Repository navigation
feat: add system.v4, reporting the Node.js version a site declares - #14
Merged
Merged
Conversation
A site's project files already say which Node.js version it needs, in .nvmrc, .node-version or package.json's engines.node, and nothing in the runtime report carried it. system.v4 adds a required node object holding that declaration and the name of the file it came from. The value is what the file says and not what is installed. Observing the running version would mean executing a binary on somebody's server, which this protocol does not ask a connector to do. declared is held to 32 characters from the set a version or range is written in, with a slash permitted only inside an lts/ alias, so a path, a URL or a sentence in the file is refused rather than forwarded. source is one of the three file names, never a path to the file. node is required and both members are nullable, so the two absences stay distinguishable: null and null is a connector that looked and found nothing declared, and no node at all is a connector that predates this version. That needed the validator to read type as a list. A list was cast to the word "Array", which no type check recognises and therefore accepts, so a schema written ["string", "null"] would have validated any value at all. No published schema used one, so nothing that validated before changes. system.v1 to v3 are untouched.
This was referenced Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
system.v4, which issystem.v3plus a required top-levelnodeobject, and releases as 1.10.0.What it carries.
declaredis the Node.js version or range exactly as a site's.nvmrc,.node-versionorpackage.jsonengines.nodewrites it.sourceis which of those three files it came from. Both are nullable.Declared, not observed. The running version would mean executing a binary on the site's server, which this protocol does not ask a connector to do. The schema has no field for it.
What it refuses.
declaredis at most 32 characters, from the characters a version or range is written in (digits, letters,.+^~<>=*|, space), with a slash allowed only inside anlts/alias. A path, URL, shell fragment or sentence fails the pattern and is refused rather than truncated.sourceis one of the three file names, never a path..npmrcand the lockfile are not accepted.nodehasadditionalProperties: false.Why
nodeis required.{declared: null, source: null}means the connector looked and nothing is declared. Nonodemeans a connector that predates v4. Making it required keeps those two distinguishable, so the platform can say "Not declared" for one and nothing for the other.Validator change. The schema uses
"type": ["string", "null"], whichSchemaValidatordid not support: it cast the list to the string "Array", which no type check recognises, so it accepted any value. It now treats a list as "any of these". No published schema used a list, so nothing that validated before validates differently. There is a test for it that includes non-string values.Add-only.
system.v1tosystem.v3, the signing fixtures and every existing fixture are untouched. v3 still rejects anodekey.Verification.
composer testpasses (435 tests, 2966 assertions, including the new v4 fixtures, pattern and length cases, null handling and the validator test).composer phpstanis clean. Version is 1.10.0 inCHANGELOG.md,composer.jsonandProtocol::VERSION, whichVersionTestchecks.Release order. Connector and platform changes that use
system.v4can't go green until this is tagged v1.10.0 and on Packagist, since the schema ships inside the package.