[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@bounda-dev/cli@0.3.0

Minor Changes

• c9bff07: Snapshots of an aggregate's state, opt-in per aggregate with runtime.overrides.<aggregate>.snapshot: { every }. A snapshot:<aggregate> subscriber writes them in the background, and a command loads the snapshot and folds only the events after it. A snapshot is a cache of the fold and never the source of truth: it is valid only for the stateFingerprint the generator now writes to the registry, a digest of the modules that shape the state and of the type inferred for it, plus the configured snapshot.version; one that is missing, from other code, unreadable or past the stream's head is ignored, and a share of the loads (snapshot.verify, 0.01 by default) is checked against a fold of the whole stream, which drops a snapshot that folds to another state. An app from createTestApp checks every load and throws SnapshotError. The state is kept with its types (Date, Map, Set, bigint). Every adapter gains a snapshots table and Storage.snapshotStore, which keeps the newest snapshot of a fingerprint whatever order two writers put theirs in; load with fromVersion in the SQL event stores now reads the stream's head before the events, bounded by it, so an append landing between the two reads can no longer report a head past the events returned.
• 699bb9f: Personal data in events, forgotten by crypto-shredding. An event's payload receives personal and person next to z: personal(schema) marks a field as personal data, stored encrypted (AES-256-GCM through WebCrypto, on Node and in workerd) with a key of the person the event names, person(schema) marks the field that names them, and without it the aggregate's id does. app.forget(personId), on every BoundaClient, deletes the key and appends PersonalDataForgotten to the stream bounda:<personId>, in one transaction: from then on every personal field of theirs reads as null, typed T | null in every handler. A read model that projects an event with personal fields must handle it from projections/bounda/personal-data-forgotten.ts, which the generator checks in .bounda/types.ts; a policy may react to it from policies/bounda/. The adapters keep the keys, with their fingerprints, in a new personal_keys table, Storage and StorageTransaction gain personalKeys, and the storage contracts cover it. The global stream shows the fields as stored, encrypted. A command that loaded a person's data before forget and appends after it fails with ConcurrencyError and is decided again, instead of writing their data back under the new key another command may have given them meanwhile: the state remembers the key each person's data was read under, and AppendArgs gains persons ({ person, fingerprint }) for this, which a store ignores. Snapshots and remembered rejections name the same and are written only while that key is still the person's; in PostgreSQL a GIN index on their persons lets forget find them without reading every row.

Patch Changes

• Updated dependencies [c9bff07]
• Updated dependencies [85b68d2]
• Updated dependencies [699bb9f]
  • @bounda-dev/core@0.3.0

@bounda-dev/cloudflare@0.3.0

Minor Changes

• 699bb9f: Personal data in events, forgotten by crypto-shredding. An event's payload receives personal and person next to z: personal(schema) marks a field as personal data, stored encrypted (AES-256-GCM through WebCrypto, on Node and in workerd) with a key of the person the event names, person(schema) marks the field that names them, and without it the aggregate's id does. app.forget(personId), on every BoundaClient, deletes the key and appends PersonalDataForgotten to the stream bounda:<personId>, in one transaction: from then on every personal field of theirs reads as null, typed T | null in every handler. A read model that projects an event with personal fields must handle it from projections/bounda/personal-data-forgotten.ts, which the generator checks in .bounda/types.ts; a policy may react to it from policies/bounda/. The adapters keep the keys, with their fingerprints, in a new personal_keys table, Storage and StorageTransaction gain personalKeys, and the storage contracts cover it. The global stream shows the fields as stored, encrypted. A command that loaded a person's data before forget and appends after it fails with ConcurrencyError and is decided again, instead of writing their data back under the new key another command may have given them meanwhile: the state remembers the key each person's data was read under, and AppendArgs gains persons ({ person, fingerprint }) for this, which a store ignores. Snapshots and remembered rejections name the same and are written only while that key is still the person's; in PostgreSQL a GIN index on their persons lets forget find them without reading every row.

Patch Changes

• Updated dependencies [c9bff07]
• Updated dependencies [85b68d2]
• Updated dependencies [699bb9f]
  • @bounda-dev/core@0.3.0

@bounda-dev/core@0.3.0

Minor Changes

• c9bff07: Snapshots of an aggregate's state, opt-in per aggregate with runtime.overrides.<aggregate>.snapshot: { every }. A snapshot:<aggregate> subscriber writes them in the background, and a command loads the snapshot and folds only the events after it. A snapshot is a cache of the fold and never the source of truth: it is valid only for the stateFingerprint the generator now writes to the registry, a digest of the modules that shape the state and of the type inferred for it, plus the configured snapshot.version; one that is missing, from other code, unreadable or past the stream's head is ignored, and a share of the loads (snapshot.verify, 0.01 by default) is checked against a fold of the whole stream, which drops a snapshot that folds to another state. An app from createTestApp checks every load and throws SnapshotError. The state is kept with its types (Date, Map, Set, bigint). Every adapter gains a snapshots table and Storage.snapshotStore, which keeps the newest snapshot of a fingerprint whatever order two writers put theirs in; load with fromVersion in the SQL event stores now reads the stream's head before the events, bounded by it, so an append landing between the two reads can no longer report a head past the events returned.
• 85b68d2: A command can be dispatched again without running twice: commands.x(payload, { idempotencyKey })
  remembers what the first dispatch under a key answered, in the same transaction as the events it
  stores, and every later dispatch with the same key, command, payload and delay answers the same,
  its rejection included, without running the handler; two racing for one key store the events once.
  The same key for another command, payload or delay rejects with IdempotencyKeyConflictError
  (IDEMPOTENCY_KEY_CONFLICT). A key lives runtime.commands.idempotencyKeyLifetime, 24 hours by
  default, in a new bounda_idempotency_keys table of every adapter, which the scheduled-command
  worker purges. Storage and StorageTransaction gain an idempotencyStore, with its contract
  test in @bounda-dev/core/adapter/testing. The React Router middleware gives every command of a request
  a key derived from its Idempotency-Key header and the command's name, idempotencyKeyFor(header, name), so an action that dispatches two commands keys each apart, and failure() answers a
  conflict with a 422. The in-memory adapter now answers, inside a transaction, the positions its events commit
  with, as the SQL adapters do.
• 699bb9f: Personal data in events, forgotten by crypto-shredding. An event's payload receives personal and person next to z: personal(schema) marks a field as personal data, stored encrypted (AES-256-GCM through WebCrypto, on Node and in workerd) with a key of the person the event names, person(schema) marks the field that names them, and without it the aggregate's id does. app.forget(personId), on every BoundaClient, deletes the key and appends PersonalDataForgotten to the stream bounda:<personId>, in one transaction: from then on every personal field of theirs reads as null, typed T | null in every handler. A read model that projects an event with personal fields must handle it from projections/bounda/personal-data-forgotten.ts, which the generator checks in .bounda/types.ts; a policy may react to it from policies/bounda/. The adapters keep the keys, with their fingerprints, in a new personal_keys table, Storage and StorageTransaction gain personalKeys, and the storage contracts cover it. The global stream shows the fields as stored, encrypted. A command that loaded a person's data before forget and appends after it fails with ConcurrencyError and is decided again, instead of writing their data back under the new key another command may have given them meanwhile: the state remembers the key each person's data was read under, and AppendArgs gains persons ({ person, fingerprint }) for this, which a store ignores. Snapshots and remembered rejections name the same and are written only while that key is still the person's; in PostgreSQL a GIN index on their persons lets forget find them without reading every row.

@bounda-dev/postgresql@0.3.0

Minor Changes

• c9bff07: Snapshots of an aggregate's state, opt-in per aggregate with runtime.overrides.<aggregate>.snapshot: { every }. A snapshot:<aggregate> subscriber writes them in the background, and a command loads the snapshot and folds only the events after it. A snapshot is a cache of the fold and never the source of truth: it is valid only for the stateFingerprint the generator now writes to the registry, a digest of the modules that shape the state and of the type inferred for it, plus the configured snapshot.version; one that is missing, from other code, unreadable or past the stream's head is ignored, and a share of the loads (snapshot.verify, 0.01 by default) is checked against a fold of the whole stream, which drops a snapshot that folds to another state. An app from createTestApp checks every load and throws SnapshotError. The state is kept with its types (Date, Map, Set, bigint). Every adapter gains a snapshots table and Storage.snapshotStore, which keeps the newest snapshot of a fingerprint whatever order two writers put theirs in; load with fromVersion in the SQL event stores now reads the stream's head before the events, bounded by it, so an append landing between the two reads can no longer report a head past the events returned.
• 85b68d2: A command can be dispatched again without running twice: commands.x(payload, { idempotencyKey })
  remembers what the first dispatch under a key answered, in the same transaction as the events it
  stores, and every later dispatch with the same key, command, payload and delay answers the same,
  its rejection included, without running the handler; two racing for one key store the events once.
  The same key for another command, payload or delay rejects with IdempotencyKeyConflictError
  (IDEMPOTENCY_KEY_CONFLICT). A key lives runtime.commands.idempotencyKeyLifetime, 24 hours by
  default, in a new bounda_idempotency_keys table of every adapter, which the scheduled-command
  worker purges. Storage and StorageTransaction gain an idempotencyStore, with its contract
  test in @bounda-dev/core/adapter/testing. The React Router middleware gives every command of a request
  a key derived from its Idempotency-Key header and the command's name, idempotencyKeyFor(header, name), so an action that dispatches two commands keys each apart, and failure() answers a
  conflict with a 422. The in-memory adapter now answers, inside a transaction, the positions its events commit
  with, as the SQL adapters do.
• 699bb9f: Personal data in events, forgotten by crypto-shredding. An event's payload receives personal and person next to z: personal(schema) marks a field as personal data, stored encrypted (AES-256-GCM through WebCrypto, on Node and in workerd) with a key of the person the event names, person(schema) marks the field that names them, and without it the aggregate's id does. app.forget(personId), on every BoundaClient, deletes the key and appends PersonalDataForgotten to the stream bounda:<personId>, in one transaction: from then on every personal field of theirs reads as null, typed T | null in every handler. A read model that projects an event with personal fields must handle it from projections/bounda/personal-data-forgotten.ts, which the generator checks in .bounda/types.ts; a policy may react to it from policies/bounda/. The adapters keep the keys, with their fingerprints, in a new personal_keys table, Storage and StorageTransaction gain personalKeys, and the storage contracts cover it. The global stream shows the fields as stored, encrypted. A command that loaded a person's data before forget and appends after it fails with ConcurrencyError and is decided again, instead of writing their data back under the new key another command may have given them meanwhile: the state remembers the key each person's data was read under, and AppendArgs gains persons ({ person, fingerprint }) for this, which a store ignores. Snapshots and remembered rejections name the same and are written only while that key is still the person's; in PostgreSQL a GIN index on their persons lets forget find them without reading every row.

Patch Changes

• Updated dependencies [c9bff07]
• Updated dependencies [85b68d2]
• Updated dependencies [699bb9f]
  • @bounda-dev/core@0.3.0

@bounda-dev/react-router@0.3.0

Minor Changes

• 85b68d2: A command can be dispatched again without running twice: commands.x(payload, { idempotencyKey })
  remembers what the first dispatch under a key answered, in the same transaction as the events it
  stores, and every later dispatch with the same key, command, payload and delay answers the same,
  its rejection included, without running the handler; two racing for one key store the events once.
  The same key for another command, payload or delay rejects with IdempotencyKeyConflictError
  (IDEMPOTENCY_KEY_CONFLICT). A key lives runtime.commands.idempotencyKeyLifetime, 24 hours by
  default, in a new bounda_idempotency_keys table of every adapter, which the scheduled-command
  worker purges. Storage and StorageTransaction gain an idempotencyStore, with its contract
  test in @bounda-dev/core/adapter/testing. The React Router middleware gives every command of a request
  a key derived from its Idempotency-Key header and the command's name, idempotencyKeyFor(header, name), so an action that dispatches two commands keys each apart, and failure() answers a
  conflict with a 422. The in-memory adapter now answers, inside a transaction, the positions its events commit
  with, as the SQL adapters do.
• 699bb9f: Personal data in events, forgotten by crypto-shredding. An event's payload receives personal and person next to z: personal(schema) marks a field as personal data, stored encrypted (AES-256-GCM through WebCrypto, on Node and in workerd) with a key of the person the event names, person(schema) marks the field that names them, and without it the aggregate's id does. app.forget(personId), on every BoundaClient, deletes the key and appends PersonalDataForgotten to the stream bounda:<personId>, in one transaction: from then on every personal field of theirs reads as null, typed T | null in every handler. A read model that projects an event with personal fields must handle it from projections/bounda/personal-data-forgotten.ts, which the generator checks in .bounda/types.ts; a policy may react to it from policies/bounda/. The adapters keep the keys, with their fingerprints, in a new personal_keys table, Storage and StorageTransaction gain personalKeys, and the storage contracts cover it. The global stream shows the fields as stored, encrypted. A command that loaded a person's data before forget and appends after it fails with ConcurrencyError and is decided again, instead of writing their data back under the new key another command may have given them meanwhile: the state remembers the key each person's data was read under, and AppendArgs gains persons ({ person, fingerprint }) for this, which a store ignores. Snapshots and remembered rejections name the same and are written only while that key is still the person's; in PostgreSQL a GIN index on their persons lets forget find them without reading every row.

Patch Changes

• Updated dependencies [c9bff07]
• Updated dependencies [85b68d2]
• Updated dependencies [699bb9f]
  • @bounda-dev/core@0.3.0
  • @bounda-dev/cli@0.3.0
  • @bounda-dev/cloudflare@0.3.0

@bounda-dev/sqlite@0.3.0

Minor Changes

• 699bb9f: Personal data in events, forgotten by crypto-shredding. An event's payload receives personal and person next to z: personal(schema) marks a field as personal data, stored encrypted (AES-256-GCM through WebCrypto, on Node and in workerd) with a key of the person the event names, person(schema) marks the field that names them, and without it the aggregate's id does. app.forget(personId), on every BoundaClient, deletes the key and appends PersonalDataForgotten to the stream bounda:<personId>, in one transaction: from then on every personal field of theirs reads as null, typed T | null in every handler. A read model that projects an event with personal fields must handle it from projections/bounda/personal-data-forgotten.ts, which the generator checks in .bounda/types.ts; a policy may react to it from policies/bounda/. The adapters keep the keys, with their fingerprints, in a new personal_keys table, Storage and StorageTransaction gain personalKeys, and the storage contracts cover it. The global stream shows the fields as stored, encrypted. A command that loaded a person's data before forget and appends after it fails with ConcurrencyError and is decided again, instead of writing their data back under the new key another command may have given them meanwhile: the state remembers the key each person's data was read under, and AppendArgs gains persons ({ person, fingerprint }) for this, which a store ignores. Snapshots and remembered rejections name the same and are written only while that key is still the person's; in PostgreSQL a GIN index on their persons lets forget find them without reading every row.

Patch Changes

• Updated dependencies [c9bff07]
• Updated dependencies [85b68d2]
• Updated dependencies [699bb9f]
  • @bounda-dev/core@0.3.0

create-bounda@0.3.0

No changes in this release.