Skip to content

merge dev to main (v3.4.2)#2431

Merged
ymc9 merged 3 commits intomainfrom
dev
Mar 2, 2026
Merged

merge dev to main (v3.4.2)#2431
ymc9 merged 3 commits intomainfrom
dev

Conversation

@ymc9
Copy link
Member

@ymc9 ymc9 commented Mar 2, 2026

Summary by CodeRabbit

  • Chores

    • Version bumped to 3.4.2 across packages.
    • Build config updated to silence a specific compiler warning.
  • New Features

    • Optional flag to skip validation of computed fields during client initialization.
    • CLI proxy now exposes a public app with API and schema endpoints (improved request handling).
  • Tests

    • Added end-to-end tests validating proxy endpoints, schema exposure, computed-field behavior, and transactions.

jiashengguo and others added 2 commits March 1, 2026 20:13
Co-authored-by: ymc9 <104139426+ymc9@users.noreply.github.com>
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 2, 2026

📝 Walkthrough

Walkthrough

This PR bumps package versions to 3.4.2 across the monorepo, adds a CLI proxy app factory and import.meta.url compatibility handling, silences an esbuild warning, introduces a client option to skip computed-field validation, and adds proxy tests. (50 words)

Changes

Cohort / File(s) Summary
Version bumps
package.json, packages/auth-adapters/better-auth/package.json, packages/cli/package.json, packages/clients/client-helpers/package.json, packages/clients/tanstack-query/package.json, packages/common-helpers/package.json, packages/config/eslint-config/package.json, packages/config/typescript-config/package.json, packages/config/vitest-config/package.json, packages/create-zenstack/package.json, packages/ide/vscode/package.json, packages/language/package.json, packages/orm/package.json, packages/plugins/policy/package.json, packages/schema/package.json, packages/sdk/package.json, packages/server/package.json, packages/testtools/package.json, packages/zod/package.json, samples/orm/package.json, tests/e2e/package.json, tests/regression/package.json, tests/runtimes/bun/package.json, tests/runtimes/edge-runtime/package.json
Updated version from 3.4.13.4.2 across packages.
CLI proxy & build config
packages/cli/src/actions/proxy.ts, packages/cli/tsup.config.ts
Adds createProxyApp(client, schema) export; prefers __filename with fallback to import.meta.url for file URLs; passes fileUrl to Jiti; adds esbuildOptions to silence 'empty-import-meta' warning.
ORM computed-field validation option
packages/orm/src/client/options.ts, packages/orm/src/client/client-impl.ts
Adds skipValidationForComputedFields?: boolean to ClientOptions and conditions validateComputedFieldsConfig() to skip when skipValidationForComputedFields is truthy on root-client initialization.
Tests
packages/cli/test/proxy.test.ts
Adds integration tests for the CLI proxy app: schema endpoint, omission of computed fields when configured, and sequential transaction handling.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Poem

🐰 I hopped through version trees today,
Bumped to three-dot-four-dot-two in play.
I stitched a proxy, quieted a build,
Told computed checks to take a chill.
Frolics, bugs — I nibble them away! 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'merge dev to main (v3.4.2)' accurately reflects the main objective of the PR, which is a version release merge with multiple package version bumps to 3.4.2 and accompanying feature additions.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch dev

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@claude
Copy link
Contributor

claude bot commented Mar 2, 2026

Claude finished @ymc9's task —— View job


PR Review: v3.4.2 Release (dev → main)

Review Tasks:

  • Read and analyze key code changes
  • Review version consistency across packages
  • Check code quality and best practices
  • Identify potential bugs or issues
  • Assess performance considerations
  • Review security concerns
  • Evaluate test coverage needs

📋 Summary

This is a clean patch release (3.4.1 → 3.4.2) containing primarily a studio/proxy server fix with consistent version bumps across all 28 packages. The changes align well with semantic versioning practices.

🔍 Detailed Analysis

Code Quality & Best Practices ✅

Strong Points:

  • Consistent version management: All packages properly updated to 3.4.2
  • Proper TypeScript types: New skipValidationForComputedFields?: boolean option properly typed in packages/orm/src/client/options.ts:210
  • Clean conditional logic: Client validation skip implemented correctly in packages/orm/src/client/client-impl.ts:78
  • Backward compatibility: New option is optional with sensible defaults

Code Quality:

  • Clear documentation for new option: "Whether to skip validation for computed fields"
  • Proper placement of the option in the ClientOptions interface
  • No breaking changes introduced

Bug Analysis & Potential Issues 🟡

Fixed Issues:

  • ✅ Runtime compatibility: Fixed import.meta.url vs __filename compatibility for CommonJS/ESM environments in packages/cli/src/actions/proxy.ts:72
  • ✅ Build warnings: Added esbuild log override to silence 'empty-import-meta' warnings in packages/cli/tsup.config.ts:13-17

Potential Concerns:

  • ⚠️ Missing validation: skipValidationForComputedFields: true is hardcoded in proxy server (packages/cli/src/actions/proxy.ts:97) without user control
  • ⚠️ Configuration exposure: Consider whether proxy users should have control over this validation setting

Performance Considerations ✅

Positive Impact:

  • Skipping computed field validation in proxy server reduces validation overhead
  • No performance regressions introduced
  • Build configuration optimizations (log override) reduce build noise

Security Concerns ✅

Assessment:

  • ✅ No security risks: Changes are related to validation behavior and build configuration
  • ✅ No credential exposure: Database URL redaction still properly implemented (packages/cli/src/actions/proxy.ts:127-141)
  • ✅ Input validation: The skip is specifically for computed fields, not user inputs

Test Coverage Needs 🟡

Missing Coverage:

  • ⚠️ New option testing: skipValidationForComputedFields option should have unit tests
  • ⚠️ Proxy behavior testing: Verify proxy server works correctly with validation skipped
  • ⚠️ Runtime compatibility: Test both CommonJS and ESM environments with the fileUrl fix

🎯 Recommendations

1. Consider Configuration Enhancement

// Could allow proxy users to control this setting
type Options = {
    // ... existing options
    skipComputedFieldValidation?: boolean; // Allow users to override
};

2. Add Tests

Consider adding tests for:

  • Client behavior with skipValidationForComputedFields: true
  • Proxy server startup with computed fields present
  • Runtime compatibility across environments

3. Documentation

Consider updating documentation to explain when skipValidationForComputedFields should be used.

✅ Approval Summary

Overall Assessment: APPROVED

This is a well-executed patch release that:

  • ✅ Addresses a specific studio/proxy issue appropriately
  • ✅ Maintains backward compatibility
  • ✅ Follows semantic versioning correctly
  • ✅ Contains no security issues
  • ✅ Has consistent version management across all packages

The changes are minimal, focused, and solve the reported issue without introducing breaking changes. The runtime compatibility fix is particularly good defensive programming.

Minor suggestions above are enhancements, not blockers.


Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
packages/orm/src/client/options.ts (1)

207-210: New option is useful and backward-compatible.

Nice additive change. Consider marking this as internal (or explicitly documenting “default: false” and intended callers) to avoid accidental long-term public API commitment if this flag is primarily for tooling flows.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/orm/src/client/options.ts` around lines 207 - 210, The new optional
flag skipValidationForComputedFields should be marked as internal or clearly
documented with its default and intended callers; update the JSDoc for the
skipValidationForComputedFields property (in options.ts) to either add an
`@internal` tag or expand the comment to explicitly state "default: false" and
that it is intended for tooling/internal flows only so consumers don't treat it
as a long-term public API.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Line 5: The packageManager entry in package.json is pinned to pnpm@10.23.0 but
the repo requires pnpm@10.12.1; update the "packageManager" field value to
"pnpm@10.12.1" in package.json (edit the packageManager property) so the
declared pnpm version matches the required one and ensures reproducible
installs.

---

Nitpick comments:
In `@packages/orm/src/client/options.ts`:
- Around line 207-210: The new optional flag skipValidationForComputedFields
should be marked as internal or clearly documented with its default and intended
callers; update the JSDoc for the skipValidationForComputedFields property (in
options.ts) to either add an `@internal` tag or expand the comment to explicitly
state "default: false" and that it is intended for tooling/internal flows only
so consumers don't treat it as a long-term public API.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c521123 and f58550e.

📒 Files selected for processing (28)
  • package.json
  • packages/auth-adapters/better-auth/package.json
  • packages/cli/package.json
  • packages/cli/src/actions/proxy.ts
  • packages/cli/tsup.config.ts
  • packages/clients/client-helpers/package.json
  • packages/clients/tanstack-query/package.json
  • packages/common-helpers/package.json
  • packages/config/eslint-config/package.json
  • packages/config/typescript-config/package.json
  • packages/config/vitest-config/package.json
  • packages/create-zenstack/package.json
  • packages/ide/vscode/package.json
  • packages/language/package.json
  • packages/orm/package.json
  • packages/orm/src/client/client-impl.ts
  • packages/orm/src/client/options.ts
  • packages/plugins/policy/package.json
  • packages/schema/package.json
  • packages/sdk/package.json
  • packages/server/package.json
  • packages/testtools/package.json
  • packages/zod/package.json
  • samples/orm/package.json
  • tests/e2e/package.json
  • tests/regression/package.json
  • tests/runtimes/bun/package.json
  • tests/runtimes/edge-runtime/package.json

"version": "3.4.1",
"version": "3.4.2",
"description": "ZenStack",
"packageManager": "pnpm@10.23.0",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Check the actual packageManager field in package.json
echo "Current packageManager value in package.json:"
grep -n '"packageManager"' package.json || echo "Not found"

echo ""
echo "Full package.json for context:"
head -20 package.json

Repository: zenstackhq/zenstack

Length of output: 1141


Pin packageManager to the required pnpm version.

The repository requires pnpm@10.12.1 per coding guidelines, but package.json specifies pnpm@10.23.0. This mismatch can reduce reproducibility between environments.

Proposed fix
-    "packageManager": "pnpm@10.23.0",
+    "packageManager": "pnpm@10.12.1",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"packageManager": "pnpm@10.23.0",
"packageManager": "pnpm@10.12.1",
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` at line 5, The packageManager entry in package.json is pinned
to pnpm@10.23.0 but the repo requires pnpm@10.12.1; update the "packageManager"
field value to "pnpm@10.12.1" in package.json (edit the packageManager property)
so the declared pnpm version matches the required one and ensures reproducible
installs.

@claude
Copy link
Contributor

claude bot commented Mar 2, 2026

Claude finished @ymc9's task —— View job


PR Review: v3.4.2 Release (dev → main)

Review Tasks:

  • Read and analyze key code changes
  • Review version consistency across packages
  • Check code quality and best practices
  • Identify potential bugs or issues
  • Assess performance considerations
  • Review security concerns
  • Evaluate test coverage needs

📋 Summary

This is a clean patch release (3.4.1 → 3.4.2) containing primarily a studio/proxy server fix with consistent version bumps across all 28 packages. The changes align well with semantic versioning practices.

🔍 Detailed Analysis

Code Quality & Best Practices ✅

Strong Points:

  • Consistent version management: All packages properly updated to 3.4.2
  • Proper TypeScript types: New skipValidationForComputedFields?: boolean option properly typed in packages/orm/src/client/options.ts:210
  • Clean conditional logic: Client validation skip implemented correctly in packages/orm/src/client/client-impl.ts:78
  • Backward compatibility: New option is optional with sensible defaults

Code Quality:

  • Clear documentation for new option: "Whether to skip validation for computed fields"
  • Proper placement of the option in the ClientOptions interface
  • No breaking changes introduced

Bug Analysis & Potential Issues 🟡

Fixed Issues:

  • ✅ Runtime compatibility: Fixed import.meta.url vs __filename compatibility for CommonJS/ESM environments in packages/cli/src/actions/proxy.ts:72
  • ✅ Build warnings: Added esbuild log override to silence 'empty-import-meta' warnings in packages/cli/tsup.config.ts:13-17

Potential Concerns:

  • ⚠️ Missing validation: skipValidationForComputedFields: true is hardcoded in proxy server (packages/cli/src/actions/proxy.ts:97) without user control
  • ⚠️ Configuration exposure: Consider whether proxy users should have control over this validation setting

Performance Considerations ✅

Positive Impact:

  • Skipping computed field validation in proxy server reduces validation overhead
  • No performance regressions introduced
  • Build configuration optimizations (log override) reduce build noise

Security Concerns ✅

Assessment:

  • ✅ No security risks: Changes are related to validation behavior and build configuration
  • ✅ No credential exposure: Database URL redaction still properly implemented (packages/cli/src/actions/proxy.ts:127-141)
  • ✅ Input validation: The skip is specifically for computed fields, not user inputs

Test Coverage Needs 🟡

Missing Coverage:

  • ⚠️ New option testing: skipValidationForComputedFields option should have unit tests
  • ⚠️ Proxy behavior testing: Verify proxy server works correctly with validation skipped
  • ⚠️ Runtime compatibility: Test both CommonJS and ESM environments with the fileUrl fix

🎯 Recommendations

1. Consider Configuration Enhancement

// Could allow proxy users to control this setting
type Options = {
    // ... existing options
    skipComputedFieldValidation?: boolean; // Allow users to override
};

2. Add Tests

Consider adding tests for:

  • Client behavior with skipValidationForComputedFields: true
  • Proxy server startup with computed fields present
  • Runtime compatibility across environments

3. Documentation

Consider updating documentation to explain when skipValidationForComputedFields should be used.

✅ Approval Summary

Overall Assessment: APPROVED

This is a well-executed patch release that:

  • ✅ Addresses a specific studio/proxy issue appropriately
  • ✅ Maintains backward compatibility
  • ✅ Follows semantic versioning correctly
  • ✅ Contains no security issues
  • ✅ Has consistent version management across all packages

The changes are minimal, focused, and solve the reported issue without introducing breaking changes. The runtime compatibility fix is particularly good defensive programming.

Minor suggestions above are enhancements, not blockers.


Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/cli/test/proxy.test.ts`:
- Around line 7-18: The teardown only closes the HTTP server (variable server)
but doesn't disconnect test client instances created with createTestClient(...),
which leaks DB handles; declare and use a clients array alongside server (e.g.,
let clients: typeof someClient[] = []) and after each createTestClient(...) call
add the returned client to clients (clients.push(client)), then update
afterEach() to first iterate clients and call a proper disconnection method on
each client (e.g., client.disconnect() or client.close()) and clear the clients
array before/after closing server to ensure all test clients are torn down.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f58550e and 4629810.

📒 Files selected for processing (2)
  • packages/cli/src/actions/proxy.ts
  • packages/cli/test/proxy.test.ts

Comment on lines +7 to +18
let server: http.Server | undefined;

afterEach(async () => {
await new Promise<void>((resolve) => {
if (server) {
server.close(() => resolve());
server = undefined;
} else {
resolve();
}
});
});
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Close test clients in teardown to avoid leaked DB handles.

afterEach closes only the HTTP server. The createTestClient(...) instances should also be disconnected to avoid lingering connections across tests.

Suggested fix
 describe('CLI proxy tests', () => {
     let server: http.Server | undefined;
+    const clients: Array<{ $disconnect: () => Promise<void> }> = [];

     afterEach(async () => {
         await new Promise<void>((resolve) => {
             if (server) {
                 server.close(() => resolve());
                 server = undefined;
             } else {
                 resolve();
             }
         });
+        await Promise.allSettled(clients.map((c) => c.$disconnect()));
+        clients.length = 0;
     });
-        const client = await createTestClient(zmodel);
+        const client = await createTestClient(zmodel);
+        clients.push(client);

(Apply the clients.push(client) addition in each test right after createTestClient(...).)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@packages/cli/test/proxy.test.ts` around lines 7 - 18, The teardown only
closes the HTTP server (variable server) but doesn't disconnect test client
instances created with createTestClient(...), which leaks DB handles; declare
and use a clients array alongside server (e.g., let clients: typeof someClient[]
= []) and after each createTestClient(...) call add the returned client to
clients (clients.push(client)), then update afterEach() to first iterate clients
and call a proper disconnection method on each client (e.g., client.disconnect()
or client.close()) and clear the clients array before/after closing server to
ensure all test clients are torn down.

@ymc9 ymc9 merged commit 02b0dcc into main Mar 2, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants