SK-3020 Flowvault release/26.8.1

.cspell.json

@@ -97,11 +97,18 @@
     "nocreds",
     "nodir",
     "detok",
-    "qhdmceurtnlz",
     "ngrok",
     "obac",
     "siom",
-    "recordss"
+    "vaultid",
+    "recordss",
+    "synthesise",
+    "synthesised",
+    "deserialise",
+    "deserialised",
+    "unmodelled",
+    "recordss",
+    "rarr"
   ],
   "languageSettings": [
     {
@@ -121,6 +128,7 @@
     "**/target/**",
     "*.lock",
     "Rule/**",
+    "**/src/main/java/com/skyflow/generated/**",
     "**/generated/**",
     "**/*.ts",
     "**/processed-*",

.github/workflows/contract-tests.yml

@@ -29,23 +29,23 @@ jobs:
           cache: 'maven'
 
       - name: Verify API surface snapshot
-        run: mvn -B install -pl common,v2 -am -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
+        run: mvn -B install -pl common,skyvault -am -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
 
       - name: Show API surface diff
         if: failure()
         run: |
           echo "### API surface changes detected ###"
-          echo "See v2/target/japicmp/default-cli.diff for the full comparison against v2/api-report/skyflow-java.baseline.jar."
+          echo "See skyvault/target/japicmp/default-cli.diff for the full comparison against skyvault/api-report/skyflow-java.baseline.jar."
           echo "If this change is intentional, run scripts/contract-snapshot-update.sh and commit the updated baseline jar."
           echo ""
-          cat v2/target/japicmp/default-cli.diff || true
+          cat skyvault/target/japicmp/default-cli.diff || true
 
       - name: Upload API surface diff on failure
         if: failure()
         uses: actions/upload-artifact@v4
         with:
           name: api-surface-diff
-          path: v2/target/japicmp/**
+          path: skyvault/target/japicmp/**
           retention-days: 7
 
       # The step above only shows a diff when the CURRENT build differs from the
@@ -61,7 +61,7 @@ jobs:
         if: always() && github.event.pull_request
         run: |
           git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1
-          if git diff --name-only "origin/${{ github.event.pull_request.base.ref }}" HEAD -- v2/api-report/skyflow-java.baseline.jar | grep -q .; then
+          if git diff --name-only "origin/${{ github.event.pull_request.base.ref }}" HEAD -- skyvault/api-report/skyflow-java.baseline.jar | grep -q .; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
@@ -71,16 +71,16 @@ jobs:
         if: always() && steps.baseline-diff-check.outputs.changed == 'true'
         run: |
           curl -sL -o /tmp/japicmp-cli.jar "https://repo.maven.apache.org/maven2/com/github/siom79/japicmp/japicmp/0.26.0/japicmp-0.26.0-jar-with-dependencies.jar"
-          mvn -q -B dependency:build-classpath -pl v2 -Dmdep.outputFile=/tmp/v2-classpath.txt -Dmaven.javadoc.skip=true -Dgpg.skip=true
-          git show "origin/${{ github.event.pull_request.base.ref }}:v2/api-report/skyflow-java.baseline.jar" > /tmp/old-baseline.jar
+          mvn -q -B dependency:build-classpath -pl skyvault -Dmdep.outputFile=/tmp/skyvault-classpath.txt -Dmaven.javadoc.skip=true -Dgpg.skip=true
+          git show "origin/${{ github.event.pull_request.base.ref }}:skyvault/api-report/skyflow-java.baseline.jar" > /tmp/old-baseline.jar
 
           java -jar /tmp/japicmp-cli.jar \
             -o /tmp/old-baseline.jar \
-            -n v2/api-report/skyflow-java.baseline.jar \
+            -n skyvault/api-report/skyflow-java.baseline.jar \
             -a protected \
             -e "com.skyflow.generated.*;com.skyflow.utils.*" \
-            --old-classpath "$(cat /tmp/v2-classpath.txt)" \
-            --new-classpath "$(cat /tmp/v2-classpath.txt)" \
+            --old-classpath "$(cat /tmp/skyvault-classpath.txt)" \
+            --new-classpath "$(cat /tmp/skyvault-classpath.txt)" \
             -m \
             --markdown > /tmp/contract-baseline-diff.md || true
 
@@ -94,7 +94,7 @@ jobs:
             const fs = require('fs');
             const summary = fs.readFileSync('/tmp/contract-baseline-diff.md', 'utf8');
             const marker = '<!-- contract-baseline-diff -->';
-            const body = `${marker}\n## Contract baseline change detected\n\nThis PR updates \`v2/api-report/skyflow-java.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:\n\n${summary}`;
+            const body = `${marker}\n## Contract baseline change detected\n\nThis PR updates \`skyvault/api-report/skyflow-java.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:\n\n${summary}`;
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner,
               repo: context.repo.repo,

.github/workflows/endorlabsScan.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           # Surefire runs each module's tests with the module directory as the working
           # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
-          for module in common v2 flowvault; do
+          for module in common skyvault flowvault; do
             cp .env "$module/.env"
             cp credentials.json "$module/credentials.json"
           done

.github/workflows/internal-release.yml

@@ -21,7 +21,7 @@ jobs:
           if [[ "${{ github.ref_name }}" == flowvault-release/* ]]; then
             echo "module=flowvault" >> "$GITHUB_OUTPUT"
           else
-            echo "module=v2" >> "$GITHUB_OUTPUT"
+            echo "module=skyvault" >> "$GITHUB_OUTPUT"
           fi
 
   build-and-deploy:

.github/workflows/main.yml

@@ -34,18 +34,61 @@ jobs:
         run: |
           # Surefire runs each module's tests with the module directory as the working
           # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
-          for module in common v2 flowvault; do
+          for module in common skyvault flowvault; do
             cp .env "$module/.env"
             cp credentials.json "$module/credentials.json"
           done
 
       - name: Build & Run tests with Maven
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 
-      - name: Codecov
-        uses: codecov/codecov-action@v2.1.0
+      # JaCoCo records packages as "com/skyflow/..." with no module prefix, and all three
+      # modules share the com.skyflow package (deliberate split-package convention). So
+      # "com/skyflow/config/VaultConfig.java" matches BOTH skyvault and flowvault, Codecov
+      # resolves it to one of them, and the other module's file silently reports no data.
+      # Prefixing each report with its own source root makes every path unique and match the
+      # repo exactly, so all three modules' files are attributed correctly.
+      - name: Qualify JaCoCo report paths with their module
+        run: |
+          for module in common skyvault flowvault; do
+            report="$module/target/site/jacoco/jacoco.xml"
+            if [ ! -f "$report" ]; then
+              echo "Error: expected $report to exist after the build."
+              exit 1
+            fi
+            tmp="$(mktemp)"
+            sed "s|<package name=\"|<package name=\"$module/src/main/java/|g" "$report" > "$tmp"
+            mv "$tmp" "$report"
+          done
+
+      # One upload per module, each with its own flag, so Codecov reports per-module
+      # coverage instead of merging three same-named package trees into one number.
+      - name: Codecov (common)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: common/target/site/jacoco/jacoco.xml
+          flags: common
+          name: codecov-common
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (skyvault)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: skyvault/target/site/jacoco/jacoco.xml
+          flags: skyvault
+          name: codecov-skyvault
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (flowvault)
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
-          files: target/site/jacoco/jacoco.xml
-          name: codecov-skyflow-java
+          files: flowvault/target/site/jacoco/jacoco.xml
+          flags: flowvault
+          name: codecov-flowvault
           verbose: true
+          fail_ci_if_error: true

.github/workflows/pr.yml

@@ -43,25 +43,64 @@ jobs:
         run: |
           # Surefire runs each module's tests with the module directory as the working
           # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
-          for module in common v2 flowvault; do
+          for module in common skyvault flowvault; do
             cp .env "$module/.env"
             cp credentials.json "$module/credentials.json"
           done
 
       - name: Build & Run tests with Maven
         run: mvn -B package -f pom.xml -Dmaven.javadoc.skip=true
 
-      # JaCoCo writes one report per module. The root pom is <packaging>pom</packaging>
-      # with no sources, so target/site/jacoco/jacoco.xml - correct when this was a
-      # single-module build - is never generated post common/v2/flowvault split, and
-      # codecov was silently uploading nothing.
-      - name: Codecov
-        uses: codecov/codecov-action@v2.1.0
+      # JaCoCo records packages as "com/skyflow/..." with no module prefix, and all three
+      # modules share the com.skyflow package (deliberate split-package convention). So
+      # "com/skyflow/config/VaultConfig.java" matches BOTH skyvault and flowvault, Codecov
+      # resolves it to one of them, and the other module's file silently reports no data.
+      # Prefixing each report with its own source root makes every path unique and match the
+      # repo exactly, so all three modules' files are attributed correctly.
+      - name: Qualify JaCoCo report paths with their module
+        run: |
+          for module in common skyvault flowvault; do
+            report="$module/target/site/jacoco/jacoco.xml"
+            if [ ! -f "$report" ]; then
+              echo "Error: expected $report to exist after the build."
+              exit 1
+            fi
+            tmp="$(mktemp)"
+            sed "s|<package name=\"|<package name=\"$module/src/main/java/|g" "$report" > "$tmp"
+            mv "$tmp" "$report"
+          done
+
+      # One upload per module, each with its own flag, so Codecov reports per-module
+      # coverage instead of merging three same-named package trees into one number.
+      - name: Codecov (common)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: common/target/site/jacoco/jacoco.xml
+          flags: common
+          name: codecov-common
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (skyvault)
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
+          files: skyvault/target/site/jacoco/jacoco.xml
+          flags: skyvault
+          name: codecov-skyvault
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Codecov (flowvault)
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_REPO_UPLOAD_TOKEN }}
-          files: common/target/site/jacoco/jacoco.xml,v2/target/site/jacoco/jacoco.xml,flowvault/target/site/jacoco/jacoco.xml
-          name: codecov-skyflow-java
+          files: flowvault/target/site/jacoco/jacoco.xml
+          flags: flowvault
+          name: codecov-flowvault
           verbose: true
+          fail_ci_if_error: true
 
   spellcheck:
     name: Run spellcheck

.github/workflows/shared-build-and-deploy.yml

@@ -135,7 +135,7 @@ jobs:
         run: |
           # Surefire runs each module's tests with the module directory as the working
           # directory, so dotenv and ./credentials.json lookups miss the repo-root copies.
-          for module in common v2 flowvault; do
+          for module in common skyvault flowvault; do
             cp .env "$module/.env"
             cp credentials.json "$module/credentials.json"
           done

.gitignore

@@ -5,3 +5,6 @@ target
 RUNNING_SAMPLES.md
 
 docs/superpowers/
+
+# local sample configuration - may hold credentials
+.env

codecov.yml

@@ -1,16 +1,90 @@
-comment: false
+# Post a summary on every PR, broken down by flag (module) and component so all three of
+# common / skyvault / flowvault are visible at a glance. require_changes: false keeps the
+# comment on PRs that touch only one module, so the other two still report their coverage.
+comment:
+  layout: "header, diff, flags, components, files, footer"
+  behavior: default
+  require_changes: false
 
-# Component paths are prefixed with **/ (quoted - a bare leading * is a YAML
-# alias) so they match every Maven module. Before the common/v2/flowvault
-# split sources lived at src/main/java/...; they are now
-# <module>/src/main/java/..., so the unprefixed globs matched zero files and
-# every component reported no coverage data.
+# A project + patch status per module, so each of the three gets its own PR check rather
+# than being averaged into one repo-wide number. informational keeps them advisory - they
+# report the delta without blocking the merge.
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+      common:
+        flags:
+          - common
+        target: auto
+        threshold: 1%
+        informational: true
+      skyvault:
+        flags:
+          - skyvault
+        target: auto
+        threshold: 1%
+        informational: true
+      flowvault:
+        flags:
+          - flowvault
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+
+# One flag per Maven module. Each module is uploaded separately in CI so its coverage is
+# reported on its own rather than merged into a single repo-wide number. carryforward keeps
+# the last known coverage for a module when a run does not upload it (e.g. a partial build).
+flags:
+  common:
+    paths:
+      - common/src/main/java/
+    carryforward: true
+  skyvault:
+    paths:
+      - skyvault/src/main/java/
+    carryforward: true
+  flowvault:
+    paths:
+      - flowvault/src/main/java/
+    carryforward: true
+
+# Components give two independent breakdowns of the same coverage data:
+#   - one per module, so a drop can be traced to common / skyvault / flowvault
+#   - one per package, so a drop can be traced to controllers / data / utils / ...
+#
+# Package paths are prefixed with **/ (quoted - a bare leading * is a YAML alias) so they
+# match every module. All three modules share the com.skyflow package name, so the JaCoCo
+# reports are rewritten in CI to carry their module's source root; without that, a path like
+# com/skyflow/config/VaultConfig.java is ambiguous and Codecov attributes it to a single
+# module while the others report no data. See the "Qualify JaCoCo report paths" CI step.
 component_management:
   default_rules:
     statuses:
       - type: project
         target: auto
   individual_components:
+    # -- per module ------------------------------------------------------------
+    - component_id: module_common
+      name: "Module: common"
+      paths:
+        - "common/src/main/java/**"
+    - component_id: module_skyvault
+      name: "Module: skyvault"
+      paths:
+        - "skyvault/src/main/java/**"
+    - component_id: module_flowvault
+      name: "Module: flowvault"
+      paths:
+        - "flowvault/src/main/java/**"
+    # -- per package, across all modules ---------------------------------------
     - component_id: service_account
       name: Service Account
       paths:
@@ -55,3 +129,18 @@ component_management:
       name: Errors
       paths:
         - "**/src/main/java/com/skyflow/errors/**"
+    - component_id: enums
+      name: Enums
+      paths:
+        - "**/src/main/java/com/skyflow/enums/**"
+    - component_id: logs
+      name: Logs
+      paths:
+        - "**/src/main/java/com/skyflow/logs/**"
+
+# Generated REST/auth clients and sample code are not hand-written and are already excluded
+# from the JaCoCo reports by the root pom; ignore them here too so they never skew a target.
+ignore:
+  - "**/src/main/java/com/skyflow/generated/**"
+  - "**/samples/**"
+  - "**/src/test/**"

common/src/main/java/com/skyflow/errors/ErrorMessage.java

@@ -154,6 +154,8 @@ public enum ErrorMessage {
     EmptyTokenGroupNamesInTokenizeRecord("%s0 Validation error. TokenGroupNames in TokenizeRecord is null or empty. Specify at least one token group name."),
     EmptyTokenGroupNameInTokenizeRecord("%s0 Validation error. Token group name in TokenizeRecord is null or empty. Specify a valid token group name."),
     TokenizeDataSizeExceedError("%s0 Maximum number of tokenize records exceeded. The limit is 10000."),
+    MissingIndexInBulkTokenizeRecord("%s0 Validation error. Index in BulkTokenizeRequestRecord is null. Specify an index for every record."),
+    DuplicateIndexInBulkTokenizeRecord("%s0 Validation error. Duplicate index in BulkTokenizeRequestRecord. Specify a unique index for every record."),
 
     // Connection
     InvalidRequestHeaders("%s0 Validation error. Request headers aren't valid. Specify valid request headers."),