v5.2.0-alpha.6

Pre-release (5.2.0-alpha.6) for testing — not a stable release.

Features

• Typed, discoverable resources — RFC 0001 (#1767): code-first defineTable plus a per-method request contract.
• harper agent CLI (#1549): a command-line client for the built-in agent (authz enforced via standard dispatch).
• Live secrets (#1776): live secret-change subscriptions and live scoped accessors, with subscription teardown reference-counted by identity.

Access control

• Record-scoped allowRead (#1422, #1419): unified row-level read access control — enforced on reads, GraphQL checkPermission, and subscription delivery, with subscriptions continuously re-authorized against the live user (#1414). Prefix/multi-record scans keep the awaited entry check; per-record enforcement is sync-only.

Security & reliability

• ReDoS in config validation fixed (#1784): a crafted directory-path regex no longer pins the CLI at 100% CPU.
• SSE mid-stream error handling (#1789): a generator that throws mid-stream no longer hangs the response or escapes as an uncaughtException.
• SSH deploy keys encrypted at rest (#1795): decrypted to a transient file only for the git operation.
• Analytics window fix (#1796/#1798): get_analytics reads from the bounded time window rather than the metric index.
• Config env-precedence fix (#1618/#1726); QUERY-verb checkPermission bypass closed.

Deploy

• General-purpose credentials array (#1797): deploy_component registryAuth reshaped into a reusable credentials array.

Also in this release

Broad QA regression-anchor promotions (static / deploy / shutdown-drain / secrets / subscription paths); build+shrinkwrap hardening (#1783); uWS-on-pointer-compression guard (#1765); analytics deflake (#1794).

Full Changelog: v5.2.0-alpha.5...v5.2.0-alpha.6