schema authoring dependency:

pnpm add boundra@0.1.1 zod

The CLI can be installed from the platform archive attached to this GitHub Release or directly from the Rust source:

cargo install --git https://github.com/qtaghdi/boundra --tag v0.1.1 boundra-cli

Verify the installation with:

boundra --version
boundra --help

Breaking Changes

• The accidentally published boundra@0.1.0 package is not supported.
• Import boundra instead of the pre-release @boundra/runtime path used by earlier documentation and generated code.

Known Limitations

• The npm package provides the TypeScript runtime but does not yet bundle native CLI binaries.
• Generated Zod schemas start as safe empty objects and must be filled with the application's real domain fields.
• A boundra init command for bootstrapping an empty project is not available yet.

Verification

• Node.js 20, 22, and 24 runtime CI
• Linux x64, macOS x64/arm64, and Windows x64 CLI builds and tests
• 52 Rust tests plus runtime and example execution
• clean-room installation and TypeScript type checking of packed boundra@0.1.1
• BR-001 through BR-004 boundary checks and domain graph verification
• npm publish dry-run and SHA-256 checksum release pipeline verification