Preserve workflow, presence and dependency updates in the canonical Next release #207

Merged

james.maes merged 19 commits from kof22/next-workflow-assets-on-pr206 into main 2026-11-05 17:22:29 +00:00

Conversation 0 Commits 19 Files Changed 147

+28882 -3828

james.maes commented 2026-11-05 13:04:00 +00:00

Owner

Copy link

Copy source

Build on PR206 and retain its Tools, permission editor, record-file, PDF and scripting changes. Add the previously deployed workflow bridge, server-issued presence leases, Auth0 profile handling, dependency advisory updates and zod 4 migration.

Package the workflow editor from canonical component merge ede4eba875ca17c5921ad4caf61a08bdff6f794d as hash-verified library assets. The component passed its existing 62 tests and webpack build; the dependency lock passed frozen validation. Next checks run on this integration PR; no duplicate full local suite was run.

Keep the RC.38 tag-only release caller. Publish only after the required Core and Collaboration artifacts are verified.

Build on PR206 and retain its Tools, permission editor, record-file, PDF and scripting changes. Add the previously deployed workflow bridge, server-issued presence leases, Auth0 profile handling, dependency advisory updates and zod 4 migration. Package the workflow editor from canonical component merge ede4eba875ca17c5921ad4caf61a08bdff6f794d as hash-verified library assets. The component passed its existing 62 tests and webpack build; the dependency lock passed frozen validation. Next checks run on this integration PR; no duplicate full local suite was run. Keep the RC.38 tag-only release caller. Publish only after the required Core and Collaboration artifacts are verified.

james.maes added 16 commits 2026-11-05 13:04:01 +00:00

feat(ui): file preview/delivery, PDF preview, isolated TypeScript editing and result fields ... b67fb5fd20

Reconcile the reviewed private UI source onto canonical main d04cfa4.
Source: private kof22-clients frontend-next commit
f49de335e8bfc88b2e96aa8a34343ac6b5e93003 (feature/kof22-rc37), files
limited to the file-preview/open/download/actions, PDF/document preview,
compiled TypeScript editor and generic API widget support
(commits b4542dbe, 0ab1f692, d0705481, 21caa18d of that branch).

Not taken: the sequential-workflow bundle staging and qfmd bridge changes,
the zod 4 migration, the RC.37 tag merge (presence, auth, My Work),
version/pom bumps and the old lockfile. Canonical next 16.4.1, zod 3 and
dompurify are unchanged; package.json and pnpm-lock.yaml add only the
editor/PDF dependencies, worker build scripts and CodeMirror pins
(lock change is additions only).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

chore: preserve paused QBit work and document remaining issues ... 40ee257847

Save the current implementation and README, status, and known-issue documentation at the user-requested stop. No completed release or deployment is claimed.

Co-Authored-By: Claude <noreply@anthropic.com>

Co-Authored-By: GPT-6 Codex <noreply@openai.com>

fix: complete file previews and portable UI verification ... 2186561950

Allow local PDF blob reads in standalone CSP and preview signed attachment PDFs without forwarding credentials. Make static export portable on Windows, bound test workers, cover transfer cancellation and size limits, and update integration evidence. Full coverage gates, 12 browser scenarios, live file/PDF flows, lint, typecheck and snapshot packaging pass.

Co-Authored-By: GPT-6 Codex <noreply@openai.com>

docs: clarify Next UI publication prerequisites ... d186ad7086

Co-Authored-By: Codex <noreply@openai.com>

chore: reconcile current main with QBit UI integration ... ddc7de731b

Preserve the upstream companion Tools workspace alongside the prepared
standard QQQ file, script, and process controls. Record the focused merge
checks and the verified missing Next Maven Central publication integration.

Validation: typecheck, changed-file lint, license headers, staged secret
scan, and 61 focused cases across the completed runs. The unchanged lazy
chart file passed with one worker after a cold parallel timeout; no test
assertion or timeout changed. Full release CI remains pending dependencies.

Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>

ci: wire the supported Next dashboard Maven release ... aba43263b2

Pin the reviewed frontend-next producer and document the qualified publisher and remaining deployment gates. The immutable baseline version is unchanged until final release preparation.

Co-Authored-By: Codex <noreply@openai.com>

chore: preserve current permission editor in QBit UI release ... 22f5749e36

Merge current main without changing the permission editor. Both branches set maxWorkers to 4; retain a single setting. All 110 affected widget/process tests and typecheck passed.

Co-Authored-By: Codex <noreply@openai.com>

chore(release): prepare QBit UI candidate RC.38 ... 0f2eb173c1

Use the next unused Maven version and record the deployed publication route and current integration evidence. Release remains sequenced after Core and Collaboration.

Co-Authored-By: Codex <noreply@openai.com>

fix(widgets): run dynamic components on the React 19 host with Material's defaultValues Map and qController.processRun ... 56ab7fe21c

Port of the KOF22 bridge fixes onto the current line: widget defaultValues are handed to dynamic components as a
Map that still allows property access, and the bridge exposes Material's qController.processRun (real process
init/run through the existing UI API). Needed by the QSequentialWorkflow editor bundle.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

build: package the qualified precompiled QSequentialWorkflow bundle as tracked Next library assets ... 94726bb52c

Track the component bundle and map compiled from the reviewed component source e6036d2 (Node 22.20.0, npm ci
--ignore-scripts, existing 3 suites passed, webpack) in dynamic-components/q-sequential-workflow/ with a sha256 lock
(scripts/dynamic-components.lock.json: source commit/tree, toolchain image digest, lockfile hash). The stage script
copies them into the export (build, dev and build:export) and refuses a missing or altered file; the pom enforcer
requires the staged bundle and map, so a release without the workflow editor fails packaging. No network, token or
component fetch is needed in the producer. The component main commit is recorded after its merge (pending in the lock).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

feat(collaboration): use server-issued presence leases in the hook (port of published RC.37 de5c1bd0) ... 73b1ea16d7

The current line has the lease API client (renew/open/beacon with sequence) but the hook still generated a client
connection id and never opened or ordered a lease. Port the hook, auth-storage, realtime invalidation, header and
mock changes of de5c1bd0 from the published v1.0.0-RC.37, so RC.38 does not regress against qbit-collaboration's
issued-lease protocol. CI, version and acceptance-stage conflicts resolved to the current line (no version or
dependency change); the people-tasks beacon test keeps the current line's equivalent assertion.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix: retain Auth0 display profile with canonical presence identity ... aaa77d7e6e

Keep the backend user ID without dropping provider display fields on sign-in or reload. Do not reuse a different user's cached profile. Reproduced callback/reload failures; full 3664-test suite, TypeScript and lint pass. Real mobile flow assertions pass locally, with Windows export diagnostics tracked separately; Linux acceptance remains required.

Co-Authored-By: Codex <noreply@openai.com>

build: pin the workflow bundle lock to the component main merge ede4eba ... 70618bd143

Component PR 5 merged normally as ede4eba875ca17c5921ad4caf61a08bdff6f794d; its tree 9efc0921... equals the qualified
source tree, so the qualified bundle and map (sha256 unchanged) are the canonical main output; no rebuild.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(deps): apply the reviewed f49 dependency advisory updates and zod 4 to the 206 line ... 04ab9ad6c9

next 16.4.1 -> 16.4.3, dompurify ^3.4.17, storybook 10.6.2, vitest/coverage/ui ^4.1.12, vite 7.3.7, zod ^4.6.7 and the
pnpm overrides (follow-redirects, undici@>=7 <8, fast-uri@>=3 <4) exactly as in the reviewed f49de335 package.json
dependency sections and pnpm-lock.yaml. PR206 carried no dependency change of its own beyond f49's (codemirror,
pdfjs-dist, typescript-editor are identical), so the f49 lockfile is used as is; `pnpm install --lockfile-only
--frozen-lockfile` (pnpm 9.15.9, Node 22.20.0) accepts it unchanged. Scripts, version RC.38 and the caller are untouched.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(deps,test): zod 4 migration and portable standalone tests from the reviewed f49 commit 0c156b22 ... fdf12d3c40

The schema, form-adjuster, possible-values, assistant-normalize and zod-from-metadata changes zod 4 needs, plus the
existing Windows-portable standalone acceptance-stage and the two dev/write page test adjustments. Taken from f49;
on these files PR206 differed from f49 only by the zod 3 forms.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

test: carry the reviewed f49 test-only fixes that keep upstream coverage equivalent ... bfcc008ca2

WidgetRenderer lazy-chunk wait, the mark-all-mentions-read My Work test (dce92cfb) and the help-results wait before
search navigation (8d372142), taken from f49. Owner-side test changes in PR205/206 (keyboard shortcuts, security headers
with blob: connect-src) are kept as they are newer.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes added 1 commit 2026-11-05 14:39:26 +00:00

fix(authentik): give the access editor's inherited-permissions schema its zod 4 key type ... 3a72c8b88a

The owner's access editor (PR205/206) was written against zod 3's single-argument z.record(value). With zod ^4.6.7 (the reviewed f49
dependency set) z.record needs the key schema too: TS2554 at (32,16), then 'inherited' infers Record<..., unknown> giving TS18046 at (84,147)
and TS2322 at (103,128) (CI 4726, node 75004 and e2e 75005, the only three type errors). Use z.record(z.string(), z.array(z.string())), the
same validation and the exact Record<string, string[]> type the component already declares; no cast, no behavior or permission change.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes added 2 commits 2026-11-05 16:54:32 +00:00

test: scope record filter control lookups ... 46e9f1212c

Preserve all filter, sorting, confirmation and accessibility assertions while avoiding repeated whole-page role scans. Focused RecordQuery tests and lint pass; release CI remains required.

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>

Merge owner PR206 46e9f121 into the PR207 branch: scoped record filter control lookups ... 00c00b0e71

Takes the owner's test-only fix (src/components/query/RecordQuery.test.tsx scopes role queries with within(); docs/QBIT-RELEASE-STATUS.md)
for the 'confirms clearing filters and preserves the selected sort' case that timed out at the default 5000 ms on the loaded CI runner
(5150/5239 ms in CI 4993 node, twice; 1.3-1.5 s unloaded locally with the fix vs 1.5-1.7 s without). No assertion, user-semantic or
sort behavior changes; no f49, Tools, owner 205/206, zod 4 or lockfile content touched.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes merged commit 27e8754f32 into main 2026-11-05 17:22:29 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

architecture

Architecture review: coupling, cohesion, UI API

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

full-acceptance

Run the full real-backend acceptance matrix on this PR

github_actions

Pull requests that update GitHub Actions code

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

javascript

Pull requests that update javascript code

question

Further information is requested

secuurity

ux

Admin UX / information architecture

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qqq-frontend-next#207