v5.2.0-alpha.4

What's Changed

• Merge pull request #1760 from HarperFast/kris/record-caching-multiworker-test
• Merge pull request #1768 from HarperFast/kris/1241-predicate-hnsw
• Merge pull request #1626 from HarperFast/kris/loadedfromsource-target-only-main
• Merge origin/main; keep target.loadedFromSource as sole cache-disposition signal
• Merge pull request #1615 from HarperFast/kris/crdt-hardening
• test(storage): cover the isRetry leak that dropped fresh-batch audit entries (#1773)
• chore(deps): update dependency @types/sinon to v22 (#1772)
• ci(review): canary Claude reviews on claude-sonnet-5 (harper only) (#1759)
• Fix root-mounted static serving: urlPath '/' matched only the exact path '/' (#1769)
• review: default filterState for direct searchLayer callers, null-guard table in isFilterablePushdown
• fix: prettier reflow of DESIGN.md table
• Predicate-aware HNSW traversal: filtered vector search with RBAC (#1241)
• test(record-caching): make the new anchors robust under Bun and uWS runtimes
• test(record-caching): add TTL-eviction, blob, and invalidate/null cross-worker anchors
• test(record-caching): throw on readiness-poll timeout in scan suite
• test(record-caching): bound request fan-out concurrency; harden worker-count parse
• fix: pin uWebSockets.js via tarball URL, not a github: git spec
• test(record-caching): run the multi-worker suite on real workers + add cross-worker coherence anchors
• test(security): extend #1414 subscription re-auth coverage to WS/MQTT + alter_role (#1634)
• Configurable cache headers for the static plugin (maxAge, immutable, cacheControl) (#1748)
• ci(docker): add smoke test that builds and boots the image (#1620)
• test(integration): de-flake computed indexed properties REST block (#1721)
• Fix SSE hang on finite generator streamed to completion (#1628) (#1632)
• Merge pull request #410 from HarperFast/record-caching
• feat(server): surface external port conflicts on all platforms; single-worker default without SO_REUSEPORT (#1605)
• Cache-Control/Vary hardening and shared-cache defaults (#1746)
• fix boot-replay hang: stamp native isRetry from isReplay in save()
• bump @harperfast/rocksdb-js to ^2.4.0 (VT invalidation fixes: clear/drop sweep, non-txn write settle, snapshot TOCTOU, backdated-version gate)
• fix(components): close deploy-validation Scopes to stop deployLifecycle listener leak (#1465)
• Merge main into record-caching
• fix: auto-wrap Error args in the logger + diagnostic property allowlist (#1734) (#1749)
• chore: add workflow to sync package-lock.json when it drifts from pac… (#421)
• fix(build): ship npm-shrinkwrap.json in published package (#1622)
• fix(lint): use node:assert not node:assert/strict in bytes-scan-crash test (#1753)
• chore: bump version to 5.2.0-alpha.1
• fix(logging): correct retention config validation + tests (#683)
• fix(logging): correct rotation duration units (M=months, m=minutes)
• fix(logging): close rotated log fd immediately and expose rotation.retention (#683)
• fix(logs): close read_log SSE tail seam gaps (Kris review)
• fix(logs): log backlog read errors and backpressure the backlog emit
• fix(logs): harden read_log SSE tail (Kris review)
• fix(logs): detect SSE backpressure across all writes in a record
• feat(logs): add SSE backpressure + resilient delta reads to read_log tail
• test(logs): rewrite read_log SSE tail test on node:assert + real modules
• refactor(logs): bound read_log SSE backlog read; reuse incremental parser
• feat(logs): stream read_log over SSE as a live tail
• Merge pull request #1580 from HarperFast/fix/load-env-config-order-1513
• Use plain node:assert per the now-enforced house lint rule
• Merge origin/main; update DESIGN.md section to the warn-don't-honor reality
• fix: make server.registerOperation() from components reachable via the ops API (#1736) (#1743)
• test(blob): wait for device schemas before asserting sharding suite (#1750)
• Merge pull request #1313 from HarperFast/kris/1298-freeze-typedarray
• Two-tier component secret delivery + env declarations (#1550) (#1582)
• feat(#914): uWebSockets.js HTTP/WebSocket backend (default-off) (#1096)
• fix(http): remove stale pre-handoff timeout listener on H2C UDS handoff
• spike: pass error object to sessionError debug log (review)
• spike: graceful h2 session drain on close + pre-handoff error/timeout hardening
• spike: cleartext HTTP/2 UDS mirror behind HARPER_H2C_UDS (h2 via symphony-L4 ALPN dispatch, #914)
• fix: don't log raw Error objects in REST.ts (leaks secrets to hdb.log) (#1734) (#1737)
• build: use typescript@7.0.2 instead of @typescript/native-preview for tsgo fast-check (#1738)
• Run tsgo via npx instead of as a devDependency
• Fix formatting
• Clarify tsgo dependency doc: install coupling, not just usage, is opt-in
• Add a plain typecheck script alongside typecheck:fast
• Add tsgo as an opt-in fast type-checker
• feat(auth): let registered operations declare permissions for scoped delegation (#1599)
• fix(cache): consult allowStaleWhileRevalidate for query-driven revalidation (#1578) (#1581)
• Merge main core sync (d33f097) into record-caching; reconcile isRetry vs ERR_TRY_AGAIN
• Enforce warn-and-skip at the loadEnv injection point for config-shaping vars
• Merge pull request #1741 from HarperFast/update-rocksdb-js
• chore(deps): Update rocksdb-js to 2.4.0
• fix: only join an ambient transaction if it is genuinely still OPEN (#1720)
• fix(storage): replay conflict retry on a fresh transaction after ERR_TRY_AGAIN (#1696)
• test(caching): cover setLoadedFromSource guard + onlyIfCached hit marking (#1576)
• Merge pull request #1621 from HarperFast/kris/blob-send-drain-core
• fix(shutdown-drain): clamp the final terminate delay, not just the ceiling
• Merge pull request #1718 from HarperFast/kris/deploy-dangling-symlink
• Pivot to warn-don't-honor: component .env config vars are detected, not applied
• Merge remote-tracking branch 'origin/main' into kris/blob-send-drain-core
• Use pipeline() for tar->gzip so an aborted upload stops the walk
• Address cross-model review: async dangling-symlink scan, not sync per-entry stat
• Fix deploy silently truncating tarball on dangling symlink
• Merge pull request #1554 from HarperFast/kris/secrets-store-715
• Merge remote-tracking branch 'origin/main' into kris/secrets-store-715
• Merge pull request #1411 from HarperFast/kris/abort-timed-out-txn-1407
• Merge pull request #1694 from HarperFast/fix/mcp-protocol-header-relax-1611
• Merge pull request #1587 from HarperFast/kris/middleware-introspection-1573
• Merge pull request #1526 from HarperFast/kris/mcp-static-tools-1448
• style: prettier formatting
• fix(lint): use node:assert instead of node:assert/strict
• Merge branch 'main' into kris/middleware-introspection-1573
• Merge branch 'main' into kris/abort-timed-out-txn-1407
• Merge branch 'main' into kris/mcp-static-tools-1448
• fix(lint): use node:assert instead of node:assert/strict
• fix(lint): use node:assert instead of node:assert/strict
• test: add custom-resource-handler over-time atomicity regression anchor (#1407)
• Merge remote-tracking branch 'origin/main' into kris/middleware-introspection-1573
• Merge remote-tracking branch 'origin/main' into kris/mcp-static-tools-1448
• Merge pull request #1517 from HarperFast/kris/qa-promote-concurrency-anchors
• Merge pull request #1592 from HarperFast/kris/op-context-user
• Merge pull request #1579 from HarperFast/kris/mcp-ops-lazy-1562
• Merge pull request #1569 from HarperFast/kris/threads-preload
• Merge pull request #1529 from HarperFast/kris/498-route-directional-schema
• Merge pull request #1394 from HarperFast/kris/586-cert-watcher-polling-fallback
• Merge remote-tracking branch 'origin/main' into record-caching
• style: prettier formatting
• Merge pull request #1574 from HarperFast/feat/static-after-ordering
• Merge pull request #1713 from HarperFast/kris/hnsw-delete-ep-flake
• Accept a missing MCP-Protocol-Version as the session's negotiated version (#1611)
• PrimaryRocksDatabase: keep entryMap mapping for metadata-less values in getEntry
• docs/tests: add weak-lru-cache dependency rationale, update bench to explicit cache:true
• PrimaryRocksDatabase: drop redundant entryMap.set in getSync/get, short-circuit getRange
• databases: fix emptiness probe in resolveIndexFormat, make caching opt-in for primary stores
• DatabaseTransaction: cap coordinated-retry loop, fix isRetry leak, preserve options on retry
• style: format middlewareChain.ts with the pinned prettier version
• fix(static): address review feedback on ordering options
• fix(static): request a restart when before/after change at runtime
• feat(static): support after ordering and warn when fallthrough: false blocks REST
• Merge pull request #1633 from HarperFast/feat/mcp-identity-quota-1610
• style: prettier formatting
• fix(lint): use node:assert instead of node:assert/strict
• Merge remote-tracking branch 'origin/main' into feat/mcp-identity-quota-1610-merge-v51
• Merge branch 'main' into record-caching
• Merge branch 'main' into kris/hnsw-delete-ep-flake
• test(cache): poll for the deferred commit instead of a fixed delay (#1702 regression)
• fix(rest): copy live cache records in finalizeResponse before mutating headers/status
• Guard undefined neighbor ids in the connectivity probe (review)
• fix(hnsw): reconnect survivors severed from the entry point by deletes (#1712)
• fix(mqtt): close last-will persistence race; give retained-message test more headroom
• lint: use node:assert instead of node:assert/strict (no-restricted-imports)
• chore(deps): sync package-lock with main after merge
• Merge remote-tracking branch 'origin/main' into record-caching
• Document quota-hook race-safety requirement (kriszyp fast-follow)
• fix(ci): keep npm latest/next dist-tags on the newest release line (#1690)
• fix(queue): waitForDrain poll fallback for drains that never emit (#1643)
• fix(blob): never gate apply commits on wire-carried save flags; gate local writes on blob durability (#1641)
• Merge remote-tracking branch 'origin/main' into kris/blob-send-drain-core
• Merge branch 'main' into kris/loadedfromsource-target-only-main
• Merge branch 'main' into kris/crdt-hardening
• Merge branch 'main' into kris/threads-preload
• Merge branch 'main' into kris/secrets-store-715
• test(resources): make subscriptionReplay collect() wait for delivery, not a fixed window
• Fix stacked-PR base drift and warn per profile on quota misconfiguration
• Add MCP per-client rate limiting and a durable operator quota hook (#1610)
• feat: re-authorize live subscriptions; revoke on permission loss or token expiry (#1414) (#1535)
• feat(secrets): explicit processEnv tier flag on hdb_secret (store + ops)
• fix(test): clean up disconnected-event listener on endAsync() failure
• fix(mqtt): await durable-session ack persistence before signaling completion
• fix(test): replace fixed delays with real completion signals in MQTT durable-session test
• Review fixes: dedupe deferred entries, null-proto provider results
• Cross-model review fixes: reserved keys, clone detachment, redacted queue accessor
• Add worker-spawn data providers and deferred env-secret decrypt replay
• fix(mcp): scope value/values/envelope audit redaction to secret-bearing tools
• Bring loadedFromSource target-only cache-disposition to main (net of v5.1 #1575 + #1590)
• @embed / models.embed no longer forwards the logical model name as the provider wire model id (#1596)
• Fix static plugin serving nothing when urlPath is configured (#1584)
• Update unitTests/components/mcp/tools/application-paramroutes.test.js
• fix(mcp): require :id to be the trailing segment for single-id param routes
• fix(mcp): register custom mcpTools/mcpPrompts on multi-segment/wildcard param routes
• fix(mcp): don't advertise create_/search_ for param routes; handlers can't bind the record id
• fix(mcp): restrict param-route enumeration to the single-:id shape the handlers bind
• fix(mcp): enumerate parameterised routes when building application tools
• fix(docker): write entrypoint via COPY heredoc so it isn't empty (#1619)
• feat(threads): graceful drain hook for in-flight work before worker shutdown
• fix(deps): update all non-major dependencies (#1607)
• Add threads.preload (--import) + threads.preloadRequire (--require)
• fix(mqtt): share the MQTT port across workers except on macOS (#1603)
• Pin the anonymous public-docs path: no-auth list/read integration case
• fix(crdt): null-prototype op registry + robust addValues mixed-type folding
• Use plain node:assert in the new test file per AGENTS.md house style
• fix(crdt): unify add fold, fix counter time-travel reconstruction, harden apply path
• Fix descriptor authority when the port config uses host:port bind form
• chore(deps): update dependency globals to v17 (#1608)
• Reject duplicate template params; fix back-compat test to actually use a legacy URI
• Notify tools/list_changed after lazy rebuilds; require a literal custom scheme
• Add MCP custom content resources via static mcpResources (#1609)
• fix(lint): use plain node:assert import in allowread-fail-closed test (#1612)
• test(resources): cover search_by_value during active runIndexing (#1345)
• chore(test): migrate node:assert/strict to plain node:assert; lint-enforce via oxlint (#1555) (#1558)
• feat(models): add openaiStream() OpenAI-compatible SSE formatter (#1106)
• revert(ci): don't run YCSB on every PR yet; fix gh-pages local-ref collision between benchmark steps
• fix(indexing): treat shutdown-closed store during backfill as benign; de-flake reindex test (#1476)
• fix(ci): format record-caching test + grant pull-requests:write for PR benchmark alert comments
• test: address review feedback — lint/format fixes + real concurrency in QA-334 T4
• fix: merge ambient context when re-wrapping with a different user, preserving transaction and request state (review feedback)
• test: cover different-user ambient re-wrap and null hdb_user (cross-model review follow-up)
• fix: establish ambient user context for operation handlers so audit records carry attribution (#1591)
• feat(http): observable middleware chain order via debug log + get_status (#1573)
• Fix loadedFromSource being unobservable on string-id gets on caching tables (#1575)
• Anchor pre-pass rootPath to the config file directory
• Force-add the fixture .env excluded by gitignore
• Apply config-shaping env vars from component .env files before config composition (#1513)
• fix(blob): decompress (inflate) on read instead of re-deflating (#1393)
• fix(mcp): profile-scope getTool; drop toolDefCache (cross-model review)
• fix(mcp): compute operations-profile tools lazily so late-registered ops surface
• feat(hnsw): versioned index nodes for VT-cached traversal + format migration (#1440)
• fix(blob): harden FileBackedBlob.stream() cancel/cleanup paths (#1457) (#1542)
• Merge origin/main into record-caching; reconcile txn options + deps
• fix: accept unpadded base64 in envelopes; strengthen read_audit_log guard tests
• fix(subscriptions): re-deliver current scope to live subscribers on a copyApply reload marker (#1530)
• fix: bind related-table allowRead to a proper resource instance (#1532)
• Auth: support token login in core — exchange a validated JWT for an httpOnly hdb-session cookie (#1546)
• Refactor preload resolver to a pure function; resolve absolute paths via Node resolver
• Support replicated: true on set_configuration (#1556)
• fix(blob): 503 an in-flight replication receive instead of 404 (#481) (#1563)
• Honor thrown Response and status field for custom-resource HTTP status
• fix: use optional catch binding + format (lint/format CI)
• fix: fail closed when allow* hooks throw or reject (#1422 gap 1)
• Disable snapshots for get_analytics queries (#35)
• Harden threads.preload resolution per cross-model review
• Add threads.preload config to preload modules (e.g. APM agents) on worker threads
• fix: keep secret ops off the MCP default-allow surface; directive test update
• fix: close secret leak paths outside the REST ops log; grants set semantics
• fix: serialize secret row mutations, no-op short-circuit, validator caps
• feat: hdb_secret store with grant-scoped secret operations
• feat: add pure secret-envelope codec (utility/secretEnvelope.ts)
• Merge pull request #1528 from HarperFast/feat/env-secret-encryption
• Merge pull request #1527 from HarperFast/feat/protect-env-files
• refactor(env): generalize decryptor hook to registerSecretDecryptor
• fix(env): log undecryptable secrets at error level (not warn)
• feat(env): dormant decrypt hook + enc:v1 contract for env-secret encryption
• feat(env): allow set_component_file to write .env files
• fix(envFile): treat backtick-quoted values literally too in closesQuote
• fix(envFile): don't backslash-escape inside single-quoted values
• fix(components): address review feedback on .env protection ops
• feat(components): protect .env files in the operations API
• feat(config): validate directional controlled-flow route fields
• refactor(mcp): address Gemini review — sync onResourcesRegistered + fixture nullish render
• fix(mcp): register component-author static mcpTools/mcpPrompts at runtime (#1448)
• test(integration): PrimaryRocksDatabase record-caching cache correctness
• ci(ycsb): add pull_request trigger for per-PR YCSB comparison
• Merge remote-tracking branch 'origin/main' into record-caching
• fix: commit promoted-test fixtures into tracked tree (were referencing gitignored qa-scratch)
• test: promote exploratory-QA concurrency & data-integrity regression anchors
• fix(table): use typeof fallback per Ethan's review suggestion
• chore: fix prettier formatting on Table.ts
• fix(table): guard stringify(undefined) → undefined before .length (#1313)
• fix(table): reject bare-array roots; truncate error payload to 200 chars
• fix(table): reject non-object record roots; guard scan freeze (#1298)
• Merge main into record-caching; bump rocksdb-js to ^2.2.0
• fix(tls): clamp sub-second cert watch interval to a 1s floor
• fix(tls): reload on chokidar change events that omit stats
• Add periodic re-read safety net for TLS cert watcher (#586)
• Abort over-time write transactions instead of force-committing (#1407)
• test(bench): add transactional read scenarios to the caching benchmark
• fix(cache): store record value via setValue/getValue so WeakLRU entries are reclaimable
• fix(txn): restore ERR_BUSY backoff retry for non-coordinated transactions
• chore: prettier-format record-caching bench/test files
• Merge main into record-caching; wire PrimaryRocksDatabase + fix VT cache coherency
• Add concurrent PUT race condition test for HNSW index (issue #386)
• refactor: clean up handleLocalTimeForGets RocksDB branches and fix benchmark
• Collapse verifyVersion+populateVersion into single getSync(expectedVersion) call
• Redesign CachingRocksDatabase as PrimaryRocksDatabase with proper VT integration
• Add benchmark: RocksDatabase vs CachingRocksDatabase
• Add unit tests for CachingRocksDatabase
• Add CachingRocksDatabase with VT-backed WeakLRUCache for primary stores

Full Changelog: v5.1.15...v5.2.0-alpha.4