Skip to content

NetScript 0.0.8-canary.3

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Oct 14:39
· 206 commits to main since this release
v0.0.8-canary.3
2845f29

NetScript 0.0.8-canary.3

What this canary is for. canary.3 is the third release candidate on the way to NetScript 0.0.8. It bundles the 61 pull requests merged since canary.2 so downstream apps can try them against real published packages before 0.0.8 ships. It is a pre-release: normal semver resolution never selects it, and Latest stays v0.0.7. All 35 @netscript/* packages are published at exactly 0.0.8-canary.3, and the canary's publish run and its version-pinned production E2E both passed (publish, production E2E).

Highlights

  • Durable commands, end to end. A PostgreSQL command store with a true transaction client (#2093), a durable outbox relayed through checked sinks (#2096), bounded command tracing with privacy conformance (#2094), and sagas that commit typed worker effects atomically with their state transitions (#2097). Sagas also persist .compensate() outcomes with a terminal compensated status (#2139).
  • Secure-by-default services and auth. Services must declare their auth policy (#2220) and their CORS origins (#2193). Signout is owner-scoped (#2177), auth cookies are stricter and propagate on REST and RPC (#2189), trusted-proxy policy is unified (#2188), and services gain internal-audience procedures and a file-reference service credential (#2166).
  • Plugins compose safely. Root composition rejects identity collisions, unknown contribution keys and missing dependencies (#2125); plugin host ports survive re-installs (#2175).
  • Fresh, SDK and desktop fixes reported by downstream apps. One TanStack DB Collection runtime across Fresh and the SDK (#2089), pure typed route href helpers that no longer hide hooks (#2090), desktop RPC reconnects after a document reload (#2091), complete native chat messages (#2092), an injectable resolveServiceUrl (#2183), and query factories that keep required context (#2209).
  • AI. Explicitly configured Anthropic model IDs, including Claude Opus 5.5, Sonnet 5.5 and Fable 5.1, with current wire options (#2078), on a peer-compatible TanStack AI family (#2087, #2126).
  • Workers, queue and KV. Job cancellation and deadlines (#2088, documented in #2204), trace context forwarded into queue subprocesses (#2136), named queues isolated within one Deno KV database (#2140), and memory/Redis KV adapters conformant on atomic versionstamps (#2135).
  • CLI and Aspire. Generated resources resolve multi-namespace clients (#2171), remote Docker daemon topology is diagnosed (#2173), the Garnet executable gets an allocated port (#2199), and the MCP server ranks guidance by content (#2124) and warns on unknown plugin registry expectations (#2216).

Breaking changes and migration

  • Explicit CORS (#2193). Services no longer default to wildcard CORS. Set NETSCRIPT_CORS_ORIGINS='https://app.example,https://admin.example' for services and plugins, or pass cors: { origin: [...] } to defineService / createPluginService (.withCors({ origin: [...] }) on builders). Unset origins deny cross-origin browser calls, and wildcard plus credentials fails build(). Generated CLI/Aspire helpers inject your enabled web apps' origins, so scaffolded projects keep working.
  • Explicit service auth policy (#2220). defineService() no longer treats a missing policy as public. Pass auth: { authn: { authenticator }, authz: { authorizer } } (authorization is optional). For a genuinely public service, pass auth: { public: true, reason: '…' } with a non-blank reason. The service README and CHANGELOG show the before and after.
  • Owner-scoped signout (#2177). Anonymous signout returns 401, sessionId must be one of the caller's own sessions, and everywhere revokes all of the caller's sessions. Revoking another user's session needs revokeSession with auth:sessions:revoke. Custom AuthSessionStorePort, KvOAuthStore and BetterAuthInstance implementations each gain one method; see the auth docs callout "Breaking in 0.0.8: migrating signout callers". plugin auth session list now needs a credential.
  • Validated plugin composition (#2125). Unknown contribution keys fail, every declared plugin dependency must be composed, and @netscript/plugin-triggers no longer declares pseudo-dependencies on the *-core libraries. Migration notes are in the plugin README and reference page.
  • Stricter auth cookies (#2189). HttpOnly=false and insecure custom-name cookies are refused outside an explicit development policy, and KvOAuthCookieOptions.httpOnly is typed true.

Known open follow-ups

  • Scaffolded auth wiring. service add does not yet wire the authenticator automatically when the auth plugin is installed (#1382, in review), and the scaffolded browser-to-backend auth topology is queued for canary.4 (#1386).
  • Callback session credential. Its removal from the public callback JSON is queued for canary.4 (#1385).
  • Downstream-reported fixes. Qualification against these published packages is in progress, and the issues close as each one is proven: #2039, #2040, #2041, #2068, #2066, #2036.
  • Saga process-restart and ordering proof. Queued for canary.4 (#1826).

Trying this canary

Pin exact versions, for example jsr:@netscript/service@0.0.8-canary.3. Deno 2.9 applies a default 24-hour minimum dependency age, so a canary less than a day old will not resolve until that window passes. For testing before then, set minimumDependencyAge: 0 in the consumer's configuration; that changes only admission timing, not versions. The generated list below includes partial-scope PRs as "closes no linked issues": they reference their issues without closing them, and the remaining scope stays tracked there.

Canary payload derived from merge-aware history after 6d1eaf5a221ce29fa55c0bfd10e3b5c7d66101e3 (61 commit(s) inspected; outcome: populated).

Included pull requests

  • #2092 fix(fresh): preserve complete native chat messages in send — closes no linked issues
  • #2078 fix(ai): support explicit Anthropic model IDs and current wire options — closes no linked issues
  • #2091 fix(desktop): reconnect native RPC after document reload — closes no linked issues
  • #2088 fix(workers): propagate job cancellation and deadlines — closes no linked issues
  • #2090 fix(fresh): keep typed route URL helpers pure — closes no linked issues
  • #2093 feat(database): PostgreSQL command store and true transaction client — closes #1484
  • #2089 fix(fresh/sdk): qualify one TanStack DB Collection runtime — closes no linked issues
  • #2087 fix(ai): keep published adapters peer-compatible with AI core — closes no linked issues
  • #2096 feat(command): relay durable outbox through checked sinks — closes #1486
  • #2094 feat(telemetry): add bounded command tracing and privacy conformance — closes #1485
  • #2097 feat(sagas): commit typed worker effects atomically with transitions — closes #1932
  • #2126 fix(ai): realign TanStack AI family to a peer-compatible set — closes no linked issues
  • #2122 fix(logger): request-scoped correlation and configurable RPC debug redaction — closes #1786, #2107
  • #2116 feat(service): add a middleware slot and an opt-in request-body limit to defineService — closes #2065
  • #2121 test(cli-e2e): assert exact HTTP status in scaffold runtime gates — closes no linked issues
  • #2119 fix(auth): accept empty OpenAPI GET input for auth me — closes #1999
  • #2131 docs(sdk): align cache-first loaders on action-then-metadata and document warm-stale persistence failure — closes #1670
  • #2123 fix(sdk): let native oRPC safe/isDefinedError narrow on createServiceClient errors — closes #2031
  • #2169 fix(docs): derive the @app/router.ts README fence stub from the scaffold template — closes #1939
  • #2135 fix(kv): conform memory and Redis adapters on atomic versionstamps, combine ops and watch — closes #2099, #2101
  • #2137 fix(service): declared fail-closed raw-route seam for createContractAuthorizer — closes #2105
  • #2136 fix(workers): forward correlation and trace context into queue task subprocess env — closes #1681
  • #2133 fix(auth): derive a stable non-OIDC subject from provider userinfo — closes #2032
  • #2124 fix(mcp): rank find_guidance on content terms with IDF weighting — closes #2102
  • #2127 fix(fresh-ui): open Dialog, Sheet and Drawer modally via showModal() — closes #1688
  • #2129 fix(tooling): apply aspire loopback-URL rule to plugin runtime source — closes #1893
  • #2130 fix(cli): report contract service-directory state truthfully — closes #2013
  • #2178 fix(auth): resolve bearer credentials in me like /session — closes #2120
  • #2192 ci(e2e): key scaffold runtime tiers per PR instead of a repo-wide mutex — closes no linked issues
  • #2167 fix(workers): emit one canonical WORKERS_CONCURRENCY env name — closes no linked issues
  • #2198 test(sagas): prove sample publish failure and HTTP idempotency — closes #1826
  • #2140 fix(queue): isolate named queues sharing one Deno KV database — closes #1682
  • #2183 feat(sdk): injectable resolveServiceUrl on createServiceClient; export the pure discovery resolver — closes #2018
  • #2196 fix(auth): omit GitHub preset OIDC issuer — closes #2164
  • #2189 fix(auth): propagate backend cookies on REST and RPC — closes no linked issues
  • #2166 feat(service): internal-audience procedures and a file-reference service credential — closes no linked issues
  • #2141 fix(sagas): actionable no-endpoint rejection diagnostic — closes #1825
  • #2193 fix(service): require explicit CORS and inject workspace app origins — closes no linked issues
  • #2195 ci(tooling): shard check-test and cache dependencies — closes no linked issues
  • #2117 fix(cli): prove guarded plugin services in scaffold.runtime and document plugin API protection — closes #1383
  • #2211 test(queue): make named isolation delivery deterministic — closes #2210
  • #2188 fix(auth): unify trusted proxy transport policy — closes no linked issues
  • #2186 ci(e2e): diagnose startup and pre-pull runtime images — closes no linked issues
  • #2139 fix(sagas): persist .compensate() outcomes and add terminal compensated status — closes #1990
  • #2182 docs(jsdoc): bind every name in published examples and enforce unbound names — closes #1765
  • #2199 fix(aspire): allocate Garnet executable endpoint port — closes no linked issues
  • #2163 fix(database): classify PostgreSQL command errors by SQLSTATE — closes #2095
  • #2197 docs(sdk): emphasize discriminant error narrowing — closes #1690
  • #2175 fix(cli): preserve plugin HostPort across re-installs and document plugin port pinning — closes #2028
  • #2171 fix(cli): resolve generate resource procedures against the client, support multi-namespace clients — closes #2030
  • #2205 docs(workers): describe implemented runner modes — closes no linked issues
  • #2204 docs(workers): document JobContext cancellation and deadlines — closes no linked issues
  • #2177 fix(auth)!: enforce signout session ownership, subject-scoped everywhere and scoped operator revocation — closes no linked issues
  • #2173 fix(cli): diagnose remote Docker daemon topology for Aspire AppHosts — closes #2024
  • #2220 fix(service): require explicit auth policy in defineService — closes no linked issues
  • #2134 fix(mcp): clear private-type-ref errors across the export map — closes #1708
  • #2128 test(contracts): harden the baseContract initializer pin — closes #1767
  • #2125 feat(plugin): validate root composition collisions and dependency closure — closes #1896
  • #2216 fix(mcp): warn on unknown plugin registry expectations — closes no linked issues
  • #2209 fix(sdk): preserve required context in query factories — closes #2111
  • #2236 docs(ai): state the published version without a stale package pin — closes no linked issues
Assets 2
Loading