Skip to content

permitio 3.0.0: refactor SDK APIs, tests, and release validation - #134

Open
zeevmoney wants to merge 116 commits into
mainfrom
per-15318/fix-checkalltenants-request
Open

permitio 3.0.0: refactor SDK APIs, tests, and release validation#134
zeevmoney wants to merge 116 commits into
mainfrom
per-15318/fix-checkalltenants-request

Conversation

@zeevmoney

@zeevmoney zeevmoney commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

This release corrects permission-check payloads and context handling, makes SDK errors and logging safer, and moves the test suite to Vitest. It also sets the supported runtimes to Node ^22.13.0 || ^24.0.0, replaces Yarn with pinned pnpm 12.8.1, and checks authored and generated code with strict TypeScript, Oxlint and Oxfmt.

Tracking: PER-16556. This description covers the implemented changes currently pushed to this PR.

SDK behavior

  • checkAllTenants sends an authenticated POST with the permission query in the body, normalizes users/resources, merges context, and does not inject a default tenant (PER-15318).
  • bulkCheck respects each item's context, followed by method and global context, without mutating caller inputs (PER-16492).
  • PDP HTTP errors and unreadable successful responses produce PermitPDPStatusError; connection failures remain PermitConnectionError. With throwOnError: false, failed bulk checks return one denial per input and all-tenant checks return an empty list (PER-16494).
  • Constructor debug logging omits the serialized configuration. JSON and in-process pretty logging work without exposing the token or requiring a worker thread (PER-16493).
  • REST failures use named errors with detached, bounded diagnostics. SDK-owned errors and logs omit credentials, private attributes and raw socket/request objects while preserving useful failure descriptions and valid status/code metadata (PER-16544, PER-16565).
  • Native WHATWG URL handling replaces url-parse. Invalid or empty PDP URLs fail during construction; dot segments are normalized. This includes @Kyzgor's contribution from refactor(deps): replace url-parse with the native URL API (PER-16497) #122 and closes url-parser is an unnecessary dependency #106.

Runtime and dependency management

  • Node 22.13.0 and 24.0.0 are the tested support floors. The runtime range, contributor instructions, build target and CI matrix agree (PER-16557).
  • pnpm 12.8.1 uses an exact lockfile, exact direct dependency pins, strict engine checks, a 24-hour publication delay and disabled dependency lifecycle scripts.
  • Builds and hook setup are explicit. pnpm commands replace Yarn and the incompatible task sequencer; unused dependencies and obsolete scripts are removed.
  • Axios 1.20.0, lodash 4.18.1 and the logging dependency tree pass production and fresh-consumer audits with zero findings.
  • Published CommonJS/ESM entry points are preserved; the reviewed OpenAPI rebaseline changes one runtime enum name as documented below. The committed package version is now 3.0.0; npm publication remains blocked by the acceptance requirements below.

Strict tooling and declaration integrity (PER-16558)

  • TypeScript 7 checks authored and generated source with strict optional properties, indexed access, overrides and module syntax. Generated @ts-ignore suppressions are removed; normalization has syntax/configuration checks and a final compiler gate.
  • Oxlint, Oxfmt and worktree-scoped prek hooks replace ESLint, Prettier and Husky. pnpm verify runs the frozen dependency check, lint, formatting, strict types, both builds and local tests. CI runs these checks as explicit required candidate jobs, followed by packed-consumer and security gates.
  • Authored source uses ESM and absolute aliases. esbuild creates the existing CommonJS/ESM entry points; TypeScript emits declarations and a checked AST pass resolves aliases to portable package paths. A private TypeScript 6 workspace supplies the compiler API used by TypeDoc and AST tooling.
  • Two missing resource-instance bulk models and five existing model exports now complete the generated bulk declarations. They come from the existing pinned schema, and a strict consumer regression catches missing exports.
  • Empty condition-set-rule creation responses produce a clear error instead of returning a missing value.
  • Contributor instructions, editor recommendations and agent instructions describe the implemented tools and checks.

Reviewed OpenAPI contract (PER-16560)

  • Regeneration uses a reviewed, hashed OpenAPI 3.1 snapshot with 263 public operations, plus the existing Elements login route. Shared local/CI configuration validates the source and reproduces the committed output from two clean generations.
  • The generated runtime enum EnvironmentCopyConflictStrategyEnum becomes EnvironmentCopyConflictStrategy. Required tenant fields, current role models and generated-only removals are documented in the migration inventory.
  • High-level condition-set, tenant, resource-instance and relationship-tuple lists return arrays by default for raw-array or envelope responses. Resource-relation lists unwrap the backend envelope to match their array contract.
  • Role-assignment and assigned-role singleton filters retain exact encoded, unbracketed query values. Explicit API/PDP destinations retain precedence over an injected Axios default URL.
  • Bulk user and relationship-tuple results use unspecified object types because the backend result schemas remain empty. Request payloads are no longer presented as response contracts; this does not claim bulk response schemas are fixed.
  • Narrow source corrections and the Elements supplement are checked against exact expected shapes. Source-spec defects are tracked separately; unsupported generated-only routes are inventoried rather than silently retained.

PDP response contracts (PER-16562)

  • Validate unknown PDP and OPA response bodies before returning authorization data. Decisions must be literal booleans and bulk responses must contain one decision per dispatched input; caller-array mutation cannot alter response or fallback cardinality.
  • Validate permission entries and granted tenants while preserving additive fields and legal dictionary keys. Apply documented missing permission/attribute defaults; nullable optional details are omitted. Any malformed or denied tenant entry invalidates the entire list.
  • Malformed responses raise PermitPDPStatusError or use the existing configured denial fallback. Per-call error policy remains supported where already exposed, and a zero timeout is preserved.
  • Unsupported useOpa: true for bulk and permission calls produces an explicit SDK error before HTTP instead of being ignored. check() retains direct OPA support. The README documents these next-major behavior changes.

HTTP ownership and retries (PER-16563)

  • Keep caller-supplied Axios clients unchanged. Private SDK transports delegate each attempt through the caller's live adapters, hooks and transforms while keeping SDK destinations, credentials, logging and retry settings separate between instances.
  • Configured SDK URLs and Bearer tokens take precedence over caller URL and Basic-auth defaults. This includes allowAbsoluteUrls: true for SDK requests; direct caller requests retain their own settings. Intentional caller hooks and caller-owned retries remain under caller control.
  • SDK retries require both the original and actual request methods to be eligible. REST POST/PATCH are never replayed; supported idempotent PUT/DELETE retries and PDP/OPA authorization POST retries remain opt-in.
  • Stop retries on cancellation or invalid configuration before invoking custom predicates. Honor cancellation added by caller hooks during backoff, preserve transient-error classification, and handle Retry-After names case-insensitively.
  • Validate retry options and bound delay arithmetic. Failed attempts and backoff consume one Axios timeout budget; zero disables that budget. REST/Elements use caller timeout settings and PDP/OPA use the SDK timeout. Arbitrary caller hooks/adapters are not interrupted by a hard wall-clock deadline.
  • Remove superseded interceptor helpers and the unused axios-retry dependency. The coverage extractor recognizes the specific internal transport declaration; its reviewed baseline delta preserves every public method and source-operation denominator.

Mixed Axios entries (PER-16669)

  • Preserve live caller default headers when SDK and supplied Axios clients use different CommonJS/ESM exports. SDK requests keep explicit destinations, Bearer credentials and retry policy.
  • Forward headers as an own-property record while retaining false/null suppression values. Request/response hooks and transforms run once per attempt; direct caller requests keep their settings.
  • Cover every SDK-entry/caller-export combination through REST and OPA, including header changes after construction and during a retry.

Configuration and API context (PER-16564)

  • Validate effective JavaScript constructor options before creating loggers or transports, with useful errors that omit rejected values. TypeScript callers keep complete Axios clients, contexts and callback types.
  • Snapshot and freeze SDK-owned settings, including nested logging, tenancy and retry arrays. The public config binding is readonly at runtime; caller-owned clients and functions remain live and editable.
  • Copy supplied API contexts into independent SDK state, preserving validated permissions and initial selection. CommonJS and ESM package entries accept each other's contexts without sharing mutable state.
  • Share one scope lookup across concurrent API wrappers within an SDK. Failed initialization can retry, malformed hierarchy cannot partially initialize state, and late completion cannot overwrite an explicit context selection. Original callers still receive their failed lookup's error.
  • Document the next-major ownership and constructor-validation changes. The removed recursive-partial helper is replaced by explicit option types.

Base URL validation (PER-16683)

  • Reject literal query and fragment delimiters in apiUrl and pdp, including empty trailing delimiters, before creating SDK loggers or transports. Errors identify the option without retaining rejected values.
  • Validate effective PERMIT_API_URL and PERMIT_PDP_URL defaults while preserving valid explicit overrides and explicit-undefined fallback.
  • Preserve HTTP(S), ports, IPv6 and ordinary or encoded path prefixes. The SDK does not strip or rewrite rejected URL components. Update configuration comments, README, the paired migration guide and generated reference.

Safe errors and diagnostics (PER-16565)

  • Normalize REST failures as PermitApiError, with useful HTTP status or transport codes and detached causes. Empty, text and validation responses produce readable descriptions.
  • Redact credentials, cookies and private request values before bounding descriptions, URLs and retained response fields. Malformed adapter status metadata is omitted. SDK errors do not retain raw socket objects, request bodies or caller stack/cause graphs.
  • Preserve the original caller error object and retry callback inputs. Bounded privacy context follows reused errors between SDK instances and both package entries without retaining requests.
  • Keep PDP and context failures named and actionable; logs describe operations and decisions without serializing user attributes or permissions. REST response diagnostics are typed as unknown, and the misleading generic error-body parameter is removed.
  • Document the changed diagnostic contract and test strict consumers, serialized errors, real logger output and encoded private-value echoes.

User-list options (PER-12643; GitHub #83)

  • Expose typed searchOperator and includeResourceInstanceRoles on users.list. Operators are startswith, endswith and contains; explicit false is serialized and omitted options keep the API defaults.
  • Preserve existing search, role and pagination behavior and the full PaginatedResultUserRead envelope, including nested resource-instance roles. Existing generated dispatch already supports the parameters; runtime files are unchanged by this unit.
  • Update the README, strict CommonJS/ESM consumer checks and generated reference. The reviewed API inventory changes only the two option members; all source-operation and method counts remain unchanged.

Tenant list totals (PER-11295)

  • Preserve the tenant array for omitted or false includeTotalCount; true returns the complete PaginatedResultTenantRead with metadata and selected attribute types. Dynamic or optional flags retain the array/page union.
  • Keep filtering, pagination, API/PDP routing and wait-for-sync clones. Snapshot options before asynchronous scope lookup so caller mutation cannot change dispatch or result selection. No pagination defaults or counts are synthesized.
  • Cover complete, empty and additive envelopes, explicit false and omitted queries, HTTP failures, strict installed consumers, and actual filtered/page counts through both local routes.

Attribute result types (PER-16504; GitHub #82)

  • Add optional caller-selected attribute types to all 22 direct user, tenant and resource-instance result paths. Default attributes remain optional object; named interfaces, literal unions, readonly members and nullable inner values retain their declared shape.
  • Preserve full user/detailed-instance pages, sync's { user, created } envelope, getter aliases and waitForSync clones. Tenant membership returns the selected user attributes. Existing role-list parameter generics and flag inference remain unchanged.
  • Keep the generic wrappers outside generated source. The README and complete public reference describe caller declarations without promising runtime response validation or inference from write payloads. Runtime code, dependencies, routes and operation counts are unchanged by this unit.

User invites (PER-12882)

  • Add permit.api.userInvites with direct selected-environment list, create, get, full-body PATCH, delete and approve operations. Facts proxy settings do not reroute these calls or promise PDP synchronization or email delivery.
  • Expose required nullable invite fields, complete pagination envelopes and the actual nullable user approval result. Internal invite IDs remain distinct from user keys; explicit attribute types describe caller expectations without runtime validation.
  • Preserve filters captured before asynchronous scope discovery, caller inputs and additive response fields. Approval HTTP 400 errors omit remote text and bodies that may disclose another stored email, while preserving safe status, transport code, route and actionable guidance.
  • Cover real local invite lifecycle, failed approval, read-only access and independent cleanup of invitations, users, grants, memberships and the temporary scoped key. Deleting an invite does not claim to revoke earlier approval facts.

Groups API (PER-16566)

  • Add permit.api.groups with the eight approved GA operations: create, delete, direct list/get, user membership assignment/removal and resource-role assignment/removal.
  • Accept qualified resource:instance keys or internal IDs for group identifiers. Membership and role-removal DELETE requests retain their required JSON bodies and selected environment context.
  • Preserve the full direct-list pagination envelope, including counts, and distinguish mutation GroupRead results from direct GroupReadSchema results with internal IDs. Strict CJS/ESM consumers verify required bodies and precise inferred result types.
  • Document group creation, filters, membership and role grants. Group-to-group membership remains deferred to later 3.x; EAP and deprecated Groups reads remain unexposed.
  • Add eight exposed GA routes while preserving all 307 source operations and the generated declarations/models. The Groups unit adds eight public HTTP methods.

Membership, detailed lists and PDP refresh (PER-16567)

  • Add tenants.addUser(tenantKeyOrId, userData) to create a new user in a tenant without requiring a role. An existing user remains a duplicate-user error.
  • Add dedicated listDetailed() methods for role assignments, resource instances and relationship tuples. Preserve full nested envelopes, total counts, optional page counts, nulls and additive fields. Pagination defaults to page 1 and 100 rows; instance searches retain repeated query values.
  • Add pdps.refresh({ reason }) for the selected environment. Its response acknowledges submission, not completion. Individual-PDP refresh remains deferred.
  • Route these five operations through the control plane even with facts proxying or waitForSync, preserving selected context and repeated filters without promising PDP synchronization. Existing methods retain their routing.
  • Correct role-assignment list return types for literal flags, dynamic booleans and conditional object unions without changing requests. The compiler inventory identifies explicit control-plane clients and preserves generated models and source operations.

PDP discovery and request context (PER-16568)

  • Add request context to the existing fifth getUserPermissions() config argument, preserving its filters and internal global-then-call context precedence.
  • Add getAuthorizedUsers() with the complete resource, tenant and user-assignment envelope. The method follows the published container/cloud route contract; real-service validation uses the isolated container.
  • Add container-only getUserTenants() for role-derived tenant discovery. Preserve tenant metadata and documented defaults. An unavailable endpoint returns an actionable status-preserving error even when denial fallback is configured.
  • Add filterObjects() using one bulk authorization request. Return original objects in order, preserving duplicates and extra application metadata; send only supported resource fields and apply each object's context over the call context. Empty input sends no request, while invalid/sparse positions and unsupported OPA mode reject before dispatch.
  • Validate complete discovery responses before returning them. Malformed or operational failures honor explicit denial fallback without returning partial grants. New discovery/filter methods always reject unsupported OPA mode; check() retains direct OPA support.
  • Preserve legal JSON dictionary keys in context and resource attributes without changing caller prototypes. Enforcement bodies are serialized before Axios; custom OPA request hooks and transforms receive JSON text and may parse, edit and reserialize it. Direct requests made through the caller's client retain their behavior.
  • Circular references and BigInt inputs produce a safe, contextual SDK error before HTTP, with the existing configured denial fallback. Raw input and serialization exceptions are not retained in diagnostics.
  • Keep the compiler-derived request shapes visible through the narrowly verified internal serializer. Generated operations/models and all 307 source operations remain unchanged.

API and PDP coverage evidence (PER-16561)

  • Compiler-based inventory maps 152 current public HTTP methods and five local helpers to generated dispatches and published API/PDP operations. Supporting scope lookups do not count as exposed wrappers.
  • Keep all 307 published operations in the denominator: 263 control-plane, 34 pinned-container and 10 cloud-PDP operations. Reports distinguish exposed, generated-only, supporting-only and missing operations, including explicit lifecycle conflicts and reasoned Node-local decisions.
  • Track signatures, request/response shapes, overloads, defaults, constants, constructor helpers and shared generated dispatch. Source checks retain server overrides, named schema keys and reusable components; unsupported referenced Path Items fail explicitly.
  • pnpm verify includes the offline contract gate. A weekly/manual workflow checks only the two allowlisted public schema documents and retains bounded drift reports with GitHub failure notifications.
  • Local integrity, coverage gaps, shared-target availability and backend evidence are separate results. The shared machine-readable target remains unavailable under PER-16345; this change does not claim cross-SDK parity or backend conformance.

Dependency security gates (PER-16559)

  • Remove obsolete standard-version tooling and its vulnerable dependency tree. Native version validation preserves semantic-version normalization, rerun and disabled-lifecycle safeguards; a release tag must match the committed package version.
  • Pinned pnpm and Trivy scan the locked production tree, full development tree and two independently resolved consumers of the exact packed SDK. Direct dependencies are exact pins; minimum/newest lanes do not claim to test minimum transitive versions.
  • Fixable HIGH/CRITICAL findings block the gate. Scanner failures, malformed reports, empty inventories and incomplete dependency graphs are INVALID. Other findings remain visible in JSON and Markdown evidence.
  • PRs and weekly/manual runs execute the scans on both supported Node floors. Publication requires both floor lanes, then scans and publishes the same final versioned tarball with scripts disabled.
  • Grouped dependency updates use cooldowns. Dependabot's documented pnpm support currently ends at version 10, so pnpm 12 lockfile updates remain unverified; scheduled audits run independently of the bot. Slack delivery awaits an authorized destination.

Tests and CI

Test execution and fixture integrity (PER-16569)

  • Require explicit queued mock responses, preserve null responses, and fail tests for unexpected requests or unused HTTP fixtures even when application code swallows the network failure.
  • Exercise public REST APIs over real loopback HTTP for concurrent scope discovery, failure recovery, cancellation, encoded CRUD identifiers, HTTP failures, pagination and persisted bulk results.
  • Verify bulk tuple IDs and stored user/tuple state instead of accepting write acknowledgments alone. Controlled service fixtures prove that missing writes, unchanged replacements and invalid IDs fail the actual tests.
  • Produce native Vitest reports and validate discovered files, named projects, executed tests and consistent result counts. Unexpected, duplicated or incorrectly nested skips fail. Missing primary backend credentials report UNAVAILABLE before importing tests; specifically approved optional omissions remain explicit limitations.
  • Execute an environment-key integration test in every configured backend lane. Optional organization/project tests use correctly scoped credentials when present; whitespace-only optional keys are treated as absent.
  • Register owned fixture cleanup before writes, preserve a supplied project, and independently verify absence after deletion. Lost write responses and cleanup failures have explicit regressions.
  • Measure all authored runtime TypeScript while excluding generated/test files. Contributor docs describe the implemented test commands and report semantics; no artificial 100% coverage claim is introduced.

Grouped APIs and legacy removal (PER-16570)

  • Remove the 29 deprecated flat API calls and api.getMethods(). Use the existing grouped clients; the migration guide lists every replacement and the changed argument/result shapes.
  • Preserve legacy condition-set type filtering through conditionSets.list({ type }) and unfiltered rule listing through conditionSetRules.list(). Rule filters are independently optional, and pagination remains available.
  • Remove DeprecatedApiClient, the three IDeprecated* interfaces, ContextTransform, and the deprecated ApiContext.level alias. permittedAccessLevel remains the permission-level property. Public runtime and strict CJS/ESM tests reject removed names and compile every grouped replacement.
  • Make ApiClient inherit the shared base directly, eliminating seven duplicate generated clients. Remove unused transform registration, dictionary/regex functions and internal method-bag code. Modern context, error, privacy and grouped-client checks remain.
  • Include MIGRATION.md in the tarball and regenerate the API reference. The new guide's OpenAPI inventory link resolves to a published repository copy for installed-package readers.
  • The reviewed inventory removes only the 29 flat HTTP methods (175 to 146). Root exports change from 171 to 167: five removed, one optional filter interface added. All 266 generated methods, 408 models and 307 source operations remain accounted for.

Packed release evidence (PER-16571)

  • Add pnpm check:release-evidence to bind supplied execution evidence to a clean SDK source tree, the exact packed candidate, the official npm 2.7.5 baseline and both installed consumer lockfiles. A fresh local build must reproduce the candidate archive byte for byte; version labels alone cannot establish identity.
  • Validate all 157 public methods and 307 published operations against a reviewed plan of 333 cases and 118 phases. Require actual positive assertion counts, matching proof levels, complete runtime/PDP cells and case totals bounded by their containing phase. A successful phase cannot supply missing case evidence.
  • Distinguish PASS, FAIL and INVALID. Preserve failed positions when evidence is incomplete; missing execution, wrong artifacts, unsuccessful setup or cleanup, zero-assertion success and unknown fields cannot pass. The checker runs locally without contacting backend services.
  • Use explicit public field allowlists and safe diagnostics. Native report hashes are unsigned producer attestations, so the producer and its comparisons still require review. Selected baseline comparisons preserve semantic values and keep intentional migration changes explicit.
  • Keep the 12 remaining unproved add/retain operations and unavailable shared parity target visible. Complete local test execution does not turn those gaps into coverage or release approval; releaseReady remains false.

Migration guide and customer agent skill (PER-16572)

  • Ship a 24-ID migration guide and matching unreleased notes covering runtime/dependency requirements, all 29 flat-to-grouped mappings, result shapes, constructor settings, errors, wire contracts, types and optional additions. Distinguish the official npm 2.7.5 baseline from behavior retained from reviewed main.
  • Include an installable customer agent skill in the package. Its read-only scanner identifies supported Permit imports, aliases, removed calls and changed result consumers; known SDK values crossing unsupported analysis boundaries require manual review. Incomplete source coverage cannot report a clean scan.
  • Pin the scanner's standalone TypeScript compiler and lockfile separately from SDK runtime dependencies. The copied skill installs with frozen dependencies and disabled lifecycle scripts; the scanner does not execute or write customer code or contact services.
  • Compile and run strict CommonJS/ESM migration fixtures against the actual packed SDK, including real loopback request and result assertions. Normal repository verification installs its test copy explicitly rather than relying on an author's local compiler.
  • Correct reference text about condition-rule filter keys and role-derived tenant discovery. Preserve SDK runtime behavior and the existing entry points.

Versioned package and required gates (PER-16573; PER-16506)

  • Commit version 3.0.0 and select genuine ESM declarations for import and CommonJS declarations for require. The ESM facade forwards the canonical declaration graph, preserving private-member ApiContext compatibility across both entries.
  • Validate strict installed customers with TypeScript 6 and 7 under Node16, NodeNext and Bundler resolution. Check actual runtime entry points, cross-entry contexts, the shipped migration scanner and copied guide links against the supplied archive.
  • Prepare isolated customer locks explicitly, audit before frozen scripts-disabled installation, and preserve the copied migration compiler lock. Cold runners do not require a populated dependency-metadata cache.
  • Build one candidate archive from clean committed source. Bind its version, metadata, file inventory, hash and source identity, then pass those exact bytes to both supported-floor consumer/security jobs and the publisher. Publishing never rebuilds or repacks the candidate.
  • Require lint, types, unit/tooling, workflow, generated-contract, consumer and security gates. Always-run aggregate checks reject failed, skipped, cancelled or missing dependencies. Backend cleanup attempts every owned deletion and fails when any deletion cannot complete.
  • Require normalized release tags to match the committed version before the scripts-disabled npm version rerun. Keep production OIDC publishing separate from unresolved publication acceptance; no approval flag substitutes for the missing shared target or Curtain Call contract.
  • Document the proposed required-check ruleset rollout and separate production/tag/Trusted Publisher owner actions. These external settings have not been changed.

Generated JSON arrays and descriptions (PER-16682)

  • Map unique JSON arrays to Array in the checked generator configuration. MonthlyUsage.monthly_tenants now matches Axios JSON responses instead of advertising JavaScript Set methods. Keep the captured UUID item schema, uniqueness constraint, default and source bytes intact.
  • Apply exactly eight checked description corrections during schema preparation, then regenerate the affected models and public reference. Reject upstream drift before replacement and preserve all source-operation, generated-operation, model and public-method counts.
  • Check the actual source-generated Axios response and physical installed declarations separately. The usage models are shipped internal declarations; this change adds no root exports, supported deep imports or organizations facade.

Checkout hook isolation (PER-16685)

  • Install pinned hooks in each checkout's private Git directory before selecting its hook path. Primary and linked checkouts preserve shared default/custom hooks and sibling configuration.
  • Exercise actual Git commits, repeated installation and failed installation across primary/linked checkouts and default/relative/absolute shared paths. Failed installation preserves the previously selected hook path.
  • Update contributor instructions. This tooling change does not alter shipped SDK files.

Public API reference (PER-13613)

  • Export 28 existing contracts used by public inputs, results and errors, including resource-relation/resource-role interfaces, their constructors and request/results, conditional pagination results, check configuration and named context errors. Existing shapes and method behavior remain unchanged.
  • Derive reference groups from the actual public API interface. Verify navigation and field links for every group, plus local page, fragment and asset targets; real missing-link/export controls must fail.
  • Check named root imports in actual packed CommonJS/ESM consumers with both maintained compilers and all three supported resolution modes. Rebuild the complete reference including user invites.
  • Align README, migration guide, release notes, contributor instructions and the shipped migration skill with the current public exports. State the breaking explicit-false pretty-logging behavior and its synchronous write cost. Website deployment remains a separate workflow and owner action.

Reference website workflow (PER-13616)

  • Make the generated public reference a required candidate check. Documentation build/link failures, skipped or missing documentation jobs prevent the candidate and SDK required checks from passing.
  • Add a separate manual Pages workflow that checks the trusted repository, main branch and exact selected commit before checkout. The read-only build audits locked dependencies, installs without lifecycle scripts, and rebuilds the actual public reference.
  • Bind a clean source checkout and actual reference file bytes to the commit, workflow run and attempt. Changed content, symlinks, hard links and excluded repository metadata fail validation before the uniquely named artifact is uploaded.
  • Limit Pages/OIDC write permissions to the deployment job, which executes only the pinned official deployment action. Website deployment remains separate from npm publication.
  • Document the owner prerequisites for switching the existing legacy main:/docs publisher to Actions, protecting the Pages environment, approving deployment and checking the hosted source marker. No Pages settings, workflow dispatch or website publication were performed for this change.

Verification

  • Current SDK commit ffe1cccc0a90dd7da47d2518e0c4483e30a3cf58, tree a7c83831e25a04c55409cdc45f3ce4dcb8a37564; companion harness commit cb6733b6497447ae3e6833257caae1505ac0da7b, tree f4deb0c15eec045bae858a07fb414757891d30e1. Two independent reviewers cleared the final Pages patch and the separate README-only harness correction.
  • Full SDK verification passes 1,759 tests / 93 files on both support floors, with no errors or limitations. The final successor only wraps contributor Markdown; all workflow, helper and test bytes match the tested source. Final hooks, formatting, strict types, builds and API contracts pass. The committed source also passes all 97 focused guard/gate tests.
  • Documentation rebuilds into 216 HTML pages with 20,732 valid local references and all 19 public API groups. All 230 generated files reproduce the committed reference. Local clean-commit binding verifies the actual file digest; its run identity is explicitly a local test value, not evidence of a GitHub Pages deployment.
  • Tests execute the actual dispatch guard and real Git/filesystem boundaries, including dirty staged/unstaged/untracked source, incorrect commits, altered content, and both link kinds. Deliberately removed main, content, clean-source and documentation guards fail their tests. Actionlint, offline Zizmor and shell checks pass; final CI performs its configured online workflow audit.
  • The final 449-file package remains byte-for-byte identical at SHA256 aa998c2e606955a097f93267d5bcd9bed187038d9607777271f341e8a5720727. It retains the prior strict TypeScript 6/7 CommonJS/ESM consumer checks, migration checks and all four dependency-security lanes on both support floors, with zero findings.
  • The same archive already passed four local service runs on Node 22.13.0, 24.0.0, 22.23.3 and 24.21.0: 333 cases / 118 phases / 14,379 assertions each, six released-baseline comparisons and all 87 candidate plus three baseline cleanup actions verified. Pages and coverage-prose changes alter no SDK or harness runtime bytes, so those exact-package reports are reused rather than presented as new service runs.
  • Harness executable code retains its passed 288 self-tests / 24 files. The README correction reflects the actual eight generated-only additions plus four cloud-operation gaps after the invite PATCH case was added; all current harness hooks and three layout checks pass.
  • The new clean committed-source export binds eight candidate/baseline runs and 24 comparisons. The validator confirms source/archive/lock/runtime/case/phase/cleanup bindings with zero behavioral failures; it remains INVALID for the 12 missing operation proofs, and release readiness remains false.
  • All 19 SDK CI jobs and both harness checks pass. Both branches include current main and are mergeable. No merge, website deployment, repository/environment setting change or npm publication has occurred.

Remaining validation

  • Groups commit 2a3330b had two CI attempts stop at PDP readiness under PER-16553. Descendants 02c0dbe and dd6204b passed both runtime readiness, integration and e2e jobs, satisfying Groups acceptance. This successful run does not resolve the broader intermittent OPAL incident.

  • ABAC decision assertions in the existing cloud e2e suite remain skipped under PER-16553; condition-set/rule/user CRUD still runs. This PR does not claim the OPAL incident is fixed.

  • CI may omit the two optional organization/project-scope tests when their scoped credentials are absent; the native report records each approved omission. The mandatory environment-key test must execute. All three execute in the owned local service run; CI job success alone is not presented as equivalent scope coverage.

  • Local harness evidence covers its implemented phase set; later SDK units will extend it. The local stack exercises real policy generation and decisions, but does not claim production event-bus or relay delivery coverage.

  • The release-gate implementation is complete locally; required-check settings and publication acceptance remain separate owner/dependency actions. Attribute generics (PER-16504) are implemented and locally validated in this PR. Tenant totals (PER-11295) are implemented and locally validated; user invites (PER-12882) are implemented and locally validated; public reference exports (PER-13613) are implemented and locally validated and the Pages workflow (PER-13616) is implemented and locally validated; owner-approved deployment and hosted verification remain separate actions. Generated model fixes (PER-16682) are implemented and locally validated; the primary-checkout hook-isolation fix (PER-16685) is validated and accepted. Base URL query/fragment rejection (PER-16683) is implemented and locally validated. The Node slice of bulk-result typing (PER-9298) remains blocked by incomplete response contracts. The tracker now includes these original units without counting covered aliases twice. Shared parity and Curtain Call remain external dependencies; local validation is not cross-SDK parity.

Credits

@Kyzgor contributed #122's native URL implementation and equivalence tests; the branch preserves that authorship. This PR also incorporates #131, #132 and #133.

Kyzgor and others added 6 commits June 23, 2026 22:48
@Kyzgor
refactor(deps): replace url-parse with native URL API
7c38c64 
url-parse was used only to build the OPA client base URL. Node's native
WHATWG URL (available since v10; engines.node already requires >=10) does
the same, so extract a buildOpaBaseUrl() helper and drop url-parse and
@types/url-parse.

yarn.lock is pruned of url-parse and its now-orphaned transitive
dependencies (querystringify, requires-port) only; every other entry is
left byte-for-byte unchanged.
@Kyzgor
test(enforcer): cover OPA base URL construction and wiring
575f1b3 
Lock the exact OPA base URL produced for the default PDP, trailing-slash,
explicit-port, https, and path-prefix inputs so the url-parse -> native URL
refactor is proven behaviour-equivalent on valid input and any regression
fails here; assert a scheme-less PDP (bare host or //host:port) throws; and
assert the Enforcer wires the OPA client baseURL to buildOpaBaseUrl(pdp).
@zeevmoney @claude
ci: pin actions to SHA and run full test suite on PRs
f438bc3 
Pin actions/checkout (v7.0.0) and actions/setup-node (v6.4.0) to full
commit SHAs in both workflows, set persist-credentials: false on all
checkouts, and bump the CI node matrix from 18/20 to 20/22 (18 is EOL).

Run the full suite on PRs/pushes, not only on release. Same-repo events
provision a throwaway Permit env via PROJECT_API_KEY, run a dockerized
PDP (now with -e PDP_API_KEY/PERMIT_API_KEY and a /healthy readiness
wait), execute test:ci:full, and delete the env on always(). Fork and
secret-less runs fall back to the no-backend test:ci:unit suite. Add the
two supporting scripts and quote $GITHUB_ENV in the publish workflow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney @claude
test: migrate from AVA to Vitest with event-based waits
4868670 
Replace AVA 3 with Vitest 4.1 (vitest.config.ts with unit / module-imports
/ integration / e2e projects; backend projects run serially via forks +
maxWorkers=1 to avoid shared-env collisions). Keep test:ci:unit /
test:ci:full names so the CI workflow is unchanged.

Remove every timer-based propagation wait: a new waitFor/waitForCheck
helper polls the actual permit.check() until it converges, bounded by a
timeout, replacing the fixed sleep(10s) waits in the e2e suites.

Rewrite fixtures to a createTestClient() factory (handleApiError now
throws). Migrate all t.* assertions to expect. Module-import specs load
the built bundle (build/index.{js,mjs}) to keep packaging-regression
coverage. Wire in the two previously orphaned specs (bulk, lists) with
proper setup/cleanup; preserve bulkRelationshipTuples coverage. Keep the
inherently racy local_facts "skip wait" case as it.skip and add a
deterministic waitForSync header unit test. Drop ava/nyc/codecov/ts-node;
add vitest/@vitest/coverage-v8; bump @types/node to ^20; skipLibCheck for
Vitest's d.ts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney @claude
test: add comprehensive unit + e2e coverage across SDK modules
e5f227b 
Add a shared mock seam (src/tests/helpers/mock-api.ts, createMockPermit)
that patches the axios adapter on the REST, PDP and OPA transports and
seeds API context without network, then add unit specs covering every
API module (resources, roles, resource-roles, role-assignments, users,
tenants, resource-instances, resource-relations, relationship-tuples,
condition-sets, condition-set-rules, resource-actions/attributes/
action-groups, projects, environments, elements, deprecated), the
enforcer (check/bulkCheck/getUserPermissions/checkAllTenants, string
parsing, default-tenant, OPA path, response shaping, throwOnError) and
the utils/config layer. Add one ABAC e2e (condition-sets) following the
event-based, self-cleaning conventions.

262 new unit tests; full no-backend suite is 333 tests. Tests-only; no
SDK source changes. Tests assert current behavior of two latent bugs
(checkAllTenants payload PER-15318; unreachable PermitPDPStatusError),
flagged in-code, not fixed here.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney @claude
fix(enforcer): send checkAllTenants payload and auth header correctly
ebd6ec0 
checkAllTenants passed { headers, params } as the axios POST body (2nd
arg), so the Authorization header was never sent and the query was
nested under `params` instead of being the request body — the PDP could
neither authenticate nor read the request.

Mirror check(): send the normalized { user, action, resource, context }
as the body and pass headers/timeout as the axios config arg. Normalize
the string forms of user/resource but skip default-tenant injection,
since an all-tenants query must not be pinned to a tenant. Add an AVA
regression test asserting the auth header is sent, the body shape is
correct, and no tenant is injected.

Fixes PER-15318

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@linear-code

linear-code Bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown

PER-15318

PER-16544

PER-16492

PER-16493

PER-16494

PER-15306

PER-15315

PER-15317

PER-16497

PER-16556

PER-16558

PER-16557

PER-16560

PER-16559

PER-16561

PER-16562

PER-16563

PER-16564

PER-16565

PER-16566

PER-16567

PER-16568

PER-16569

PER-16570

PER-16571

PER-16572

PER-16573

PER-16574

PER-9298

PER-16504

PER-16506

PER-12643

PER-11295

PER-12882

PER-8113

PER-13616

PER-13613

PER-16669

zeevmoney and others added 23 commits June 28, 2026 23:40
@zeevmoney @claude
ci: run unit/integration/module-imports on PR, defer e2e to next PR
5e29bcc 
The e2e suites are AVA with fixed sleep(10s) waits and fail fast on the
first error. Against a freshly started PDP they hit a momentary
ECONNREFUSED window right after the write burst (OPA reload), which kills
the whole run even though the env, key, and policy sync are all healthy
(/healthy passes). Scope the PR backend run to the suite that reliably
passes — unit + integration + module-imports (what `yarn test` runs, the
same set the publish workflow runs). The event-based, error-tolerant e2e
lands in the stacked test-migration PR, which re-includes e2e in CI.

Also add a PDP diagnostics step (docker logs + container state +
/healthy) on backend-run failure so PDP connection errors, which surface
with no HTTP response, are debuggable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney
Merge branch 'per-15306/ci-pin-actions-tests-on-pr' into per-15315/vi…
0aec4df 
…test-event-based-tests

* per-15306/ci-pin-actions-tests-on-pr:
  ci: run unit/integration/module-imports on PR, defer e2e to next PR

# Conflicts:
#	package.json
@zeevmoney
Merge branch 'per-15315/vitest-event-based-tests' into per-15317/comp…
6524fe1 
…rehensive-sdk-tests

* per-15315/vitest-event-based-tests:
  ci: run unit/integration/module-imports on PR, defer e2e to next PR
@zeevmoney @claude
ci: run on all pull requests, not only those targeting main
f5dffbf 
Stacked PRs target feature branches, so a pull_request filter of
branches:[main] meant they never ran CI. Drop the base-branch filter so
every PR is tested regardless of base.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney
Merge branch 'per-15306/ci-pin-actions-tests-on-pr' into per-15315/vi…
329a80c 
…test-event-based-tests

* per-15306/ci-pin-actions-tests-on-pr:
  ci: run on all pull requests, not only those targeting main
@zeevmoney
Merge branch 'per-15315/vitest-event-based-tests' into per-15317/comp…
9e2ccbd 
…rehensive-sdk-tests

* per-15315/vitest-event-based-tests:
  ci: run on all pull requests, not only those targeting main
@zeevmoney @claude
ci: pin PDP connection to IPv4 (127.0.0.1) in the backend test run
fc2529b 
Node resolves `localhost` to ::1 (IPv6) first, but the GitHub runner's
Docker IPv6 port publish refuses connections, so e2e permit.check() calls
hit ECONNREFUSED even though the PDP is healthy on IPv4 (curl /healthy
returns 200). Set PDP_URL to http://127.0.0.1:7766 so the SDK uses the
working IPv4 path, and pin the readiness probe to 127.0.0.1 too.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney
Merge branch 'per-15306/ci-pin-actions-tests-on-pr' into per-15315/vi…
b8c69b1 
…test-event-based-tests

* per-15306/ci-pin-actions-tests-on-pr:
  ci: pin PDP connection to IPv4 (127.0.0.1) in the backend test run
@zeevmoney
Merge branch 'per-15315/vitest-event-based-tests' into per-15317/comp…
696f446 
…rehensive-sdk-tests

* per-15315/vitest-event-based-tests:
  ci: pin PDP connection to IPv4 (127.0.0.1) in the backend test run
@zeevmoney @claude
test: make rbac useOpa checks opt-in and widen rebac CI budget
42ad33f 
The dockerized PDP in CI doesn't expose OPA (port 8181), so rbac's direct
useOpa checks hit ECONNREFUSED. Gate them behind PERMIT_RUN_OPA_E2E
(default off) so they only run against an OPA-exposed setup. Raise the
rebac convergence gate to 150s and the e2e test timeout to 300s, since
the heavy ReBAC graph needs longer to propagate cloud->PDP on a cold env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney
Merge branch 'per-15315/vitest-event-based-tests' into per-15317/comp…
9ae3a77 
…rehensive-sdk-tests

* per-15315/vitest-event-based-tests:
  test: make rbac useOpa checks opt-in and widen rebac CI budget
@zeevmoney @claude
test: poll the rbac multi-result reads to remove propagation races
64b288c 
bulkCheck and getUserPermissions query separate PDP endpoints that can
lag a single permit.check, so the direct assertions raced cloud->PDP
propagation and flaked on the slower matrix leg. Gate the complete-user
read and poll bulkCheck/getUserPermissions until they converge before
asserting.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney
Merge branch 'per-15315/vitest-event-based-tests' into per-15317/comp…
6ade914 
…rehensive-sdk-tests

* per-15315/vitest-event-based-tests:
  test: poll the rbac multi-result reads to remove propagation races
@zeevmoney @claude
test: register the user attribute used by the ABAC condition set
d721e50 
A userset condition set referencing user.<attr> requires that attribute
to exist on the built-in user resource; users.sync alone doesn't register
it, so the condition-set creation failed with 400 MISSING_RESOURCE_ATTRIBUTE.
Register a run-unique attribute on the __user resource before creating the
userset, reference it consistently in the condition and the synced users,
and remove it in the tolerant afterAll.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney @claude
test: widen the ABAC condition-set check budget to 180s
a71e7ad 
Condition sets compile to new policy (rego), which propagates slower than
role/fact writes, so the 60s default left the ABAC check timing out in CI
before the policy took effect. Match the heavier rebac budget.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@zeevmoney @claude
Map all-tenant decisions from the PDP response
20b1353 
PER-15318

Read allowed_tenants and return the tenant details. Merge the global
context store into the request context, with caller keys taking
precedence, as check() does. Replace adapter fixtures with real local
HTTP tests for normalized POST bodies, authentication, SDK-language
headers, attributes, empty decisions, and global context merging.

Add a shared local PDP test server for these and later regression
tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zeevmoney @claude
Fix per-check context precedence in bulk authorization
3df9603 
PER-16492

Merge each check's context over the method context before deriving the
global context. Keep sibling checks and caller-owned contexts isolated.

Add local HTTP regression coverage for precedence, optional method
context, shallow merging, and unchanged inputs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zeevmoney @claude
Preserve PDP HTTP errors separately from transport failures
bef5ec8 
PER-16494

Raise PermitPDPStatusError with statusCode and responseBody for HTTP
responses, including Axios rejections, in check, bulkCheck,
getUserPermissions and checkAllTenants. Preserve transport connection
errors.

HTTP error responses that Axios rejects, such as 401 and 500, used to
raise PermitConnectionError with a connection-failure message. Their
error name is now PermitPDPStatusError, and their message is the one
used for unexpected resolved statuses: "Permit.<method>() got an
unexpected status code: <status>, ...". The message does not include
the user, action or resource.

A 200 response with a body the SDK cannot read, such as {}, also used
to raise PermitConnectionError saying the SDK cannot connect to the
PDP. It now raises PermitPDPStatusError with statusCode 200, the raw
body in responseBody, and a message saying the PDP returned an
unexpected response body.

Make PermitPDPStatusError extend PermitConnectionError so existing
instanceof PermitConnectionError catches keep handling HTTP failures
that previously surfaced as connection errors. Keep one-argument
construction available; SDK-generated HTTP errors fill both new fields.

checkAllTenants no longer rethrows the raw AxiosError, which carried
the request config and its Authorization header. It maps PDP errors
like the other methods and, when throwing, logs each one once, without
the extra log in Permit.checkAllTenants. Like check and bulkCheck, it
applies the SDK throwOnError setting to every failure, including an
invalid resource string: with throwing disabled it logs the error and
returns an empty tenant list. With throwing disabled, bulkCheck
returns one false per input check instead of an empty array.

Cover 401, 500, unexpected resolved statuses, string response bodies,
unreadable 200 bodies, and transport timeouts for all four methods,
and invalid resource strings for the three methods that take a
resource, as separate tests, with per-call and global error-policy
overrides. Check that thrown errors contain neither the API key nor
user details.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zeevmoney @claude
Prevent secret logging and honor JSON log configuration
2657389 
PER-16493

Stop serializing SDK configuration in debug logs. Use plain Pino JSON
for JSON mode. For pretty mode, write through a synchronous in-process
pino-pretty stream instead of a Pino transport, so bundled apps need no
worker-thread target and Permit instances add no process exit
listeners.

Keep JSON lines as the default output: log.json defaults to true. When
log.json is omitted, PERMIT_LOG_JSON=false selects pretty output. The
variable ignores letter case and surrounding whitespace, and any other
value keeps JSON lines instead of making new Permit() throw. An
explicit log.json always overrides the environment variable.

Cover default, explicit and environment JSON and pretty settings with
12 instances each, PERMIT_LOG_JSON values and overrides, configured
secret exclusion, and debug logging for successful calls, HTTP errors
and connections the PDP closes without replying, for all four PDP
methods, with throwing enabled and disabled. HTTP errors must surface
as PermitPDPStatusError and closed connections as
PermitConnectionError, and in JSON mode a thrown failure must produce
exactly one error log record.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zeevmoney @claude
Document logging options and PDP error types
6b818cd 
PER-16493
PER-16494

Add a Logging and errors section to the README. Describe log.level,
the JSON default, how PERMIT_LOG_JSON is read, pretty output, and how
an explicit log.json overrides the environment variable. Describe
PermitPDPStatusError and PermitConnectionError, including unreadable
200 responses, the statusCode field and the raw responseBody, matching
errors with instanceof, and what each PDP method returns when
throwOnError is false.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zeevmoney @claude
Fix existing lint warnings in tests
a9be8b7 
Remove unused imports and constants from the e2e and module-import
specs, and replace a non-null assertion with an equivalent type
assertion. These warnings are pre-existing on main. There is no
behaviour change: the emitted JavaScript differs only by two removed
unused constants.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zeevmoney @claude
Keep the API key out of serialized REST errors
71a7ad6 
PER-16544

PermitApiError stored the raw AxiosError in its enumerable
originalError field. The error's request config carried the
Authorization header with the API key, and its Node request object
carried the same header in its raw header block, so logging a failed
REST call with util.inspect, JSON.stringify, pino's err serializer or
an error tracker leaked the key. The deprecated permit.api methods
rethrew the raw AxiosError, with the same exposure.

Remove credentials from the Axios error before it is thrown. Reduce
the request config to method, URL, params, body and timeout, redact
the value of every request header except a short list that carries no
credentials, redact the response Set-Cookie header, and drop the
request objects. The status, response body, method and URL stay
available for debugging. PermitApiError.request is now undefined.

Cover 401 and 500 responses from a current and a deprecated REST
method, and a connection reset, against a local server. Check that
util.inspect, JSON.stringify and pino output contain neither the API
key, a custom header secret nor a cookie, and that the useful fields
remain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@zeevmoney @claude
Merge the test and CI stack (#131-#133) into the correctness fixes
5cb6dad 
PER-15306
PER-15315
PER-15317

Fold the stacked test and CI branches into this branch so the SDK
fixes land together with the Vitest suite, the per-module unit tests
and the CI changes. The merged head is #133 (a71e7ad), which contains
#132 (64b288c) and #131 (fc2529b).

Conflicts:
- src/tests/e2e/lists.e2e.spec.ts, src/tests/e2e/rbac.e2e.spec.ts and
  src/tests/module-imports/esm-import.spec.ts: this branch only removed
  unused imports from the AVA versions. The stack rewrote these files
  for Vitest, so the stack's versions are kept.
- src/tests/unit/config.spec.ts: both sides added the file. The stack's
  Vitest version is kept here; the next commit ports this branch's
  PERMIT_LOG_JSON cases into it.

The SDK sources are this branch's; the stack did not touch them. The
stack's package.json replaces AVA, nyc, ts-node, codecov and open-cli
with Vitest, so this merge changes the dev dependencies and the lock
file. This branch's AVA unit specs are ported to Vitest in the next
commit, and the stack's tests that pin the old SDK behaviour are
updated after that.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

URL validation accepts query and fragment components that cause configured API and PDP endpoints to be misrouted.

Review effort: Balanced
Findings: 1 High severity · 1 Medium severity · 8 Low severity

Open (10)

Comment thread src/config.ts
Comment thread src/openapi/types/data-generator-lib-schemas-schema-opal-data-derivation-settings.ts Outdated
Comment thread src/openapi/types/elements-user-invite-approve.ts Outdated
Comment thread src/openapi/types/group-assignment.ts Outdated
Comment thread src/openapi/types/group-create.ts Outdated
Comment thread src/openapi/types/group-read-schema.ts Outdated
Comment thread src/openapi/types/paginated-result-relationship-tuple-detailed-read.ts Outdated
Comment thread src/openapi/types/paginated-result-resource-instance-detailed-read.ts Outdated
Comment thread src/openapi/types/tenant-block-read.ts Outdated
Copilot AI balanced review requested due to automatic review settings October 1, 2026 04:04
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The release combines extensive public API, generated-contract, transport, build, and CI changes that require final human validation.

Review effort: Balanced
Findings: 1 High severity · 1 Medium severity · 8 Low severity

Open (10)

Copilot AI balanced review requested due to automatic review settings October 1, 2026 04:43
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

Primary-worktree hook installation can overwrite the shared default hook directory used by sibling worktrees.

Review effort: Balanced
Findings: 1 High severity · 8 Low severity

Open (9)
Resolved since last review (1)

Copilot AI balanced review requested due to automatic review settings October 1, 2026 05:40
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

It combines a major public API rebaseline with extensive generated code, packaging, build, security, and release-pipeline changes requiring final human validation.

Review effort: Balanced
Findings: 1 High severity

Open (1)
Resolved since last review (8)

Copilot AI balanced review requested due to automatic review settings October 1, 2026 05:56
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The major release combines extensive generated API changes with runtime, packaging, testing, and release-pipeline migrations that require final human validation.

Review effort: Balanced
Findings: 1 High severity

Open (1)

Copilot AI balanced review requested due to automatic review settings October 1, 2026 10:47
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The semver-major API and generated-contract rewrite spans release-critical tooling and still documents pending CI and twelve unproved operations.

Review effort: Balanced
Findings: 1 High severity

Open (1)

Copilot AI balanced review requested due to automatic review settings October 1, 2026 11:03
Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The semver-major change spans generated contracts, runtime behavior, packaging, CI, and security gates while release evidence still reports 12 unproved operations and pending CI.

Review effort: Balanced
Findings: 1 High severity

Open (1)

Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The release-wide API and generated-contract changes are extensive, while the supplied release evidence remains invalid and new-head CI is still pending.

Review effort: Balanced
Findings: 1 High severity

Open (1)

Copilot AI reviewed Oct 1, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The major release spans generated contracts, public APIs, build tooling, dependency security, and release validation, requiring final human review.

Review effort: Balanced
Findings: 1 High severity

Open (1)

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@EliMoshkovich EliMoshkovich EliMoshkovich requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

url-parser is an unnecessary dependency

4 participants

@zeevmoney @EliMoshkovich @Kyzgor