Repository navigation
graft: recover orphan branch rescue/orphan-8060b10db775-feat-clients-complete-the-polyglot-sdk-m onto main - #6
Merged
ORESoftware merged 165 commits intoSep 12, 2026
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- zed-interfaces: VersionScheme (semver/calver/opaque), tolerant version parsing (v-prefix, Go +incompatible, PEP 440), npm-style range parsing, shared sync contract types (SyncWriteMode/ErrorPolicy/ChangeEvent), regenerated schemas. - zed-cli: resolve via the shared calver-aware resolver; deterministic zip artifacts alongside tar.gz with magic-byte extraction. - zed-api-server: persist and serve version_scheme (entity + migration + handlers). - zed-clients: dependency-free sync wire types bridge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…t parsing - Python: add the missing publish() (stdlib multipart); tolerate unknown server fields (filter kwargs to dataclass fields) so new fields never crash clients; auth + error-mapping on download_artifact; percent-encode segments. - Go: check HTTP status in DownloadArtifact (typed ApiError), add bearer auth, percent-encode path segments, add version_scheme. - TypeScript: version_scheme type; error-code fallback (http_<status>) so code is never undefined; encodeURIComponent on segments. - Rust: percent-encode path segments (opaque version tags). - All four SDK test suites pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Never send the registry auth token to a download_url (the URL comes from the registry response; sending the bearer there leaked it). Go and Python fixed; Rust/TS confirmed already correct. - Validate the download_url scheme: https always, http only for loopback or an http registry base; reject everything else (incl. file://). - Cap the artifact read at declared-size + slack, ceilinged at 100 MiB, to prevent an OOM from a hostile/oversized body. - Add connect+read timeouts (default 30s) to every SDK's HTTP client. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This repo is polyglot — one library, many language clients. Rather than publishing a single fat artifact (which would make e.g. a Java consumer download the Node sources), each [targets.<lang>] publishes as its own package `<org>/<name>-<lang>` at this single shared version, so a consumer installs and downloads only the language it uses. Consumers depend on the language package directly, e.g. "<org>/<name>-java" = "^0.1" or let zed infer the target from the project (package.json -> nodejs, go.mod -> golang, pom.xml -> java, ...). Design: zed-docs doc 17 (polyglot client libraries). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Each language target now declares the adapter zed uses to wire it into a consumer's build, so installing a slice sets up NODE_PATH / the JVM classpath / go.work / PYTHONPATH / cargo paths / pub path deps without the consumer configuring anything. Targets whose ecosystem zed cannot wire keep no adapter: they still install into zed_modules/ and are listed in .zed/paths.json. The zed-package gate additionally asserts every *language* artifact declares a concrete `language`, which is what lets a consumer install refuse e.g. the -java slice in an npm-only project. `[targets.repository]` is exempt: it is the whole-repository release surface (doc 18), language-agnostic by construction and correctly ungated. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…adapters The pins predated the go/python/rust/dart adapters, so `zed pack` rejected `adapter = "dart"` as an unsupported value and the whole fan-out failed. Pinning by SHA is deliberate — a moving ref would let an upstream change alter what this repo's CI validates — so the fix is to move the pins, not to loosen them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The module proxy resolves a subdirectory module by `<subdir>/vX.Y.Z`, which the repo-global `[publish].tag_format` cannot express — doc 19's highest-leverage gap. `[targets.golang.native].tag_format` is the per-target override that closes it, so declare it alongside the module path the proxy will serve. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
zed-polyglot.yml still pinned zed-interfaces before the multi-registry route model, so `forge` and `tag_format` did not exist in that schema and manifests declaring them failed to deserialize. Only zed-package.yml had been bumped. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…SDKs Move the existing go, python, rust and typescript clients from the repo root into clients/<lang> (git mv), updating the Go module path to github.com/zed-pkg/zed-clients/clients/go and the Rust client's zed-interfaces path dependency for the deeper nesting. Add four new SDKs implementing the same contract (getPackage, getVersion, search, claimOrg, yank, sha256-verified downloadArtifact with the https/loopback download-url policy and the 100 MiB + slack size cap, and multipart publish, with typed ApiError codes): - clients/wasm: Rust -> WebAssembly via wasm-pack (wasm-bindgen + global fetch), reusing the zed-interfaces DTOs; pure logic unit-tested on the host target. - clients/dart: package:http transport, streamed size-capped downloads, MockClient tests. - clients/gleam: gleam_httpc transport behind an injectable Transport, gleeunit tests. - clients/erlang: stdlib-only (httpc + OTP 27 json + crypto), eunit tests including round-trips against a one-shot loopback server. Update .zpkg.toml targets for the new layout (including the golang.native subdirectory tag format) and add rust-wasm, dart, gleam and erlang targets; verified with the pinned zed-cli: pack produces the repository artifact plus 8 language slices and the zed-package interop checks pass, as does publish --dry-run. Extend ci.yml with wasm, dart, gleam and erlang jobs and point every job at clients/<lang>. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Complete the ten-language Zed client matrix without repeating the earlier layout migration. Add Java 17 and Swift 5.9 core clients with package/version lookup, search, org claim, yank/restore, bounded SHA-256-verified downloads, and raw multipart publication. Preserve gateway prefixes, refuse redirects, separate registry bearer credentials from artifact hosts, bound diagnostics, register Maven/Swift Zed targets, and pin the read-only ten-language matrix. Exact reviewed head 34661cbf365338a1bf2fa3c3ad7158dca90a1fe3 passed CI run 30613633910 and Zed interoperability run 30613633937 with no unresolved review threads.
Add polyglot generator/parity guidance, minimal tool pointers, and the read-only reusable policy gate pinned to preserved zed-monorepo commit fb2417b1a976459e3de740f788916d3d91d3669e.
Semantically combine the historical extended-route SDK work with current main. Preserve the merged Java/Swift clients, hierarchical agent policy, and current release metadata while adding the branch's unique Go, Python, Rust, TypeScript, and Rust/WASM parity changes. Refs DEN-1111 and DEN-1159.
Preserve the fleet-wide artifact URL and bounded-error semantics after the conceptual SDK branch union. Production code remains unchanged; Go and TypeScript tests now distinguish HTTPS production boundaries, explicit HTTP development registries, complete structured errors, and truncated invalid JSON. Refs DEN-1111 and DEN-1159.
Correct the public ten-client lifecycle matrix, prove the reviewed yank/restore entrypoints remain implemented, and add the permanent claim-to-code drift gate.
Land the current-main TypeScript reader, canonicalizer, and negative conformance tests for zed.nix-export-plan/v1.
Land the browser-compatible TypeScript zed.nix-adapter/v1 reader, Rust-compatible canonical digest helpers, closure-free Nix-to-Zed validation, artifact-byte binding, golden vectors, and replay-boundary documentation.
Add the pinned, fail-closed Zed client synchronization boundary and its read-only validator without claiming runtime adoption beyond the declared stage.
Add a zero-runtime-dependency Go implementation of the canonical Zed↔Nix adapter contract with strict parsing, canonical JSON, digest and artifact verification, immutable-source and policy validation, deterministic normalization, and adversarial coverage.
Apply only native formatter output for the Go Nix adapter, Rust client, Dart client/tests, and Gleam client/tests. Preserve all transport, authentication, URL, timeout, response-bound, artifact, API, and test semantics. Exact pinned formatter validation and complete repository CI passed on d01354e. Refs DEN-1350 and DEN-359.
Certify zed-interfaces native lock provenance at exact head a23cdd2ac509a39ca6fd6d21a3774fdd3a0f7660 from an independent SDK consumer. Run the complete locked product tests, strict Clippy, deterministic schema regeneration, and a locked offline consumer covering legacy compatibility, source-aware identity, deterministic ordering, upsert replacement, and fail-closed provenance validation. Refs DEN-1565.
Add the canonical zed-interfaces dependency, materialize Zed packages under .vendor/.zed, and exclude generated dependency content from publication without fabricating a lockfile or nonexistent shared-library coordinate.
Add functional Elixir, Kotlin, Ruby, and PHP clients; explicit TypeScript entry points for Node.js, Deno, Bun, and edge runtimes; canonical Zed targets; and CI/drift checks that keep all fourteen maintained client slices aligned.
…the-polyglot-sdk-m into main (graft, scaffolding reconciled) `rescue/orphan-8060b10db775-feat-clients-complete-the-polyglot-sdk-m` was recovered from a dangling commit and shares no history with `main`. This is a real two-parent merge built with plumbing (no checkout). Every path the orphan adds is taken verbatim (106 file(s)). The overlap was scaffolding only: .gitignore: union (6 extra rule(s) carried over) kept main's current version: .zpkg.toml README.md The orphan's own copies remain readable at `git show 8060b10:<path>`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KAAGBnXTSw7zE5xnY4tiBY
ORESoftware
deleted the
graft/rescue-orphan-8060b10db775-feat-clients-complete-the-polyglot-sdk-m-20260905
branch
September 12, 2026 16:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft.
rescue/orphan-8060b10db775-feat-clients-complete-the-polyglot-sdk-mwas rescued from a dangling commit, so it has no common history withmainand GitHub would not open a pull request for it.This branch is a genuine two-parent merge of
origin/mainand8060b10db7758cb8a90aa0da0822465c3a0066d8, built withgit merge-tree/commit-treeplumbing — no checkout, no working-tree change anywhere.How the overlap was resolved (both sides carried these files; there is no common ancestor to diff against):
.gitignore— union (6 extra rule(s) carried over)main's current version:.zpkg.toml README.mdThose are scaffolding files that
mainhas regenerated since the orphan was written; the orphan's own copies are not lost — read them withgit show 8060b10db7758cb8a90aa0da0822465c3a0066d8:<path>. Everything else the orphan adds (106 file(s)) is here verbatim.🤖 Generated with Claude Code
https://claude.ai/code/session_01KAAGBnXTSw7zE5xnY4tiBY