diff --git a/.agents/skills/fast-forward-changelog/.fast-forward-install.json b/.agents/skills/fast-forward-changelog/.fast-forward-install.json new file mode 100644 index 0000000..1dc46c0 --- /dev/null +++ b/.agents/skills/fast-forward-changelog/.fast-forward-install.json @@ -0,0 +1,21 @@ +{ + "schema": 1, + "owner": "fast-forward/changelog", + "name": "fast-forward-changelog", + "scope": "project", + "target": ".agents/skills/fast-forward-changelog", + "source": { + "package": "fast-forward/changelog", + "version": "v0.2.0", + "reference": "2d3f84fa9e5350f03636153fdb3ae2a822e5ae60" + }, + "files": { + "LICENSE": "58bd7c00603e499c575d53a97b8b8c1d1398f584ea5f9f77d369780efb2066ab", + "SKILL.md": "bef12db180f4c8812019ca9286ebaba722fca9850c6d6cfa6a9e7f0e060b4ac2", + "examples/contribution.php": "46f2b30277b4f880a8fc4f5d503d2a4fd13c6802a929159b1895f55f9a97dd2e", + "references/automation.md": "1096976a165c2a0f849470312996b4cdffaf43a18ca04be6e0f823720b47eccb", + "references/cli.md": "787f33efcbc72d40ce5b55507f6f0a59b686bffe4d7edfcf4242c427d7db023e", + "references/php-api.md": "32b67728f3c4ba5870a40f5ad88946dd274f84619676d4783642780a172cade8" + }, + "payload_sha256": "6aa35eb349f80bad8fc78a2cad7995b2fe39e41948f9538ad8a7b0b662ab9fa8" +} diff --git a/.agents/skills/fast-forward-changelog/LICENSE b/.agents/skills/fast-forward-changelog/LICENSE new file mode 100644 index 0000000..f320900 --- /dev/null +++ b/.agents/skills/fast-forward-changelog/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Felipe Sayao Lobato Abreu + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/.agents/skills/fast-forward-changelog/SKILL.md b/.agents/skills/fast-forward-changelog/SKILL.md new file mode 100644 index 0000000..69fb4dd --- /dev/null +++ b/.agents/skills/fast-forward-changelog/SKILL.md @@ -0,0 +1,142 @@ +--- +name: fast-forward-changelog +description: Adopt Fast Forward Changelog's GitHub lifecycle, write and check independent fragments, review version PRs, and perform authorized release maintenance. Discover the selected release's documentation and CLI capabilities before choosing integration details. +license: MIT +compatibility: Requires access to the application repository and the selected release's documentation. Verify that release's runner or PHP requirements before execution. Local CLI examples use CPX; PHP integration uses the application's Composer installation. GitHub credentials are needed only for authorized remote operations. +metadata: + author: php-fast-forward + source: original + repository: https://github.com/php-fast-forward/changelog + api-baseline: Verify the selected published release; commands and integration details are release-specific. +--- + +# Fast Forward Changelog + +Ordinary contributions add independent `.changelog/*.md` fragments. GitHub +automation checks each contribution, maintains PR feedback and prepares a +reviewable version PR. That PR consolidates the accepted fragments into +`CHANGELOG.md` and deletes only the consumed files. Publication follows a +separate approval for the exact result; a green check or prepared PR is not that +approval. + +## Select the real contract + +1. Read application instructions, Git status and its existing changelog setup. + Use its reviewed version for an ordinary task; do not upgrade it incidentally. + If its ref is a moving channel, resolve the current commit and corresponding + published full tag before selecting a local runtime. `v0` is not Composer `0`. +2. For new adoption or a requested update, discover the latest published stable + release in the [official repository](https://github.com/php-fast-forward/changelog/releases). + Confirm the complete release tag and its commit, exclude drafts/prereleases, + and respect any explicitly selected maintenance line. For CPX or PHP use, + confirm the same version is available on + [Packagist](https://packagist.org/packages/fast-forward/changelog). +3. Read that tag's README and relevant documentation, not `main` or an old copy + of this skill. Before adding a workflow, inspect its + `resources/workflows/changelog.yml`, companion README and the reusable workflow + they reference. Copy the release's caller, review inputs/permissions and set + its product references to that verified full tag or immutable release commit; + do not retain an obsolete embedded pin blindly. After setting the final ref, + inspect the reusable workflow at that exact ref and confirm its inputs, + permissions and runner requirements before saving the application caller. + Keep publication + disabled for adoption. Change existing integration only within task scope. +4. For local CLI work, set `CHANGELOG_VERSION` to the verified exact numeric + release, without the tag's `v`. Discover commands and inspect their arguments: + + ```sh + cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" list --raw + cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" help add + cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" help check + ``` + + Use [CPX's official setup](https://github.com/laravel/cpx) when installation is + authorized; do not pin the executor in these commands. `--skip-local` selects + its separate tool installation. CPX may handle `--help` or `--version` itself, + so use `help ` for changelog help. An existing reviewed project binary + may be used directly instead. Confirm prerequisites from the chosen release. + +Installing this skill installs instructions, independently of the runtime. If +the selected CLI offers skill installation/check/update operations, inspect +their help and use only the supported operation and requested scope. Otherwise +follow that release's skill-installation guide; do not invent a command. + +This procedure avoids a frozen API inventory. A breaking release can still +change the lifecycle or these entrypoints: when documentation and capabilities +disagree, resolve the mismatch before writes rather than guessing compatibility. + +## Write and check a contribution + +Read the change and describe its observable effect. For example, create one +unique `.changelog/preserve-markdown-spaces.md`: + +```markdown +--- +category: fixed +type: patch +--- + +Preserves meaningful Markdown spaces when parsing fragments. +``` + +Keep existing notes and Markdown intact. Use the selected release's fragment +schema. For the established category scheme, `added`, `changed` and `deprecated` +default to `minor`, `removed` to `major`, and `fixed`/`security` to `patch`. +Persist the effective type explicitly; a justified override may express a +compatible dependency change as `changed`/`patch`. Apply the application's +versioning policy deliberately, especially during `0.x` development. + +After help confirms these arguments, the CLI can create and validate that note +from the application directory instead of writing the example manually: + +```sh +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" add "Preserves meaningful Markdown spaces when parsing fragments." --category=fixed --no-interaction +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" check --no-interaction +``` + +Verify that exactly one intended fragment was created and central history stayed +unchanged. Do not run both authoring routes for the same note. Fix diagnostics +and rerun the check. Before a committed PR comparison, inspect `help check`, +fetch the intended baseline under existing authority, then use its supported +comparison option, for example: + +```sh +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" check --since=origin/main --no-interaction +``` + +That comparison requires committed contribution changes. A local uncommitted +fragment can pass local validation without satisfying the PR comparison. + +Optional PR/issue/author metadata must come from verified evidence. When the +origin PR is already known and supported, use `--pull-request=` or +`pull_request: ` after confirming its repository and exact head. Leave +unknown fields absent; do not invent a number or require a second fragment +commit after opening a PR. If the selected release resolves PR origins during +compilation, follow its documented policy consistently across preparation and +publication. No qualifying PR should become an invented commit or author link. + +Ordinary work preserves inherited fragments and published history. Do not add a +new `Unreleased` section. Editorial replacement, history maintenance and release +consolidation require their own task scope. + +## Verify the lifecycle + +For adoption, open a small pilot PR and inspect the exact head's required status, +sticky comment and independent application checks. Exercise a missing or +malformed note and any enabled bot route. Inspect the generated version PR: +planned version/impact, exact notes, central-history changes and only the accepted +fragment deletions. Review again after its head changes. The workflow does not +merge its own version PR. + +Load only the reference needed for the task: + +- [Automation](references/automation.md): selected caller, optional settings, + credentials, maintenance lines and pilot verification. +- [CLI maintenance](references/cli.md): previews, consolidation, history, + interrupted transactions and separately authorized publication. +- [PHP integration](references/php-api.md): release-specific application + services and the bundled example, only when programmatic integration is needed. + +Retain authority already given, but do not infer commit, push, merge, installation +elsewhere or publication authority from an ordinary fragment task. Report changed +paths, executed checks and the verified version/PR/SHA relevant to the result. diff --git a/.agents/skills/fast-forward-changelog/examples/contribution.php b/.agents/skills/fast-forward-changelog/examples/contribution.php new file mode 100644 index 0000000..1fdd8de --- /dev/null +++ b/.agents/skills/fast-forward-changelog/examples/contribution.php @@ -0,0 +1,45 @@ + + * @license https://opensource.org/licenses/MIT MIT License + */ + +use FastForward\Changelog\Container\ServiceProvider\ChangelogServiceProvider; +use FastForward\Changelog\Fragment\FragmentWriterInterface; +use FastForward\Changelog\Release\Factory\ReleaseOptionsFactoryInterface; +use FastForward\Changelog\Validation\CheckServiceInterface; + +use function FastForward\Container\container; + +$autoload = $argv[1] ?? ''; +$directory = realpath($argv[2] ?? ''); +if ('' === $autoload || !is_file($autoload) || !isset($argv[2]) || false === $directory || !is_dir($directory)) { + fwrite(STDERR, "Usage: php contribution.php /consumer/vendor/autoload.php /existing/project\n"); + exit(2); +} +require $autoload; + +$container = container(ChangelogServiceProvider::class); +$options = $container->get(ReleaseOptionsFactoryInterface::class)->create([ + 'workingDirectory' => $directory, + 'source' => 'tags', +]); +$path = $container->get(FragmentWriterInterface::class)->add( + $options, + 'Preserves meaningful Markdown spaces when parsing fragments.', + category: 'fixed', + name: 'php-api-example.md', +); +$expected = "---\ncategory: fixed\ntype: patch\n---\n\nPreserves meaningful Markdown spaces when parsing fragments.\n"; +if ($expected !== file_get_contents($path)) { + throw new RuntimeException('The fragment does not match the expected application output.'); +} +if (!$container->get(CheckServiceInterface::class)->check($options)->isValid()) { + throw new RuntimeException('The pending fragment inventory is invalid.'); +} +fwrite(STDOUT, "Contribution example PASS\n"); diff --git a/.agents/skills/fast-forward-changelog/references/automation.md b/.agents/skills/fast-forward-changelog/references/automation.md new file mode 100644 index 0000000..46e36e1 --- /dev/null +++ b/.agents/skills/fast-forward-changelog/references/automation.md @@ -0,0 +1,58 @@ +# GitHub lifecycle adoption + +Load when installing or changing workflows, configuring credentials or runners, +selecting maintenance lines, or diagnosing feedback. Discover the latest stable +published release for new adoption, respecting an explicitly selected release +line. For ordinary work, retain the application's reviewed implementation. + +## Use the selected release's caller + +From the verified full tag, read `README.md`, +`resources/workflows/changelog.yml`, its companion README, and the reusable +workflow referenced by that caller. Consult that tag's relevant guides, including +`docs/reusable-lifecycle.md`, `docs/github-app.md` and `docs/automation-map.md` when +present. If paths moved, follow that release's README rather than guessing. +Do not combine a caller from one version with settings copied from `main`. + +Copy the caller into the application's `.github/workflows/`, review its events, +inputs and effective permissions, then set its product references to the selected +published complete tag or verified immutable release commit. Review older pins +embedded in the copied caller. After replacing a pin, inspect the reusable +workflow at the final selected ref and verify its actual inputs, permissions and +runner requirements before saving the application caller. +GitHub `uses` references the executable reusable +workflow under `.github/workflows`; the resource caller is a copyable asset. +Internal `repository-*` workflows belong to the library, not the consumer. + +Keep publication disabled during adoption. Choose base and managed branches, +fragment/history paths, historical sources and PR-reference policy consistently +across enabled operations. For parallel maintenance, select a separate managed +branch per release line and verify its actual planned version; a branch's name +does not enforce a SemVer range. Use individual workflows or Docker actions only +when their release-specific contracts suit the application's orchestration. + +Full tags preserve a concrete implementation. A moving major channel is an +explicit update policy and must be documented by the selected product release; +do not assume it exists. In particular `@v0` may cross breaking `0.x` minors and +does not mean Composer `^0.1`. Changing a workflow ref is a deliberate update. + +## Credentials and acceptance + +Use the selected workflow's documented token/App route and the application's +approved secret storage. Preserve the verified automation identity and narrow +permissions. Never check out untrusted PR code in a privileged custom job. +Token-generated events may behave differently from human/App events; consult +the selected release and GitHub's current rules before promising downstream CI. + +Run a small pilot with publication disabled. Verify a valid fragment, missing or +malformed notes, the exact PR head's required status and sticky-comment recovery, +any enabled bot operation, and the generated version PR. Check the actual runner +requirements and access when changing Linux/self-hosted selection. Test custom +policy changes relevant to the application rather than assuming a default-branch +green run proves its generated head. + +The version PR must preserve exact notes and consume only its accepted fragment +set, with no technical plan files or new `Unreleased` section. Head changes need +fresh review and checks. Successful preparation does not authorize merging or +publication. Enable publication only under existing authority for the verified +result, using the selected release's committed evidence and recovery procedure. diff --git a/.agents/skills/fast-forward-changelog/references/cli.md b/.agents/skills/fast-forward-changelog/references/cli.md new file mode 100644 index 0000000..55eea75 --- /dev/null +++ b/.agents/skills/fast-forward-changelog/references/cli.md @@ -0,0 +1,77 @@ +# CLI maintenance + +Load for release previews, history maintenance, recovery or authorized +publication. First select the real release and inspect `list --raw` and +`help ` as described in the skill. Read `docs/cli-fragments.md` and the +relevant maintenance/publication guide from that complete release tag. Verify +that its PHP and Git requirements match the environment. Do not infer arguments +or current behavior from an older installed skill. + +## Execute the selected CLI + +Run from the application's directory. `CHANGELOG_VERSION` is the verified exact +numeric product version, not a range frozen into this skill: + +```sh +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" list --raw +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" help status +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" help version +``` + +CPX keeps tool dependencies separate from the application's Composer project; +the command still operates on application files. It is not a filesystem sandbox +or a PHP runtime. CPX's own update/help/version commands concern the executor. +An existing reviewed `vendor/bin/changelog` may run the same supported arguments +without changing the application's dependencies. + +When `list` offers instruction-management operations, inspect their help before +using install, check or update options. Use the requested project/global scope +and preserve local changes. Their existence is a discovered capability, not a +promise that every published changelog version contains them. Runtime updates, +instruction installation and host-session activation remain separate results. + +## Preview before consolidation + +For releases offering these arguments, inspect the read-only plan first: + +```sh +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" status --json --source=tags --no-interaction +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" version --dry-run --source=tags --no-interaction +``` + +Review the baseline/current/next version, effective impact, accepted fragment +paths, notes and affected files. Choose the relevant maintenance branch and +historical source explicitly. A branch name alone does not establish a release +range. Check command help before treating an exit code as success or failure; +check modes may use a nonzero result for drift as well as errors. + +The normal GitHub lifecycle prepares the version PR. Applying a local version +transaction requires existing consolidation authority and the same reviewed +options as the preview. Preserve exact committed input bytes, custom-template +trust requirements and any PR-resolution setting required by that release. +Verify only central history and consumed-fragment deletions are changed; no +technical plan file or new `Unreleased` section belongs in the version PR. + +If interrupted, preserve the recovery journal and remaining files. Follow that +release's recovery procedure with the same inputs. Do not edit a journal, delete +newer notes or replace history merely to force a retry. + +## Additional maintenance and publication + +Backfill, format, notes extraction and custom templates are optional operations. +Discover their actual commands and read that release's guide before using them. +Keep published descriptions, unknown dates, existing references and pending +fragments intact as required by the operation. Executable PHP templates require +explicit trust. Preview mutations and review the resulting diff. + +Publication requires separate authority for an exact approved full commit SHA. +Read that release's publication guide and command help, preview when supported, +and supply the verified target explicitly. Use the application's approved +credential mechanism. Verify the approved version, notes, consumed fragments, +tag and source commit; PR text or a moving branch is not transaction evidence. +Preparation and publication must use the same policies that affect the output. + +Do not move conflicting concrete tags or overwrite divergent published notes. +After an uncertain response, inspect remote evidence and follow the selected +release's idempotent recovery route under the existing authority. Report what +was actually published or recovered separately from successful validation. diff --git a/.agents/skills/fast-forward-changelog/references/php-api.md b/.agents/skills/fast-forward-changelog/references/php-api.md new file mode 100644 index 0000000..2dc88e4 --- /dev/null +++ b/.agents/skills/fast-forward-changelog/references/php-api.md @@ -0,0 +1,40 @@ +# Optional PHP integration + +Load only when the application needs injected services instead of the CLI or +GitHub lifecycle. CPX executes a separate tool; it does not provide an application +autoloader. Inspect the application's Composer installation with +`composer show fast-forward/changelog`, then read the PHP integration/API guide, +manifest requirements and migration notes from that exact release tag. + +Use the installed namespaces and method signatures. Keep the application's +existing command loader, container precedence and secret mechanism. Expose only +the needed domain services and inject external boundaries in application tests. +Resolving a service or writing a fragment does not authorize commits or releases. + +## Bundled contribution example + +The complete [contribution program](../examples/contribution.php) illustrates the +`0.1.0` PHP API: explicit consumer autoloader and target directory, provider +composition, fragment creation and validation. It is an optional example, not +the contract for every later release. Before using it with another version, +compare its imports/signatures with that release's documented API or use the +example shipped with the selected release. + +For a matching API, run it first in a disposable target: + +```sh +php .agents/skills/fast-forward-changelog/examples/contribution.php ./vendor/autoload.php /absolute/project +vendor/bin/changelog check --no-interaction +``` + +Success prints `Contribution example PASS`; exactly one +`.changelog/php-api-example.md` is created, with no commit or central-history +change. A repeated run must expose the filename collision rather than overwrite +the file. Missing inputs and runtime failures remain nonzero. Do not report +success after a failed write or ignore the validation report. + +Keep PR/issue/author fields absent unless verified. Service access follows the +same fragment, version-transaction and publication boundaries as the selected +release's CLI. Learn optional configuration, planner/history services and +approved-commit publication from that version's documentation when the task +requires them; do not load an API inventory for an ordinary fragment task. diff --git a/.changelog/fast-forward-release-workflow.md b/.changelog/fast-forward-release-workflow.md new file mode 100644 index 0000000..c7bdd71 --- /dev/null +++ b/.changelog/fast-forward-release-workflow.md @@ -0,0 +1,14 @@ +--- +category: changed +type: patch +--- + +Replace Changesets with the Fast Forward Changelog lifecycle for independent +release notes, PR validation and comments, Dependabot notes and reviewed version +PRs, preserving Git-tag-based Composer releases without Node release tooling. +Normalize the complete changelog to Keep a Changelog categories, verified release +publication dates and version comparisons; retain historical descriptions, +correct the original delivery references for stacked contributions and record +the existing policy that omits automatic author acknowledgements. +Include the upstream release-tooling skill in the project with its native +installation receipt. diff --git a/.changeset/README.md b/.changeset/README.md deleted file mode 100644 index a588eb7..0000000 --- a/.changeset/README.md +++ /dev/null @@ -1,229 +0,0 @@ -# Release notes and version PRs - -Changesets is development tooling for the Composer package `coisa/error-handler`. -The private npm manifest starts at the published `2.0.0` baseline and tracks the -next version. It is never published to npm. Composer continues to derive its -version from Git tags; do not add a `version` field to `composer.json`. - -Installing or using the PHP library does not require Node.js. The tooling, -lockfile and workflows are excluded from Composer distribution archives. - -## Add a release note - -Use Node.js 24 and npm 10.9 or newer for maintenance: - -```sh -npm ci --ignore-scripts - -git fetch origin - -npm run changeset - -npm run changeset:status -``` - -Select `@coisa/error-handler`, choose the appropriate bump, and describe the -consumer-visible change in English. Commit the generated `.changeset/*.md` file -with the change. Use `patch` for compatible fixes or maintenance and `minor` for -compatible additions. Changes to public contracts or supported PHP versions need -separate major-release planning. This setup includes only a maintenance patch. - -Keep `package-lock.json` committed to make development dependencies reproducible. -Do not run the version command as part of an ordinary feature PR. -Local status compares runtime files (`src/` and `composer.json`) against the -configured base (`origin/master` in this repository). CI selects the repository's -default branch automatically. -Version PRs can therefore validate after consuming their notes. Tooling-only or -documentation-only PRs may omit a note when no version bump is intended. - -The **Changesets** workflow's status and comment jobs follow the official -[non-blocking status example](https://changesets.dev/guide/automating#non-blocking). -It uses `changesets/action/pr-status` and `changesets/action/pr-comment` to create -or update one informational comment, skipping `changeset-release/` branches. -No Changeset bot installation is needed. A read-only job checks out the trusted -base and reads PR files without executing them; a separate job can only post the -comment. It never installs dependencies or runs PHP or npm scripts from the PR. - -## Dependabot updates and their release notes - -Dependabot checks Composer, the private npm tooling and GitHub Actions weekly, -with at most three open version-update PRs per ecosystem. Each update remains a -separate PR; there is no automatic approval or merge. Composer major updates are -excluded from these maintenance proposals and need an explicit compatibility -decision. npm and action majors are reviewable development-tooling proposals; -they do not automatically mean a major release of this PHP library. - -Composer uses `versioning-strategy: widen` to retain already supported dependency -versions rather than raising their minimum. This works with a manifest-only -library: the automation detects `composer.json` updates without requiring a -tracked `composer.lock`. Releases already allowed by a constraint do not need a -new manifest-only PR. Without a committed Composer lockfile, this setup does not -track a fixed transitive dependency graph or promise transitive security-update -PRs. Consumer applications resolve and audit their own installations. See -[Dependabot versioning strategies](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#versioning-strategy). - -The same **Changesets** workflow's Dependabot job writes -`.changeset/dependabot-.md` directly with `printf`. It reads the package -name from the default branch's `package.json` and uses the PR title as the summary -with a default `patch` classification. This job does not install Node/npm or run -the Changesets CLI. Each run replaces the same file; identical contents produce -no new commit. Manual edits to that note, including its release classification, -are overwritten on the next run. Other note files are left alone. - -A small `gh` check skips stale/closed PRs. The job identifies these PRs by the -`dependabot/` head-branch prefix, without checking the author's login or ID. It -writes only to branches in this repository. - -[`stefanzweifel/git-auto-commit-action@v7`](https://github.com/stefanzweifel/git-auto-commit-action) -commits only that PR's generated note after the workflow switches to the checked -PR commit. No PR code or tooling runs after that switch. Checkout retains the -built-in token only in this job so the action can push; no additional secret is -required. A rebase that removes the note gets it back at the same path on its next -event. Review dependencies and make final release adjustments after the last -dependency update. - -The generated commit has a bot DCO sign-off and `[dependabot skip]`, allowing -[later rebases](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/manage-dependabot-prs#allowing-dependabot-to-rebase-and-force-push-over-extra-commits). -The job uses the existing `pull_request_target` event, following -[Dependabot's write-access guidance](https://github.com/dependabot/fetch-metadata#enabling-auto-merge), -and executes only trusted default-branch code. Informational status and comment -jobs skip `dependabot/` branches because the writer already creates the note; they -do not depend on the writer. The general Changesets validation remains independent. -No PR code is executed by the writer. - -This activates after merge. Observe the first real bot PR and rebase then; local -checks do not establish hosted write permissions. `GITHUB_TOKEN` commits -[do not trigger ordinary PR workflows](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow), -so the generated commit does not automatically get another validation run. The -existing `workflow_dispatch` trigger can validate the updated branch manually. -The initial run belongs to its original SHA. General dependency/PHP CI remains -separate from this minimal release-note job. - -## Review the version PR - -After changes reach the default branch and validation passes, the version job -creates or updates `changeset-release/`. Changesets consumes pending notes, updates -`package.json`, and generates `CHANGELOG.md`. The version script also updates -`package-lock.json` so both manifests have the same version. - -The title includes the repository and recalculated version, for example -`chore(release): release coisa/error-handler 2.0.1`. The action locates the open -PR by its head and base branches, not its title. Further merged changes update -that same PR and its title, even when they change the planned release version. -The `chore(release)` commit records release preparation without classifying it -as another runtime feature or bug fix. - -Changelog entries use the official -[`@changesets/changelog-github`](https://changesets.dev/packages/changelog-github) -formatter with links to PRs and commits. Author acknowledgements are disabled -with `disableThanks: true`. It reads the -repository from `GITHUB_REPOSITORY`, which Actions provides automatically, and -uses `GITHUB_TOKEN` for read-only GitHub queries. The validation rehearsal passes -the built-in token; the version action passes its token to the version command. -No personal token, custom template or repository name in the config is needed. - -Review the version, changelog and consumed notes before merging that PR. The -workflow needs the repository setting **Settings → Actions → General → Workflow -permissions → Allow GitHub Actions to create and approve pull requests** enabled. -It uses the built-in `GITHUB_TOKEN`; no personal token or npm credential is needed. - -The validation job installs the locked tooling, validates pending notes -and uses `changesets/action/select-mode` to rehearse only pending releases. -The version job also dispatches validation on the generated branch, without relying -on automatic `pull_request` events from `GITHUB_TOKEN` or on a separate PHP CI. -The validation job has read-only repository access. The version job can write -version metadata, manage its PR and dispatch validation; the publication job -can create tags and GitHub releases. -All six jobs live in `.github/workflows/changesets.yml`. PR checks run on -`pull_request`; the status jobs use `pull_request_target` without executing PR -code. Only pushes to the default branch can prepare a version PR. Dispatched runs validate -the generated branch without starting another version job. - -The workflow follows the official [Git tags only recipe](https://changesets.dev/guide/automating#publish-git-tags-only): -Node.js 24, a private package, `privatePackages.tag: true`, and the official -`select-mode`, `version` and `publish` actions. Permissions start empty and are -granted per job; jobs that write to GitHub disable package-manager caching. -This Composer library needs no npm build or publishing credentials. -The explicit validation dispatch avoids requiring an additional GitHub App token. -Actions use the publishers' major references (`@v7` and `@v2`) so compatible action -updates do not require a dependency-update PR for every patch or minor release. -The version PR title, commit message and description use `github.repository` -instead of a hardcoded repository name. The workflow uses -`github.event.repository.default_branch` for event selection, status comparisons, -the stale-run guard and the generated validation branch. - -## Merge to release - -Merging the generated version PR is the release decision. When no pending notes -remain and the private package has an unpublished tag, the official -`select-mode` action selects `publish`. The publication job checks out the -event's commit and calls the official `changesets/action/publish` action. -There is no custom release script. - -Concurrency uses `queue: max` with cancellation disabled, retaining up to 100 -pending runs per group. Another push therefore does not replace a pending -release run. Publication uses that run's validated commit even if the default -branch has advanced; version-PR preparation still skips outdated commits. -See GitHub's [concurrency queue documentation](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency#example-queueing-multiple-pending-runs). - -The official publisher creates `v2.0.1`-style tags and a GitHub release from the -matching changelog entry. Existing `1.0.0` and `2.0.0` tags remain unchanged; -Composer accepts the `v` prefix on new versions. Review version changes through -the generated PR; GitHub records who merged it in the PR timeline and its -`merged_by` API field. - -`create-github-releases: true` is explicit. `push-git-tags` is omitted because -the action already defaults it to `true`. No package is sent to npm. Packagist -discovers the Composer version from the Git tag through the repository's -existing integration; this workflow does not configure or force a Packagist sync. - -Version commits use the default GitHub API transport, which signs them with -GitHub's key and attributes them to the token owner. `push-with-git-cli` changes -that transport; it does not identify who merges the PR. See the official -[version action inputs](https://github.com/changesets/action/tree/v2/version). - -Existing tags are excluded from the official publication plan. If a run stops -after creating a tag but before creating its GitHub release, inspect that tag -and finish the missing release with the matching changelog entry; this minimal -workflow does not add a separate recovery implementation. - -The first live version PR and release must still be observed after an -owner-authorized merge. Review prerelease needs separately before adding a -prerelease policy to this stable 2.x flow. - -## Maintain the changelog introduction and history - -Keep the changelog title, introduction and historical backfills on the default -branch. The generator preserves that introduction and inserts new entries before -the first version heading. Use plain headings such as `## 2.0.0`, with release -links or other metadata below them. - -Edits made only to a generated version PR can be overwritten when it is rebuilt -from the default branch. Backfill only published versions; pending versions -belong to their Changesets. A documentation-only backfill does not need a new -Changeset when no additional version bump is intended. - -## Rehearse locally - -In a disposable checkout with the tooling installed, provide -`GITHUB_REPOSITORY=coisa/error-handler` and a read-capable `GITHUB_TOKEN` through -your environment, then run: - -```sh -npm run changeset:status - -npm run version:packages - -git diff -- package.json package-lock.json CHANGELOG.md .changeset -``` - -Never commit the token. Adding notes and running `changeset:status` do not need -a GitHub token. - -With only the initial maintenance note, expect `2.0.1` in both manifests, a patch -changelog entry, and removal of that note. `composer.json` and `src/` must remain -unchanged; any ignored local `composer.lock` is outside release preparation. -A second run with no pending notes must not bump -the version again; Changesets 3 exits with code 1 for that no-op. The validation -job skips this command when the release plan is empty. Do not commit a local -rehearsal into a feature PR. diff --git a/.changeset/config.json b/.changeset/config.json deleted file mode 100644 index ad0ad70..0000000 --- a/.changeset/config.json +++ /dev/null @@ -1,17 +0,0 @@ -{ - "$schema": "https://unpkg.com/@changesets/config/schema.json", - "changelog": ["@changesets/changelog-github", { "disableThanks": true }], - "commit": false, - "fixed": [], - "linked": [], - "access": "restricted", - "baseBranch": "origin/master", - "changedFilePatterns": ["src/**", "composer.json"], - "updateInternalDependencies": "patch", - "ignore": [], - "format": false, - "privatePackages": { - "version": true, - "tag": true - } -} diff --git a/.gitattributes b/.gitattributes index c5ebc0b..29c1981 100644 --- a/.gitattributes +++ b/.gitattributes @@ -4,11 +4,8 @@ AGENTS.md export-ignore /examples/ export-ignore docs/index.html export-ignore docs/.nojekyll export-ignore -.changeset/ export-ignore +.changelog/ export-ignore .github/ export-ignore -node_modules/ export-ignore -package.json export-ignore -package-lock.json export-ignore CONTRIBUTING.md export-ignore tests/ export-ignore .editorconfig export-ignore diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 890ad48..2da9962 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -15,15 +15,6 @@ updates: prefix: chore include: scope - - package-ecosystem: npm - directory: / - schedule: - interval: weekly - open-pull-requests-limit: 3 - commit-message: - prefix: chore - include: scope - - package-ecosystem: github-actions directory: / schedule: diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml new file mode 100644 index 0000000..cc81bfa --- /dev/null +++ b/.github/workflows/changelog.yml @@ -0,0 +1,32 @@ +name: Changelog + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled] + + pull_request_target: + types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled, closed] + + push: + + workflow_dispatch: + +permissions: {} + +jobs: + changelog: + permissions: + contents: write + pull-requests: write + issues: read + statuses: write + + # Official v0 compatibility branch; reviewed against v0.2.0. + uses: php-fast-forward/changelog/.github/workflows/changelog.yml@v0 + + with: + source: tags + comment-mode: always + version-pr-title: 'chore(release): prepare {next_version} for publication' + prepare-release: true + publish: true diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml deleted file mode 100644 index 83d9600..0000000 --- a/.github/workflows/changesets.yml +++ /dev/null @@ -1,259 +0,0 @@ -name: Changesets - -on: - pull_request: - pull_request_target: - push: - workflow_dispatch: - -permissions: {} - -env: - DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} - -concurrency: - group: changesets-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} - queue: max - cancel-in-progress: false - -jobs: - dependabot: - name: Add Dependabot Changeset - if: >- - github.event_name == 'pull_request_target' && - github.event.pull_request.head.repo.full_name == github.repository && - startsWith(github.head_ref, 'dependabot/') - runs-on: ubuntu-latest - timeout-minutes: 5 - - permissions: - contents: write - pull-requests: read - - steps: - # Use default-branch code and tooling; only PR metadata is read by API. - - uses: actions/checkout@v7 - with: - ref: ${{ github.event.repository.default_branch }} - persist-credentials: true - - - name: Write the release note from the PR title - id: note - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_NUMBER: ${{ github.event.pull_request.number }} - PR_TITLE: ${{ github.event.pull_request.title }} - PR_HEAD: ${{ github.event.pull_request.head.sha }} - PR_BRANCH: ${{ github.head_ref }} - run: | - package=$(jq -r '.name' package.json) - note="dependabot-$PR_NUMBER.md" - printf -- '---\n"%s": patch\n---\n\n%s\n' "$package" "$PR_TITLE" > "$RUNNER_TEMP/$note" - - current=$(gh pr view "$PR_NUMBER" --json state,headRefOid --jq 'select(.state == "OPEN") | .headRefOid') - if [ "$current" = "$PR_HEAD" ]; then - git fetch --no-tags origin "$PR_HEAD" - git checkout -b "$PR_BRANCH" FETCH_HEAD - mv "$RUNNER_TEMP/$note" ".changeset/$note" - echo 'created=true' >> "$GITHUB_OUTPUT" - fi - - # Only this PR's generated note is committed; no PR code or tooling runs. - - uses: stefanzweifel/git-auto-commit-action@v7 - if: steps.note.outputs.created == 'true' - with: - branch: ${{ github.head_ref }} - skip_fetch: true - file_pattern: '.changeset/dependabot-${{ github.event.pull_request.number }}.md' - commit_message: 'chore(release): add Dependabot Changeset [dependabot skip]' - commit_options: --signoff - commit_author: 'github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>' - - validate: - name: Validate Changesets - if: >- - github.event_name == 'workflow_dispatch' || - (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) || - (github.event_name == 'pull_request' && github.base_ref == github.event.repository.default_branch) - runs-on: ubuntu-latest - timeout-minutes: 5 - - permissions: - contents: read - - outputs: - mode: ${{ steps.mode.outputs.mode }} - - steps: - - uses: actions/checkout@v7 - with: - fetch-depth: 0 - persist-credentials: false - - - uses: actions/setup-node@v7 - with: - node-version: '24' - cache: npm - - - run: npm ci --ignore-scripts - - - run: npm run changeset -- status --since="origin/$DEFAULT_BRANCH" - - - name: Select Changesets mode - id: mode - uses: changesets/action/select-mode@v2 - - - name: Rehearse versioning in the disposable checkout - if: steps.mode.outputs.mode == 'version' - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: npm run version:packages - - status: - name: Read PR Changesets - if: >- - github.event_name == 'pull_request_target' && - github.base_ref == github.event.repository.default_branch && - !startsWith(github.head_ref, 'dependabot/') && - !startsWith(github.head_ref, 'changeset-release/') - runs-on: ubuntu-latest - timeout-minutes: 5 - - permissions: - contents: read - - outputs: - comment-body: ${{ steps.status.outputs.comment-body }} - - steps: - # Check out the trusted base; the action only reads PR files. - - uses: actions/checkout@v7 - with: - persist-credentials: false - - - name: Generate Changeset status - id: status - uses: changesets/action/pr-status@v2 - - comment: - name: Comment PR Changesets - needs: status - runs-on: ubuntu-latest - timeout-minutes: 5 - - permissions: - pull-requests: write - - steps: - - name: Create or update the Changeset comment - uses: changesets/action/pr-comment@v2 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - body: ${{ needs.status.outputs.comment-body }} - - version: - name: Prepare version PR - needs: validate - if: >- - github.event_name == 'push' && - github.ref_name == github.event.repository.default_branch && - needs.validate.outputs.mode == 'version' - runs-on: ubuntu-latest - timeout-minutes: 10 - - permissions: - contents: write - pull-requests: write - actions: write - - steps: - - uses: actions/checkout@v7 - with: - persist-credentials: false - - - uses: actions/setup-node@v7 - with: - node-version: '24' - package-manager-cache: false - - - run: npm ci --ignore-scripts - - - name: Check the current default-branch tip - id: tip - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - current=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/$DEFAULT_BRANCH" --jq .object.sha) - if [ "$current" = "$GITHUB_SHA" ]; then - echo "current=true" >> "$GITHUB_OUTPUT" - fi - - - name: Create or update the version PR - id: version - if: steps.tip.outputs.current == 'true' - uses: changesets/action/version@v2 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: npm run version:packages - pr-title: 'chore(release): prepare next release of ${{ github.repository }}' - commit-message: 'chore(release): prepare next version of ${{ github.repository }}' - - - name: Describe the version PR - if: steps.version.outputs.pr-number != '' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_NUMBER: ${{ steps.version.outputs.pr-number }} - REPOSITORY: ${{ github.repository }} - run: | - version=$(node -p "require('./package.json').version") - - printf 'Prepare %s %s for release.\n\n' "$REPOSITORY" "$version" > "$RUNNER_TEMP/version-pr.md" - - cat >> "$RUNNER_TEMP/version-pr.md" <<'MARKDOWN' - Review the generated `CHANGELOG.md`, the versions in `package.json` and - `package-lock.json`, and the consumed `.changeset/*.md` notes. - - Merging this PR starts validated Git tag and GitHub release publication. - Review it as the release decision. The private npm package is never published. - MARKDOWN - - gh pr edit "$PR_NUMBER" \ - --title "chore(release): release $REPOSITORY $version" \ - --body-file "$RUNNER_TEMP/version-pr.md" - - - name: Validate the generated version branch - if: steps.version.outputs.pr-number != '' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: gh workflow run changesets.yml --ref "changeset-release/$DEFAULT_BRANCH" - - publish: - name: Publish reviewed release - needs: validate - if: >- - github.event_name == 'push' && - github.ref_name == github.event.repository.default_branch && - needs.validate.outputs.mode == 'publish' - runs-on: ubuntu-latest - timeout-minutes: 10 - - permissions: - contents: write - - steps: - - uses: actions/checkout@v7 - with: - fetch-depth: 0 - persist-credentials: false - - - uses: actions/setup-node@v7 - with: - node-version: '24' - package-manager-cache: false - - - run: npm ci --ignore-scripts - - - name: Publish the Composer tag and GitHub release - uses: changesets/action/publish@v2 - with: - create-github-releases: true diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 846ea25..d793cb2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,6 +63,10 @@ jobs: - name: Run formatting, PHPCS, PHPUnit and maximum src-plus-tests analysis run: composer --no-plugins check + - name: Lint the upstream Changelog skill on its tooling runtime + if: matrix.php == '8.5' + run: git ls-files -z -- '.agents/skills/fast-forward-changelog/*.php' | xargs -0 -n1 php -l + production: name: Production / PHP ${{ matrix.php }} / ${{ matrix.dependencies }} runs-on: ubuntu-latest @@ -94,8 +98,9 @@ jobs: coverage: none tools: composer:v2 - - name: Lint all tracked PHP on the actual runtime - run: git ls-files -z -- '*.php' | xargs -0 -n1 php -l + - name: Lint library PHP on the actual runtime + # The upstream release-tooling example has its own PHP requirement. + run: git ls-files -z -- '*.php' ':(exclude).agents/skills/fast-forward-changelog/**' | xargs -0 -n1 php -l - name: Verify the committed distribution and create a clean consumer run: | diff --git a/.gitignore b/.gitignore index f2c8d28..1891fc2 100644 --- a/.gitignore +++ b/.gitignore @@ -2,7 +2,6 @@ /composer.lock .idea/ vendor/ -node_modules/ tests/html/ tests/clover.xml tests/cobertura.xml diff --git a/.php-cs-fixer.dist.php b/.php-cs-fixer.dist.php index 334fdd9..044132e 100755 --- a/.php-cs-fixer.dist.php +++ b/.php-cs-fixer.dist.php @@ -20,6 +20,7 @@ $paths = [ __FILE__, __DIR__, + '!.agents/skills/fast-forward-changelog', ]; $header = HeaderExtractor::extractFromFile(__FILE__); diff --git a/AGENTS.md b/AGENTS.md index 154359c..14b0d39 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -5,7 +5,7 @@ Maintain `coisa/error-handler` under `CoiSA\ErrorHandler` as a small PHP library ## Compatibility and ownership - Preserve the declared PHP `^7.4 || ^8.0` range and existing 2.x public classes, interfaces, factories, ConfigProvider and Laminas discovery metadata. Keep executable example syntax compatible with PHP 7.4. -- Use the actual selected source and Composer version as authority. The proposed major has different container, middleware, rendering and exit contracts; do not present that proposal or a pending Changeset as a published release. +- Use the actual selected source and Composer version as authority. The proposed major has different container, middleware, rendering and exit contracts; do not present that proposal or a pending release note as a published release. - Applications own reporters, PSR-14 dispatchers, PSR-17 factories, HTTP emission and when native PHP callbacks are installed. Resolving a service must not install callbacks. - Preserve the existing container integration. FastForward adoption, removal of legacy classes and API changes require their own explicitly reviewed scope. - Callbacks are process-wide. Use distinct handlers for nested scopes and restore in reverse order. Direct reporting, registered uncaught exceptions and fatal shutdown reporting are different paths; do not promise recovery or an automatic nonzero exit. @@ -18,7 +18,7 @@ Inspect branch/HEAD, tracked/untracked/ignored state, applicable contracts and r Use Composer 2 dependency installs with `--no-plugins --no-scripts`, then run `composer --no-plugins check`. Development integrations may need a newer PHP than the library minimum: verify minimum runtime separately through a clean no-dev consumer. Report actual PHP/Composer/dependency versions, the tested SHA and existing failures honestly. -Keep source, meaningful regression coverage, affected examples/guides, the source-linked `coisa-error-handler` consumer skill and a pending Changeset aligned. Never install the skill globally as part of maintenance. +Keep source, meaningful regression coverage, affected examples/guides, the source-linked `coisa-error-handler` consumer skill and an independent `.changelog/*.md` fragment aligned. Never install the skill globally as part of maintenance. The Fast Forward Changelog workflow prepares the reviewed version PR; do not consolidate history or consume pending notes in ordinary contributions. Run `php examples/verify.php` with the documented application dependencies after example or documented-contract changes. The verifier owns bounded child processes, including fatal experiments. Do not run fatal fixtures in an agent, application, real server or parent test process. Use synthetic records and disposable consumer dependencies; never application credentials or production logs. @@ -49,8 +49,9 @@ and verification continue to follow this AGENTS.md. - [examples/verify.md](examples/verify.md): bounded verifier inputs, outputs, child-process effects and recovery. - [docs/testing.md](docs/testing.md): direct PHPUnit contracts, isolated native process cases, installed-package checks and honest coverage limits; no custom test runner. - [CONTRIBUTING.md](CONTRIBUTING.md): library dependency resolution and clean production-container checks. -- [.changeset/README.md](.changeset/README.md): pending notes, reviewed version PRs and separate publication authority. +- [docs/releases.md](docs/releases.md): independent fragments, reviewed version PRs, Git-tag version authority and publication boundaries. - [docs/agent-skill.md](docs/agent-skill.md): optional project/global skill distribution, trust and lifecycle; copying does not establish host activation. - [resources/skills/coisa-error-handler/SKILL.md](resources/skills/coisa-error-handler/SKILL.md): portable consumer integration procedure, bundled examples and supported API contract; keeps its own package entrypoint and source identity. +- [.agents/skills/fast-forward-changelog/SKILL.md](.agents/skills/fast-forward-changelog/SKILL.md): project-installed upstream release-tooling procedure, managed through its native installation receipt; PHP requirements belong to the tool, not this library. No subtree needs an additional AGENTS.md. Guides and the skill retain their own procedures without duplicating repository authority. diff --git a/CHANGELOG.md b/CHANGELOG.md index fb962b4..a1d9567 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,246 +1,280 @@ # Changelog -Notable changes to `coisa/error-handler`, with the newest release first. +All notable changes to this project will be documented in this file. -This file is inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) -and uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html). -New entries are generated from [Changesets](https://changesets.dev/) using its -GitHub changelog formatter and change categories. +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The entries for 1.0.0 and 2.0.0 were reconstructed from their published Git tags. -Pending changes live in `.changeset/` until a version PR is prepared. -## 2.5.2 +## [2.5.2] - 2026-10-17 -### Patch Changes +### Added -- [#114](https://github.com/coisa/error-handler/pull/114) [`e00b98c`](https://github.com/coisa/error-handler/commit/e00b98c76e36b44c2e33dbbcbdbfbc0aeba94cd3) - Preserve caller-owned output buffers when a capture reporter closes the factory's buffer and returns normally. Use the existing diagnostic fallback without consuming caller bytes or invoking their output callbacks; retain empty-output and `"0"` fallback behavior. +- Document security support for the latest stable release and the existing private reporting channel. Include the security policy in Composer distributions and link it from the README and consumer skill. ([#116](https://github.com/coisa/error-handler/pull/116)) -- [#116](https://github.com/coisa/error-handler/pull/116) [`f5e985f`](https://github.com/coisa/error-handler/commit/f5e985fcd1cb95a08df5f84f763189db2082af40) - Document security support for the latest stable release and the existing private reporting channel. Include the security policy in Composer distributions and link it from the README and consumer skill. +### Fixed -## 2.5.1 +- Preserve caller-owned output buffers when a capture reporter closes the factory's buffer and returns normally. Use the existing diagnostic fallback without consuming caller bytes or invoking their output callbacks; retain empty-output and `"0"` fallback behavior. ([#114](https://github.com/coisa/error-handler/pull/114)) -### Patch Changes +## [2.5.1] - 2026-10-17 -- [#109](https://github.com/coisa/error-handler/pull/109) [`af43a68`](https://github.com/coisa/error-handler/commit/af43a68f809664831af99bef4eb3aebf94e129d1) - Document published 2.5.0 as the minimum for JSON, Whoops and Interop provider routes in the guides and bundled consumer skill, while retaining the common 2.4 baseline and existing 2.x behavior. +### Changed -## 2.5.0 +- Document published 2.5.0 as the minimum for JSON, Whoops and Interop provider routes in the guides and bundled consumer skill, while retaining the common 2.4 baseline and existing 2.x behavior. ([#109](https://github.com/coisa/error-handler/pull/109)) -### Minor Changes +## [2.5.0] - 2026-10-17 -- [#92](https://github.com/coisa/error-handler/pull/92) [`fb418fb`](https://github.com/coisa/error-handler/commit/fb418fba4f342f2113a34cd8dfbb15418c0ade87) - Add an opt-in pure JSON throwable response factory with generic public output, integer HTTP 400–599 status preservation and an explicit development mode with metadata-only traces and no-store caching. Add a separate report-before-render response decorator for the existing 2.x middleware and independent Interop providers for explicit legacy or JSON composition with fresh HTTP scopes. Applications select the JSON provider before the base provider and supply PSR-17 factories and a private reporter; the FastForward integration requires PHP 8.3+ and an application runtime dependency, while the core retains PHP 7.4 and existing container/output-capture defaults. Debug alone needs the optional JSON extension on PHP 7.4. +### Added -- [#92](https://github.com/coisa/error-handler/pull/92) [`fae2d58`](https://github.com/coisa/error-handler/commit/fae2d58471e72136d3e9967f54bd81a7fc38bc48) - Add an optional Whoops HTML response renderer with application-controlled development activation and page configuration. Provide an independent opt-in Interop profile using the application's PSR-17 factories and private reporter, with a lazy configurable PrettyPageHandler service. Applications compose the base and Whoops maps in one aggregate and obtain fresh middleware scopes through FastForward on PHP 8.3+. Sequential rendering preserves page configuration and replaces diagnostic state, with a fresh Run, response and stream. Reuse explicit reporting composition without changing existing middleware, capture defaults or HTTP negotiation; service resolution and fallback remain the container's policy. Bundle focused HTML guidance and executable consumer programs in the canonical skill, with installed-API availability checks. Require optional Whoops ^2.18.4 or later within 2.x, including the upstream PHP 8.5 fix to avoid its additional PHP deprecation report during rendering. Core PHP 7.4 and ordinary production installations still do not require Whoops or FastForward. +- Add an opt-in pure JSON throwable response factory with generic public output, integer HTTP 400–599 status preservation and an explicit development mode with metadata-only traces and no-store caching. Add a separate report-before-render response decorator for the existing 2.x middleware and independent Interop providers for explicit legacy or JSON composition with fresh HTTP scopes. Applications select the JSON provider before the base provider and supply PSR-17 factories and a private reporter; the FastForward integration requires PHP 8.3+ and an application runtime dependency, while the core retains PHP 7.4 and existing container/output-capture defaults. Debug alone needs the optional JSON extension on PHP 7.4. ([#92](https://github.com/coisa/error-handler/pull/92)) -### Patch Changes +- Add an optional Whoops HTML response renderer with application-controlled development activation and page configuration. Provide an independent opt-in Interop profile using the application's PSR-17 factories and private reporter, with a lazy configurable PrettyPageHandler service. Applications compose the base and Whoops maps in one aggregate and obtain fresh middleware scopes through FastForward on PHP 8.3+. Sequential rendering preserves page configuration and replaces diagnostic state, with a fresh Run, response and stream. Reuse explicit reporting composition without changing existing middleware, capture defaults or HTTP negotiation; service resolution and fallback remain the container's policy. Bundle focused HTML guidance and executable consumer programs in the canonical skill, with installed-API availability checks. Require optional Whoops ^2.18.4 or later within 2.x, including the upstream PHP 8.5 fix to avoid its additional PHP deprecation report during rendering. Core PHP 7.4 and ordinary production installations still do not require Whoops or FastForward. ([#96](https://github.com/coisa/error-handler/pull/96)) -- [#105](https://github.com/coisa/error-handler/pull/105) [`723e985`](https://github.com/coisa/error-handler/commit/723e985899b86deef2a936e6e1c1b2267110b948) - Clarify the 2.x learning path, integration prerequisites, service aliases and factories, application extension contracts, and reporting/HTTP troubleshooting while retaining the existing Markdown guides and static documentation site. +### Changed -## 2.4.4 +- Clarify the 2.x learning path, integration prerequisites, service aliases and factories, application extension contracts, and reporting/HTTP troubleshooting while retaining the existing Markdown guides and static documentation site. ([#105](https://github.com/coisa/error-handler/pull/105)) -### Patch Changes +## [2.4.4] - 2026-10-17 -- [#103](https://github.com/coisa/error-handler/pull/103) [`e77e590`](https://github.com/coisa/error-handler/commit/e77e5908718f009260938ba29179c9812926de3e) - Make the 2.x README easier to use with a complete quick start, focused integration - guides and explicit lifecycle and HTTP boundaries. +### Changed -## 2.4.3 +- Make the 2.x README easier to use with a complete quick start, focused integration guides and explicit lifecycle and HTTP boundaries. ([#103](https://github.com/coisa/error-handler/pull/103)) -### Patch Changes +## [2.4.3] - 2026-10-17 -- [#101](https://github.com/coisa/error-handler/pull/101) [`2ee7bdf`](https://github.com/coisa/error-handler/commit/2ee7bdf6ddd0c74c2260d176fe0f45486e0de27a) - Ship the portable coisa-error-handler consumer skill in Composer distributions, with a supported 2.4 API contract, complete application examples and optional project synchronization instructions. +### Added -## 2.4.2 +- Ship the portable coisa-error-handler consumer skill in Composer distributions, with a supported 2.4 API contract, complete application examples and optional project synchronization instructions. ([#101](https://github.com/coisa/error-handler/pull/101)) -### Patch Changes +## [2.4.2] - 2026-10-16 -- [#93](https://github.com/coisa/error-handler/pull/93) [`e39b363`](https://github.com/coisa/error-handler/commit/e39b363f9467434ebd3c7907fc99bf6351cb9b54) - Preserve the original failure when wrapping container exceptions with string codes such as PDO SQLSTATE. Integer codes remain unchanged; string codes use zero on the wrapper and remain available on its previous throwable. +### Fixed -- [#91](https://github.com/coisa/error-handler/pull/91) [`9e4876d`](https://github.com/coisa/error-handler/commit/9e4876da10dceb857fc55e130c3ee8ef35f93339) - Use the application's PSR-17 default reason phrase when an exception message contains forbidden HTTP status-line control bytes. Preserve valid messages, the existing 400–500 status mapping, original throwable reporting and response body behavior. +- Preserve the original failure when wrapping container exceptions with string codes such as PDO SQLSTATE. Integer codes remain unchanged; string codes use zero on the wrapper and remain available on its previous throwable. ([#93](https://github.com/coisa/error-handler/pull/93)) -## 2.4.1 +- Use the application's PSR-17 default reason phrase when an exception message contains forbidden HTTP status-line control bytes. Preserve valid messages, the existing 400–500 status mapping, original throwable reporting and response body behavior. ([#91](https://github.com/coisa/error-handler/pull/91)) -### Patch Changes +## [2.4.1] - 2026-10-16 -- [#86](https://github.com/coisa/error-handler/pull/86) [`94055d2`](https://github.com/coisa/error-handler/commit/94055d2b2c869cb11a8c92a0d7d754ebf6aed992) - Expose all existing 2.x recipes in a complete source-checked cookbook. Preserve - website excerpt validation and verify every full recipe against executable PHP, - with application setup, consumer guidance and navigation aligned. +### Added -- [#87](https://github.com/coisa/error-handler/pull/87) [`85d8488`](https://github.com/coisa/error-handler/commit/85d8488c9eb161f9ea870d802dfe5ff13b3683c1) - Permit coverage decreases while requiring an overall line-coverage minimum of - 80% by default, configurable with MINIMUM_COVERAGE_THRESHOLD. Preserve authentic - baseline comparisons, per-file differences and the existing sticky PR report. +- Expose all existing 2.x recipes in a complete source-checked cookbook. Preserve website excerpt validation and verify every full recipe against executable PHP, with application setup, consumer guidance and navigation aligned. ([#86](https://github.com/coisa/error-handler/pull/86)) -- [#84](https://github.com/coisa/error-handler/pull/84) [`f095afe`](https://github.com/coisa/error-handler/commit/f095afec6e075bd5b9186a615012f7cdac4b6f11) - Continue exceptional output-buffer cleanup when PHP removes a buffer before its - output callback throws. Preserve the original reporter/capture failure and - caller-owned buffers while discarding remaining reachable removable scopes. +### Changed -- [#83](https://github.com/coisa/error-handler/pull/83) [`e40dddd`](https://github.com/coisa/error-handler/commit/e40dddd0a4e06e77900b12eb1ef5d16eaf69fe49) - Describe the released logging and best-effort adapters as available opt-in 2.x APIs across the guides, cookbook, static site and consumer skill. Retain installed-version checks and the distinction between pending Changesets and published releases. +- Permit coverage decreases while requiring an overall line-coverage minimum of 80% by default, configurable with MINIMUM_COVERAGE_THRESHOLD. Preserve authentic baseline comparisons, per-file differences and the existing sticky PR report. ([#87](https://github.com/coisa/error-handler/pull/87)) -## 2.4.0 +- Describe the released logging and best-effort adapters as available opt-in 2.x APIs across the guides, cookbook, static site and consumer skill. Retain installed-version checks and the distinction between pending Changesets and published releases. ([#83](https://github.com/coisa/error-handler/pull/83)) -### Minor Changes +### Fixed -- [#80](https://github.com/coisa/error-handler/pull/80) [`6fa8ed0`](https://github.com/coisa/error-handler/commit/6fa8ed06f9bfb9cd2345ea9c5ef336a3841fa230) - Add an opt-in BestEffortThrowableHandlerAggregate that attempts every configured reporter in order and then exposes all reporter failures through AggregateReportingException, preserving the original throwable. Existing fail-fast aggregation, defaults, callback lifecycle and HTTP behavior remain unchanged. +- Continue exceptional output-buffer cleanup when PHP removes a buffer before its output callback throws. Preserve the original reporter/capture failure and caller-owned buffers while discarding remaining reachable removable scopes. ([#84](https://github.com/coisa/error-handler/pull/84)) -### Patch Changes +## [2.4.0] - 2026-10-16 -- [#81](https://github.com/coisa/error-handler/pull/81) [`76ca4d3`](https://github.com/coisa/error-handler/commit/76ca4d36a80af8db158fb8acd6912bb557a58ac9) - Remove the unused manual Pages upload/deployment jobs now that GitHub Pages publishes the configured branch's docs folder. Keep read-only source, link and excerpt validation and align the publication guidance. +### Added -## 2.3.1 +- Add an opt-in BestEffortThrowableHandlerAggregate that attempts every configured reporter in order and then exposes all reporter failures through AggregateReportingException, preserving the original throwable. Existing fail-fast aggregation, defaults, callback lifecycle and HTTP behavior remain unchanged. ([#80](https://github.com/coisa/error-handler/pull/80)) -### Patch Changes +### Removed -- [#77](https://github.com/coisa/error-handler/pull/77) [`d88c6d3`](https://github.com/coisa/error-handler/commit/d88c6d366d337dd99804a66088cfcf916467fe83) - Expand direct PHPUnit class coverage with meaningful contract and failure assertions, remove strictly subsumed legacy tests and scope process isolation to native global state. Document measured coverage and native limits without changing the 2.x runtime or coverage policy. +- Remove the unused manual Pages upload/deployment jobs now that GitHub Pages publishes the configured branch's docs folder. Keep read-only source, link and excerpt validation and align the publication guidance. ([#81](https://github.com/coisa/error-handler/pull/81)) -- [#77](https://github.com/coisa/error-handler/pull/77) [`bac5992`](https://github.com/coisa/error-handler/commit/bac599295f412909d388d261c9a8255ea3d9a439) - Replace standalone failure and HTTP test runners with PHPUnit contracts and bounded Symfony Process fixtures, declaring the development dependency directly and updating the cookbook verifier and testing entrypoints. +## [2.3.1] - 2026-10-16 -## 2.3.0 +### Changed -### Minor Changes +- Expand direct PHPUnit class coverage with meaningful contract and failure assertions, remove strictly subsumed legacy tests and scope process isolation to native global state. Document measured coverage and native limits without changing the 2.x runtime or coverage policy. ([#74](https://github.com/coisa/error-handler/pull/74)) -- [#73](https://github.com/coisa/error-handler/pull/73) [`018edbf`](https://github.com/coisa/error-handler/commit/018edbf30c845d2c0b78020af7c3a4f7120e82c9) - Add the explicit CallablePhpErrorHandler adapter for four-argument application callbacks. Preserve the void boundary, ignored callback returns, application-owned mask policy and unchanged typed ErrorHandler constructor. +- Replace standalone failure and HTTP test runners with PHPUnit contracts and bounded Symfony Process fixtures, declaring the development dependency directly and updating the cookbook verifier and testing entrypoints. ([#77](https://github.com/coisa/error-handler/pull/77)) -## 2.2.0 +## [2.3.0] - 2026-10-16 -### Minor Changes +### Added -- [#69](https://github.com/coisa/error-handler/pull/69) [`9068a5d`](https://github.com/coisa/error-handler/commit/9068a5dda9759376c01bf5f95c593938d0f4ef8d) - Add the opt-in LogThrowableHandler adapter for direct PSR-3 reporting with the exact throwable message, configured level and original exception context. Preserve logger failures, existing discovery, application-owned transports and PHP 7.4 compatibility; add runnable examples and matching integration guidance. +- Add the explicit CallablePhpErrorHandler adapter for four-argument application callbacks. Preserve the void boundary, ignored callback returns, application-owned mask policy and unchanged typed ErrorHandler constructor. ([#73](https://github.com/coisa/error-handler/pull/73)) -## 2.1.0 +## [2.2.0] - 2026-10-16 -### Minor Changes +### Added -- [#68](https://github.com/coisa/error-handler/pull/68) [`efb5cb2`](https://github.com/coisa/error-handler/commit/efb5cb258c7152ef559899b174f48b0b80ffbfd0) - Add the opt-in FilteringThrowableHandler decorator with an explicit boolean predicate, original-object delivery and fail-fast collaborator errors. Keep default discovery, PHP suppression and HTTP response policy unchanged. +- Add the opt-in LogThrowableHandler adapter for direct PSR-3 reporting with the exact throwable message, configured level and original exception context. Preserve logger failures, existing discovery, application-owned transports and PHP 7.4 compatibility; add runnable examples and matching integration guidance. ([#69](https://github.com/coisa/error-handler/pull/69)) -### Patch Changes +## [2.1.0] - 2026-10-16 -- [#58](https://github.com/coisa/error-handler/pull/58) [`c012aa2`](https://github.com/coisa/error-handler/commit/c012aa249836573a39294de8c4e5057d6ac7081b) - Attempt to discard removable output buffers above the stream factory's entry level when reporting or capture throws. If cleanup returns, the primary failure propagates; output callbacks that terminate the process or trigger an engine fatal can prevent that return. Cleanup stops on protected buffers, failed closes, absent progress or callback failure. Successful capture and empty/`0` fallback bytes remain unchanged. +### Added -## 2.0.9 +- Add the opt-in FilteringThrowableHandler decorator with an explicit boolean predicate, original-object delivery and fail-fast collaborator errors. Keep default discovery, PHP suppression and HTTP response policy unchanged. ([#68](https://github.com/coisa/error-handler/pull/68)) -### Patch Changes +### Fixed -- [#64](https://github.com/coisa/error-handler/pull/64) [`6fb45d7`](https://github.com/coisa/error-handler/commit/6fb45d7d00465d394b0917d26f02fc50b3c98ef5) - Exclude the intentionally invalid compile-fatal fixture from optimized development classmaps while preserving its explicit bounded fire-test execution. +- Attempt to discard removable output buffers above the stream factory's entry level when reporting or capture throws. If cleanup returns, the primary failure propagates; output callbacks that terminate the process or trigger an engine fatal can prevent that return. Cleanup stops on protected buffers, failed closes, absent progress or callback failure. Successful capture and empty/`0` fallback bytes remain unchanged. ([#58](https://github.com/coisa/error-handler/pull/58)) -- [#63](https://github.com/coisa/error-handler/pull/63) [`0157fcc`](https://github.com/coisa/error-handler/commit/0157fccc27aab0771bb3a8934c79a246b0712017) - Retire the historical Scrutinizer configuration and badges after verifying that its latest public inspection predates the 2.x line. Link the current PHP CI and document its security-analysis limits without changing runtime code or external service settings. +## [2.0.9] - 2026-10-16 -- [#59](https://github.com/coisa/error-handler/pull/59) [`c82fbab`](https://github.com/coisa/error-handler/commit/c82fbabb6a35f28b07d69f913f2587ee5ed4cb24) - Add a static 2.x documentation guide with checked example excerpts and a manual Pages workflow. +### Added -## 2.0.8 +- Add a static 2.x documentation guide with checked example excerpts and a manual Pages workflow. ([#59](https://github.com/coisa/error-handler/pull/59)) -### Patch Changes +### Removed -- [#60](https://github.com/coisa/error-handler/pull/60) [`2b69625`](https://github.com/coisa/error-handler/commit/2b69625faacc99dd371432bb9c27e126b5cbbf6e) - Add regression coverage for aggregate reporter order, appended handlers and preservation of the original throwable instance. +- Retire the historical Scrutinizer configuration and badges after verifying that its latest public inspection predates the 2.x line. Link the current PHP CI and document its security-analysis limits without changing runtime code or external service settings. ([#63](https://github.com/coisa/error-handler/pull/63)) -- [#53](https://github.com/coisa/error-handler/pull/53) [`cde8f16`](https://github.com/coisa/error-handler/commit/cde8f1675bcd980148e84126e41a114608ed0e8f) - Add PHPUnit line-coverage artifacts, overall baseline regression checks and a configurable minimum, with a SHA-aware sticky note for eligible same-repository pull requests. Verify that throwable listeners preserve event identity when callbacks return a replacement. +### Fixed -## 2.0.7 +- Exclude the intentionally invalid compile-fatal fixture from optimized development classmaps while preserving its explicit bounded fire-test execution. ([#64](https://github.com/coisa/error-handler/pull/64)) -### Patch Changes +## [2.0.8] - 2026-10-16 -- [#56](https://github.com/coisa/error-handler/pull/56) [`1946d88`](https://github.com/coisa/error-handler/commit/1946d884a3ab871ea47a4c7a2f2ac6c68e0f966e) - Document the existing 2.x lifecycle, reporting, container and HTTP APIs with PHP 7.4-compatible runnable examples, bounded example verification and matching portable consumer guidance. Keep application-owned dependencies and observed output/exit limitations explicit. +### Added -## 2.0.6 +- Add PHPUnit line-coverage artifacts, overall baseline regression checks and a configurable minimum, with a SHA-aware sticky note for eligible same-repository pull requests. Verify that throwable listeners preserve event identity when callbacks return a replacement. ([#53](https://github.com/coisa/error-handler/pull/53)) -### Patch Changes +### Changed -- [#43](https://github.com/coisa/error-handler/pull/43) [`642ee2a`](https://github.com/coisa/error-handler/commit/642ee2a8c51a2d06772b2a0dcb018bdeca554ba4) - Add bounded child-process and loopback HTTP characterization for the existing 2.x behavior, including explicit known limitations and harness timeout/output-cap cleanup checks. Runtime code and public contracts are unchanged. +- Add regression coverage for aggregate reporter order, appended handlers and preservation of the original throwable instance. ([#60](https://github.com/coisa/error-handler/pull/60)) -- [#55](https://github.com/coisa/error-handler/pull/55) [`b4e6ccb`](https://github.com/coisa/error-handler/commit/b4e6ccb1fc665d2341f26b953f8911beeae264df) - Align the internal functional middleware test namespace with its PSR-4 path so Composer's strict optimized autoloader includes it. Test assertions and runtime behavior are unchanged. +## [2.0.7] - 2026-10-16 -- [#47](https://github.com/coisa/error-handler/pull/47) [`bfd7005`](https://github.com/coisa/error-handler/commit/bfd700501e426e8b8278cabec00e88a12e976a84) - Remove the obsolete PHP 7.2/Xdebug 2.6 development Docker wrappers and document the native Composer/PHP checks. The library's PHP requirements, public API and runtime dependencies are unchanged. +### Added -- [#51](https://github.com/coisa/error-handler/pull/51) [`3655296`](https://github.com/coisa/error-handler/commit/36552960b7deb3c794e9dd7d16d7fa6963a21c2b) - Remove the unused PHP-CS-Fixer 2 configuration and its distribution exclusion. The tested PHP-CS-Fixer 3 configuration remains the formatter entrypoint. +- Document the existing 2.x lifecycle, reporting, container and HTTP APIs with PHP 7.4-compatible runnable examples, bounded example verification and matching portable consumer guidance. Keep application-owned dependencies and observed output/exit limitations explicit. ([#56](https://github.com/coisa/error-handler/pull/56)) -- [#52](https://github.com/coisa/error-handler/pull/52) [`010dd85`](https://github.com/coisa/error-handler/commit/010dd856957cc4b37e178e27210f236c221fdcab) - Remove the Makefile and its privileged Composer bootstrap. Use the documented native Composer commands for dependency installation and quality checks. +## [2.0.6] - 2026-10-16 -## 2.0.5 +### Added -### Patch Changes +- Add bounded child-process and loopback HTTP characterization for the existing 2.x behavior, including explicit known limitations and harness timeout/output-cap cleanup checks. Runtime code and public contracts are unchanged. ([#43](https://github.com/coisa/error-handler/pull/43)) -- [#48](https://github.com/coisa/error-handler/pull/48) [`5213f01`](https://github.com/coisa/error-handler/commit/5213f01150dd7f95e7a17955c966d0e62d1d77d7) - Check the complete development quality suite on PHP 8.3–8.5 and clean production distributions on PHP 7.4 and 8.0–8.5, including lowest runtime dependency resolutions at both endpoints. +### Removed -## 2.0.4 +- Remove the obsolete PHP 7.2/Xdebug 2.6 development Docker wrappers and document the native Composer/PHP checks. The library's PHP requirements, public API and runtime dependencies are unchanged. ([#47](https://github.com/coisa/error-handler/pull/47)) -### Patch Changes +- Remove the unused PHP-CS-Fixer 2 configuration and its distribution exclusion. The tested PHP-CS-Fixer 3 configuration remains the formatter entrypoint. ([#51](https://github.com/coisa/error-handler/pull/51)) -- [#45](https://github.com/coisa/error-handler/pull/45) [`7584519`](https://github.com/coisa/error-handler/commit/758451907ca2bb61d5afa32475b896bd0e91aa00) - Exclude the development-only formatter configuration and Docker ignore file from Composer distribution archives while preserving all runtime source and useful consumer metadata. +- Remove the Makefile and its privileged Composer bootstrap. Use the documented native Composer commands for dependency installation and quality checks. ([#52](https://github.com/coisa/error-handler/pull/52)) -- [#44](https://github.com/coisa/error-handler/pull/44) [`7a3e867`](https://github.com/coisa/error-handler/commit/7a3e867782b29dedb5ebd03314d6daca992339df) - Complete legacy service and fixture PHPDoc, correct file headers, and apply the shared coding-style preset while preserving PHP 7.4 support and the public runtime API. +### Fixed -## 2.0.3 +- Align the internal functional middleware test namespace with its PSR-4 path so Composer's strict optimized autoloader includes it. Test assertions and runtime behavior are unchanged. ([#55](https://github.com/coisa/error-handler/pull/55)) -### Patch Changes +## [2.0.5] - 2026-10-16 -- [#37](https://github.com/coisa/error-handler/pull/37) [`8846d6f`](https://github.com/coisa/error-handler/commit/8846d6fe75b6b60556f1d0c6a4d8c682c730dc41) - Declare `psr/container` as a runtime dependency so the existing container and its factories load in production installations. Require `^1.1 || ^2.0`, matching the existing typed identifiers without changing public APIs or the supported PHP range. +### Added -- [#42](https://github.com/coisa/error-handler/pull/42) [`8a101be`](https://github.com/coisa/error-handler/commit/8a101bed2c9997e5e8eee5589f67d8cda817fbd6) - Fix alias resolution on the declared PHP 7.4 runtime by retaining AliasFactory's unrestricted return contract in PHPDoc instead of a PHP 8 native `mixed` declaration. Preserve exact delegated values, object identity, exceptions and modern PHP behavior. +- Check the complete development quality suite on PHP 8.3–8.5 and clean production distributions on PHP 7.4 and 8.0–8.5, including lowest runtime dependency resolutions at both endpoints. ([#48](https://github.com/coisa/error-handler/pull/48)) -- [#39](https://github.com/coisa/error-handler/pull/39) [`83bd9a0`](https://github.com/coisa/error-handler/commit/83bd9a04d9ac0eb1fa958938d07b8faa4367f732) - Restore the development-only Prophecy integrations, update PHPUnit 9 configuration, separate ordinary tests from optional coverage reporting, use the fixer's own file header as its template, and limit multiline trailing commas to PHP 7.4-compatible locations. +## [2.0.4] - 2026-10-16 -- [#38](https://github.com/coisa/error-handler/pull/38) [`63986d0`](https://github.com/coisa/error-handler/commit/63986d072fe25a34eac4563dcdbac39475ba4539) - Handle string exception codes such as PDO SQLSTATE values without a secondary TypeError when creating an HTTP response. Preserve the 2.x integer 400–500 mapping, original reason phrase and throwable stream delegation; string codes fall back to status 500. +### Changed -## 2.0.2 +- Complete legacy service and fixture PHPDoc, correct file headers, and apply the shared coding-style preset while preserving PHP 7.4 support and the public runtime API. ([#44](https://github.com/coisa/error-handler/pull/44)) -### Patch Changes +### Fixed -- [#36](https://github.com/coisa/error-handler/pull/36) [`2468eec`](https://github.com/coisa/error-handler/commit/2468eeca15df2b5a93c2e9fd3f38f9e242da35c0) - chore(deps-dev): Update squizlabs/php_codesniffer requirement from ^3.13 to ^3.13 || ^4.0 +- Exclude the development-only formatter configuration and Docker ignore file from Composer distribution archives while preserving all runtime source and useful consumer metadata. ([#45](https://github.com/coisa/error-handler/pull/45)) -- [#34](https://github.com/coisa/error-handler/pull/34) [`bc9dd4e`](https://github.com/coisa/error-handler/commit/bc9dd4e06314f0969925bb02fa4b673fa5068eb3) - Add weekly Composer, npm and GitHub Actions dependency checks with automatic, reviewable Changesets for Dependabot pull requests. +## [2.0.3] - 2026-10-16 -- [#35](https://github.com/coisa/error-handler/pull/35) [`65baacb`](https://github.com/coisa/error-handler/commit/65baacb0a5d98d77b72c743180d5d6cca46be834) - Stop tracking the library's Composer lockfile and ignore contributor-local locks. Document fresh dependency resolution and application-owned lockfiles while retaining the Node tooling lockfile and the existing PHP runtime requirements and public API. +### Fixed -- [#32](https://github.com/coisa/error-handler/pull/32) [`ea28301`](https://github.com/coisa/error-handler/commit/ea2830100d60b58a2821c4ba598ca62743f701fa) - Update the development-only PHP_CodeSniffer dependency to the patched 3.x series to address CVE-2026-67434, without changing the library's runtime requirements. +- Declare `psr/container` as a runtime dependency so the existing container and its factories load in production installations. Require `^1.1 || ^2.0`, matching the existing typed identifiers without changing public APIs or the supported PHP range. ([#37](https://github.com/coisa/error-handler/pull/37)) -- [#28](https://github.com/coisa/error-handler/pull/28) [`2e91d7f`](https://github.com/coisa/error-handler/commit/2e91d7fa88ebf659aa75ef70f66411539eed116e) - Update development tooling to CoiSA PHP CS Fixer 3 and PHPUnit 9.6, which provides the shared diff dependency required by the current formatter. Check changed PHP files in pull requests through the formatter's reusable workflow. Preserve the library's existing runtime requirements and public API. +- Fix alias resolution on the declared PHP 7.4 runtime by retaining AliasFactory's unrestricted return contract in PHPDoc instead of a PHP 8 native `mixed` declaration. Preserve exact delegated values, object identity, exceptions and modern PHP behavior. ([#42](https://github.com/coisa/error-handler/pull/42)) -## 2.0.1 +- Restore the development-only Prophecy integrations, update PHPUnit 9 configuration, separate ordinary tests from optional coverage reporting, use the fixer's own file header as its template, and limit multiline trailing commas to PHP 7.4-compatible locations. ([#39](https://github.com/coisa/error-handler/pull/39)) -### Patch Changes +- Handle string exception codes such as PDO SQLSTATE values without a secondary TypeError when creating an HTTP response. Preserve the 2.x integer 400–500 mapping, original reason phrase and throwable stream delegation; string codes fall back to status 500. ([#38](https://github.com/coisa/error-handler/pull/38)) -- [#27](https://github.com/coisa/error-handler/pull/27) [`d8973f4`](https://github.com/coisa/error-handler/commit/d8973f4b8c2a861490bf24ce99db103dd6e3ff29) - Add development-only Changesets tooling, GitHub-linked changelogs, reviewed version PRs and GitHub releases after those PRs are merged, preserving the PHP runtime requirements and public API of the 2.x line. +## [2.0.2] - 2026-10-16 -## 2.0.0 +### Added -[Release](https://github.com/coisa/error-handler/releases/tag/2.0.0) · -[Changes since 1.0.0](https://github.com/coisa/error-handler/compare/1.0.0...2.0.0) +- Add weekly Composer, npm and GitHub Actions dependency checks with automatic, reviewable Changesets for Dependabot pull requests. ([#34](https://github.com/coisa/error-handler/pull/34)) -### Major Changes +### Changed -- Require PHP `^7.4 || ^8.0` instead of `^7.1`. -- Replace the callable-based `ErrorHandler` constructor with a - `ThrowableHandlerInterface` dependency. Construction no longer installs PHP - callbacks or starts output buffering; applications call `register()` and - `unregister()` explicitly. -- Separate throwable reporting, PHP error handling and shutdown handling into - `ThrowableHandlerInterface`, `PhpErrorHandlerInterface` and - `ShutdownHandlerInterface`, with configurable error and shutdown handlers. -- Replace the invokable `HandlerInterface` and `CollectionHandler` API, and - remove the output-specific handlers (`ErrorLogHandler`, `HtmlHandler`, - `JsonHandler`, `VarDumpHandler`, `VarExportHandler`), `DebugHandler`, - `DebugHelper` and `ExceptionHelper`. -- Change the declared package license from Apache 2.0 to MIT. +- Expand the development-only PHP_CodeSniffer requirement from `^3.13` to `^3.13 || ^4.0`. ([#36](https://github.com/coisa/error-handler/pull/36)) + +- Update development tooling to CoiSA PHP CS Fixer 3 and PHPUnit 9.6, which provides the shared diff dependency required by the current formatter. Check changed PHP files in pull requests through the formatter's reusable workflow. Preserve the library's existing runtime requirements and public API. ([#28](https://github.com/coisa/error-handler/pull/28)) + +- Omit automatic author acknowledgements from generated release notes while retaining delivery references. ([#31](https://github.com/coisa/error-handler/pull/31)) + +### Removed + +- Stop tracking the library's Composer lockfile and ignore contributor-local locks. Document fresh dependency resolution and application-owned lockfiles while retaining the Node tooling lockfile and the existing PHP runtime requirements and public API. ([#35](https://github.com/coisa/error-handler/pull/35)) + +### Security + +- Update the development-only PHP_CodeSniffer dependency to the patched 3.x series to address CVE-2026-67434, without changing the library's runtime requirements. ([#32](https://github.com/coisa/error-handler/pull/32)) + +## [2.0.1] - 2026-10-15 + +### Added + +- Add development-only Changesets tooling, GitHub-linked changelogs, reviewed version PRs and GitHub releases after those PRs are merged, preserving the PHP runtime requirements and public API of the 2.x line. ([#27](https://github.com/coisa/error-handler/pull/27)) + +## [2.0.0] - 2024-12-27 ### Added -- PSR-14 integration for dispatching throwables and error events, with listener - providers, callable listeners and a PSR-3 logging listener. -- PSR-15 error-handling middleware and throwable response/stream factories - built on PSR-17 HTTP factories. -- A PSR-11 error-handler container, service factories and a `ConfigProvider` - with Laminas discovery metadata. -- Callable throwable and shutdown adapters, a throwable-handler aggregate, - and dedicated PHP error and last-error shutdown handlers. +- PSR-14 integration for dispatching throwables and error events, with listener providers, callable listeners and a PSR-3 logging listener. ([#1](https://github.com/coisa/error-handler/pull/1)) + +- PSR-15 error-handling middleware and throwable response/stream factories built on PSR-17 HTTP factories. ([#1](https://github.com/coisa/error-handler/pull/1)) + +- A PSR-11 error-handler container, service factories and a `ConfigProvider` with Laminas discovery metadata. ([#1](https://github.com/coisa/error-handler/pull/1)) + +- Callable throwable and shutdown adapters, a throwable-handler aggregate, and dedicated PHP error and last-error shutdown handlers. ([#1](https://github.com/coisa/error-handler/pull/1)) + +### Changed + +- Require PHP `^7.4 || ^8.0` instead of `^7.1`. + +- Replace the callable-based `ErrorHandler` constructor with a `ThrowableHandlerInterface` dependency. Construction no longer installs PHP callbacks or starts output buffering; applications call `register()` and `unregister()` explicitly. ([#1](https://github.com/coisa/error-handler/pull/1)) + +- Separate throwable reporting, PHP error handling and shutdown handling into `ThrowableHandlerInterface`, `PhpErrorHandlerInterface` and `ShutdownHandlerInterface`, with configurable error and shutdown handlers. ([#1](https://github.com/coisa/error-handler/pull/1)) + +- Change the declared package license from Apache 2.0 to MIT. ([#1](https://github.com/coisa/error-handler/pull/1)) + +### Removed -## 1.0.0 +- Replace the invokable `HandlerInterface` and `CollectionHandler` API, and remove the output-specific handlers (`ErrorLogHandler`, `HtmlHandler`, `JsonHandler`, `VarDumpHandler`, `VarExportHandler`), `DebugHandler`, `DebugHelper` and `ExceptionHelper`. ([#1](https://github.com/coisa/error-handler/pull/1)) -[Initial release](https://github.com/coisa/error-handler/releases/tag/1.0.0) -(marked as a prerelease on GitHub). +## [1.0.0] - 2019-09-23 + +This version is marked as a prerelease on GitHub. ### Added -- PHP errors, uncaught exceptions and shutdown handling under the - `CoiSA\ErrorHandler` namespace, registered during `ErrorHandler` construction. +- PHP errors, uncaught exceptions and shutdown handling under the `CoiSA\ErrorHandler` namespace, registered during `ErrorHandler` construction. + - Callable throwable handling and an invokable handler collection. -- Built-in `error_log`, HTML, JSON, `var_dump` and `var_export` output handlers, - with exception and debug output helpers. + +- Built-in `error_log`, HTML, JSON, `var_dump` and `var_export` output handlers, with exception and debug output helpers. + - A Composer library requiring PHP `^7.1`, with Apache 2.0 licensing. + +[2.5.2]: https://github.com/coisa/error-handler/compare/v2.5.1...v2.5.2 +[2.5.1]: https://github.com/coisa/error-handler/compare/v2.5.0...v2.5.1 +[2.5.0]: https://github.com/coisa/error-handler/compare/v2.4.4...v2.5.0 +[2.4.4]: https://github.com/coisa/error-handler/compare/v2.4.3...v2.4.4 +[2.4.3]: https://github.com/coisa/error-handler/compare/v2.4.2...v2.4.3 +[2.4.2]: https://github.com/coisa/error-handler/compare/v2.4.1...v2.4.2 +[2.4.1]: https://github.com/coisa/error-handler/compare/v2.4.0...v2.4.1 +[2.4.0]: https://github.com/coisa/error-handler/compare/v2.3.1...v2.4.0 +[2.3.1]: https://github.com/coisa/error-handler/compare/v2.3.0...v2.3.1 +[2.3.0]: https://github.com/coisa/error-handler/compare/v2.2.0...v2.3.0 +[2.2.0]: https://github.com/coisa/error-handler/compare/v2.1.0...v2.2.0 +[2.1.0]: https://github.com/coisa/error-handler/compare/v2.0.9...v2.1.0 +[2.0.9]: https://github.com/coisa/error-handler/compare/v2.0.8...v2.0.9 +[2.0.8]: https://github.com/coisa/error-handler/compare/v2.0.7...v2.0.8 +[2.0.7]: https://github.com/coisa/error-handler/compare/v2.0.6...v2.0.7 +[2.0.6]: https://github.com/coisa/error-handler/compare/v2.0.5...v2.0.6 +[2.0.5]: https://github.com/coisa/error-handler/compare/v2.0.4...v2.0.5 +[2.0.4]: https://github.com/coisa/error-handler/compare/v2.0.3...v2.0.4 +[2.0.3]: https://github.com/coisa/error-handler/compare/v2.0.2...v2.0.3 +[2.0.2]: https://github.com/coisa/error-handler/compare/v2.0.1...v2.0.2 +[2.0.1]: https://github.com/coisa/error-handler/compare/2.0.0...v2.0.1 +[2.0.0]: https://github.com/coisa/error-handler/compare/1.0.0...2.0.0 +[1.0.0]: https://github.com/coisa/error-handler/releases/tag/1.0.0 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a67f27c..155eec6 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -89,8 +89,10 @@ Dependency installation in a fresh checkout resolves a local lockfile; subsequen installs can reuse it. CI must record the actual resolution for its runner, and cache keys must not require a committed Composer lockfile. -`package-lock.json` remains tracked for the independent Node release tooling. -Node.js is not a runtime dependency of the Composer library. +Add one independent `.changelog/*.md` fragment for observable changes, including +dependencies and workflows. The [release process](docs/releases.md) describes the +format, PR checks and reviewed version PR. Release automation supplies its own +runtime; it adds no PHP or Node dependency to this library. ## Native development environment diff --git a/README.md b/README.md index 218dfaa..e920992 100644 --- a/README.md +++ b/README.md @@ -19,8 +19,7 @@ Requires PHP `^7.4 || ^8.0` and Composer 2. Applications supply their logger, event dispatcher, HTTP factories and response emitter as needed. This README describes the 2.x API. Check `composer show coisa/error-handler` -and the [release history](CHANGELOG.md) for your installed version; a pending -Changeset is not a published Composer release. +and the [release history](CHANGELOG.md) for your installed version. ## 🛠️ Quick start @@ -124,8 +123,9 @@ the private reporting channel. Ordinary bugs and feature requests belong in issu Follow the [contributor guide](CONTRIBUTING.md) for dependency setup and `composer --no-plugins check`. See [testing](docs/testing.md) for process fixtures -and platform evidence, and [Changesets](.changeset/README.md) for release notes. -Node.js is used only by development release tooling. +and platform evidence, and the [release process](docs/releases.md) for independent +release notes and reviewed version PRs. Release automation uses the Fast Forward +Changelog reusable workflow without adding a runtime or Node dependency. ## License diff --git a/docs/api.md b/docs/api.md index 25f2bc0..1059ea6 100644 --- a/docs/api.md +++ b/docs/api.md @@ -1,6 +1,6 @@ # Core API and lifecycle in 2.x -These guides describe the existing 2.x API, including compatible maintenance on `master`. Confirm the installed version with `composer show coisa/error-handler` and consult its matching source. A pending Changeset is not a published Composer version. The PSR-11 metadata and PHP 7.4 alias corrections are tracked in [#13](https://github.com/coisa/error-handler/issues/13) and [#40](https://github.com/coisa/error-handler/issues/40); container recipes on PHP 7.4 need a checkout or release containing both. +These guides describe the 2.x API. Confirm the installed version with `composer show coisa/error-handler` and consult its matching source. The PSR-11 metadata and PHP 7.4 alias corrections are tracked in [#13](https://github.com/coisa/error-handler/issues/13) and [#40](https://github.com/coisa/error-handler/issues/40); container recipes on PHP 7.4 need a checkout or release containing both. The declared runtime is PHP `^7.4 || ^8.0`. This is a dependency contract, not evidence that every PHP/dependency combination has been tested. Application integrations can impose narrower requirements. @@ -57,11 +57,11 @@ The [complete logging example](https://github.com/coisa/error-handler/blob/maste The predicate must return a boolean: truthy/false-like non-booleans raise `TypeError`. Predicate and delegate failures propagate unchanged, without retry. To invert a condition, supply a predicate that returns its boolean negation. A skipped branch does not recover an operation, change PHP suppression or imply a successful HTTP response; a failure still stops later aggregate reporters. -The [filtering example](https://github.com/coisa/error-handler/blob/master/examples/filtering.php) routes synthetic PHP deprecations to a selected branch while keeping the general branch. Inspect `ErrorException::getSeverity()` for PHP severity; arbitrary exception codes do not carry that meaning. Use a callable directly for one-off application logic, and the decorator when wrapping an existing reporter or aggregate. This is an additive, opt-in 2.x API: use a source version containing it; a pending minor Changeset is not a published release. +The [filtering example](https://github.com/coisa/error-handler/blob/master/examples/filtering.php) routes synthetic PHP deprecations to a selected branch while keeping the general branch. Inspect `ErrorException::getSeverity()` for PHP severity; arbitrary exception codes do not carry that meaning. Use a callable directly for one-off application logic, and the decorator when wrapping an existing reporter or aggregate. ## Best-effort reporting -`new Handler\BestEffortThrowableHandlerAggregate($first, $second, ...)` is an explicit alternative to the existing fail-fast `ThrowableHandlerAggregate`. It takes a fixed constructor list of `ThrowableHandlerInterface` reporters. Construction invokes nothing and installs no callbacks. Use a checkout/release containing these new classes; a pending minor Changeset does not make them available in older 2.x installations. +`new Handler\BestEffortThrowableHandlerAggregate($first, $second, ...)` is an explicit alternative to the existing fail-fast `ThrowableHandlerAggregate`. It takes a fixed constructor list of `ThrowableHandlerInterface` reporters. Construction invokes nothing and installs no callbacks. Each `handleThrowable($original)` invocation attempts every constructor slot once, in order, with the identical original object. A reporter's `Throwable` failure is retained while later slots run. Duplicate slots remain deliberate separate attempts. Zero reporters and all-success passes return normally. If any reporter fails, including partial success, one `Exception\AggregateReportingException` escapes after all attempts. diff --git a/docs/index.html b/docs/index.html index f2397d2..b32ef60 100644 --- a/docs/index.html +++ b/docs/index.html @@ -113,7 +113,7 @@

Error Handler 2.x

Compose diagnostic reporting, native PHP callbacks and HTTP responses with explicit application boundaries.

The library supplies handlers and PSR adapters. Your application chooses reporters, PSR implementations, callback installation and HTTP emission.

-
This guide describes the existing 2.x API and compatible maintenance on master. Check your installed version and matching source. A pending Changeset is not a published release.
+
This guide describes the 2.x API. Check your installed version and matching source.

New to the library? Follow installation, run direct reporting, then choose process callbacks or an explicit HTTP response policy. Add container integration when the application needs service lookup.

@@ -223,7 +223,7 @@

Select diagnostic branches explicitly

Severity selection from examples/filtering.php · the example also retains a general diagnostic branch
    static fn(Throwable $error): bool => $error instanceof ErrorException && E_USER_DEPRECATED === $error->getSeverity(),
-

This opt-in adapter requires a source version containing the additive API; a pending Changeset is not a published release. It adds no discovery, output, callback registration, recursion guard or response policy. A nonmatch is not recovery or redaction: built-in empty capture still falls back to diagnostic text. See the API guide and HTTP composition.

+

This opt-in adapter adds no discovery, output, callback registration, recursion guard or response policy. A nonmatch is not recovery or redaction: built-in empty capture still falls back to diagnostic text. See the API guide and HTTP composition.

@@ -363,6 +363,7 @@

Continue in the source guides

  • Native checks, bounded probes and evidence limits
  • Portable consumer skill and optional installation
  • Published release history
    • +
  • Release fragments, reviewed version PRs and publication
    • diff --git a/docs/releases.md b/docs/releases.md new file mode 100644 index 0000000..27d3b74 --- /dev/null +++ b/docs/releases.md @@ -0,0 +1,191 @@ +# Release notes and reviewed releases + +The [Changelog workflow](https://github.com/coisa/error-handler/blob/master/.github/workflows/changelog.yml) +uses [Fast Forward Changelog](https://github.com/php-fast-forward/changelog) for +independent release notes, PR checks and a reviewed version PR. Git tags are the +version authority for `coisa/error-handler`; there is no separate npm manifest +or Composer `version` field to maintain. + +## Add a release note + +Create a unique lowercase dash-separated file in `.changelog/`, for example +`.changelog/preserve-reporting-order.md`: + +```markdown +--- +category: fixed +type: patch +--- + +Preserve reporter order when handling an application exception. +``` + +Describe the observable change in English. Commit the fragment with the change; +keep meaningful Markdown indentation, code fences and hard line breaks. Prefer +a backslash at the end of a line for an explicit Markdown break: Git's unchanged +whitespace check rejects trailing spaces, even when intended as a hard break. Ordinary +contributions leave existing fragments and `CHANGELOG.md` intact. + +Categories are `added`, `changed`, `deprecated`, `removed`, `fixed` and `security`. +Always specify `type`: `patch` for compatible fixes or maintenance, `minor` for +compatible additions, and `major` for breaking changes. A tooling change or an +upstream dependency's major version does not itself require a library major. +The 2.x maintenance line preserves its public API and PHP requirements. + +PR references are discovered automatically after contributions are merged. +Write the fragment before opening its PR; no follow-up edit is needed to add +the number. An optional `pull_request` field can record an already verified PR +number. Never infer it from an issue, branch name or commit message. Omit +`issue` and `author` in ordinary notes: entries use a delivering PR link when +known, with no automatic thanks or commit-link substitute. +The folder contains only valid fragments; contribution instructions live here. + +No local changelog installation is required. The workflow supplies its trusted +Docker runtime on Linux. If you already use the compatible upstream CLI, its +`check` and `status --json --source=tags` commands validate and preview the plan. +Local CLI requirements belong to that tool, not the library's PHP support. +Local commands leave PR-origin discovery disabled unless +`--resolve-pull-requests` is selected; use it when rehearsing the workflow's +plan in a disposable copy with authorized read-only GitHub access. `source: tags` +selects historical notes and does not disable PR-origin API reads. +With no pending fragments, the version command succeeds without changing files. + +## Project tooling skill + +The repository includes the upstream `fast-forward-changelog` skill under +`.agents/skills`, installed with the CLI's native project-scoped installer. Its +receipt records the source release and payload hashes. It is separate from the +library's bundled `coisa-error-handler` consumer skill and is excluded from the +Composer distribution. + +For the reviewed release, use [CPX](https://github.com/laravel/cpx) with the exact +numeric Composer version, without a `v` prefix: + +```sh +CHANGELOG_VERSION=0.2.0 + +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" help skill:install +cpx --skip-local "fast-forward/changelog:$CHANGELOG_VERSION" skill:install --check +``` + +Run these commands from the repository root. Inspect the selected release's help +before installing or updating; preserve local changes and let its installer +manage the payload and receipt together. A fresh project installation uses +`skill:install` without `--check`. Do not modify the upstream copy directly or +install it globally as part of repository maintenance. Installation and a clean +receipt check do not establish activation in a particular agent session. + +This release tool requires PHP 8.5. CPX isolates its Composer dependencies but +does not supply a PHP runtime. The workflow uses upstream's Docker runtime; +library users retain the declared PHP 7.4+ support. PHP CI checks library-owned +files on each supported runtime and the upstream skill's PHP example on 8.5. + +## Central history format + +`CHANGELOG.md` uses English [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) +headings and [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Retain one +title and introduction. Published versions use `## [version] - YYYY-MM-DD`, +newest first, with their verified publication dates; do not substitute commit +dates or today's date when historical evidence is missing. + +Classify entries by behavior under Added, Changed, Deprecated, Removed, Fixed +or Security, in that order, omitting empty categories. The category describes +the change; fragment `type` separately selects its SemVer impact. Keep Markdown +paragraphs, lists and code fences intact. A verified delivering PR is linked +inline as `([#123](https://github.com/coisa/error-handler/pull/123))`. Without +verified PR evidence, leave only the description; do not add author thanks, +issues or commit hashes as substitutes. + +The footer contains version link definitions in the same newest-to-oldest order +as the sections. Each later version compares its preceding tag with that tag; +the first version links to its own release/tag. Preserve correct existing +destinations. Pending contributions live in fragments, so consolidation adds +no new `Unreleased` section. Historical normalization is an explicit maintenance +task, not part of ordinary contribution editing. + +## Contribution checks and feedback + +One caller handles the lifecycle on the repository's default branch: + +- `pull_request` checks committed contributions with read-only permissions. +- `pull_request_target` uses the upstream runtime for one updated PR comment and + commit status, without executing consumer PHP, Composer scripts or templates + from the PR with write credentials. +- Dependabot PRs receive a fragment from verified dependency metadata. Existing + notes are preserved; review the generated summary and release impact. +- Default-branch pushes and manual dispatch prepare or update `changelog/version`. + +The caller has no repository name or default-branch literal. The reusable +workflow selects those from the event. It retains the lifecycle's default +`resolve-pull-requests: true` consistently across preparation, generated-head +checks and publication. The upstream runtime verifies exact fragment origins and +merged-PR repository/ancestry evidence without modifying fragment metadata. +No qualifying merged PR leaves the description alone; ambiguous or unavailable +evidence blocks preparation rather than inventing a reference. + +The workflow follows upstream's official `v0` compatibility branch. This is a +branch/channel, not a version tag; the reviewed implementation matches published +`v0.2.0`. Minor updates in the `0.x` channel can change contracts. Verify the +channel's resolved commit and compatible release contract when investigating a +run or updating the integration. + +Review the [upstream lifecycle contract](https://github.com/php-fast-forward/changelog/blob/v0.2.0/docs/reusable-lifecycle.md) +before changing the workflow's runtime reference or settings. The caller supplies +no consumer PHP, Composer or Node runtime and keeps its current Linux runner and +job-scoped permissions. Do not add privileged execution of PR code. + +PHP CI, coverage and formatting remain independent checks. The generated-head +changelog status verifies release inputs; it does not run the PHP suite. +With `GITHUB_TOKEN`, GitHub can require owner approval before workflows on a +generated PR run. Approve those runs and verify their exact head before merging. +An optional GitHub App is an application-level authentication choice, described +in the [upstream guide](https://github.com/php-fast-forward/changelog/blob/v0.2.0/docs/github-app.md). +This workflow configures no App, secret, repository setting or branch rule. + +Central-history maintenance requires the reusable's verified maintain/admin +authorization, including the actual granting actor. A label name by itself does +not authorize an edit or waive validation. Keep the migration's maintenance +grant separate from the new fragment, independent PHP checks and publication. + +## Review and publication + +The version PR consolidates validated fragments into `CHANGELOG.md` and removes +only the consumed notes. Review its next version, text, diff and actual PHP CI +results. New contributions update the same managed PR; its title is not its +identity. Preserve historical descriptions, verified dates, links and the +introductory header. Automatic PR discovery adds verified links in memory; +failed origin checks require investigation, not manual fabricated associations. +Let the workflow regenerate an existing managed version PR after changed settings +or history reach the default branch; do not overwrite its signed head or trailers. + +The workflow retains automatic publication after the owner merges the managed +version PR. `publish: true` routes that approved merge to the upstream publisher, +which validates the exact merge SHA and consolidation evidence before creating +its `v`-prefixed Git tag and GitHub Release. It does not publish an npm package, +merge PRs or bypass review. Composer consumers receive versions through Git tags +and the existing package registry integration. + +Preparing this integration or passing CI does not authorize an agent to merge a +PR or publish a release. Test consolidation only in a disposable copy. For a +failed publication, inspect the run and its exact SHA; upstream can complete a +matching partial publication without moving an existing tag. Never move or +delete published tags to repair a prepared version. + +## Existing GitHub Releases + +The approved central history is the canonical source of each Release's notes. +Use the compatible CLI's `notes ` command to extract that version, +preserving the Markdown and the reference context needed by its links. Compare +each proposed body with its current Release before requesting synchronization. +Inspect the extracted body for unresolved reference links and include only the +definitions needed by that body when preparing its standalone Release notes. +Do not attach the entire changelog, an author list or GitHub's generated commit +summary. + +Historical reconciliation is separate from the normal publisher. A divergent +existing Release is not silently rewritten by merging a contribution. Prepare +updates, and missing Releases only for verified tags, for owner approval first. +After the approved history is integrated and synchronization is authorized, +revalidate its exact SHA and reread every changed Release. Preserve tags, target +commits, assets and draft/prerelease flags; do not move tags or backdate a Release +created during reconciliation. diff --git a/package-lock.json b/package-lock.json deleted file mode 100644 index 94dacd5..0000000 --- a/package-lock.json +++ /dev/null @@ -1,586 +0,0 @@ -{ - "name": "@coisa/error-handler", - "version": "2.5.2", - "lockfileVersion": 3, - "requires": true, - "packages": { - "": { - "name": "@coisa/error-handler", - "version": "2.5.2", - "devDependencies": { - "@changesets/changelog-github": "1.0.1", - "@changesets/cli": "3.0.3" - }, - "engines": { - "node": "^22.11 || ^24 || >=26", - "npm": ">=10.9.0" - } - }, - "node_modules/@changesets/apply-release-plan": { - "version": "8.1.1", - "resolved": "https://registry.npmjs.org/@changesets/apply-release-plan/-/apply-release-plan-8.1.1.tgz", - "integrity": "sha512-nk2Hbq3M9NeHMdaIRBDvawKrQJzXB9sGyBUE5yWnIKtvdcNCPj75zBekJYr0gTT2ecJH3eFeTrc8eisPImcv0Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/config": "^4.0.1", - "@changesets/format": "^0.1.2", - "@changesets/git": "^4.0.1", - "@changesets/should-skip-package": "^1.0.0", - "@changesets/types": "^7.0.0", - "import-meta-resolve": "^4.2.0", - "jsonc-parser": "^3.3.1", - "semver": "^7.8.1" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/assemble-release-plan": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/@changesets/assemble-release-plan/-/assemble-release-plan-7.0.0.tgz", - "integrity": "sha512-oEW8BxdA604kGGtDSCiHr5w9Tv4UWe9I2k61IBNZzCOE1kbYaJj4v+lFQNgcEZFkUc2pV/+hASErGDvpJOZCTg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/errors": "^1.0.0", - "@changesets/get-dependents-graph": "^3.0.0", - "@changesets/should-skip-package": "^1.0.0", - "@changesets/types": "^7.0.0", - "semver": "^7.8.1" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/changelog-git": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/@changesets/changelog-git/-/changelog-git-1.0.0.tgz", - "integrity": "sha512-3Dst2Ime2Op5nd4XmWJLPIgp11ZFqJqSkVug9izK6TDcIV4YlhPS4ECbEVR+eGI0bk0r1ItogD4j2Oli87bJrA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/types": "^7.0.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/changelog-github": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/@changesets/changelog-github/-/changelog-github-1.0.1.tgz", - "integrity": "sha512-QUcrV7878yHlWPXXPA6gqSxNKwtVHCd1K22L7ZAoJw2yGy8K4QvjwOStD75+1Q9KD9ZSUgGS94HuYdd7HOVtpA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/get-github-info": "^1.0.1", - "@changesets/types": "^7.0.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/cli": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/@changesets/cli/-/cli-3.0.3.tgz", - "integrity": "sha512-L1i67bMfkK6iC/kDejuNO4pFgTRcWIObsD6Qof2woP1I4M8tj17DGlcpRaTzTv1DYSP5EMwWdEtR8X0Pj5Jg3Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/apply-release-plan": "^8.1.1", - "@changesets/assemble-release-plan": "^7.0.0", - "@changesets/changelog-git": "^1.0.0", - "@changesets/config": "^4.0.1", - "@changesets/errors": "^1.0.0", - "@changesets/get-dependents-graph": "^3.0.0", - "@changesets/git": "^4.0.1", - "@changesets/pre": "^3.0.0", - "@changesets/read": "^1.0.1", - "@changesets/should-skip-package": "^1.0.0", - "@changesets/types": "^7.0.0", - "@changesets/write": "^1.0.1", - "@clack/prompts": "^1.7.0", - "@manypkg/get-packages": "^3.1.0", - "@pnpm/deps.graph-sequencer": "^1100.0.1", - "cac": "^7.0.0", - "import-meta-resolve": "^4.2.0", - "launch-editor": "^2.14.1", - "package-manager-detector": "^1.6.0", - "semver": "^7.8.1", - "tinyexec": "^1.3.1" - }, - "bin": { - "changeset": "bin.js" - }, - "engines": { - "node": "^22.11 || ^24 || >=26", - "npm": ">=10.9.0", - "pnpm": ">=10.0.0", - "yarn": ">=4.5.2" - } - }, - "node_modules/@changesets/config": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/@changesets/config/-/config-4.0.1.tgz", - "integrity": "sha512-PxpxSQLQSLDjceAgRq+4FWlU+HflDIw03mmPVipxoQx9xrXFUjmqTy3SE+n/2t+DqPdpPiLWVr5NRiLZvjyLwg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/get-dependents-graph": "^3.0.0", - "@changesets/should-skip-package": "^1.0.0", - "@changesets/types": "^7.0.0", - "@manypkg/get-packages": "^3.1.0", - "picomatch": "^4.0.7" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/errors": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/@changesets/errors/-/errors-1.0.0.tgz", - "integrity": "sha512-ElN/mEzn6zmETgjwf5MclCMa9ef59sAR0lfO8VSYIsiRvbC2FbLB/92EoYw10Sl0kGixxHFiJZUSv7dA+YpR8g==", - "dev": true, - "license": "MIT", - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/format": { - "version": "0.1.2", - "resolved": "https://registry.npmjs.org/@changesets/format/-/format-0.1.2.tgz", - "integrity": "sha512-Caez5XtNXCFS/G5bwyav3wuXL0tMxVd2ZGbaumWbzN08tyzO21asCw7JZhNtVsAZDCvDRUzZN+Iit9SyRITSYA==", - "dev": true, - "license": "MIT", - "dependencies": { - "package-manager-detector": "^1.8.0", - "tinyexec": "^1.3.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/get-dependents-graph": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/@changesets/get-dependents-graph/-/get-dependents-graph-3.0.0.tgz", - "integrity": "sha512-ji/t5wFA1zREKXRUePE6Qi+Qu2UgxCeSSGQrphezwvQZrp49B7sJ+8+wvM0tA7zPeSxYKCojDy3WWgrl+s+awg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/types": "^7.0.0", - "semver": "^7.8.1" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/get-github-info": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/@changesets/get-github-info/-/get-github-info-1.0.1.tgz", - "integrity": "sha512-ifLQCky/ZtDgZ4xCiUMjnLZSJ8xk52iIzMJbBBPlZWjr2CiTNTaTDddIVWKicrUAdWuLWL7PUw2fNa1yPwLpIg==", - "dev": true, - "license": "MIT", - "dependencies": { - "dataloader": "^2.2.3" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/git": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/@changesets/git/-/git-4.0.1.tgz", - "integrity": "sha512-6vWpIAC4LkpmlqaIu37ViT5enyd9+uBwAiGqCGhASvkSHBgx4PrtTGXWTMFYpDmZbjgyonyVgMciPrW4MqtJsA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/errors": "^1.0.0", - "@changesets/types": "^7.0.0", - "@manypkg/get-packages": "^3.1.0", - "picomatch": "^4.0.4", - "tinyexec": "^1.3.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/parse": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/@changesets/parse/-/parse-1.0.0.tgz", - "integrity": "sha512-P0iaMb9p9CRYZiTgAllEIF9AUMQHIy1G72tKlcIqJp61icZSsKQNiOPdxAMZG8m/DvZwt/oz5xEbTpike//dWg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/types": "^7.0.0", - "yaml": "^2.9.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/pre": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/@changesets/pre/-/pre-3.0.0.tgz", - "integrity": "sha512-Zm/6YliV/a2oeWTqHJf6KxLrQwgcK1i/BRDl2m0EKZvbnxV5fG9QRhwJJGshjsZTUTS6dkfURQ2K6aAvgNw/3Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/errors": "^1.0.0", - "@changesets/types": "^7.0.0", - "@manypkg/get-packages": "^3.1.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/read": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/@changesets/read/-/read-1.0.1.tgz", - "integrity": "sha512-nzvSC6RcTiWf/dsuwZFXpLzGGsRHYCL68U3uHV7srsulU93aVWY7u2GEJiDZ+4GIIElfaW5EqtKC0UHroY+LTQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/git": "^4.0.1", - "@changesets/parse": "^1.0.0", - "@changesets/types": "^7.0.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/should-skip-package": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/@changesets/should-skip-package/-/should-skip-package-1.0.0.tgz", - "integrity": "sha512-pwqoJmbONn1XgXmZXPEExgAaT+HdZLjALFTDgIm+PnS5KeO2nLtzA2/Q+4aMFY14kFMuXKG30MObhvDzWgzDgg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/types": "^7.0.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/types": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/@changesets/types/-/types-7.0.0.tgz", - "integrity": "sha512-c5GoiQyt3pxiXjrWSNoP8/GRf4kG+VnKzovx1OQM8dYYALlSwgedmkPmJ+ZqGxqwg9D3Bkj85Uo4KLd5BN3A0w==", - "dev": true, - "license": "MIT", - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@changesets/write": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/@changesets/write/-/write-1.0.1.tgz", - "integrity": "sha512-q/ThtP9gcnEP6xlv7LrY26C2mHqdGBti/MmOVngt/M/oIGYkssmQGxPK9WzBNt2juVcH/vml2WQ+ra8LXYOTaA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@changesets/format": "^0.1.1", - "@changesets/types": "^7.0.0", - "human-id": "^4.2.0" - }, - "engines": { - "node": "^22.11 || ^24 || >=26" - } - }, - "node_modules/@clack/core": { - "version": "1.5.1", - "resolved": "https://registry.npmjs.org/@clack/core/-/core-1.5.1.tgz", - "integrity": "sha512-iHTrHA8MtVuLl2TfZySmcKv1qO2PoyC9Z7pfSDozEuV5vtY3/wcOPKJXlqJ5Oq2Cx5DDGQGAMVx6HZfRRoVEbQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "fast-wrap-ansi": "^0.2.0", - "sisteransi": "^1.0.5" - }, - "engines": { - "node": ">= 20.12.0" - } - }, - "node_modules/@clack/prompts": { - "version": "1.8.1", - "resolved": "https://registry.npmjs.org/@clack/prompts/-/prompts-1.8.1.tgz", - "integrity": "sha512-dlT1m5e/0yUL0kRNcQn7yGLVThkgbB0Ga/1AmfDDC/8ik6AIiSf2QLQO2zPYvefsHP0aFgxO93cVLCCfDp7kzQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "@clack/core": "1.5.1", - "fast-string-width": "^3.0.2", - "fast-wrap-ansi": "^0.2.0", - "sisteransi": "^1.0.5" - }, - "engines": { - "node": ">= 20.12.0" - } - }, - "node_modules/@manypkg/find-root": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/@manypkg/find-root/-/find-root-3.1.0.tgz", - "integrity": "sha512-BcSqCyKhBVZ5YkSzOiheMCV41kqAFptW6xGqYSTjkVTl9XQpr+pqHhwgGCOHQtjDCv7Is6EFyA14Sm5GVbVABA==", - "dev": true, - "license": "MIT", - "dependencies": { - "@manypkg/tools": "^2.1.0" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@manypkg/get-packages": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/@manypkg/get-packages/-/get-packages-3.1.0.tgz", - "integrity": "sha512-0TbBVyvPrP7xGYBI/cP8UP+yl/z+HtbTttAD7FMAJgn/kXOTwh5/60TsqP9ZYY710forNfyV0N8P/IE/ujGZJg==", - "dev": true, - "license": "MIT", - "dependencies": { - "@manypkg/find-root": "^3.1.0", - "@manypkg/tools": "^2.1.0" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@manypkg/tools": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/@manypkg/tools/-/tools-2.1.2.tgz", - "integrity": "sha512-6QEf6yqFbETdwGITKq57aYoPfX/3K8XFNwsAlx0C1M7o8cb79sv1M3w+tWuWvIcSbNqrLF7OD7YpZMVVz335hQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "jju": "^1.4.0", - "tinyglobby": "^0.2.13", - "yaml": "^2.9.0" - }, - "engines": { - "node": ">=20.0.0" - } - }, - "node_modules/@pnpm/deps.graph-sequencer": { - "version": "1100.0.1", - "resolved": "https://registry.npmjs.org/@pnpm/deps.graph-sequencer/-/deps.graph-sequencer-1100.0.1.tgz", - "integrity": "sha512-pOr5+q1fLYKwFN3LAJuGZEnfXDcQ73zqgDHMtGy+K+uIoUqyY+6MeDCWFwfu+4EFuq76I5EPFofoNAI+Bmmq4A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=22.13" - }, - "funding": { - "url": "https://opencollective.com/pnpm" - } - }, - "node_modules/cac": { - "version": "7.1.0", - "resolved": "https://registry.npmjs.org/cac/-/cac-7.1.0.tgz", - "integrity": "sha512-LMDU/U2yA4IPIY8KT0NsNPWEYZvAMkbgyspxJ6btJaYV+WMDOHAZCmB0lsTObiHaRS1V/ztKAl7+TSkTqXyeoA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=20.19.0" - } - }, - "node_modules/dataloader": { - "version": "2.2.3", - "resolved": "https://registry.npmjs.org/dataloader/-/dataloader-2.2.3.tgz", - "integrity": "sha512-y2krtASINtPFS1rSDjacrFgn1dcUuoREVabwlOGOe4SdxenREqwjwjElAdwvbGM7kgZz9a3KVicWR7vcz8rnzA==", - "dev": true, - "license": "MIT" - }, - "node_modules/fast-string-truncated-width": { - "version": "3.0.3", - "resolved": "https://registry.npmjs.org/fast-string-truncated-width/-/fast-string-truncated-width-3.0.3.tgz", - "integrity": "sha512-0jjjIEL6+0jag3l2XWWizO64/aZVtpiGE3t0Zgqxv0DPuxiMjvB3M24fCyhZUO4KomJQPj3LTSUnDP3GpdwC0g==", - "dev": true, - "license": "MIT" - }, - "node_modules/fast-string-width": { - "version": "3.0.2", - "resolved": "https://registry.npmjs.org/fast-string-width/-/fast-string-width-3.0.2.tgz", - "integrity": "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==", - "dev": true, - "license": "MIT", - "dependencies": { - "fast-string-truncated-width": "^3.0.2" - } - }, - "node_modules/fast-wrap-ansi": { - "version": "0.2.2", - "resolved": "https://registry.npmjs.org/fast-wrap-ansi/-/fast-wrap-ansi-0.2.2.tgz", - "integrity": "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==", - "dev": true, - "license": "MIT", - "dependencies": { - "fast-string-width": "^3.0.2" - } - }, - "node_modules/fdir": { - "version": "6.5.0", - "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz", - "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=12.0.0" - }, - "peerDependencies": { - "picomatch": "^3 || ^4" - }, - "peerDependenciesMeta": { - "picomatch": { - "optional": true - } - } - }, - "node_modules/human-id": { - "version": "4.2.2", - "resolved": "https://registry.npmjs.org/human-id/-/human-id-4.2.2.tgz", - "integrity": "sha512-Z+8unD6em/MJwyrkWQ2M3wygRGI1+MztbutiNwk1DCuEPXOZRWGjtcMPZYP1exY9iNZMhd7ZOSMQSo9WYtiQRw==", - "dev": true, - "license": "MIT", - "bin": { - "human-id": "dist/cli.js" - } - }, - "node_modules/import-meta-resolve": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/import-meta-resolve/-/import-meta-resolve-4.2.0.tgz", - "integrity": "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==", - "dev": true, - "license": "MIT", - "funding": { - "type": "github", - "url": "https://github.com/sponsors/wooorm" - } - }, - "node_modules/jju": { - "version": "1.4.0", - "resolved": "https://registry.npmjs.org/jju/-/jju-1.4.0.tgz", - "integrity": "sha512-8wb9Yw966OSxApiCt0K3yNJL8pnNeIv+OEq2YMidz4FKP6nonSRoOXc80iXY4JaN2FC11B9qsNmDsm+ZOfMROA==", - "dev": true, - "license": "MIT" - }, - "node_modules/jsonc-parser": { - "version": "3.3.1", - "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz", - "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==", - "dev": true, - "license": "MIT" - }, - "node_modules/launch-editor": { - "version": "2.14.2", - "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.14.2.tgz", - "integrity": "sha512-NHJEb30MGBCkmZXLZwz25t37QR4aY03ZzPYUJXOJaOa92uWwExI9SBQUuIznBYc1xkD7cJNGX7oc3Nl3sq2kQQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "picocolors": "^1.1.1", - "shell-quote": "^1.10.0" - } - }, - "node_modules/package-manager-detector": { - "version": "1.9.0", - "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.9.0.tgz", - "integrity": "sha512-zAMfbta9nPA8AKkA4WdmNAT8R8s6Dk0/xwPsqNnRidMFcLo1YkLuPDTgs2f64XdzS8vbLNnoJ+uUIkgbz7oRHA==", - "dev": true, - "license": "MIT" - }, - "node_modules/picocolors": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", - "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==", - "dev": true, - "license": "ISC" - }, - "node_modules/picomatch": { - "version": "4.0.7", - "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz", - "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=12" - }, - "funding": { - "url": "https://github.com/sponsors/jonschlinkert" - } - }, - "node_modules/semver": { - "version": "7.8.5", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", - "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", - "dev": true, - "license": "ISC", - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" - } - }, - "node_modules/shell-quote": { - "version": "1.12.0", - "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.12.0.tgz", - "integrity": "sha512-PcByqNyT/38F2kDNi006HAMRJaULuBzq/FOsw3qdZvX/GA9W/jamDaRskgHjubHiftXK5sIFxLNkvrXUwcof6Q==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/sisteransi": { - "version": "1.0.5", - "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz", - "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==", - "dev": true, - "license": "MIT" - }, - "node_modules/tinyexec": { - "version": "1.3.1", - "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz", - "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=18" - } - }, - "node_modules/tinyglobby": { - "version": "0.2.17", - "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz", - "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==", - "dev": true, - "license": "MIT", - "dependencies": { - "fdir": "^6.5.0", - "picomatch": "^4.0.4" - }, - "engines": { - "node": ">=12.0.0" - }, - "funding": { - "url": "https://github.com/sponsors/SuperchupuDev" - } - }, - "node_modules/yaml": { - "version": "2.9.1", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz", - "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==", - "dev": true, - "license": "ISC", - "bin": { - "yaml": "bin.mjs" - }, - "engines": { - "node": ">= 14.6" - }, - "funding": { - "url": "https://github.com/sponsors/eemeli" - } - } - } -} diff --git a/package.json b/package.json deleted file mode 100644 index 1576657..0000000 --- a/package.json +++ /dev/null @@ -1,19 +0,0 @@ -{ - "name": "@coisa/error-handler", - "version": "2.5.2", - "private": true, - "description": "Development-only release tooling for the coisa/error-handler Composer package", - "scripts": { - "changeset": "changeset", - "changeset:status": "changeset status --since=origin/master", - "version:packages": "changeset version && npm install --package-lock-only --ignore-scripts && git diff --check" - }, - "engines": { - "node": "^22.11 || ^24 || >=26", - "npm": ">=10.9.0" - }, - "devDependencies": { - "@changesets/changelog-github": "1.0.1", - "@changesets/cli": "3.0.3" - } -}