docs: v0.0.79 release notes, breaking changes, and reference updates - #22
Conversation
…scovery, availableIn role scoping
- Release note (blog/2026-08-11-v0-0-79.md, EN) covering milestone 39: function
verb/schema/view contract, rule-based slots, /info-view-schema discovery,
built-in catalog function, SDI/MDI view display modes, context.Related,
updateData/exit discovery, role-scoped availableIn, unified role grant
evaluator, completed child correlations, UrlTemplates BasePath
- Breaking-changes post (TR) with 7 migration items from #859/#860/#870/#871
- TR reference pages updated: view display object form, function contract +
discovery endpoints, catalog function, state response correlations/functions,
workflow availableIn {state, roles}, mappings context.Related,
authorization single-evaluator model, url-templates rewritten for BasePath
- EN mirrors: short placeholder sections per repo convention
- Announcement bar bumped from stale v0.0.58 to v0.0.79
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reviewer's GuideDocs updates for runtime v0.0.79: introduce function declarative contracts and discovery endpoints, catalog function and state response changes, SDI/MDI view display modes, mapping script related-instance access, role-scoped availableIn and unified authorization evaluation, URLTemplates BasePath model, REST API route docs, breaking changes blog, release notes, and announcement bar bump, plus EN mirror stubs. Sequence diagram for function discovery and invocation with contractssequenceDiagram
actor Client
participant ApiGateway
participant DomainFunctionsInfoEndpoint as DomainFunctionsInfo
participant InstanceFunctionsInfoEndpoint as InstanceFunctionsInfo
participant InstanceFunctionEndpoint as InstanceFunction
Client->>ApiGateway: GET /api/v1/{domain}/functions/{function}/info
ApiGateway->>DomainFunctionsInfo: GET /functions/{function}/info
DomainFunctionsInfo-->>ApiGateway: 200 { verbs, href, hasView, hasSchema }
ApiGateway-->>Client: 200 { verbs, href, hasView, hasSchema }
Client->>ApiGateway: GET /api/v1/{domain}/workflows/{workflow}/instances/{instance}/functions/{function}/info
ApiGateway->>InstanceFunctionsInfo: GET /instances/{instance}/functions/{function}/info
alt [caller unauthorized]
InstanceFunctionsInfo-->>ApiGateway: 403
ApiGateway-->>Client: 403
else [caller authorized]
InstanceFunctionsInfo-->>ApiGateway: 200 { verbs, href }
ApiGateway-->>Client: 200 { verbs, href }
end
Client->>ApiGateway: POST /api/v1/{domain}/workflows/{workflow}/instances/{instance}/functions/{function}
ApiGateway->>InstanceFunctionEndpoint: POST /instances/{instance}/functions/{function}
alt [verb not in attributes.verbs]
InstanceFunctionEndpoint-->>ApiGateway: 405 Allow: declared-verbs
ApiGateway-->>Client: 405 Allow: declared-verbs
else [verb allowed]
alt [attributes.inputSchema defined]
Note over InstanceFunctionEndpoint: validate request body against inputSchema
opt [schema violation]
InstanceFunctionEndpoint-->>ApiGateway: 400 with field errors
ApiGateway-->>Client: 400 with field errors
end
end
InstanceFunctionEndpoint-->>ApiGateway: 200 function result
ApiGateway-->>Client: 200 function result
end
Client->>ApiGateway: GET /api/v1/{domain}/workflows/{workflow}/instances/{instance}/functions/catalog
ApiGateway->>InstanceFunctionEndpoint: GET /instances/{instance}/functions/catalog
InstanceFunctionEndpoint-->>ApiGateway: 200 { functions[] (role-filtered) }
ApiGateway-->>Client: 200 { functions[] (role-filtered) }
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughThe PR adds v0.0.79 release notes and documents function contracts, discovery endpoints, authorization changes, related-instance access, SDI/MDI views, correlation reporting, URL configuration, and migration requirements. Changesv0.0.79 Documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 15
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@blog-breaking-changes/2026-08-11-v0-0-79.md`:
- Around line 54-65: Update the migration guidance in the breaking-changes entry
to include `$userBehalfOf.` alongside `$user.` and `$role.` when scanning role
definitions for dynamic grant syntax. Ensure both referenced scan lists mention
this supported prefix, or explicitly state that `$userBehalfOf.` is excluded.
In `@blog/2026-08-11-v0-0-79.md`:
- Around line 1-7: Add the required id and sidebar_label frontmatter fields to
the release-v0-0-79 page, alongside the existing title field, using values
consistent with the page’s naming and documentation conventions.
In `@docs/components/functions/built-in.md`:
- Around line 107-127: Update both correlations examples to match the documented
response shape by adding href, parentState, subFlowInstanceId, subFlowDomain,
subFlowVersion, and status to each entry, or explicitly label the objects as
abbreviated. Keep the existing completion-specific fields and ensure both
example sections use the same representation.
- Line 202: Enforce the configured roles during POST execution for the cancel,
updateData, and exit transitions, rather than relying only on transition listing
filters. Add the authorization check in the shared transition execution path and
reject callers whose roles do not match before applying the transition;
alternatively, explicitly document that callers must perform this check before
invoking the application action.
In `@docs/components/functions/custom.md`:
- Line 268: Update the rule-based dizi description to say rules are evaluated in
declaration order at resolution time for the current invocation or discovery
request, using “bildirim sırasıyla değerlendirilir”; retain that the first
matching entry wins and the rule-less final entry acts as the fallback.
In `@docs/components/mappings.md`:
- Around line 283-284: Update the cross-domain read statement near the
transition visibility note to explicitly describe whether the host transition
transaction is propagated through internal endpoints. Document the resulting
consistency behavior: if it is not propagated, state that reads use data
committed by the target instance; otherwise, describe the propagation mechanism
and guarantees.
In `@docs/components/view.md`:
- Around line 175-176: The response contract documentation must explicitly
define runtime behavior for objects containing only mdi and no sdi. Update the
relevant schema and compatibility text around the sdi/mdi requirement and
display/modes response description to state whether display is omitted, null,
defaulted, or the object is rejected, and ensure both statements consistently
reflect that behavior.
In `@docs/components/workflow.md`:
- Around line 732-733: Use transitions as the State response field name in both
docs/components/workflow.md lines 732-733 and
i18n/en/docusaurus-plugin-content-docs/current/components/workflow.md lines
248-254, replacing availableTransitions while preserving the surrounding
workflow documentation.
In `@docs/concepts/authorization.md`:
- Around line 131-152: Update the transition roles wording in
docs/concepts/authorization.md lines 131-152 to describe roles as controlling
discovery/offering, while retaining the explicit caveat that roles are not
enforced during execution. Apply the same discovery-versus-execution wording to
the corresponding transition roles table entry in
i18n/en/docusaurus-plugin-content-docs/current/concepts/authorization.md lines
134-139.
In `@docs/configuration/url-templates.md`:
- Around line 93-99: Revise the “Faydaları” bullet about structural BasePath
inheritance to qualify the no-prefix guarantee: state that prefixless href
errors are prevented only for endpoint templates without explicit overrides.
Preserve the existing explanation that explicit overrides are used verbatim.
- Around line 27-33: Update the gateway examples in the URL templates
documentation to use two separate json code fences, each containing one root
object; remove the inline comments so every labeled block is valid JSON.
- Line 39: Update the fenced formula block in url-templates.md by adding the
text language identifier to its opening fence, changing the untyped fence to a
text-labeled fence while leaving the formula content unchanged.
In `@docusaurus.config.ts`:
- Line 204: Update the announcementBar.content value to remove the 🚀 emoji;
replace it with a Lucide-style inline SVG using a 24x24 viewBox and strokeWidth
1.75, or omit the icon entirely while preserving the release announcement text.
In
`@i18n/en/docusaurus-plugin-content-docs/current/components/functions/custom.md`:
- Around line 256-264: Add verbs, inputSchema, outputSchema, inputView, and
outputView to the English Attributes Properties table in the custom function
documentation, or link that table to a complete field reference. Preserve the
fixed component-reference template and document these fields consistently with
the v0.0.79 contract described in the Function Contract & Discovery section.
In `@i18n/en/docusaurus-plugin-content-docs/current/components/mappings.md`:
- Around line 271-283: Add the missing public IRelatedInstanceAccessor Related {
get; } property to the English ScriptContext property declaration, matching the
corresponding Turkish declaration and the documented context.Related usage.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 34d1ab31-d73f-4de3-be9d-ff78a1be1e5c
📒 Files selected for processing (18)
blog-breaking-changes/2026-08-11-v0-0-79.mdblog/2026-08-11-v0-0-79.mddocs/api-reference/rest-api.mddocs/components/functions/built-in.mddocs/components/functions/custom.mddocs/components/functions/index.mddocs/components/interfaces.mddocs/components/mappings.mddocs/components/view.mddocs/components/workflow.mddocs/concepts/authorization.mddocs/configuration/url-templates.mddocusaurus.config.tsi18n/en/docusaurus-plugin-content-docs/current/components/functions/built-in.mdi18n/en/docusaurus-plugin-content-docs/current/components/functions/custom.mdi18n/en/docusaurus-plugin-content-docs/current/components/mappings.mdi18n/en/docusaurus-plugin-content-docs/current/components/workflow.mdi18n/en/docusaurus-plugin-content-docs/current/concepts/authorization.md
| ### 4. Dynamic role grant sözdizimi doğrulaması artık gerçekten hata üretiyor | ||
|
|
||
| **Etkilenen Alan:** Component doğrulama — **tüm** transition tipleri ([vnext #859](https://github.com/burgan-tech/vnext/pull/859)) | ||
|
|
||
| **Önceki Davranış:** | ||
| `ValidateRoleGrants` hiç hata üretemiyordu. `$user.$.Context.ownerId` gibi büyük/küçük harf hatalı ya da bozuk bir dynamic grant, doğrulamadan geçiyor ve çalışma zamanında sessizce etkisiz kalıyordu (asla eşleşmeyen bir ALLOW ya da asla engellemeyen bir DENY). | ||
|
|
||
| **Yeni Davranış:** | ||
| Bozuk dynamic grant'lar (`$user.`/`$role.` ile başlayıp geçerli forma uymayanlar) deploy sırasında **doğrulama hatası** üretir. Statik rol adları ve dört ön tanımlı instance rolü serbest biçimli kalır. | ||
|
|
||
| **Migration:** | ||
| Sürüme geçmeden önce mevcut domain paketlerini tarayın: `$user.` / `$role.` / `$.context.` içeren tüm `roles` tanımlarının sözdizimini kontrol edin. Önceden sessizce etkisiz olan grant'lar deploy'u durduracaktır. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files:"
git ls-files | rg '(^|/)2026-08-11-v0-0-79\.md$|authorization|role|grant|validate' || true
echo
echo "Target excerpt:"
if [ -f blog-breaking-changes/2026-08-11-v0-0-79.md ]; then
nl -ba blog-breaking-changes/2026-08-11-v0-0-79.md | sed -n '45,75p'
fi
echo
echo "Search relevant identifiers:"
rg -n --hidden '\$userBehalfOf|userBehalfOf|ValidateRoleGrants|Dynamic role|dynamic role|dynamic role grant|validateRoleGrants|\$user\.|\$role\.|\$context\.|\$.context\.|\$context' .Repository: burgan-tech/vnext-docs
Length of output: 400
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Target excerpt:"
awk '{printf "%6d\t%s\n", NR, $0}' blog-breaking-changes/2026-08-11-v0-0-79.md | sed -n '45,75p'
echo
echo "Search relevant identifiers in relevant files:"
for f in blog-breaking-changes/2026-08-11-v0-0-79.md docs/concepts/authorization.md i18n/en/docusaurus-plugin-content-docs/current/concepts/authorization.md; do
if [ -f "$f" ]; then
echo "--- $f ---"
grep -InE '\$userBehalfOf|userBehalfOf|ValidateRoleGrants|Dynamic role|dynamic role|dynamic-role|validateRoleGrants|\$user\.(<|[^<])|\$role\.(<|[^<])|\$context\.|\$context\.|\$.context\.' "$f" || true
fi
doneRepository: burgan-tech/vnext-docs
Length of output: 4889
🌐 Web query:
docs/concepts/authorization.md $userBehalfOf
💡 Result:
The term userBehalfOf does not refer to a standard, universal parameter in OAuth 2.0 or OpenID Connect specifications [1][2][3]. Instead, it is likely a specific identifier, variable, or parameter name used within a particular internal codebase, documentation set, or vendor-specific implementation to represent the On-Behalf-Of (OBO) flow [1][4][5]. The On-Behalf-Of (OBO) pattern is a widely recognized authorization delegation flow where a middle-tier service or agent, acting on behalf of a user, exchanges an incoming user token for a new token to access downstream protected resources [1][4][6][3]. This allows the downstream API to verify the identity and permissions of the original user, rather than trusting the middle-tier service alone [1][6]. Key characteristics of the OBO flow include: Delegated Authority: OBO uses delegated scopes rather than application roles, ensuring permissions are bound to the user (the principal) and not the service performing the action [1][7][5]. Token Exchange: Middle-tier services authenticate with the authorization server using their own credentials and provide a subject token (the user's original token) to request a new access token scoped to the downstream service [1][4][3][8]. Standardization: While vendor implementations vary (e.g., Microsoft Identity Platform's OBO flow or RFC 8693 OAuth 2.0 Token Exchange), the goal is to maintain the identity context across a chain of services [1][4][3]. If userBehalfOf appears in your documentation (e.g., docs/concepts/authorization.md), it is likely an implementation-specific key used to invoke this delegation mechanism or to store the context of the user being represented [1][4][9][10]. You should check your project's specific SDK or API reference to see how this variable is defined or used in token acquisition calls [9][11][10].
Citations:
- 1: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-on-behalf-of-flow
- 2: https://datatracker.ietf.org/doc/html/draft-oauth-ai-agents-on-behalf-of-user-02
- 3: https://www.identra.ai/glossary/oauth-on-behalf-of/
- 4: https://tus.auth0.com/docs/secure/call-apis-on-users-behalf/on-behalf-of-token-exchange
- 5: https://github.com/MicrosoftDocs/entra-docs/blob/main/docs/identity-platform/v2-oauth2-on-behalf-of-flow.md
- 6: https://nhimg.org/glossary/on-behalf-of-authorization/
- 7: https://learn.microsoft.com/en-us/azure/logic-apps/set-up-on-behalf-of-user-flow
- 8: https://auth0.com/docs/api/authentication/on-behalf-of-token-exchange/get-token
- 9: https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.client.confidentialclientapplication.acquiretokenonbehalfof?view=msal-dotnet-latest
- 10: https://learn.microsoft.com/en-us/dotnet/api/microsoft.identity.client.acquiretokenonbehalfofparameterbuilder?view=msal-dotnet-latest
- 11: https://developer.alpha-sense.com/agent-api/on-behalf-of
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository search for dynamic role grant implementation and validation:"
git grep -InE 'ValidateRoleGrants|validateRoleGrants|userBehalfOf|\$userBehalfOf|\$user\.|\$role\.|\$context\.|jsonpath|JSONPath' . -- '!:node_modules' -- '!:dist' -- '!:build' || true
echo
echo "Search for breaking-change section references with full prefix names:"
git grep -InE '\$userBehalfOf\.|\$user\.|\$role\.|\$.context\.|\$context\.' . -- '!:node_modules' -- '!:dist' -- '!:build' | sed -n '1,160p'Repository: burgan-tech/vnext-docs
Length of output: 381
🌐 Web query:
burgan-tech vnext docs concepts authorization $userBehalfOf dynamic grant
💡 Result:
The vNext Platform, developed by Burgan Tech, is a.NET-based orchestration system that utilizes Clean Architecture and Domain-Driven Design (DDD) to manage high-security workflows and functions [1]. While the term "on-behalf-of" (often abbreviated as OBO) is a standard pattern in OAuth 2.0 authorization flows—where an application exchanges a user's token to acquire access to downstream services on that user's behalf [2][3][4]—there is no specific documentation in the public burgan-tech/vnext repositories referencing a "$userBehalfOf" feature or "dynamic grant" mechanism by that exact name. Based on the available technical documentation for vNext, authorization is managed through custom function-level roles and internal authorization managers. Key components include: - ICurrentUser and ITransitionAuthorizationManager: These are used to inject and gate custom function execution, enforcing role-based restrictions (e.g., IsAnyRoleAllowedForGrantsAsync) [5]. - Query Authorization: The system enforces access control in services like the InstanceQueryAppService, where guards added to methods evaluate query roles (EvaluateQueryRolesAsync) and return an HTTP 403 status if access is denied [5]. - Documentation: Detailed architecture guides, including information on function handler architecture and query authorization enforcement, are available via the official vNext Docs Portal (https://burgan-tech.github.io/vnext-docs/) [6]. If you are encountering "$userBehalfOf" or "dynamic grant" within a specific codebase, these may be internal naming conventions, custom extensions, or implementation-specific abstractions not exposed in the core platform's public documentation. You can verify your specific implementation details by checking the src/BBT.Workflow.Application/Authorization/ directory or the architecture decision records (ADRs) found in the docs/ folder of your vNext project [5][1].
Citations:
- 1: https://github.com/burgan-tech/vnext
- 2: https://learn.microsoft.com/en-us/azure/logic-apps/set-up-on-behalf-of-user-flow
- 3: https://learn.microsoft.com/en-us/graph/auth-v2-user
- 4: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/wiki/on-behalf-of-2.x
- 5: Add role-based state aliases with localized labels vnext#708
- 6: https://github.com/burgan-tech/vnext-runtime
Add $userBehalfOf. to the migration scan.
docs/concepts/authorization.md includes $userBehalfOf.<jsonpath> as a supported dynamic grant. This migration item scans only $user. and $role. grants, so malformed $userBehalfOf. grants can fail deployment without being found. Add this prefix to Lines 62 and 65, or state that it is excluded.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@blog-breaking-changes/2026-08-11-v0-0-79.md` around lines 54 - 65, Update the
migration guidance in the breaking-changes entry to include `$userBehalfOf.`
alongside `$user.` and `$role.` when scanning role definitions for dynamic grant
syntax. Ensure both referenced scan lists mention this supported prefix, or
explicitly state that `$userBehalfOf.` is excluded.
| --- | ||
| slug: release-v0-0-79 | ||
| title: Release v0.0.79 | ||
| authors: [vnext-team] | ||
| tags: [release, duyuru, functions, authorization, views] | ||
| date: 2026-08-11 | ||
| --- |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Add the required documentation frontmatter fields.
This page defines title but omits id and sidebar_label.
Proposed frontmatter
---
+id: release-v0-0-79
title: Release v0.0.79
+sidebar_label: Release v0.0.79
authors: [vnext-team]As per coding guidelines: Every documentation page under **/{docs,architecture,business,product,blog}/**/*.{md,mdx} must include frontmatter with at minimum id, title, and sidebar_label fields.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| --- | |
| slug: release-v0-0-79 | |
| title: Release v0.0.79 | |
| authors: [vnext-team] | |
| tags: [release, duyuru, functions, authorization, views] | |
| date: 2026-08-11 | |
| --- | |
| --- | |
| slug: release-v0-0-79 | |
| id: release-v0-0-79 | |
| title: Release v0.0.79 | |
| sidebar_label: Release v0.0.79 | |
| authors: [vnext-team] | |
| tags: [release, duyuru, functions, authorization, views] | |
| date: 2026-08-11 | |
| --- |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@blog/2026-08-11-v0-0-79.md` around lines 1 - 7, Add the required id and
sidebar_label frontmatter fields to the release-v0-0-79 page, alongside the
existing title field, using values consistent with the page’s naming and
documentation conventions.
Source: Coding guidelines
| "correlations": [ | ||
| { | ||
| "correlationId": "corr-122", | ||
| "subFlowName": "kyc-subflow", | ||
| "subFlowType": "SubFlow", | ||
| "isCompleted": true, | ||
| "completedAt": "2026-08-01T09:14:22Z", | ||
| "terminalOutcome": "completed", | ||
| "currentState": "kyc-approved", | ||
| "stateChangedAt": "2026-08-01T09:14:20Z", | ||
| "createdAt": "2026-08-01T09:02:41Z" | ||
| }, | ||
| { | ||
| "correlationId": "corr-123", | ||
| "subFlowName": "approval-subflow", | ||
| "subFlowType": "SubFlow", | ||
| "isCompleted": false, | ||
| "currentState": "pending-approval", | ||
| "createdAt": "2026-08-01T09:15:03Z" | ||
| } | ||
| ], |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Align the correlations examples with the documented response shape.
The text says each correlations entry includes the activeCorrelations fields plus completion fields. The examples omit href, parentState, subFlowInstanceId, subFlowDomain, subFlowVersion, and status.
Add the shared fields or mark the objects as abbreviated. Otherwise, clients may infer the wrong response schema.
Also applies to: 221-232
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/components/functions/built-in.md` around lines 107 - 127, Update both
correlations examples to match the documented response shape by adding href,
parentState, subFlowInstanceId, subFlowDomain, subFlowVersion, and status to
each entry, or explicitly label the objects as abbreviated. Keep the existing
completion-specific fields and ensure both example sections use the same
representation.
| - Listelenen anahtar, workflow tanımındaki **configured key**'dir; well-known alias'lar (`update-parent-data`, `exit`) istek tarafında kabul edilmeye devam eder. | ||
| - Her girişin `kind` alanı transition türünü söyler: `cancel` / `updateData` / `exit` (state ve shared transition'larda ilgili tür). | ||
| - Aktif bir subflow'un listesi, parent'ın `updateData` ve `exit` transition'larını da merge eder — client tek döngüyle hepsini sürebilir. | ||
| - `roles` bu üç transition için de artık **etkindir**: rol eşleşmeyen çağırana listelenmez. Roller execution'da enforce edilmez (tasarım gereği — `roles` client'a *ne sunulacağını* belirler); execution yalnızca state-machine ve `availableIn` doğrulaması yapar. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 6 '\b(cancel|updateData|exit)\b|availableTransitions|Authorize|authorize' \
--glob '*.{cs,csx,ts,tsx,js,jsx}'Repository: burgan-tech/vnext-docs
Length of output: 160
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Tracked files matching docs/components:"
git ls-files | rg '^docs/components/.*\.(md|mdx)$' | head -200
echo
echo "Target file existence and relevant excerpts:"
if [ -f docs/components/functions/built-in.md ]; then
wc -l docs/components/functions/built-in.md
sed -n '160,230p' docs/components/functions/built-in.md | cat -n -v
else
echo "docs/components/functions/built-in.md not found"
fi
echo
echo "Search built-in.md for roles/transition terms:"
rg -n -C 4 'roles|availableIn|availableTransitions|cancel|updateData|exit|authorize|Authorize' docs/components/functions/built-in.md || true
echo
echo "All tracked files:"
git ls-files | wc -lRepository: burgan-tech/vnext-docs
Length of output: 17351
Enforce transition roles on POST execution.
cancel, updateData, and exit are role-filtered in transitions but are not enforced when executed directly. Add a role gate in the execution path, or document that every transition call must pass an Authorization check before application action.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/components/functions/built-in.md` at line 202, Enforce the configured
roles during POST execution for the cancel, updateData, and exit transitions,
rather than relying only on transition listing filters. Add the authorization
check in the shared transition execution path and reject callers whose roles do
not match before applying the transition; alternatively, explicitly document
that callers must perform this check before invoking the application action.
| `inputSchema`, `outputSchema`, `inputView` ve `outputView` alanlarının her biri üç biçimde yazılabilir: | ||
|
|
||
| 1. **Tek referans** — doğrudan `{key, domain, flow, version}` (veya `ref`). | ||
| 2. **Rule-based dizi** — her öğe `rule` (IConditionMapping uygulayan ScriptCode) + `view`/`schema` referansı taşır. Öğeler **bildirim sırasında** değerlendirilir, **ilk eşleşen kazanır**; `rule`'suz öğe her zaman eşleşir, bu yüzden **son öğe** olmalıdır (fallback). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Describe rule evaluation as declaration-order matching.
bildirim sırasında reads as “during declaration”. The rule is evaluated for the current invocation or discovery request. Use bildirim sırasıyla değerlendirilir and state that the first matching entry wins at resolution time.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/components/functions/custom.md` at line 268, Update the rule-based dizi
description to say rules are evaluated in declaration order at resolution time
for the current invocation or discovery request, using “bildirim sırasıyla
değerlendirilir”; retain that the first matching entry wins and the rule-less
final entry acts as the fallback.
| Her endpoint'in etkin şablonu şu şekilde hesaplanır: | ||
|
|
||
| **Senaryo 1: Path Prefix'li Gateway** | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a language identifier to the formula fence.
Markdownlint reports MD040 at Line 39. Use text for this non-executable formula.
Proposed fix
-```
+```text📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ``` |
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 39-39: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/configuration/url-templates.md` at line 39, Update the fenced formula
block in url-templates.md by adding the text language identifier to its opening
fence, changing the untyped fence to a text-labeled fence while leaving the
formula content unchanged.
Source: Linters/SAST tools
| ## Faydaları | ||
|
|
||
| - **Çapraz Domain Yönlendirme**: Tek bir gateway arkasında birden fazla domain desteği | ||
| - **İstemci Basitliği**: İstemciler URL manipülasyonu yapmadan Hateoas linklerini takip edebilir | ||
| - **Gateway Esnekliği**: Herhangi bir gateway yönlendirme yapılandırmasına uyum | ||
| - **API Versiyonlama**: Hateoas kullanan istemcileri bozmadan URL yapısı değişiklikleri | ||
| - **Tek ayar**: 19 endpoint şablonunun host başına kopyalanması yerine bir satır; yeni eklenen bir endpoint şablonu `BasePath`'i **yapısal olarak** devralır — konfigürasyonda unutulduğu için prefix'siz href üretme hatası artık mümkün değildir. | ||
| - **Çapraz Domain Yönlendirme**: Tek bir gateway arkasında birden fazla domain desteği. | ||
| - **İstemci Basitliği**: İstemciler URL manipülasyonu yapmadan HATEOAS linklerini takip edebilir. | ||
| - **Gateway Esnekliği**: Override'lar herhangi bir gateway yönlendirme yapısına uyum sağlar. | ||
|
|
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Qualify the no-prefix guarantee.
Line 44 says explicit overrides are used verbatim and do not receive BasePath. The override at Line 51 can therefore omit /api/v1. The claim at Line 95 that prefixless href errors are no longer possible is too strong. Limit the claim to endpoints without an explicit override.
Proposed fix
-- **Tek ayar**: 19 endpoint şablonunun host başına kopyalanması yerine bir satır; yeni eklenen bir endpoint şablonu `BasePath`'i **yapısal olarak** devralır — konfigürasyonda unutulduğu için prefix'siz href üretme hatası artık mümkün değildir.
+- **Tek ayar**: 19 endpoint şablonunun host başına kopyalanması yerine bir satır; override tanımlanmayan endpoint şablonları `BasePath`'i **yapısal olarak** devralır. Açık override'ların prefix'i yapılandırma sahibinin sorumluluğundadır.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ## Faydaları | |
| - **Çapraz Domain Yönlendirme**: Tek bir gateway arkasında birden fazla domain desteği | |
| - **İstemci Basitliği**: İstemciler URL manipülasyonu yapmadan Hateoas linklerini takip edebilir | |
| - **Gateway Esnekliği**: Herhangi bir gateway yönlendirme yapılandırmasına uyum | |
| - **API Versiyonlama**: Hateoas kullanan istemcileri bozmadan URL yapısı değişiklikleri | |
| - **Tek ayar**: 19 endpoint şablonunun host başına kopyalanması yerine bir satır; yeni eklenen bir endpoint şablonu `BasePath`'i **yapısal olarak** devralır — konfigürasyonda unutulduğu için prefix'siz href üretme hatası artık mümkün değildir. | |
| - **Çapraz Domain Yönlendirme**: Tek bir gateway arkasında birden fazla domain desteği. | |
| - **İstemci Basitliği**: İstemciler URL manipülasyonu yapmadan HATEOAS linklerini takip edebilir. | |
| - **Gateway Esnekliği**: Override'lar herhangi bir gateway yönlendirme yapısına uyum sağlar. | |
| ## Faydaları | |
| - **Tek ayar**: 19 endpoint şablonunun host başına kopyalanması yerine bir satır; override tanımlanmayan endpoint şablonları `BasePath`'i **yapısal olarak** devralır. Açık override'ların prefix'i yapılandırma sahibinin sorumluluğundadır. | |
| - **Çapraz Domain Yönlendirme**: Tek bir gateway arkasında birden fazla domain desteği. | |
| - **İstemci Basitliği**: İstemciler URL manipülasyonu yapmadan HATEOAS linklerini takip edebilir. | |
| - **Gateway Esnekliği**: Override'lar herhangi bir gateway yönlendirme yapısına uyum sağlar. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/configuration/url-templates.md` around lines 93 - 99, Revise the
“Faydaları” bullet about structural BasePath inheritance to qualify the
no-prefix guarantee: state that prefixless href errors are prevented only for
endpoint templates without explicit overrides. Preserve the existing explanation
that explicit overrides are used verbatim.
| id: 'v0_0_79_release', | ||
| content: | ||
| '🚀 vNext <b>v0.0.58</b> yayınlandı — <a href="/vnext-docs/blog/release-v0-0-58">Release Notes</a>', | ||
| '🚀 vNext <b>v0.0.79</b> yayınlandı — <a href="/vnext-docs/blog/release-v0-0-79">Release Notes</a>', |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove the emoji from the TypeScript configuration.
Line 204 adds 🚀 to announcementBar.content. Replace it with an inline SVG icon, or remove the icon.
Proposed fix
- '🚀 vNext <b>v0.0.79</b> yayınlandı — <a href="/vnext-docs/blog/release-v0-0-79">Release Notes</a>',
+ 'vNext <b>v0.0.79</b> yayınlandı — <a href="/vnext-docs/blog/release-v0-0-79">Release Notes</a>',As per coding guidelines: **/*.{tsx,ts} must use inline SVG icons instead of emojis, with a Lucide-style 24x24 viewBox and strokeWidth 1.75.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| '🚀 vNext <b>v0.0.79</b> yayınlandı — <a href="/vnext-docs/blog/release-v0-0-79">Release Notes</a>', | |
| 'vNext <b>v0.0.79</b> yayınlandı — <a href="/vnext-docs/blog/release-v0-0-79">Release Notes</a>', |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docusaurus.config.ts` at line 204, Update the announcementBar.content value
to remove the 🚀 emoji; replace it with a Lucide-style inline SVG using a 24x24
viewBox and strokeWidth 1.75, or omit the icon entirely while preserving the
release announcement text.
Source: Coding guidelines
| ## Function Contract & Discovery <sup>New</sup> | ||
|
|
||
| As of v0.0.79 a function can declare a full client contract — all fields are opt-in: | ||
|
|
||
| - **`verbs`** (`GET`/`POST`/`PATCH`/`DELETE`) — an undeclared verb returns **405** with an `Allow` header. | ||
| - **`inputSchema`** — the request body is validated against the resolved `sys-schemas` contract (**400** with field-level errors on violation); **`outputSchema`** is declarative only. | ||
| - **`inputView` / `outputView`** — the `sys-views` contract a client renders to collect input / present output. | ||
| - Every slot accepts a single reference or **rule-based entries** (declaration order, first match wins, trailing rule-less fallback). | ||
| - Discovery endpoints answer *may I run this, with which verb, and which view/schema applies now*: `GET .../functions/{function}/info`, `/view?target=input|output`, `/schema?target=input|output` — at domain and instance scope, guarded by the same scope/role policy as execution (`403` on denial). |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Add the new contract fields to the English attributes table.
The Attributes Properties table at Lines 91-100 still omits verbs, inputSchema, outputSchema, inputView, and `outputView. This section presents them as part of the v0.0.79 contract.
Update the table or link it to a complete field reference.
As per coding guidelines: Component reference pages must follow the fixed template, including a field reference table.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@i18n/en/docusaurus-plugin-content-docs/current/components/functions/custom.md`
around lines 256 - 264, Add verbs, inputSchema, outputSchema, inputView, and
outputView to the English Attributes Properties table in the custom function
documentation, or link that table to a complete field reference. Preserve the
fixed component-reference template and document these fields consistently with
the v0.0.79 contract described in the Function Contract & Discovery section.
Source: Coding guidelines
| #### Related <sup>New</sup> | ||
|
|
||
| Reads a **related** workflow instance's data from a mapping script — the parent that started this instance as a SubFlow/SubProcess, or one of this instance's own sub-item correlations — without duplicating data across the boundary. | ||
|
|
||
| ```csharp | ||
| var parent = await context.Related.ParentAsync(); // one hop up | ||
| var kyc = await context.Related.SubAsync("kyc-flow"); // newest matching correlation | ||
| var uploads = await context.Related.SubsAsync("doc-upload"); // all matching, oldest first | ||
| ``` | ||
|
|
||
| Absence returns `null` / an empty list; a read failure or cap breach throws `RelatedInstanceAccessException`. Results are memoized per script context and capped (`Workflow:Scripting:RelatedAccess:MaxResolutionsPerContext`, default 10). Reads are unfiltered by design — do not copy `x-roles`-restricted fields into this instance's data. | ||
|
|
||
| > 🚧 Full English translation is pending. See the [Turkish page](/docs/components/mappings) for the complete method table, `IsCompleted` vs `CorrelationCompleted` semantics, transaction behavior, and cross-domain routing notes. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Add Related to the English ScriptContext property list.
The English ScriptContext declaration at Lines 151-173 omits public IRelatedInstanceAccessor Related { get; }, while this section documents context.Related. The Turkish mirror includes the property in docs/components/mappings.md at Lines 168-190. Add the property to keep the API declaration and usage section consistent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@i18n/en/docusaurus-plugin-content-docs/current/components/mappings.md` around
lines 271 - 283, Add the missing public IRelatedInstanceAccessor Related { get;
} property to the English ScriptContext property declaration, matching the
corresponding Turkish declaration and the documented context.Related usage.
1 participant
What
Documentation for runtime v0.0.79 (milestone 39, 11 PRs).
New blog posts
blog/2026-08-11-v0-0-79.md(EN, v0.0.76 template): function verb/schema/view contract (#858, #868),/info–/view–/schemadiscovery + built-incatalogfunction (#868, #869), SDI/MDI view display modes (#858),context.Relatedfor mapping scripts (#857),updateData/exitdiscovery + role filtering (#859), role-scopedavailableIn(#870), unified role grant evaluator (#860), completed child correlations in the state response (#856),UrlTemplates→ singleBasePath(#871); fixes #867 (generation-token cache invalidation) and #855 (subflow terminal dedup). Cites schema 0.0.52.blog-breaking-changes/2026-08-11-v0-0-79.md(TR, template format): 7 items with migration steps — x-roles DENY across the grant set, deny-only sets for role-less callers, human-task list alignment, dynamic role grant validation now failing at deploy,availableInexecution gate for well-known transitions, orchestration hrefs/api→/api/v1, instance-list visibility widening.Updated TR reference pages
components/view.md—displayobject form{sdi, mdi}+ mode sectioncomponents/functions/index.md/custom.md— contract fields (verbs,inputSchema,outputSchema,inputView,outputView), rule-based slots, discovery endpointscomponents/functions/built-in.md— state responsecorrelations+functionscatalog pointer, well-known transitions in the list, new Catalog sectioncomponents/workflow.md—availableIn{state, roles}form, AND composition, well-known transition discovery/execution notescomponents/mappings.md+interfaces.md—context.Related(ParentAsync/SubAsync/SubsAsync), x-roles copy warningconcepts/authorization.md— single evaluation core, three-surface alignment table,availableInnarrowingconfiguration/url-templates.md— rewritten for theBasePathmodel (verbatim overrides preserved)api-reference/rest-api.md— six discovery routes + catalog routedocusaurus.config.ts— announcement bar bumped from stale v0.0.58 to v0.0.79EN mirrors
Short English summary + "🚧 translation pending" placeholder sections added to the five fully-translated mirrors (mappings, built-in, custom, workflow, authorization), per repo convention.
Reviewer notes
schemaVersion0.0.52 is cited per team confirmation but is not yet published to npm (latest is 0.0.51 without the new fields) — verify the number once the schema package is cut.npm run buildpasses for both locales. The only broken-anchor warnings are pre-existing ones in archived release posts (v0.0.21–v0.0.42), untouched here.🤖 Generated with Claude Code
Summary by Sourcery
Document runtime v0.0.79 features, behavior changes, and breaking changes across function contracts, discovery, views, mappings, workflows, authorization, URL templates, and REST API, and surface them in release/breaking-changes blog posts and config.
New Features:
Enhancements:
Documentation:
Summary by CodeRabbit
New Features
Documentation