chore(release): 1.0.0 - #202
Merged
Merged
Conversation
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.1.0 to 7.2.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@bcafcac...f9f3042) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps nginxinc/nginx-unprivileged from `3707417` to `8122337`. --- updated-dependencies: - dependency-name: nginxinc/nginx-unprivileged dependency-version: alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: syalioune <sy_alioune@yahoo.fr>
ADR-009 foundation. NEW src/lib/auth-strategy.ts — AuthStrategy interface
(kind / authorizationHeader(): Promise<string|null> / onUnauthorized?()) +
BasicAuthStrategy concrete reading cfg.{username,password} via getter closure
(explicit field — project tsconfig forbids parameter-properties).
api.ts request() + multipartFetch() now `await authStrategy.authorizationHeader()`
(funnel already async). 401 path calls authStrategy.onUnauthorized?.() —
no-op for Basic, additive seam for Bearer (28.3) + OIDC (28.4). basicAuth()
deleted (only request + multipart called it). setAuthStrategy / getAuthStrategy
exported + on the api object.
Active strategy stays BasicAuthStrategy for the whole session — selection-by-
connection-kind lands in 28.2. Observably inert for Basic: same Basic <b64>
header, same NFR-8 redaction (Basic ***), all existing request.test.ts green.
Tests: src/lib/__tests__/auth-strategy.test.ts (+7); auth-strategy-funnel (+11).
Full suite 102 files / 1150 tests green; tsc + biome clean.
Refs: ADR-009 (architecture.md:256), FR-4 (prd.md:324), AuthStrategyKind
reused from src/lib/auth-strategy-config.ts:28 (Story 23.2).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…trategy dispatcher Activates Story 23.2's dormant per-connection authStrategyConfig. NEW src/components/AuthStrategyFields.tsx — segmented-control + per-kind field group extracted (N=3 codification: Add modal + Edit modal + Auth tab). Add/Edit modals refactored to consume it; all 23.2 testids preserved. Dormancy note is now bearer/OIDC-only (Basic is live). NEW src/lib/install-auth-strategy.ts — installStrategyForActiveConnection() maps kind → AuthStrategy (app-layer, import-cycle avoidance). basic → BasicAuthStrategy (live); bearer/oidc → DormantAuthStrategy placeholder (carries the kind, emits Basic header) until 28.3/28.4. Fired at 3 points: app mount, SAVED_CONNECTIONS_CHANGED listener, Auth-tab Save. SettingsModal gains a third tab (connection | authentication | about). The Auth tab edits the active connection: hydrate → validate (23.2 parseAuthStrategyConfig) → updateConnection → install → toast, with an in-tab ErrorBox + diff-empty Save-disabled guard. Per-story single commit (operator directive) folds the refactor+feat split. Tests: AuthStrategyFields (+6), install-auth-strategy (+6), settings-auth-tab Vitest (+6), settings-auth-tab E2E (+5). Full suite 105 files / 1168 green; tsc + biome ci + coverage all clean. Refs: ADR-009 (architecture.md:256), FR-4 (prd.md:324), Story 23.2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
Swaps Story 28.2's bearer DormantAuthStrategy placeholder for the real concrete. NEW BearerAuthStrategy (src/lib/auth-strategy.ts) — Bearer <token> from the active connection's persisted authStrategyConfig.config.token via a live getter (re-paste without re-install); empty token → null → no header → 401. Opaque token, no exp/refresh (that's OIDC's job, 28.4). First real onUnauthorized consumer: a 401 dispatches OPEN_SETTINGS_AUTH (new nav-event) via an injected callback; the app listener opens SettingsModal at the Authentication tab (new initialTab prop) for a re-paste — additive to the error (screen still shows its ErrorBox). Idempotent under a 401 retry-storm. Dormancy note narrowed to OIDC-only (Bearer now live); 28.2 Bearer-dormancy assertions dropped + replaced with Bearer-live (placeholder-swap cleanup). Live-engine scope boundary: header-swap + 401-open are fully automated; real-OAuth 200 is the operator-validation boundary (Basic-only CI engine). Tests: auth-strategy (+6 Bearer), install-auth-strategy (+2), e2e OPEN_SETTINGS_AUTH-opens-Settings case. Full suite 105 files / 1175 green; tsc + biome ci + coverage clean. Refs: ADR-009 (architecture.md:256), FR-4 (prd.md:324), Story 28.1/28.2. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…c-context
Closes Epic 28 — all three AuthStrategy concretes (Basic/Bearer/OIDC) live;
FR-4 + ADR-009 fully delivered. Installs react-oidc-context + oidc-client-ts
(own `oidc` Vite chunk). main.tsx DYNAMICALLY imports the provider
(src/lib/oidc-provider.tsx) only when the active connection is OIDC →
Basic/Bearer users never load it (tree-shake; build shows split chunks).
NEW OidcAuthStrategy (injected accessor getter — auth-strategy.ts stays
React-free). authorizationHeader() awaits the bridge accessor's getToken()
(silent-renew on demand) → the async seam from 28.1 pays off with zero funnel
edits. OidcTokenBridge (useAuth) publishes the accessor into the plain-TS
singleton oidc-accessor.ts; OidcAuthStrategy reads it via the dispatcher's
injected getter.
NFR-11: tokens in-memory only (react-oidc-context default userStore; NO
WebStorageStateStore). Only {issuer,clientId,scopes} config persists (23.2).
<AuthProvider> is render-time → switch-into/out-of-OIDC fires a guarded
reload (reloadIfOidcProviderMismatch, no-op at mount). Sign-in/out affordances
in the Auth tab. DormantAuthStrategy + the last dormancy note removed.
Tests: OIDC strategy (+7), oidc-accessor (+5); dormancy assertions dropped;
e2e no-dormancy + sign-in-pending + Save-persists. Full suite 106 files /
1187 green; tsc + biome ci + coverage + build all clean. RC-18 documents the
reload + engine-side + in-memory boundaries.
Refs: ADR-009 (architecture.md:256), FR-4 (prd.md:324), NFR-11 (prd.md:429).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: syalioune <sy_alioune@yahoo.fr>
The default Flowable engine is Basic-only and cannot validate IdP JWTs (ADR-009), so end-to-end OIDC testing needs a real OpenID Provider. Adds a throwaway Keycloak fixture (standalone docker-compose.keycloak.yml, distinct project name) that auto-imports keycloak/flowatch-realm.json: - realm `flowatch`, public PKCE client `flowatch` (S256, redirect http://localhost:5173/*, webOrigins localhost:5173, no secret) - two test users — mira/mira-test, alice/alice-test (offline_access) - Keycloak on :8081 (Flowable owns :8080); tokens stay in-memory (NFR-11) make keycloak-up / keycloak-down / keycloak-logs / keycloak-ps. Settings → Authentication → OIDC: issuer http://localhost:8081/realms/flowatch, client `flowatch`, scopes openid profile email offline_access. docs/oidc-testing.md documents the flow + what to verify (header swap, PKCE, in-memory tokens, silent renew, sign-out). Verified: well-known issuer + PKCE S256 advertised; client + both users imported correctly via the admin API. Credentials are GitGuardian-allowlisted as throwaway dev-only (keycloak/** + the two passwords). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…kens, post-signin refetch (Story 28.4)
Four defects caught by the live-Keycloak smoke (docs/oidc-testing.md fixture):
1. Redirect loop — OidcAuthStrategy.onUnauthorized() called signinRedirect()
on every 401. The Basic-only Flowable engine 401s every OIDC call, so the
app bounced to the IdP endlessly. Now onUnauthorized does a DEBOUNCED
(<=1/10s) best-effort silent renew (signinSilent, iframe) and never
interactive-redirects. Sign-in stays user-initiated via the Auth-tab button.
getToken() no longer calls signinSilent per-request (iframe storm).
2. `Authorization: Basic Og==` — probe/nav calls fired under the module-default
BasicAuthStrategy (empty creds = btoa(":")) before app.tsx's mount effect
swapped the strategy. main.tsx now installs the strategy at module load.
3. NFR-11 violated — oidc-client-ts' DEFAULT userStore is sessionStorage, NOT
in-memory. oidc-provider.tsx now passes an explicit InMemoryWebStorage
userStore; stateStore stays localStorage (PKCE verifier survives the redirect).
4. Post-sign-in dashboard had no token — react-oidc-context finishes the token
exchange ASYNC after mount, so the first probe/nav-count/loader fetches fire
before the access token exists (no header → 401, screens stuck). app.tsx now
re-runs probe + tenants + nav counts + router.invalidate on OIDC_AUTH_CHANGED,
so the dashboard self-populates with the Bearer token once sign-in completes.
Verified end-to-end vs live Keycloak (user mira): token endpoint 200, Flowable
calls carry Bearer <jwt> automatically after sign-in (no manual nav), Auth tab
shows "signed in — mira", zero tokens in web storage, no redirect loop. Full
suite 106 files / 1188 green; tsc + biome ci + coverage + build clean. RC-18 +
CLAUDE.md updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…t (Story 28.4) The `check` job's NOTICE-freshness gate (generate-notice.mjs --check) failed: Story 28.4 added react-oidc-context + oidc-client-ts to dependencies but the generated NOTICE wasn't regenerated. Regenerated — adds oidc-client-ts (Apache-2.0) + react-oidc-context (MIT); both inside the license allow-list (license-checker green). GitGuardian flagged the Keycloak test-fixture credentials (mira-test / alice-test / admin). Extend `.gitguardian.yml`: path-ignore docs/oidc-testing.md (it repeats the fixture creds) alongside the already-ignored keycloak/** + docker-compose.keycloak.yml, and add an `admin` ignored-match for the bootstrap admin password. All three are intentionally-weak throwaway dev-only creds for a never-deployed local fixture. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…1 size gate The `check` job's NFR-21 file-size gate (≤50 KB) failed: Story 28.x pushed src/components.tsx to 55.9 KB and src/api.ts to 51.2 KB. - Move the Settings → Authentication tab (SettingsAuthTab + OidcSignInOut + hydrate/build helpers, ~250 lines) to NEW src/components/SettingsAuthTab.tsx. components.tsx 55.9 KB → 46.5 KB. `api`/`toast` import from the barrel is a runtime-safe cycle (used only in effects/handlers). All testids preserved; settings-auth-tab + saved-connections e2e green (25 passed). - Trim the Story 28.1 auth-strategy comment block in api.ts: 51.2 KB → 50.9 KB. - Coverage: the extracted Auth tab carried 85% branch coverage, so removing it drops components.tsx branches 75→74 (≤2pp ratchet-down). SettingsAuthTab.tsx is added to the coverage include + gated at 80/80/65/80 — the code + its tests moved together, no coverage loss. tsc + biome ci + vitest 1188 + coverage + build + file-size gate all green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [0.0.4-beta.1](v0.0.3...v0.0.4-beta.1) (2026-06-07) 📊 **270 commits** · **0 breaking** changes >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🔐 Authentication * **auth:** extract SettingsAuthTab from components.tsx for NFR-21 size gate ([69871f9](69871f9)) * **auth:** Story 28.2 — Settings Authentication tab + install-auth-strategy dispatcher ([7f27c0f](7f27c0f)) * **auth:** Story 28.3 — Bearer (paste-a-token) auth strategy ([8d6c8b5](8d6c8b5)) * **oidc:** Keycloak OIDC test fixture for the AuthStrategy (Story 28.4) ([5b6949e](5b6949e)) * **oidc:** stop 401 redirect loop, Basic Og== leak, sessionStorage tokens, post-signin refetch (Story 28.4) ([ca2143a](ca2143a)) * **oidc:** Story 28.4 — OIDC Authorization Code + PKCE via react-oidc-context ([33e7796](33e7796)) ### 🌐 Flowable REST contract * **api:** Story 28.1 — pluggable AuthStrategy seam in request() funnel ([9ba918d](9ba918d)) ### 🛠️ DevEx & Tooling * **ci:** refresh NOTICE for oidc deps + extend GitGuardian allowlist (Story 28.4) ([dddeed5](dddeed5)) * **release:** back-merge v0.0.3 into develop [skip release] ([0a5ec66](0a5ec66)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
…y fallback (Story 29.1)
Install @bpmn-io/form-js-viewer@1.21.3 as the 3rd Pattern P-006 vanilla-wrap
consumer (after bpmn-js / dmn-js) and render modern form-js task forms inside
the existing <TaskFormPanel>, keeping the Story 11.3 legacy formProperties
renderer verbatim as the FR-23 fallback.
- New `forms` Vite manualChunk + optimizeDeps; form-js CSS imported once in
main.tsx; .form-js-host data-look override hooks (no hard-coded colors).
- Widen FlowableTaskForm with `components?`; exported `classifyTaskForm`
discriminator + `mapFormJsData` envelope mapper.
- classifyTaskForm requires NON-EMPTY arrays: the live engine returns
`formProperties: []` for no-form tasks, so a bare Array.isArray check wrongly
hides the Complete button (golden-path regression). Empty arrays -> "none".
- form-js submit maps `data` -> the SAME `{ properties: [{id,value}] }` envelope
via api.submitTaskForm (FR-22 wire path preserved; no new endpoint).
- TaskDetail Complete-button gate now uses classifyTaskForm(...) !== "none".
- Tests: unit + form-js component tests (mocked Form) + e2e fixture-injection.
Gates green: tsc, biome ci, vitest (1199), build (forms chunk), playwright.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…y 29.1)
bmad-code-review (Blind Hunter / Edge Case Hunter / Acceptance Auditor)
findings actioned:
- mapFormJsData: skip null/undefined field values instead of serializing them
to the literal strings "null"/"undefined" (faithful to the legacy wire shape).
- FormJsForm: add key={taskId} so navigating between two form-js tasks gets a
fresh instance (clean ready/busy/error state), mirroring the legacy branch's
taskId-keyed reset.
- FormJsForm: add a cancelled-guard to the async importSchema().then/.catch
chain to avoid setState-after-unmount on fast navigation (BpmnModeler/useApi
precedent).
- form-js submit handler: re-entrant guard (if busy return).
- Unit test for the mapFormJsData null/undefined skip.
Non-scalar serialization + real-viewer failure-path e2e deferred (no live
form-js source in 29.1; tracked in deferred-work.md). Gates green: tsc, biome,
vitest (1201), playwright (form specs + golden-path).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: syalioune <sy_alioune@yahoo.fr>
@bpmn-io/form-js-viewer declares "SEE LICENSE IN LICENSE" in package.json (license-checker reports it as "Custom: LICENSE"), same as bpmn-js / dmn-js; its LICENSE file is MIT (https://github.com/bpmn-io/form-js/blob/develop/LICENSE). Extend --excludePackagesStartingWith to cover the scoped @bpmn-io/form-js prefix so the strict --onlyAllow gate passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [0.0.4-beta.2](v0.0.4-beta.1...v0.0.4-beta.2) (2026-06-07) 📊 **274 commits** · **0 breaking** changes >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ###▶️ Runtime, Tasks & Forms * **forms:** apply code-review patches to form-js task rendering (Story 29.1) ([554f938](554f938)) * **forms:** render task forms via @bpmn-io/form-js-viewer with legacy fallback (Story 29.1) ([9585f13](9585f13)) ### 🧰 Other * allowlist @bpmn-io/form-js-viewer in license-checker (Story 29.1) ([43eaef3](43eaef3)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.1.0 to 4.2.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@4907a6d...650006c) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
… round-trip (Story 30.1)
Register a `flowable` moddle descriptor on the vanilla bpmn-js modeler and
expose Flowable element extensions as editable fields in the existing
`.mod-props` panel — delivering FR-38 and the D-8 / R-3 differentiator
(Camunda Modeler drops Flowable extensions on import→export; Flowatch's
descriptor types the full surface so every `flowable:` attribute and
extensionElements child round-trips losslessly).
Two halves:
- Descriptor = round-trip completeness. `src/modeler/flowable-moddle.json`
is authored from the canonical flowable-bpmn-extensions.xsd and registered
via the only constructor change: `moddleExtensions: { flowable: ... }`.
Untyped/foreign content still round-trips via moddle lax `$attrs`.
- Fields = editability. Inline element-type dispatch on `bpmnKind(sel)`
(UserTask / ServiceTask / ScriptTask / CallActivity / BusinessRuleTask /
StartEvent / SequenceFlow + Process-level fields in the Outline). Simple
attrs write via `modeling.updateProperties` (empty/false clears — Flowable
booleans are string "true"/absent); listeners, field injection and in/out
mappings write nested extensionElements via `bpmnFactory.create` +
`modeling.updateModdleProperties` through the command stack.
Removes the `bpmn-properties-pending-banner` placeholder (placeholder-then-
real). Adds headless round-trip unit tests (bpmn-moddle), dispatch-per-kind
component tests, and a live-engine e2e asserting the exported XML carries the
edits. Regenerates the BPMN-modeler visual baseline for the new Outline
Process section. No new endpoint; deploy path unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…extensions (Story 30.2) Closes ADR-006's DMN half. The Flowable DMN XML converter consumes standard OMG DMN and ships NO `flowable:`-namespace extensions (its parser schema dir holds only OMG DC/DI/DMN schemas), so — unlike the BPMN half (Story 30.1) — there is no rich Flowable field set to author and intentionally no DMN moddle descriptor. This is a verify-and-document story: - Document the negative finding in CLAUDE.md with the schema-dir citation (auditable) + the "no DMN descriptor by design" rationale. - Verify (not reimplement) decision id/name + hit policy + input/output typeRef editing + round-trip — dmn-js's built-in definitionPropertiesView and decision-table editor already own this. No new metadata field needed. - Prove lossless round-trip headless via dmn-moddle (standard surface + non-default COLLECT/SUM + the generic OMG extensionElements escape hatch with a foreign child) and live via an e2e (real dmn-js load→export retains the table + a non-default hitPolicy="FIRST"). - Lock JUEL-not-FEEL (RC-13) with a Pattern P-008 guard that parses DmnModeler.tsx and asserts no FEEL label is introduced. Only modeler change is a `dmn-save-xml` testid on the existing Save button. No new endpoint; deploy / test-execute wire paths unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…ze gate Story 30.1's additions (descriptor fields, nested-extension editors, condition + event-definition editing) pushed src/modeler/BpmnModeler.tsx to 71 KB, over the 50 KB navigability limit (NFR-21, check-file-size.sh). Split by responsibility — no behavior change: - src/modeler/ExtensionEditors.tsx — the listener / field-injection / in-out editor sub-components (presentational, draft-state-owning widgets). - src/modeler/FlowablePropertiesPanel.tsx — the .mod-props panel: moddle read/write helpers, element-type field dispatch, condition + event-definition fields, Process-level Outline section. Takes the live modeler ref + selection + a re-render bump from the parent. BpmnModeler.tsx drops to ~33 KB; the new files are each well under the limit. All gates green (tsc / biome / 1229 tests); the two BPMN-properties e2e specs pass unchanged against the live engine. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [0.0.4-beta.3](v0.0.4-beta.2...v0.0.4-beta.3) (2026-06-08) 📊 **278 commits** · **0 breaking** changes >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🎨 Modelers (BPMN & DMN) * **modeler:** DMN round-trip + JUEL guard; document no-Flowable-DMN-extensions (Story 30.2) ([ace0a53](ace0a53)) * **modeler:** Flowable BPMN properties panel with lossless extension round-trip (Story 30.1) ([c7269bd](c7269bd)) * **modeler:** split properties panel into modules for the NFR-21 size gate ([965cefe](965cefe)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
Surface the engine version reported by api.ping() as conn.version on the "ok" probe commit (no new /management/engine round-trip), and render a non-blocking <VersionDriftBanner> between the Topbar and <main> when the detected version differs from the build-time __FLOWABLE_TESTED_VERSION__ baseline (currently 7.2.0). - Exact-string drift predicate (no semver lib); patch drift legitimately warns and is silenced by a one-click, version-keyed dismissal. - Dismissal persisted to localStorage flowatch.version-banner-dismissed.v1 as the dismissed version STRING (not a boolean) so a later drift to a different version re-shows the banner. Defensive try/catch on read/write. - role="status" (advisory, non-blocking); token-only CSS (Pattern P-007), warn-tinted via color-mix on --warn, density-aware via --pad/--gap/--row-h. - Golden path is silent (detected === tested); the live make-stack engine reports 7.2.0 so drift is fixture-verified via page.route injection, mirroring the form-js compat-boundary e2e precedent. Tests: unit truth-table (7) + fixture-injected e2e drift/dismiss-persist + golden-path-silent (2). Full suite 1236 green; tsc + biome clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
…y 31.1 review) Code-review patches on Story 31.1: - docs/compat.md link was route-relative (`href="docs/compat.md"`) and 404'd from every SPA screen since docs/ is not bundled into the deployed app. Point at the absolute repo source URL, open in a new tab. - Trim both sides of the drift compare (tested/detected). The vite `define` capture keeps a trailing `\r` on a CRLF compat.md and the engine could pad `r.version`; an un-trimmed exact-string compare would false-positive the banner on the golden path. Whitespace normalization only — not semver tolerance; exact-string intent preserved. Banner copy textContent unchanged; tsc + 7/7 unit + biome green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [0.0.4-beta.4](v0.0.4-beta.3...v0.0.4-beta.4) (2026-06-08) 📊 **281 commits** · **0 breaking** changes >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🧭 Routing & Navigation * **chrome:** harden version-drift banner link + version compare (Story 31.1 review) ([658a6e2](658a6e2)) * **chrome:** Story 31.1 — version-drift advisory banner (NFR-7) ([c755f4c](c755f4c)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
Add @axe-core/playwright (devDependency, axe-core 4.11.4) and a 90-cell accessibility matrix scan (15 top-level routes × 3 looks × 2 themes). Look/theme is seeded before first paint via the Pattern P-007 localStorage key + <html> data-attributes; modeler canvas internals are excluded (.djs-container, AC #8). The scan is advisory in 32.1 — it records findings to a git-ignored JSON artifact and asserts only matrix completeness; the hard gate lands in 32.2 (placeholder-then-real). Extract the canonical screen registry to e2e/a11y/screens.ts so keyboard.spec, aria.spec, and the new axe-scan spec share one source (test-infra dedup, not a src/ pattern extraction). Coverage strictly increased — keyboard.spec now also walks /app-definitions, /batches, /events. Audit deliverable: docs/a11y-audit-1.0.0.md. 447 violation-nodes collapse to 4 root-cause defects, all fix-in-32.2, zero won't-fix. Score -1520 (measurement baseline). Contrast findings reconcile against the 2026-05 token-math audit: they fall on token pairs that audit never checked. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
… the matrix scan Remediates every critical/serious finding from the Story 32.1 audit (docs/a11y-audit-1.0.0.md): 447 axe violation-nodes to 0 across all 90 matrix cells (15 screens x 3 looks x 2 themes). Post-fix rubric score 100 (>=98 gate). Root causes: - label (108): aria-label / htmlFor+id on the Topbar search, the Events + App-definitions filter strips, and the BPMN properties panel. - scrollable-region-focusable (90): tabIndex=0 + role=region + aria-label on the PageHead .code snippet (justified biome-ignore — the tabindex IS the WCAG SC 2.1.1 fix). - color-contrast (243): new on-tint foreground tokens --ok-fg/--warn-fg/--bad-fg/--info-fg for the light status chips/badges (OKLCH-lightness-lowered, hue/chroma preserved; dark mirrors the semantic token); UA buttonface reset on the dark BPMN outline rows; the dmn-js decision-table FEEL cells are out-of-tree and excluded (AC #8). - select-name (6): aria-label on the Events event-type select. Flips e2e/a11y/axe-scan.spec.ts from advisory to a hard expect(blockingViolations).toEqual([]) gate and extends the canvas exclusion to .dmn-decision-table-container. Extends the Pattern P-008 contrast guard with 4 on-tint pairs x 6 combos and adds a Topbar accessible-name regression pin. Finalizes both a11y audit docs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
… found violations Code-review follow-ups for Story 32.2 (D1 + patches): - Expand the axe hard gate to the 9 $id/$key detail routes (error-state per look×theme; populated-state for deployment/definition/decision via a deterministic BPMN+DMN beforeAll seed). No conditional test.skip — seeded cells are only emitted for entities guaranteed present, so every generated test runs (72 detail cells, 0 skipped, 0 blocking). - Fix scrollable-region-focusable (serious): role="region"/aria-label/ tabIndex on the XML <pre> viewers (ProcessDefinitionDetail, DecisionDetail) and the stacktrace <pre> panels (JobStacktracePanel, BatchPartsPanel). - Fix color-contrast (serious): ErrorBox message text var(--bad) → var(--bad-fg); --bad failed AA on the lightest background (terminal/light). - Regenerate the BPMN-modeler visual baseline (32.2's .out-row CSS change drifted the outline panel vs the Story 30.1 snapshot). - Harden the g-d nav-chord e2e (sidebar-mount gate + waitForURL) — was a load flake. - Doc patches: .out-row re-attributed to the BPMN modeler outline; FEEL → JUEL (project convention); a11y-controls docstring tightened. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [0.0.4-beta.5](v0.0.4-beta.4...v0.0.4-beta.5) (2026-06-14) 📊 **285 commits** · **0 breaking** changes >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🌍 i18n & Accessibility * **a11y:** Story 32.1 — axe-core matrix audit across look×theme×screen ([61bac84](61bac84)), closes [#8](#8) * **a11y:** Story 32.2 — clear all blocking axe violations + hard-gate the matrix scan ([22a2eea](22a2eea)), closes [#8](#8) * **a11y:** Story 32.2 review — expand axe gate to detail routes + fix found violations ([025c5a5](025c5a5)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
Promote the app version shown in the Logo brand-tag from v0.0.2 to v1.0.0, marking the transition out of the 0.0.x pre-release series. BREAKING CHANGE: Flowatch graduates from the 0.0.x pre-release line to the 1.0.0 GA series. This triggers the major-version bump per the release milestone plan; on develop semantic-release emits 1.0.0-beta.1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [1.0.0-beta.1](v0.0.4-beta.5...v1.0.0-beta.1) (2026-06-14) 📊 **287 commits** · **1 breaking** change >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### ⚠ BREAKING CHANGES * **branding:** Flowatch graduates from the 0.0.x pre-release line to the 1.0.0 GA series. This triggers the major-version bump per the release milestone plan; on develop semantic-release emits 1.0.0-beta.1. ### 🎭 Design System & Theming * **branding:** graduate Flowatch to 1.0.0 GA line ([0ded9a2](0ded9a2)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
- Replace pre-alpha banner with 1.0.0 release announcement - Add screenshots section (3 dashboard variants + instance-detail) with click-to-enlarge lightbox using native <dialog> -- no CDN, NFR-9 compliant - Update project status section: Pre-alpha -> Stable 1.0.0 - Stage screenshots/ from branding/ in landing-stage Makefile target - Update landing/README.md constraint (pre-alpha -> release banner guidance) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Alioune SY <sy.alioune.b@gmail.com>
## [1.0.0-beta.5](v1.0.0-beta.4...v1.0.0-beta.5) (2026-06-18) 📊 **302 commits** · **1 breaking** change >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🧱 Foundation & Build * **pages:** update landing page for 1.0.0 release ([d49ecea](d49ecea)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
- Correct stale references across 8 docs (api.js→api.ts, .jsx→.tsx, modeler.jsx→src/modeler/, styles.css→src/styles/, vite.config.js→.ts) - Update routing claims (no router→TanStack Router), language (JS→TypeScript), and test/lint/CI status (none→Vitest/Biome/Playwright/GHA) - Add missing API wrappers to api-contracts.md (executeTimerJob, rescheduleTimerJob, timer/deadletter stacktrace, variable CRUD, listEventSubscriptions, deployBar, listBatches, App sub-app section) - Document configurable sub-app path overrides (dmnPath/appPath/cmmnPath) - Add prominent stale-snapshot warnings to source-tree-analysis.md and component-inventory.md; add sibling-panel components table - Fix duplicate RC-13 in runtime-caveats.md (eagerly-created historic instances entry renumbered to RC-19) - Add new doc links to index.md (compat, runtime-caveats, oidc-testing, a11y-audit-1.0.0, token-metrics); reference token-metrics from README Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
… surface New request files covering endpoints added since the last Bruno update: - Repository: Get deployment resource - Runtime: Get process/task, task attachment CRUD (URL + file) - Management: Get job, execute/reschedule timer job, timer/deadletter stacktrace, batch-part stacktrace - History: Get historic process instance - Identity: Get user/group, list group members, remove user from group, update/delete group - DMN: Get DMN decision resource, get/delete DMN deployment, DMN execution auditdata - App: Get app definition, get/delete app deployment resources, deploy .bar Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.0.0 to 4.1.0. - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](docker/setup-qemu-action@ce36039...0611638) --- updated-dependencies: - dependency-name: docker/setup-qemu-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
flowable:topic was already typed in flowable-moddle.json (ServiceTaskExtension) but omitted from the properties panel — making external worker task configuration (type=external-worker + topic) impossible without hand-editing the XML. Adds one textField row between `type` and `resultVariableName` in the ServiceTask block of FlowablePropertiesPanel.tsx. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [1.0.0-beta.6](v1.0.0-beta.5...v1.0.0-beta.6) (2026-06-21) 📊 **306 commits** · **1 breaking** change >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🎨 Modelers (BPMN & DMN) * **modeler:** surface flowable:topic in ServiceTask properties panel ([6e664aa](6e664aa)) ### 🌐 Flowable REST contract * **bruno:** add missing Bruno collection requests for post-1.0.0 API surface ([17e3a28](17e3a28)) ### 📝 Documentation * **docs:** update docs for consistency and completeness post-1.0.0 ([ac407ff](ac407ff)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
…lop/docker/login-action-4.2.0 ci(deps): bump docker/login-action from 4.1.0 to 4.2.0
…lop/docker/build-push-action-7.2.0 ci(deps): bump docker/build-push-action from 7.1.0 to 7.2.0
…xinc/nginx-unprivileged-8122337 chore(deps): bump nginxinc/nginx-unprivileged from `3707417` to `8122337`
…lop/docker/setup-qemu-action-4.1.0 ci(deps): bump docker/setup-qemu-action from 4.0.0 to 4.1.0
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.0.0 to 4.1.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](docker/setup-buildx-action@4d04d5d...d7f5e7f) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…lop/docker/setup-buildx-action-4.1.0 ci(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0
…w patches - `connectionRoot()` / `dmnBase()` / `appBase()` / `cmmnBase()` helpers derive sub-app roots from a per-connection `servicePath`/`dmnPath`/`cmmnPath`/`appPath` override; blank → standard Flowable-REST 7.2.0 defaults (byte-identical to pre-34.1) - `pingForConn()` routes the test-connection call through the `request()` funnel so NFR-8 redaction and API_LOG apply; temporary auth-strategy swap is restored in a `finally` block even on failure - `<SubAppPrefixFields>` gains an overlap-warning when a prefix field duplicates the service path already embedded in baseUrl; `baseUrl` prop wired from both `<AddConnectionModal>` and `<EditConnectionModal>` - `SavedConnectionsState` bumped to `schemaVersion: 2`; lossless v1→v2 migration in `loadConnections()`; `normalizePrefix()` validates prefix fields on load - `SettingsAuthTab` removed; auth config moved into `<ManageConnectionsPanel>` (Edit button); `installStrategyForActiveConnection()` fired on `SAVED_CONNECTIONS_CHANGED` (replaces the removed Auth-tab Save path) - OIDC connection switch: Settings modal stays open (no premature dismiss); `sessionStorage` flag + mount effect reopens it after the forced reload - Sidebar side-foot stale after Topbar connection switch: `setActiveConnection` now always dispatches `conn:config-changed` unconditionally - `main.tsx` seeds `api.cfg` from the persisted active connection before first render so earliest API calls (probe, nav counts, assignee=me check) use the correct credentials and base URL - `OPEN_SETTINGS_AUTH` nav-event added; `SAVED_CONNECTIONS_CHANGED` constant extracted to `nav-events.ts` - e2e: `saved-connections.spec.ts` updated for removed Cancel button (now uses aria-labeled Close Settings); `tasks-list.spec.ts` updated to seed the `flowatch.connections.v1` schema-v2 format instead of the removed v1 key - CLAUDE.md updated: Connection config section, Auth-tab references removed, Bearer/OIDC sign-in affordance location corrected, `<AuthStrategyFields>` N=2 codified, `installStrategyForActiveConnection` dispatcher section updated - 8 new unit tests for `api.pingForConn` (Pattern P-001 funnel, NFR-8 redaction, credential isolation, strategy restore on failure) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [1.0.0-beta.7](v1.0.0-beta.6...v1.0.0-beta.7) (2026-06-21) 📊 **313 commits** · **1 breaking** change >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🌐 Flowable REST contract * **api:** Story 34.1 — configurable per-sub-app URI prefixes + review patches ([1e34a7b](1e34a7b)) ### 📦 Dependencies * **deps:** bump docker/build-push-action from 7.1.0 to 7.2.0 ([f5ed3e5](f5ed3e5)) * **deps:** bump docker/login-action from 4.1.0 to 4.2.0 ([18001c6](18001c6)) * **deps:** bump docker/setup-buildx-action from 4.0.0 to 4.1.0 ([dea036b](dea036b)) * **deps:** bump docker/setup-qemu-action from 4.0.0 to 4.1.0 ([4b1772b](4b1772b)) * **deps:** bump nginxinc/nginx-unprivileged ([b9838c8](b9838c8)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
…alysis.md Both files are snapshots from 2026-05-11 and have grown significantly out of date. The source-tree snapshot pre-dates the .tsx migration, TanStack Router, the src/routes/ restructure, and the Story 34.2 nginx removal. CLAUDE.md is the authoritative source of current structure; refs in architecture.md, index.md, and project-overview.md updated accordingly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy.alioune.b@gmail.com>
Baseline mutation score established at 71.46% on src/api.ts (2026-06-21). Threshold set to break=70 / low=70 / high=80 so CI fails if the score drops below the baseline floor. Gate-less comment removed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy.alioune.b@gmail.com>
Move all detailed architecture conventions into docs/claude/ subfiles: - api-layer.md (request() funnel, auth strategies, inspector, connection config, CORS) - modelers.md (P-006, form-js N=3, BPMN moddle, DMN JUEL discipline) - modal-conventions.md (5 modal shapes, ARIA, segmented-control, datetime-local) - component-patterns.md (panel-as-sibling, row-expand, PUT-partial, useApi, N=4 policy) - sequencing-conventions.md (14 epic/commit discipline conventions) CLAUDE.md retained as a lean 88-line index: orientation + links. No content dropped; all text preserved verbatim in subfiles. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy.alioune.b@gmail.com>
… returns an error Move the test-result badge inside the flex:1 content div so long error messages cannot push action buttons off-screen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [1.0.0-beta.8](v1.0.0-beta.7...v1.0.0-beta.8) (2026-06-28) 📊 **318 commits** · **1 breaking** change >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🔐 Authentication * **auth:** keep test/edit/delete buttons visible when connection test returns an error ([b8a264a](b8a264a)) ### 🛡️ Quality Gates * **test:** set Stryker mutation threshold at 70% (baseline 71.46%) ([99271b6](99271b6)) ### 📝 Documentation * **docs:** remove stale project-scan-report.json and source-tree-analysis.md ([93b552b](93b552b)) * **docs:** slim CLAUDE.md via progressive disclosure — 79KB → 12KB ([07fd0d9](07fd0d9)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
…hecks Promotes mutation score from advisory to a required PR gate at the 70% threshold already configured in stryker.config.mjs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
Story 34.1's unconditional conn:config-changed dispatch triggers probe + tenants + 7 nav-count calls that settle after the test's clear+seed step, inflating the drawer to 15 entries instead of 3. Add a logFrozen flag to logCall() with dev-only __flowatchPauseApiLog / __flowatchResumeApiLog window hooks. Visual test calls pause → clear → seed so in-flight real calls are silently dropped and cannot pollute the deterministic seed set. Regenerate the stale snapshot to match Story 34.1. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [1.0.0-beta.9](v1.0.0-beta.8...v1.0.0-beta.9) (2026-06-28) 📊 **321 commits** · **1 breaking** change >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### 🛡️ Quality Gates * **ci:** add Stryker mutation check to required branch-protection checks ([de06b70](de06b70)) * **test:** freeze API_LOG before clear in visual inspector baseline ([c480e27](c480e27)) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
…limit) My prior fix added ~1.6 KB of code + comments, pushing api.ts to 51.6 KB. Collapse five multi-line comment blocks to single lines or remove them (redactAuthHeader, captureBody, pause/resume hooks, request() inline annotations). No logic change — only prose reduction. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: syalioune <sy_alioune@yahoo.fr>
Signed-off-by: syalioune <sy_alioune@yahoo.fr>
## [1.0.0-rc.1](v0.0.3...v1.0.0-rc.1) (2026-06-28) GA — pluggable auth (Basic/Bearer/OIDC PKCE), Flowable BPMN properties panel + DMN JUEL round-trip guard, version-drift advisory banner, axe-core a11y gate, configurable sub-app URI prefixes, native Flowable CORS (nginx proxy removed), public release. 📊 **15 issues** closed · **324 commits** · **1 breaking** change >⚠️ **Pre-1.0 posture.** Flowatch does **not** guarantee compatibility > between pre-1.0 releases. Breaking changes may land at any time. > Operators following the main branch should expect to rebuild state > between releases. **1.0.0** will be the first public, > compatibility-stable milestone. ### ⚠ BREAKING CHANGES * **branding:** Flowatch graduates from the 0.0.x pre-release line to the 1.0.0 GA series. This triggers the major-version bump per the release milestone plan; on develop semantic-release emits 1.0.0-beta.1. ### 🎨 Modelers (BPMN & DMN) * **modeler:** DMN round-trip + JUEL guard; document no-Flowable-DMN-extensions (Story 30.2) ([ace0a53](ace0a53)) * **modeler:** Flowable BPMN properties panel with lossless extension round-trip (Story 30.1) ([c7269bd](c7269bd)) * **modeler:** split properties panel into modules for the NFR-21 size gate ([965cefe](965cefe)) * **modeler:** surface flowable:topic in ServiceTask properties panel ([6e664aa](6e664aa)) ###▶️ Runtime, Tasks & Forms * **forms:** apply code-review patches to form-js task rendering (Story 29.1) ([554f938](554f938)) * **forms:** render task forms via @bpmn-io/form-js-viewer with legacy fallback (Story 29.1) ([9585f13](9585f13)) ### 🔐 Authentication * **auth:** extract SettingsAuthTab from components.tsx for NFR-21 size gate ([69871f9](69871f9)) * **auth:** keep test/edit/delete buttons visible when connection test returns an error ([b8a264a](b8a264a)) * **auth:** Story 28.2 — Settings Authentication tab + install-auth-strategy dispatcher ([7f27c0f](7f27c0f)) * **auth:** Story 28.3 — Bearer (paste-a-token) auth strategy ([8d6c8b5](8d6c8b5)) * **oidc:** Keycloak OIDC test fixture for the AuthStrategy (Story 28.4) ([5b6949e](5b6949e)) * **oidc:** stop 401 redirect loop, Basic Og== leak, sessionStorage tokens, post-signin refetch (Story 28.4) ([ca2143a](ca2143a)) * **oidc:** Story 28.4 — OIDC Authorization Code + PKCE via react-oidc-context ([33e7796](33e7796)) ### 🎭 Design System & Theming * **branding:** graduate Flowatch to 1.0.0 GA line ([0ded9a2](0ded9a2)) ### 🧭 Routing & Navigation * **chrome:** harden version-drift banner link + version compare (Story 31.1 review) ([658a6e2](658a6e2)) * **chrome:** Story 31.1 — version-drift advisory banner (NFR-7) ([c755f4c](c755f4c)) ### 🌐 Flowable REST contract * **api:** configurable per-sub-app URI prefixes (Story 34.1, FR-59) ([47384b2](47384b2)) * **api:** move extracted-module imports to top of api.ts (biome organizeImports) ([9e6e532](9e6e532)) * **api:** split api-app.ts + api-history.ts to satisfy NFR-21 (50 KB) ([ff9a19e](ff9a19e)) * **api:** Story 28.1 — pluggable AuthStrategy seam in request() funnel ([9ba918d](9ba918d)) * **api:** Story 34.1 — configurable per-sub-app URI prefixes + review patches ([1e34a7b](1e34a7b)) * **api:** trim verbose comments in api.ts to satisfy NFR-21 (50 KB limit) ([8e43336](8e43336)) * **bruno:** add missing Bruno collection requests for post-1.0.0 API surface ([17e3a28](17e3a28)) ### 🛡️ Quality Gates * **ci:** add Stryker mutation check to required branch-protection checks ([de06b70](de06b70)) * **test:** freeze API_LOG before clear in visual inspector baseline ([c480e27](c480e27)) * **test:** set Stryker mutation threshold at 70% (baseline 71.46%) ([99271b6](99271b6)) ### 🧱 Foundation & Build * **docker:** replace nginx CORS proxy with native Flowable CORS (Story 34.2, NFR-31) ([535eb5a](535eb5a)) * **pages:** update landing page for 1.0.0 release ([d49ecea](d49ecea)) ### 🛠️ DevEx & Tooling * **ci:** refresh NOTICE for oidc deps + extend GitGuardian allowlist (Story 28.4) ([dddeed5](dddeed5)) * **release-prep:** milestone headline for 1.0.0 ([b803081](b803081)) * **release:** 0.0.4-beta.1 [skip release] ([235861d](235861d)) * **release:** 0.0.4-beta.2 [skip release] ([67f12a5](67f12a5)) * **release:** 0.0.4-beta.3 [skip release] ([14eca61](14eca61)) * **release:** 0.0.4-beta.4 [skip release] ([044cb47](044cb47)) * **release:** 0.0.4-beta.5 [skip release] ([9807ad2](9807ad2)) * **release:** 1.0.0-beta.1 [skip release] ([9883d0b](9883d0b)) * **release:** 1.0.0-beta.2 [skip release] ([2505dd2](2505dd2)) * **release:** 1.0.0-beta.3 [skip release] ([281cf56](281cf56)) * **release:** 1.0.0-beta.4 [skip release] ([cf1e467](cf1e467)) * **release:** 1.0.0-beta.5 [skip release] ([60ef769](60ef769)) * **release:** 1.0.0-beta.6 [skip release] ([46b6c06](46b6c06)) * **release:** 1.0.0-beta.7 [skip release] ([c771ed6](c771ed6)) * **release:** 1.0.0-beta.8 [skip release] ([0b8310a](0b8310a)) * **release:** 1.0.0-beta.9 [skip release] ([ddfabf3](ddfabf3)) * **release:** back-merge v0.0.3 into develop [skip release] ([0a5ec66](0a5ec66)) ### 📝 Documentation * **docs:** materialize Epic 34 (Flexible Engine Connection) + re-sync backlog ([994a66b](994a66b)) * **docs:** remove stale project-scan-report.json and source-tree-analysis.md ([93b552b](93b552b)) * **docs:** resync user-stories with GitHub issues ([d74b552](d74b552)), closes [103/#104](https://github.com/103/flowatch/issues/104) [191-#195](https://github.com/syalioune/191-/issues/195) * **docs:** slim CLAUDE.md via progressive disclosure — 79KB → 12KB ([07fd0d9](07fd0d9)) * **docs:** update docs for consistency and completeness post-1.0.0 ([ac407ff](ac407ff)) * **readme:** add live instance-detail "see it operate" screenshot (Story 33.1 follow-up) ([a6fa3fb](a6fa3fb)) * **readme:** add per-look Dashboard screenshots near the top (Story 33.1, DOC-DAA-001) ([0dd6160](0dd6160)) ### 🌍 i18n & Accessibility * **a11y:** Story 32.1 — axe-core matrix audit across look×theme×screen ([61bac84](61bac84)), closes [#8](#8) * **a11y:** Story 32.2 — clear all blocking axe violations + hard-gate the matrix scan ([22a2eea](22a2eea)), closes [#8](#8) * **a11y:** Story 32.2 review — expand axe gate to detail routes + fix found violations ([025c5a5](025c5a5)) ### 📦 Dependencies * **deps:** bump docker/build-push-action from 7.1.0 to 7.2.0 ([f5ed3e5](f5ed3e5)) * **deps:** bump docker/login-action from 4.1.0 to 4.2.0 ([18001c6](18001c6)) * **deps:** bump docker/setup-buildx-action from 4.0.0 to 4.1.0 ([dea036b](dea036b)) * **deps:** bump docker/setup-qemu-action from 4.0.0 to 4.1.0 ([4b1772b](4b1772b)) * **deps:** bump nginxinc/nginx-unprivileged ([b9838c8](b9838c8)) ### 🧰 Other * allowlist @bpmn-io/form-js-viewer in license-checker (Story 29.1) ([43eaef3](43eaef3)) ### 🌍 Help, i18n & Docs * add GitHub social-preview card (Story 33.3, DOC-DAA-002) ([d26b619](d26b619)) * draft Flowable forum announcement for v1.0 (Story 33.2, DOC-SYS-001) ([dc730e1](dc730e1)), closes [#4](#4) --- _Auto-generated by [semantic-release](https://github.com/semantic-release/semantic-release)._
|
🎉 This PR is included in version 1.0.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release 1.0.0
Promotes
develop→release/1.0.0→mainper ADR-011.Pre-flight
Refs milestone-0.0.1 retro / story 6.5-5 runbook.