From 0ab5e39122990d3e8fb4ac4e533bdbc46f24216a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 4 Jul 2026 17:01:00 +0000 Subject: [PATCH] chore: version packages --- .../adr-0053-list-view-mode-guardrail.md | 27 ---- .changeset/adr-0069-last-login-audit.md | 21 --- .changeset/adr-0069-shared-ratelimit-store.md | 23 --- .../adr-0086-two-doors-permission-sets.md | 36 ----- .changeset/automation-bind-flows-cold-boot.md | 30 ---- .changeset/automation-publish-rebind-flows.md | 39 ----- .changeset/automation-run-history.md | 37 ----- .changeset/destructive-ops-rbac-mapping.md | 16 -- .changeset/durable-package-install.md | 14 -- .../meta-validation-issues-passthrough.md | 32 ---- .changeset/multivalue-field-shape.md | 5 - .changeset/permission-package-provenance.md | 26 --- .changeset/permset-resolve-observability.md | 13 -- .../related-list-primary-derived-columns.md | 26 --- .changeset/require-auth-secure-by-default.md | 45 ------ .changeset/validation-error-human-message.md | 22 --- .changeset/view-expand-collision-warning.md | 15 -- .../view-overlay-identity-inheritance.md | 16 -- .changeset/view-ref-build-lint.md | 16 -- examples/app-crm/CHANGELOG.md | 16 ++ examples/app-crm/package.json | 2 +- examples/app-showcase/CHANGELOG.md | 20 +++ examples/app-showcase/package.json | 2 +- examples/app-todo/CHANGELOG.md | 25 +++ examples/app-todo/package.json | 2 +- examples/embed-objectql/CHANGELOG.md | 17 ++ examples/embed-objectql/package.json | 2 +- packages/adapters/hono/CHANGELOG.md | 10 ++ packages/adapters/hono/package.json | 2 +- packages/apps/account/CHANGELOG.md | 15 ++ packages/apps/account/package.json | 2 +- packages/apps/setup/CHANGELOG.md | 15 ++ packages/apps/setup/package.json | 2 +- packages/apps/studio/CHANGELOG.md | 15 ++ packages/apps/studio/package.json | 2 +- packages/cli/CHANGELOG.md | 143 +++++++++++++++++ packages/cli/package.json | 2 +- packages/client-react/CHANGELOG.md | 15 ++ packages/client-react/package.json | 2 +- packages/client/CHANGELOG.md | 14 ++ packages/client/package.json | 2 +- packages/cloud-connection/CHANGELOG.md | 18 +++ packages/cloud-connection/package.json | 2 +- .../connectors/connector-mcp/CHANGELOG.md | 14 ++ .../connectors/connector-mcp/package.json | 2 +- .../connectors/connector-openapi/CHANGELOG.md | 14 ++ .../connectors/connector-openapi/package.json | 2 +- .../connectors/connector-rest/CHANGELOG.md | 14 ++ .../connectors/connector-rest/package.json | 2 +- .../connectors/connector-slack/CHANGELOG.md | 14 ++ .../connectors/connector-slack/package.json | 2 +- packages/console/CHANGELOG.md | 2 + packages/console/package.json | 2 +- packages/core/CHANGELOG.md | 13 ++ packages/core/package.json | 2 +- packages/create-objectstack/CHANGELOG.md | 2 + packages/create-objectstack/package.json | 2 +- packages/dogfood/CHANGELOG.md | 22 +++ packages/dogfood/package.json | 2 +- packages/downstream-contract/CHANGELOG.md | 13 ++ packages/downstream-contract/package.json | 2 +- packages/formula/CHANGELOG.md | 13 ++ packages/formula/package.json | 2 +- packages/lint/CHANGELOG.md | 39 +++++ packages/lint/package.json | 2 +- packages/mcp/CHANGELOG.md | 15 ++ packages/mcp/package.json | 2 +- packages/metadata-core/CHANGELOG.md | 13 ++ packages/metadata-core/package.json | 2 +- packages/metadata-fs/CHANGELOG.md | 6 + packages/metadata-fs/package.json | 2 +- packages/metadata-protocol/CHANGELOG.md | 104 ++++++++++++ packages/metadata-protocol/package.json | 2 +- packages/metadata/CHANGELOG.md | 29 ++++ packages/metadata/package.json | 2 +- packages/objectql/CHANGELOG.md | 52 ++++++ packages/objectql/package.json | 2 +- packages/observability/CHANGELOG.md | 13 ++ packages/observability/package.json | 2 +- packages/platform-objects/CHANGELOG.md | 33 ++++ packages/platform-objects/package.json | 2 +- packages/plugins/driver-memory/CHANGELOG.md | 14 ++ packages/plugins/driver-memory/package.json | 2 +- packages/plugins/driver-mongodb/CHANGELOG.md | 14 ++ packages/plugins/driver-mongodb/package.json | 2 +- packages/plugins/driver-sql/CHANGELOG.md | 15 ++ packages/plugins/driver-sql/package.json | 2 +- .../plugins/driver-sqlite-wasm/CHANGELOG.md | 15 ++ .../plugins/driver-sqlite-wasm/package.json | 2 +- packages/plugins/embedder-openai/CHANGELOG.md | 13 ++ packages/plugins/embedder-openai/package.json | 2 +- .../plugins/knowledge-memory/CHANGELOG.md | 15 ++ .../plugins/knowledge-memory/package.json | 2 +- .../plugins/knowledge-ragflow/CHANGELOG.md | 15 ++ .../plugins/knowledge-ragflow/package.json | 2 +- .../plugins/plugin-approvals/CHANGELOG.md | 18 +++ .../plugins/plugin-approvals/package.json | 2 +- packages/plugins/plugin-audit/CHANGELOG.md | 16 ++ packages/plugins/plugin-audit/package.json | 2 +- packages/plugins/plugin-auth/CHANGELOG.md | 56 +++++++ packages/plugins/plugin-auth/package.json | 2 +- packages/plugins/plugin-dev/CHANGELOG.md | 35 +++++ packages/plugins/plugin-dev/package.json | 2 +- packages/plugins/plugin-email/CHANGELOG.md | 17 ++ packages/plugins/plugin-email/package.json | 2 +- .../plugins/plugin-hono-server/CHANGELOG.md | 16 ++ .../plugins/plugin-hono-server/package.json | 2 +- .../plugins/plugin-org-scoping/CHANGELOG.md | 16 ++ .../plugins/plugin-org-scoping/package.json | 2 +- packages/plugins/plugin-reports/CHANGELOG.md | 16 ++ packages/plugins/plugin-reports/package.json | 2 +- packages/plugins/plugin-security/CHANGELOG.md | 95 +++++++++++ packages/plugins/plugin-security/package.json | 2 +- packages/plugins/plugin-sharing/CHANGELOG.md | 20 +++ packages/plugins/plugin-sharing/package.json | 2 +- packages/plugins/plugin-webhooks/CHANGELOG.md | 15 ++ packages/plugins/plugin-webhooks/package.json | 2 +- packages/rest/CHANGELOG.md | 58 +++++++ packages/rest/package.json | 2 +- packages/runtime/CHANGELOG.md | 99 ++++++++++++ packages/runtime/package.json | 2 +- packages/sdui-parser/CHANGELOG.md | 2 + packages/sdui-parser/package.json | 2 +- .../services/service-analytics/CHANGELOG.md | 14 ++ .../services/service-analytics/package.json | 2 +- .../services/service-automation/CHANGELOG.md | 113 +++++++++++++ .../services/service-automation/package.json | 2 +- packages/services/service-cache/CHANGELOG.md | 15 ++ packages/services/service-cache/package.json | 2 +- .../service-cluster-redis/CHANGELOG.md | 14 ++ .../service-cluster-redis/package.json | 2 +- .../services/service-cluster/CHANGELOG.md | 14 ++ .../services/service-cluster/package.json | 2 +- .../services/service-datasource/CHANGELOG.md | 14 ++ .../services/service-datasource/package.json | 2 +- packages/services/service-i18n/CHANGELOG.md | 14 ++ packages/services/service-i18n/package.json | 2 +- packages/services/service-job/CHANGELOG.md | 16 ++ packages/services/service-job/package.json | 2 +- .../services/service-knowledge/CHANGELOG.md | 14 ++ .../services/service-knowledge/package.json | 2 +- .../services/service-messaging/CHANGELOG.md | 14 ++ .../services/service-messaging/package.json | 2 +- .../services/service-package/CHANGELOG.md | 14 ++ .../services/service-package/package.json | 2 +- packages/services/service-queue/CHANGELOG.md | 16 ++ packages/services/service-queue/package.json | 2 +- .../services/service-realtime/CHANGELOG.md | 16 ++ .../services/service-realtime/package.json | 2 +- .../services/service-settings/CHANGELOG.md | 17 ++ .../services/service-settings/package.json | 2 +- .../services/service-storage/CHANGELOG.md | 17 ++ .../services/service-storage/package.json | 2 +- packages/spec/CHANGELOG.md | 148 ++++++++++++++++++ packages/spec/package.json | 2 +- packages/triggers/trigger-api/CHANGELOG.md | 14 ++ packages/triggers/trigger-api/package.json | 2 +- .../trigger-record-change/CHANGELOG.md | 14 ++ .../trigger-record-change/package.json | 2 +- .../triggers/trigger-schedule/CHANGELOG.md | 14 ++ .../triggers/trigger-schedule/package.json | 2 +- packages/types/CHANGELOG.md | 13 ++ packages/types/package.json | 2 +- packages/verify/CHANGELOG.md | 76 +++++++++ packages/verify/package.json | 2 +- packages/vscode-objectstack/CHANGELOG.md | 2 + packages/vscode-objectstack/package.json | 2 +- 167 files changed, 2005 insertions(+), 533 deletions(-) delete mode 100644 .changeset/adr-0053-list-view-mode-guardrail.md delete mode 100644 .changeset/adr-0069-last-login-audit.md delete mode 100644 .changeset/adr-0069-shared-ratelimit-store.md delete mode 100644 .changeset/adr-0086-two-doors-permission-sets.md delete mode 100644 .changeset/automation-bind-flows-cold-boot.md delete mode 100644 .changeset/automation-publish-rebind-flows.md delete mode 100644 .changeset/automation-run-history.md delete mode 100644 .changeset/destructive-ops-rbac-mapping.md delete mode 100644 .changeset/durable-package-install.md delete mode 100644 .changeset/meta-validation-issues-passthrough.md delete mode 100644 .changeset/multivalue-field-shape.md delete mode 100644 .changeset/permission-package-provenance.md delete mode 100644 .changeset/permset-resolve-observability.md delete mode 100644 .changeset/related-list-primary-derived-columns.md delete mode 100644 .changeset/require-auth-secure-by-default.md delete mode 100644 .changeset/validation-error-human-message.md delete mode 100644 .changeset/view-expand-collision-warning.md delete mode 100644 .changeset/view-overlay-identity-inheritance.md delete mode 100644 .changeset/view-ref-build-lint.md diff --git a/.changeset/adr-0053-list-view-mode-guardrail.md b/.changeset/adr-0053-list-view-mode-guardrail.md deleted file mode 100644 index c6793ad8e7..0000000000 --- a/.changeset/adr-0053-list-view-mode-guardrail.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/lint": minor -"@objectstack/cli": minor ---- - -feat(spec,lint): reject userFilters on object list views (ADR-0053 phase 4) - -ADR-0053 reserves `userFilters`/`quickFilters` for page lists ("filters" mode); -on an object list view ("views" mode — where the `ViewTabBar` is the only nav -control) they are silently dropped. This lands the phase-4 guardrail as a -layered defence, so the wrong-context authoring mistake is caught without -breaking existing metadata: - -- **Type-level (author time):** new `ObjectListViewSchema` = `ListViewSchema` - minus `userFilters`. Object built-in `listViews` and `defineView` - `list`/`listViews` now use it, so `userFilters` on an object list view is a - `tsc` error. The full `ListViewSchema` (page "filters" mode) is untouched. -- **Runtime (back-compat):** the field is STRIPPED at parse (default strip, no - throw), so existing metadata keeps loading — `ObjectSchema.parse` never fails - on a stray `userFilters`. -- **Author/CI (actionable):** new `@objectstack/lint` rule - `validateListViewMode`, wired into `os validate`, reports the wrong-context - field PRE-parse (before the schema strips it) with a fix hint. - -Closes the schema half of objectui #2219; supersedes the interim runtime warn in -objectui #2220. diff --git a/.changeset/adr-0069-last-login-audit.md b/.changeset/adr-0069-last-login-audit.md deleted file mode 100644 index 97b4732e13..0000000000 --- a/.changeset/adr-0069-last-login-audit.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -"@objectstack/platform-objects": minor -"@objectstack/plugin-auth": minor ---- - -feat(auth): last-login audit fields — sys_user.last_login_at / last_login_ip (ADR-0069 D7) - -Completes the ADR-0069 D7 identity-field set: `sys_user.last_login_at` and -`sys_user.last_login_ip` are stamped on every successful `/sign-in/email` by -`AuthManager.stampLastLogin` (a best-effort after-hook, independent of the -lockout-accounting path so it runs even when lockout is disabled). The IP is -taken from the trusted forwarded headers (`x-forwarded-for` → -`cf-connecting-ip` → `x-real-ip`), the same precedence as the D5 IP allow-list -middleware, and capped to the 45-char column width. Both fields are -system-managed, read-only, and land in the Admin group of `sys_user`. - -The rest of ADR-0069 P1 (password complexity/history/expiry, HIBP, account -lockout, enforced MFA) was already implemented; this fills the one missing D7 -field pair. ADR-0069 status updated Proposed → Accepted (P1/P2 implemented) -with an implementation-status matrix reflecting what is landed vs the remaining -P2 gaps (per-org IP ranges, shared-store rate limiting). diff --git a/.changeset/adr-0069-shared-ratelimit-store.md b/.changeset/adr-0069-shared-ratelimit-store.md deleted file mode 100644 index aeb3cf32a4..0000000000 --- a/.changeset/adr-0069-shared-ratelimit-store.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -"@objectstack/plugin-auth": minor ---- - -feat(auth): shared cross-node rate-limit + session store via the cache service (ADR-0069 D2) - -Multi-node deployments previously rate-limited **per process** — better-auth's -default `rateLimit` store is in-memory, so each node counted independently and -an attacker could rotate nodes to bypass the limit. `AuthPlugin` now wires the -kernel `cache` service as better-auth's `secondaryStorage` and flips -`rateLimit.storage` to `'secondary-storage'`, so rate-limit counters (and the -session cache) are enforced against **one shared store across every node** — -shared iff the cache service is (Redis adapter in a cluster; memory single-node, -where behavior is unchanged). When no cache service is registered the plugin -logs a warning that a multi-node deployment needs a shared cache (ADR-0069 -honesty — no silent per-process limiting presented as global). - -New `cacheSecondaryStorage(cache)` adapter (`ICacheService` → better-auth -`SecondaryStorage`). Note: the cache has no atomic increment, so under high -concurrency the get→set counter path can slightly over-count — acceptable for a -rate limiter and strictly better than independent per-node counters; a future -cache adapter exposing atomic INCR can add an `increment` method for exact -counting. diff --git a/.changeset/adr-0086-two-doors-permission-sets.md b/.changeset/adr-0086-two-doors-permission-sets.md deleted file mode 100644 index d45f90192d..0000000000 --- a/.changeset/adr-0086-two-doors-permission-sets.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -"@objectstack/metadata-protocol": minor -"@objectstack/plugin-security": minor ---- - -feat(security): two-doors separation for permission sets (ADR-0086 P2) - -Splits who may change a permission set into two non-overlapping doors, enforced -at the data layer instead of by convention: - -**块1 — the package door (publish-time materialization).** -`ObjectStackProtocolImplementation` gains a generic publish-time materializer -registry (`registerPublishMaterializer(type, fn)`). When a draft of a registered -type is published, its body is projected into a data-plane row and the result is -surfaced on the publish response as `materializeApplied` (best-effort, never -thrown — same contract as `seedApplied`). `promoteDraft` now returns the draft's -`packageId` so the materializer can stamp the owning package. `plugin-security` -registers a `permission` materializer that upserts the published set into -`sys_permission_set` with `managed_by:'package'` + `package_id` — so a set -authored through the studio package door (saved as a `permission` draft, then -published) lands in the admin surface with the exact provenance the boot seeder -already stamps, now on the runtime publish path too. The single-set upsert is -shared with `bootstrapDeclaredPermissions` (`upsertPackagePermissionSet`), so -both paths apply the same own-row / foreign-package / env-authored rules. - -**块2 — the admin door (data-layer write gate).** -The security middleware now refuses any admin-door write -(`update`/`delete`/`transfer`/`restore`/`purge`) to a `sys_permission_set` row -with `managed_by:'package'`, and refuses an `insert` that forges -`managed_by:'package'`. The gate fails closed regardless of the caller's grants -(a platform admin with `modifyAllRecords` is blocked just the same), so it is a -real data-layer boundary rather than a UI hint. System/boot writes carry -`isSystem` and bypass the whole middleware, so the boot seeder and the publish -materializer are unaffected. Env-authored sets (`managed_by` `user`/`platform` -or absent) stay freely editable through the admin door — the two doors never -overwrite each other. diff --git a/.changeset/automation-bind-flows-cold-boot.md b/.changeset/automation-bind-flows-cold-boot.md deleted file mode 100644 index 77f0ae7cd0..0000000000 --- a/.changeset/automation-bind-flows-cold-boot.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -"@objectstack/service-automation": patch ---- - -fix(automation): bind flow triggers on a cold boot, not just after an HMR reload - -Record-triggered (and other trigger-typed) flows silently never fired on a -fresh process start — in dev and in production. The automation service's -boot-time flow pull reads `ql.registry.listItems('flow')`, which is **empty for -flows defined inline in an app manifest** — `registry.registerApp()` stores the -app under type `'app'` and never promotes its inline flows to standalone -registry `'flow'` items. The re-sync that *could* see them only ran on the -`metadata:reloaded` hook, which never fires on a cold boot (`os dev` restarts -the process on recompile rather than firing it, and production never reloads). - -Net effect: after any real restart, **no flow bound its trigger**, so -record-change automations did not fire at all. - -Fix: bind flows at `kernel:ready` from `protocol.getMetaItems({ type: 'flow' })` -— the canonical flattened flow view that `GET /meta/flow` serves and that does -surface inline app flows — once every plugin has finished `init()`/`start()` -(so the app, hence its flows, is registered). `registerFlow` is idempotent, so -re-binding a flow the boot pull already registered is harmless. - -Verified end-to-end on a clean instance: before the fix, updating a record -fired **0** flows (0 bound at boot); after, a cold boot binds all flows and a -single record update fires every matching record-triggered flow. Regression -test boots a kernel with an inline-app record-triggered flow served only via -`protocol.getMetaItems` and asserts it is bound after `bootstrap()` alone with -no `metadata:reloaded` fired — it fails on the pre-fix code. diff --git a/.changeset/automation-publish-rebind-flows.md b/.changeset/automation-publish-rebind-flows.md deleted file mode 100644 index 5bc331913e..0000000000 --- a/.changeset/automation-publish-rebind-flows.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -"@objectstack/service-automation": patch -"@objectstack/runtime": patch ---- - -fix(automation): bind a flow published while the server runs, without a restart - -Follow-up to #2560 (cold-boot flow binding). A flow **published while the server -is running** — the Studio online-authoring journey: author a record-triggered -automation, publish it, immediately update a matching record — did **not** fire. -Its trigger only bound on the next process restart. - -Two gaps, both fixed: - -1. **The publish path fired no rebind signal.** `POST /packages/:id/publish-drafts` - → `protocol.publishPackageDrafts` promotes the drafts to active but emitted no - event the automation service listens to. The runtime dispatcher now announces - `metadata:reloaded` after a successful publish — the same signal a dev artifact - reload fires (`MetadataPlugin._reloadAndAnnounce`) — so boot-cached consumers - re-sync without a restart. - -2. **The runtime re-sync read the wrong source.** The automation service's - `metadata:reloaded` re-sync pulled `metadata.list('flow')`, which returns 0 in a - real running server (it does not surface inline app flows), so even when the - hook fired it bound nothing. It now reads `protocol.getMetaItems({ type: 'flow' })` - — the same flattened flow view #2560's cold-boot bind and `GET /meta/flow` use — - while keeping the teardown of flows removed from the artifact. A failed or - unavailable protocol read is a no-op and never tears down live flows. - -Production is largely unaffected (a deploy reboots the process, so #2560's -cold-boot bind covers it); this closes the gap for dev and single-instance -Studio authoring. - -Verified end-to-end on a clean instance: authored a record-triggered flow in a -package, published it via `POST /packages/:id/publish-drafts` **without -restarting**, then updated a matching record and observed the flow fire (before -the fix it did not). New regression tests boot a kernel whose protocol serves a -flow only after boot and assert `metadata:reloaded` binds it — and that the -re-sync reads the protocol, not `metadata.list` — both failing on the pre-fix code. diff --git a/.changeset/automation-run-history.md b/.changeset/automation-run-history.md deleted file mode 100644 index 513edd5af4..0000000000 --- a/.changeset/automation-run-history.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -"@objectstack/service-automation": minor ---- - -feat(automation): durable run history — every terminal run leaves a queryable record with its failure reason - -Automation runs were observable **only in memory**: the engine kept the last N -`ExecutionLogEntry` records in a ring buffer, so "did this flow run, and why did -it fail?" could not be answered after a process restart (or once the buffer -evicted the entry), and a failed run surfaced no reason at all. This was the -biggest silent-trust gap for anyone authoring automations — a flow could stop -firing or start failing with nothing durable to inspect. - -`sys_automation_run` — previously the ADR-0019 store for *live suspended* runs -only — becomes a durable **run-history** table. On every terminal run the engine -mirrors a row through the `SuspendedRunStore` (`recordTerminal`): `status` -(`completed` / `failed`), `finished_at`, `duration_ms`, and, for a failure, the -`error` message a designer needs to fix it. `listRuns()` merges this durable -history with the in-memory buffer (in-memory wins on id, newest-first) so the -Studio "Runs" surface shows runs that predate the current process. - -The design is **safe and additive**. Terminal history rows use a `run_`-prefixed -id, disjoint from live suspended runs (which key on the raw `runId` with -`status: 'paused'`), so the suspend save/load/delete/list path is untouched and -resume sweeps (`list()` filters `status: 'paused'`) never see history rows. -Persisting is **best-effort and fire-and-forget** — a history-write failure is -logged and swallowed, never breaking the run that produced it. New object fields -(`finished_at`, `duration_ms`, `error`) are all optional and the `status` enum -gains `running` / `completed` / `failed` alongside the existing `paused`. - -Verified end-to-end on a clean showcase instance: a schedule-triggered flow and -seven task-completion flows each left durable `completed` rows; a genuinely -failing flow (`showcase_resilient_sync`) left a `failed` row carrying its -`try_catch` failure reason; a live `paused` suspended run coexisted without -collision; and after a full process restart the `failed` row — reason intact — -was still queryable via `/api/v1/data/sys_automation_run`. New `run-history.test.ts` -covers completed/failed persistence, read-across-restart, and best-effort isolation. diff --git a/.changeset/destructive-ops-rbac-mapping.md b/.changeset/destructive-ops-rbac-mapping.md deleted file mode 100644 index 126044f515..0000000000 --- a/.changeset/destructive-ops-rbac-mapping.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@objectstack/plugin-security": minor -"@objectstack/spec": patch ---- - -feat(security): pre-map `transfer`/`restore`/`purge` to their RBAC bits (#1883) - -The permission evaluator now maps the destructive record-lifecycle operations -to their spec permission bits (`transfer` → `allowTransfer`, `restore` → -`allowRestore`, `purge` → `allowPurge`) and extends the `modifyAllRecords` -super-user bypass to cover them. The ObjectQL operations themselves are still -roadmap M2 — but the gate now exists ahead of them: the moment such an -operation is dispatched through the security middleware it is denied unless a -resolved permission set grants the matching bit. Unmapped destructive -operations continue to fail closed (ADR-0049). Spec descriptions updated from -`[EXPERIMENTAL — not enforced]` to `[RBAC-gated; operation pending M2]`. diff --git a/.changeset/durable-package-install.md b/.changeset/durable-package-install.md deleted file mode 100644 index 45eff9ab69..0000000000 --- a/.changeset/durable-package-install.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@objectstack/metadata-protocol": patch ---- - -fix(protocol): versionless package installs now persist to sys_packages (#2532) - -`installPackage` writes both package stores, but its durable half was guarded by -`pkgSvc?.publish && manifest.version` — silently skipping every versionless -runtime-created base (`{id, name}` from the builder / Setup). Those packages -lived only in the in-memory registry and vanished on restart, while their -metadata and tables survived. The version is now defaulted (`0.1.0`) instead of -skipping, a failed persist logs loudly instead of silently, and `deletePackage` -drops the `sys_packages` record so an uninstalled package no longer resurrects -at the next boot (service-package hydrates that table into the registry). diff --git a/.changeset/meta-validation-issues-passthrough.md b/.changeset/meta-validation-issues-passthrough.md deleted file mode 100644 index 27024f1612..0000000000 --- a/.changeset/meta-validation-issues-passthrough.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -"@objectstack/metadata-protocol": patch -"@objectstack/runtime": patch ---- - -fix(runtime): carry spec-validation issues (and the 422 status) through metadata save/publish errors - -`protocol.saveMetaItem` already validates a metadata draft against its spec Zod -schema and, on failure, throws a rich error: HTTP `status: 422`, `code: -'invalid_metadata'`, and a structured `issues: [{ path, message, code }]` array -(field-anchored, `superRefine` issues included). But the HTTP dispatcher's catch -blocks collapsed all of that to a single message — the save path even hardcoded -`400` — so a client could only show a generic "failed validation" banner with no -way to point at the offending field. The publish path was worse: the per-draft -catch in `publishPackageDrafts` flattened each failure into `{ type, name, error -}` and **dropped `issues` entirely**. - -Now: -- A new `errorFromThrown(e, fallbackStatus)` dispatcher helper preserves the - error's own `status` (so validation surfaces as **422**, not a downgraded 400) - and attaches `{ code, issues }` under `error.details` when present. Errors that - carry neither behave exactly as before. Used by the metadata **save** (`PUT - /meta/:type/:name`) and **publish** (`POST /packages/:id/publish-drafts`) - catch sites. -- `publishPackageDrafts` now carries `issues` into each `failed[]` entry, so a - validation failure during publish is field-anchored too (it previously kept - only the message). - -This is the server half of "surface validation at the save/publish moment, on -the field" — the Studio can now map each issue back to its input instead of -showing a wall-of-text banner. Purely additive to the error payload; the only -behavior change is the more-correct 422 (was 400) for a failed metadata save. diff --git a/.changeset/multivalue-field-shape.md b/.changeset/multivalue-field-shape.md deleted file mode 100644 index 4939fde3d4..0000000000 --- a/.changeset/multivalue-field-shape.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@objectstack/objectql": patch ---- - -Enforce array shape for multi-value fields in the write pipeline (#2552). Lone scalars sent at a `multiselect` / `checkboxes` / `tags` field — or at a `select` / `radio` / `lookup` / `user` / `file` / `image` field flagged `multiple: true` — are now normalized into single-element arrays before validation instead of being stored verbatim (which silently corrupted the column shape), un-wrappable shapes are rejected with a new `invalid_type` validation code, and a legal array at a `select`+`multiple` field is no longer mis-rejected as `invalid_option`. diff --git a/.changeset/permission-package-provenance.md b/.changeset/permission-package-provenance.md deleted file mode 100644 index 5c40c286f8..0000000000 --- a/.changeset/permission-package-provenance.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/plugin-security": minor ---- - -feat(security): permission-set package provenance + declared-permission seeding (ADR-0086 P1) - -Packages now ship working default access for their own objects, with a -machine-checkable metadata↔config boundary: - -- **Spec (ADR-0086 D3)**: `PermissionSetSchema.packageId` (owning package for - a package-shipped set; absent = env-authored) and per-record provenance - `managedBy: 'package' | 'platform' | 'user'` on the existing - metadata-persistence axis. Persisted on `sys_permission_set` as - `package_id` / `managed_by` (new columns + `package_id` index). -- **Seeding (ADR-0086 D5)**: new `bootstrapDeclaredPermissions` — the sibling - of `bootstrapDeclaredRoles` — materializes `stack.permissions` into - `sys_permission_set` at boot with `managed_by:'package'` + `package_id`. - Idempotent and upgrade-aware: rows the seeder owns are re-seeded to the - shipped declaration on every boot; rows owned by a different package are - refused loudly; env-authored `platform`/`user`/legacy rows are never - clobbered. Closes the ADR-0078 inert-metadata violation for - `stack.permissions` (declared sets were runtime-enforced but never - materialized — invisible to the admin surface, uninstall undefined). -- Conformance matrix row `declarative-permission-seeding` (ADR-0056 D10) + - dogfood proof pin the behavior so it cannot regress to inert. diff --git a/.changeset/permset-resolve-observability.md b/.changeset/permset-resolve-observability.md deleted file mode 100644 index e6acf4d40a..0000000000 --- a/.changeset/permset-resolve-observability.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@objectstack/plugin-security": patch ---- - -fix(security): surface swallowed permission-set resolution failures (#2565) - -`PermissionEvaluator.resolvePermissionSets` swallowed metadata `list()` and -`sys_permission_set` dbLoader failures silently — fail-closed (unresolvable -sets grant nothing), but a transient DB error made custom permission sets -vanish with no trace, leaving the resulting 403s undiagnosable. The evaluator -now accepts an optional `{ logger }` and emits one `warn` per failed source, -naming the unresolved permission sets and the error. SecurityPlugin wires its -plugin logger into both call sites. Resolution behavior is byte-identical. diff --git a/.changeset/related-list-primary-derived-columns.md b/.changeset/related-list-primary-derived-columns.md deleted file mode 100644 index 1efdc940fd..0000000000 --- a/.changeset/related-list-primary-derived-columns.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -"@objectstack/spec": minor ---- - -Detail-page related lists: `relatedList: 'primary'` prominence + optional related-list columns (#2579). - -`Field.relatedList` on a child's `lookup`/`master_detail` FK becomes a tri-state -`boolean | 'primary'`. `'primary'` marks a CORE relationship — a prominence hint -(ADR-0085), not a layout switch — that the detail page promotes to its own tab, -while non-primary children collapse into a single shared "Related" tab. -`false`/`true` keep their meaning (suppress / show in the derived default), so -the change is additive and opt-in per relationship (no primary anywhere → the -detail page is byte-for-byte the legacy stacked default). - -`RecordRelatedListProps.columns` becomes optional: when omitted the related list -derives its columns from the child object's `highlightFields` / default list -columns — a related list is just another surface that lists that object. -Required → optional is back-compat. - -Renderer + derivation changes ship in objectui: `relatedList: 'primary'` → own -tab; one related list per eligible FK (a child that references the parent -through several relationships now surfaces each, previously only the first); -self-referential relationships (hierarchies) surface a "child" list; and the -lookup-picker default columns are unified onto the same `highlightFields` -source so a picker and a related list of the same object agree with zero -per-surface config. diff --git a/.changeset/require-auth-secure-by-default.md b/.changeset/require-auth-secure-by-default.md deleted file mode 100644 index f5fa8f57a1..0000000000 --- a/.changeset/require-auth-secure-by-default.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -"@objectstack/spec": major -"@objectstack/rest": major -"@objectstack/verify": patch -"@objectstack/cli": patch ---- - -feat(security)!: `api.requireAuth` now defaults to `true` — anonymous access to the data API is denied by default (ADR-0056 D2 flip) - -**BREAKING.** The global `requireAuth` default flipped FROM `false` TO `true` -(`RestApiConfigSchema.requireAuth` in `@objectstack/spec`, mirrored by -`RestServer.normalizeConfig` in `@objectstack/rest`). Anonymous requests to -the `/data/*` CRUD + batch endpoints are now rejected with HTTP 401 unless the -deployment explicitly opts out. (Scope note: this gate covers the REST -`/data/*` surface — the metadata read/write endpoints and the dispatcher -GraphQL route have their own pre-existing anonymous posture, tracked -separately; this flip does not change them.) - -**Migration (one line):** a deployment that intentionally serves data publicly -(demo / playground / kiosk) sets the flag on the stack config — now a declared -`ObjectStackDefinitionSchema.api` field, so it survives `defineStack` strict -parsing (previously an undeclared top-level `api` key was silently stripped): - -```ts -export default defineStack({ - // … - api: { requireAuth: false }, -}); -``` - -The REST plugin logs a boot warning for the explicit opt-out so a fail-open -posture is always visible. A misplaced `api.requireAuth` at the plugin level -(one nesting short) is now also called out with a boot warning instead of -being silently ignored. - -**What keeps working with no action:** - -- **Share links** — validate their token, then read under a system context. -- **Public forms** — self-authorizing via the declaration-derived - `publicFormGrant` (create + read-back on the declared target object only); - no `guest_portal` profile needed. -- **Control plane** — `/auth`, `/health`, `/discovery` are exempt. -- **`objectstack serve` with an auth-less stack** — the CLI passes an explicit - `requireAuth: false` for stacks whose tier set has no `auth` (nothing could - authenticate against them), with the boot warning. diff --git a/.changeset/validation-error-human-message.md b/.changeset/validation-error-human-message.md deleted file mode 100644 index c6eb600993..0000000000 --- a/.changeset/validation-error-human-message.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -"@objectstack/objectql": patch ---- - -fix(objectql): surface the human validation message in `ValidationError.message`, not a `field (code)` digest - -When an object-level validation rule (ADR-0020 `validations[]`) rejected a -save, the console toast showed the generic English string -`Validation failed for 1 field(s): _record (rule_violation)` instead of the -rule author's own `message` (often localized, e.g. 最小水深不能大于最大水深。). - -The author's message was always transported in `ValidationError.fields[].message` -through the whole chain (rule-validator → REST envelope `fields[]` → client SDK -`error.details`), but every generic UI surface displays the top-level -`Error.message`, which only contained the `field (code)` pairs. - -Fix at the single choke point — the `ValidationError` constructor now builds its -top-level message from the per-field human messages (joined with `; `), falling -back to `field (code)` only when a field error has no message. Machine-readable -`code` and `fields[]` are unchanged, so programmatic consumers and the REST -envelope shape are unaffected; every client (console toast, CLI, SDK callers) -now sees the author-written message with no client-side change needed. diff --git a/.changeset/view-expand-collision-warning.md b/.changeset/view-expand-collision-warning.md deleted file mode 100644 index 6e0f7a3c11..0000000000 --- a/.changeset/view-expand-collision-warning.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@objectstack/spec": patch -"@objectstack/objectql": patch -"@objectstack/metadata": patch ---- - -Surface view-key collisions during view container expansion instead of renaming silently. - -`expandViewContainer` keeps its backward-compatible rename behaviour (`.` → -`._2` on collision) but now stamps a machine-readable -`_diagnostics.warnings` entry on the renamed `ExpandedViewItem`, explaining that -references targeting the requested name (form action targets, navigation `viewName`s) -will resolve to the *other* view. Both flattening loaders — the ObjectQL engine and the -MetadataPlugin — log these warnings at boot so the collision is visible instead of -manifesting as a form action opening a list view (#2554). diff --git a/.changeset/view-overlay-identity-inheritance.md b/.changeset/view-overlay-identity-inheritance.md deleted file mode 100644 index 335800f46c..0000000000 --- a/.changeset/view-overlay-identity-inheritance.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@objectstack/metadata-protocol": patch ---- - -Stop runtime view personalization from permanently removing views from the switcher. - -A console personalization PUT (grid column sort, inline edit, …) sends only the raw -view config — no top-level `viewKind`/`object`. Persisted verbatim, the overlay row -replaced the flattened package entry wholesale on read, stripping the identity fields -every switcher-style consumer filters on (`viewKind && object`) — one sort click and -the view vanished until the DB row was deleted (#2555). - -Two independent guards: `saveMetaItem` now inherits the missing `viewKind`/`object`/ -`label` from the registry entry the overlay shadows before persisting, and -`getMetaItems` heals identity-less rows already in the DB the same way on read. The -overlay's own fields always win; `defineView` container bodies are untouched. diff --git a/.changeset/view-ref-build-lint.md b/.changeset/view-ref-build-lint.md deleted file mode 100644 index dccd387972..0000000000 --- a/.changeset/view-ref-build-lint.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/cli": minor ---- - -Add a build-time view-reference lint that fails `os compile` on a broken form-view reference, and surfaces the previously-silent `_2` rename collision as a warning (#2554). - -`expandViewContainer` gains a behaviour-preserving companion `expandViewContainerWithDiagnostics` that also reports every `.` name collision. List and form views share one namespace during expansion, and the default `list` implicitly claims `.default`; a colliding key was previously renamed to `._2` **silently**, so references (form action `target`s, navigation `viewName`s) resolved to the *other* view. - -The new `lint-view-refs` build lint consumes those diagnostics with a broken/fragile severity split, tuned so an upgrade does NOT break existing apps that merely have a colliding key: - -- **view-ref-form-target-kind** — ERROR (fails the build): a `type:'form'` action whose `target` resolves to an existing LIST view — the concrete #2554 breakage (a blank form, a silently no-op submit). High-confidence, so it fails. -- **view-key-collision** — WARNING: a key silently renamed on collision. Fragile, not broken — it breaks something only if the requested name is referenced — so it warns. -- **view-ref-form-target-missing** — WARNING: a form target resolving to no view; probably a typo, but possibly a view the lint failed to collect, so it warns rather than risk a false-positive build failure. - -This shifts objectui's runtime `viewKind` guard left to compile time: the author — very often an AI generating templates — discovers the mistake on `os compile` instead of when an end user clicks. It mirrors the existing broken/fragile two-level authoring lints (flow-patterns, autonumber, liveness). `expandViewContainer`'s runtime behaviour is unchanged; the fix is diagnostics-only plus the build gate. diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md index 3eba9cf52c..b3d11cdb07 100644 --- a/examples/app-crm/CHANGELOG.md +++ b/examples/app-crm/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/example-crm +## 4.0.70 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [9693a36] +- Updated dependencies [7c09621] +- Updated dependencies [e3498fb] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/runtime@12.0.0 + ## 4.0.69 ### Patch Changes diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json index ffe79c284a..6b560727e6 100644 --- a/examples/app-crm/package.json +++ b/examples/app-crm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-crm", - "version": "4.0.69", + "version": "4.0.70", "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md index 6749c6beb7..1c4e349276 100644 --- a/examples/app-showcase/CHANGELOG.md +++ b/examples/app-showcase/CHANGELOG.md @@ -1,5 +1,25 @@ # @objectstack/example-showcase +## 0.2.16 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [9693a36] +- Updated dependencies [7c09621] +- Updated dependencies [e3498fb] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/runtime@12.0.0 + - @objectstack/cloud-connection@12.0.0 + - @objectstack/connector-rest@12.0.0 + - @objectstack/connector-slack@12.0.0 + - @objectstack/driver-sql@12.0.0 + ## 0.2.15 ### Patch Changes diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json index 0509245e32..8c0b0e1c1a 100644 --- a/examples/app-showcase/package.json +++ b/examples/app-showcase/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-showcase", - "version": "0.2.15", + "version": "0.2.16", "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, AI). Built for demonstration, debugging, and coverage-driven verification.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md index 486a752baa..265b4460e8 100644 --- a/examples/app-todo/CHANGELOG.md +++ b/examples/app-todo/CHANGELOG.md @@ -1,5 +1,30 @@ # @objectstack/example-todo +## 4.0.70 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [9693a36] +- Updated dependencies [7c09621] +- Updated dependencies [e3498fb] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/runtime@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/metadata@12.0.0 + - @objectstack/client@12.0.0 + - @objectstack/mcp@12.0.0 + - @objectstack/driver-sqlite-wasm@12.0.0 + - @objectstack/knowledge-memory@12.0.0 + - @objectstack/service-knowledge@12.0.0 + ## 4.0.69 ### Patch Changes diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json index 7571d34e6f..280cec64cd 100644 --- a/examples/app-todo/package.json +++ b/examples/app-todo/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-todo", - "version": "4.0.69", + "version": "4.0.70", "description": "Example Todo App using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/examples/embed-objectql/CHANGELOG.md b/examples/embed-objectql/CHANGELOG.md index bbd3d802b6..08c4db6ffd 100644 --- a/examples/embed-objectql/CHANGELOG.md +++ b/examples/embed-objectql/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/example-embed-objectql +## 0.0.10 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/driver-memory@12.0.0 + ## 0.0.9 ### Patch Changes diff --git a/examples/embed-objectql/package.json b/examples/embed-objectql/package.json index 349cd09ed6..397d938f0f 100644 --- a/examples/embed-objectql/package.json +++ b/examples/embed-objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-embed-objectql", - "version": "0.0.9", + "version": "0.0.10", "private": true, "description": "Embed the ObjectQL engine as a plain library via @objectstack/objectql/core — no kernel, no plugins, no metadata protocol (ADR-0076).", "type": "module", diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md index 88c4baccc8..57549a4e5e 100644 --- a/packages/adapters/hono/CHANGELOG.md +++ b/packages/adapters/hono/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/hono +## 12.0.0 + +### Patch Changes + +- Updated dependencies [9693a36] +- Updated dependencies [e3498fb] + - @objectstack/runtime@12.0.0 + - @objectstack/plugin-hono-server@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json index 70fb3b4643..0e9923432b 100644 --- a/packages/adapters/hono/package.json +++ b/packages/adapters/hono/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/hono", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md index 42bdb70b7b..09db4f93ec 100644 --- a/packages/apps/account/CHANGELOG.md +++ b/packages/apps/account/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/account +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json index 930d2695a6..881877b679 100644 --- a/packages/apps/account/package.json +++ b/packages/apps/account/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/account", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md index 940385da10..849c007728 100644 --- a/packages/apps/setup/CHANGELOG.md +++ b/packages/apps/setup/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/setup +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json index 24617897be..4f72db9282 100644 --- a/packages/apps/setup/package.json +++ b/packages/apps/setup/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/setup", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md index 4bb939d009..aad8bff6db 100644 --- a/packages/apps/studio/CHANGELOG.md +++ b/packages/apps/studio/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/studio +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json index 555bbb858e..ffcd8b7265 100644 --- a/packages/apps/studio/package.json +++ b/packages/apps/studio/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/studio", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 18b41fccd3..c56f6602c6 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,148 @@ # @objectstack/cli +## 12.0.0 + +### Minor Changes + +- e695fe0: feat(spec,lint): reject userFilters on object list views (ADR-0053 phase 4) + + ADR-0053 reserves `userFilters`/`quickFilters` for page lists ("filters" mode); + on an object list view ("views" mode — where the `ViewTabBar` is the only nav + control) they are silently dropped. This lands the phase-4 guardrail as a + layered defence, so the wrong-context authoring mistake is caught without + breaking existing metadata: + + - **Type-level (author time):** new `ObjectListViewSchema` = `ListViewSchema` + minus `userFilters`. Object built-in `listViews` and `defineView` + `list`/`listViews` now use it, so `userFilters` on an object list view is a + `tsc` error. The full `ListViewSchema` (page "filters" mode) is untouched. + - **Runtime (back-compat):** the field is STRIPPED at parse (default strip, no + throw), so existing metadata keeps loading — `ObjectSchema.parse` never fails + on a stray `userFilters`. + - **Author/CI (actionable):** new `@objectstack/lint` rule + `validateListViewMode`, wired into `os validate`, reports the wrong-context + field PRE-parse (before the schema strips it) with a fix hint. + + Closes the schema half of objectui #2219; supersedes the interim runtime warn in + objectui #2220. + +- 069c205: Add a build-time view-reference lint that fails `os compile` on a broken form-view reference, and surfaces the previously-silent `_2` rename collision as a warning (#2554). + + `expandViewContainer` gains a behaviour-preserving companion `expandViewContainerWithDiagnostics` that also reports every `.` name collision. List and form views share one namespace during expansion, and the default `list` implicitly claims `.default`; a colliding key was previously renamed to `._2` **silently**, so references (form action `target`s, navigation `viewName`s) resolved to the _other_ view. + + The new `lint-view-refs` build lint consumes those diagnostics with a broken/fragile severity split, tuned so an upgrade does NOT break existing apps that merely have a colliding key: + + - **view-ref-form-target-kind** — ERROR (fails the build): a `type:'form'` action whose `target` resolves to an existing LIST view — the concrete #2554 breakage (a blank form, a silently no-op submit). High-confidence, so it fails. + - **view-key-collision** — WARNING: a key silently renamed on collision. Fragile, not broken — it breaks something only if the requested name is referenced — so it warns. + - **view-ref-form-target-missing** — WARNING: a form target resolving to no view; probably a typo, but possibly a view the lint failed to collect, so it warns rather than risk a false-positive build failure. + + This shifts objectui's runtime `viewKind` guard left to compile time: the author — very often an AI generating templates — discovers the mistake on `os compile` instead of when an end user clicks. It mirrors the existing broken/fragile two-level authoring lints (flow-patterns, autonumber, liveness). `expandViewContainer`'s runtime behaviour is unchanged; the fix is diagnostics-only plus the build gate. + +### Patch Changes + +- 7c09621: feat(security)!: `api.requireAuth` now defaults to `true` — anonymous access to the data API is denied by default (ADR-0056 D2 flip) + + **BREAKING.** The global `requireAuth` default flipped FROM `false` TO `true` + (`RestApiConfigSchema.requireAuth` in `@objectstack/spec`, mirrored by + `RestServer.normalizeConfig` in `@objectstack/rest`). Anonymous requests to + the `/data/*` CRUD + batch endpoints are now rejected with HTTP 401 unless the + deployment explicitly opts out. (Scope note: this gate covers the REST + `/data/*` surface — the metadata read/write endpoints and the dispatcher + GraphQL route have their own pre-existing anonymous posture, tracked + separately; this flip does not change them.) + + **Migration (one line):** a deployment that intentionally serves data publicly + (demo / playground / kiosk) sets the flag on the stack config — now a declared + `ObjectStackDefinitionSchema.api` field, so it survives `defineStack` strict + parsing (previously an undeclared top-level `api` key was silently stripped): + + ```ts + export default defineStack({ + // … + api: { requireAuth: false }, + }); + ``` + + The REST plugin logs a boot warning for the explicit opt-out so a fail-open + posture is always visible. A misplaced `api.requireAuth` at the plugin level + (one nesting short) is now also called out with a boot warning instead of + being silently ignored. + + **What keeps working with no action:** + + - **Share links** — validate their token, then read under a system context. + - **Public forms** — self-authorizing via the declaration-derived + `publicFormGrant` (create + read-back on the declared target object only); + no `guest_portal` profile needed. + - **Control plane** — `/auth`, `/health`, `/discovery` are exempt. + - **`objectstack serve` with an auth-less stack** — the CLI passes an explicit + `requireAuth: false` for stacks whose tier set has no `auth` (nothing could + authenticate against them), with the boot warning. + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [1b1b34e] +- Updated dependencies [9796e7c] +- Updated dependencies [f84f8d5] +- Updated dependencies [9693a36] +- Updated dependencies [ffafb30] +- Updated dependencies [7c09621] +- Updated dependencies [e3498fb] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [48ad533] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/lint@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/plugin-auth@12.0.0 + - @objectstack/plugin-security@12.0.0 + - @objectstack/service-automation@12.0.0 + - @objectstack/runtime@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/rest@12.0.0 + - @objectstack/verify@12.0.0 + - @objectstack/account@12.0.0 + - @objectstack/setup@12.0.0 + - @objectstack/studio@12.0.0 + - @objectstack/client@12.0.0 + - @objectstack/cloud-connection@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + - @objectstack/mcp@12.0.0 + - @objectstack/observability@12.0.0 + - @objectstack/driver-memory@12.0.0 + - @objectstack/driver-mongodb@12.0.0 + - @objectstack/driver-sql@12.0.0 + - @objectstack/driver-sqlite-wasm@12.0.0 + - @objectstack/plugin-approvals@12.0.0 + - @objectstack/plugin-audit@12.0.0 + - @objectstack/plugin-email@12.0.0 + - @objectstack/plugin-hono-server@12.0.0 + - @objectstack/plugin-org-scoping@12.0.0 + - @objectstack/plugin-reports@12.0.0 + - @objectstack/plugin-sharing@12.0.0 + - @objectstack/plugin-webhooks@12.0.0 + - @objectstack/service-analytics@12.0.0 + - @objectstack/service-cache@12.0.0 + - @objectstack/service-datasource@12.0.0 + - @objectstack/service-job@12.0.0 + - @objectstack/service-messaging@12.0.0 + - @objectstack/service-package@12.0.0 + - @objectstack/service-queue@12.0.0 + - @objectstack/service-realtime@12.0.0 + - @objectstack/service-settings@12.0.0 + - @objectstack/service-storage@12.0.0 + - @objectstack/trigger-api@12.0.0 + - @objectstack/trigger-record-change@12.0.0 + - @objectstack/trigger-schedule@12.0.0 + - @objectstack/types@12.0.0 + - @objectstack/console@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 6f5eb44f56..097c040169 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cli", - "version": "11.10.0", + "version": "12.0.0", "description": "Command Line Interface for ObjectStack Protocol", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md index 26b07b86b7..6caaef3989 100644 --- a/packages/client-react/CHANGELOG.md +++ b/packages/client-react/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/client-react +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/client@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/client-react/package.json b/packages/client-react/package.json index 92eedb7612..45990938e6 100644 --- a/packages/client-react/package.json +++ b/packages/client-react/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client-react", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "React hooks for ObjectStack Client SDK", "main": "dist/index.js", diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index b9eebefd4d..dba0229d92 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/client +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/client/package.json b/packages/client/package.json index 35ca80f1c2..c743efc88a 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Official Client SDK for ObjectStack Protocol", "main": "dist/index.js", diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md index 5aec591d4c..81ab892e00 100644 --- a/packages/cloud-connection/CHANGELOG.md +++ b/packages/cloud-connection/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/cloud-connection +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [9693a36] +- Updated dependencies [7c09621] +- Updated dependencies [e3498fb] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/runtime@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json index 0d2441386c..253eff4837 100644 --- a/packages/cloud-connection/package.json +++ b/packages/cloud-connection/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cloud-connection", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.", "type": "module", diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md index 56ffbfe6c9..0f432225af 100644 --- a/packages/connectors/connector-mcp/CHANGELOG.md +++ b/packages/connectors/connector-mcp/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/connector-mcp +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json index 3fc3c4a541..ea55a283ef 100644 --- a/packages/connectors/connector-mcp/package.json +++ b/packages/connectors/connector-mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-mcp", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).", "main": "dist/index.js", diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md index 92bf27e8ae..3536f86822 100644 --- a/packages/connectors/connector-openapi/CHANGELOG.md +++ b/packages/connectors/connector-openapi/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/connector-openapi +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json index 44825d4638..5bb441f375 100644 --- a/packages/connectors/connector-openapi/package.json +++ b/packages/connectors/connector-openapi/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-openapi", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).", "main": "dist/index.js", diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md index ddc86eb3db..8ebdde9c47 100644 --- a/packages/connectors/connector-rest/CHANGELOG.md +++ b/packages/connectors/connector-rest/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/connector-rest +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json index f6ca331bfb..0a859e6823 100644 --- a/packages/connectors/connector-rest/package.json +++ b/packages/connectors/connector-rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-rest", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).", "main": "dist/index.js", diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md index bbc7edc9dd..8ced39b30a 100644 --- a/packages/connectors/connector-slack/CHANGELOG.md +++ b/packages/connectors/connector-slack/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/connector-slack +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json index de168eaa70..e644e1dc28 100644 --- a/packages/connectors/connector-slack/package.json +++ b/packages/connectors/connector-slack/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-slack", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).", "main": "dist/index.js", diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md index df105b8f89..f3112f90b1 100644 --- a/packages/console/CHANGELOG.md +++ b/packages/console/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/console +## 12.0.0 + ## 11.10.0 ### Minor Changes diff --git a/packages/console/package.json b/packages/console/package.json index ca2e98ae93..002351f9eb 100644 --- a/packages/console/package.json +++ b/packages/console/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/console", - "version": "11.10.0", + "version": "12.0.0", "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).", "license": "Apache-2.0", "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index f2e3334ce3..b4851e2756 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/core +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index 18852b2351..479785a509 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/core", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Microkernel Core for ObjectStack", "type": "module", diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md index 1c1c647471..f53f484759 100644 --- a/packages/create-objectstack/CHANGELOG.md +++ b/packages/create-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # create-objectstack +## 12.0.0 + ## 11.10.0 ## 11.9.0 diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index 988df84598..0537e4c486 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -1,6 +1,6 @@ { "name": "create-objectstack", - "version": "11.10.0", + "version": "12.0.0", "description": "Create a new ObjectStack project — npx create-objectstack", "bin": { "create-objectstack": "./bin/create-objectstack.js" diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md index 35130af7c0..2528a9029c 100644 --- a/packages/dogfood/CHANGELOG.md +++ b/packages/dogfood/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/dogfood +## 0.0.18 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [9796e7c] +- Updated dependencies [7c09621] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [48ad533] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/plugin-security@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/verify@12.0.0 + - @objectstack/example-crm@4.0.70 + - @objectstack/example-showcase@0.2.16 + ## 0.0.17 ### Patch Changes diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json index 2e7bd3306c..2ac0a89c45 100644 --- a/packages/dogfood/package.json +++ b/packages/dogfood/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/dogfood", - "version": "0.0.17", + "version": "0.0.18", "private": true, "license": "Apache-2.0", "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.", diff --git a/packages/downstream-contract/CHANGELOG.md b/packages/downstream-contract/CHANGELOG.md index 5e27fe927b..d3b67d7785 100644 --- a/packages/downstream-contract/CHANGELOG.md +++ b/packages/downstream-contract/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/downstream-contract +## 0.0.16 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + ## 0.0.15 ### Patch Changes diff --git a/packages/downstream-contract/package.json b/packages/downstream-contract/package.json index 831782fd9c..d667466551 100644 --- a/packages/downstream-contract/package.json +++ b/packages/downstream-contract/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/downstream-contract", - "version": "0.0.15", + "version": "0.0.16", "description": "Frozen third-party consumer fixture — a backward-compatibility gate for @objectstack/spec. Authored the way an external project on a published release authors metadata; if a spec change breaks it, that change is breaking (#2035).", "license": "Apache-2.0", "private": true, diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md index cf5cb3eb25..8f63a6f6cd 100644 --- a/packages/formula/CHANGELOG.md +++ b/packages/formula/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/formula +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/formula/package.json b/packages/formula/package.json index 2602bcebaa..31c4dddead 100644 --- a/packages/formula/package.json +++ b/packages/formula/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/formula", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry", "main": "dist/index.js", diff --git a/packages/lint/CHANGELOG.md b/packages/lint/CHANGELOG.md index 7440fb9025..84b66c7d90 100644 --- a/packages/lint/CHANGELOG.md +++ b/packages/lint/CHANGELOG.md @@ -1,5 +1,44 @@ # @objectstack/lint +## 12.0.0 + +### Minor Changes + +- e695fe0: feat(spec,lint): reject userFilters on object list views (ADR-0053 phase 4) + + ADR-0053 reserves `userFilters`/`quickFilters` for page lists ("filters" mode); + on an object list view ("views" mode — where the `ViewTabBar` is the only nav + control) they are silently dropped. This lands the phase-4 guardrail as a + layered defence, so the wrong-context authoring mistake is caught without + breaking existing metadata: + + - **Type-level (author time):** new `ObjectListViewSchema` = `ListViewSchema` + minus `userFilters`. Object built-in `listViews` and `defineView` + `list`/`listViews` now use it, so `userFilters` on an object list view is a + `tsc` error. The full `ListViewSchema` (page "filters" mode) is untouched. + - **Runtime (back-compat):** the field is STRIPPED at parse (default strip, no + throw), so existing metadata keeps loading — `ObjectSchema.parse` never fails + on a stray `userFilters`. + - **Author/CI (actionable):** new `@objectstack/lint` rule + `validateListViewMode`, wired into `os validate`, reports the wrong-context + field PRE-parse (before the schema strips it) with a fix hint. + + Closes the schema half of objectui #2219; supersedes the interim runtime warn in + objectui #2220. + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/formula@12.0.0 + - @objectstack/sdui-parser@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/lint/package.json b/packages/lint/package.json index e322905a8c..c104b117a2 100644 --- a/packages/lint/package.json +++ b/packages/lint/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/lint", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Static, build-time validation for an ObjectStack metadata graph — dashboard widget bindings, CEL/predicate expressions, and more. Pure (stack) => Issue[] functions shared by the CLI's `os validate` and any other consumer (e.g. AI authoring). Depends on @objectstack/spec; never on a runtime.", "type": "module", diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md index 506df24af6..6559ff5749 100644 --- a/packages/mcp/CHANGELOG.md +++ b/packages/mcp/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/plugin-mcp-server +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 3543611fe7..ee85dcc30e 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/mcp", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)", "type": "module", diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md index eaa8ec31db..ece3d1691b 100644 --- a/packages/metadata-core/CHANGELOG.md +++ b/packages/metadata-core/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/metadata-core +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json index 1f2656adb1..68a34ae168 100644 --- a/packages/metadata-core/package.json +++ b/packages/metadata-core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-core", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).", "type": "module", diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md index 8ede19234b..126cc8b376 100644 --- a/packages/metadata-fs/CHANGELOG.md +++ b/packages/metadata-fs/CHANGELOG.md @@ -1,5 +1,11 @@ # @objectstack/metadata-fs +## 12.0.0 + +### Patch Changes + +- @objectstack/metadata-core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json index b10039fc3c..3f2f45a0eb 100644 --- a/packages/metadata-fs/package.json +++ b/packages/metadata-fs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-fs", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).", "type": "module", diff --git a/packages/metadata-protocol/CHANGELOG.md b/packages/metadata-protocol/CHANGELOG.md index 6990b74033..d2125e0f4c 100644 --- a/packages/metadata-protocol/CHANGELOG.md +++ b/packages/metadata-protocol/CHANGELOG.md @@ -1,5 +1,109 @@ # @objectstack/metadata-protocol +## 12.0.0 + +### Minor Changes + +- 9796e7c: feat(security): two-doors separation for permission sets (ADR-0086 P2) + + Splits who may change a permission set into two non-overlapping doors, enforced + at the data layer instead of by convention: + + **块 1 — the package door (publish-time materialization).** + `ObjectStackProtocolImplementation` gains a generic publish-time materializer + registry (`registerPublishMaterializer(type, fn)`). When a draft of a registered + type is published, its body is projected into a data-plane row and the result is + surfaced on the publish response as `materializeApplied` (best-effort, never + thrown — same contract as `seedApplied`). `promoteDraft` now returns the draft's + `packageId` so the materializer can stamp the owning package. `plugin-security` + registers a `permission` materializer that upserts the published set into + `sys_permission_set` with `managed_by:'package'` + `package_id` — so a set + authored through the studio package door (saved as a `permission` draft, then + published) lands in the admin surface with the exact provenance the boot seeder + already stamps, now on the runtime publish path too. The single-set upsert is + shared with `bootstrapDeclaredPermissions` (`upsertPackagePermissionSet`), so + both paths apply the same own-row / foreign-package / env-authored rules. + + **块 2 — the admin door (data-layer write gate).** + The security middleware now refuses any admin-door write + (`update`/`delete`/`transfer`/`restore`/`purge`) to a `sys_permission_set` row + with `managed_by:'package'`, and refuses an `insert` that forges + `managed_by:'package'`. The gate fails closed regardless of the caller's grants + (a platform admin with `modifyAllRecords` is blocked just the same), so it is a + real data-layer boundary rather than a UI hint. System/boot writes carry + `isSystem` and bypass the whole middleware, so the boot seeder and the publish + materializer are unaffected. Env-authored sets (`managed_by` `user`/`platform` + or absent) stay freely editable through the admin door — the two doors never + overwrite each other. + +### Patch Changes + +- b5be479: fix(protocol): versionless package installs now persist to sys_packages (#2532) + + `installPackage` writes both package stores, but its durable half was guarded by + `pkgSvc?.publish && manifest.version` — silently skipping every versionless + runtime-created base (`{id, name}` from the builder / Setup). Those packages + lived only in the in-memory registry and vanished on restart, while their + metadata and tables survived. The version is now defaulted (`0.1.0`) instead of + skipping, a failed persist logs loudly instead of silently, and `deletePackage` + drops the `sys_packages` record so an uninstalled package no longer resurrects + at the next boot (service-package hydrates that table into the registry). + +- e3498fb: fix(runtime): carry spec-validation issues (and the 422 status) through metadata save/publish errors + + `protocol.saveMetaItem` already validates a metadata draft against its spec Zod + schema and, on failure, throws a rich error: HTTP `status: 422`, `code: +'invalid_metadata'`, and a structured `issues: [{ path, message, code }]` array + (field-anchored, `superRefine` issues included). But the HTTP dispatcher's catch + blocks collapsed all of that to a single message — the save path even hardcoded + `400` — so a client could only show a generic "failed validation" banner with no + way to point at the offending field. The publish path was worse: the per-draft + catch in `publishPackageDrafts` flattened each failure into `{ type, name, error +}` and **dropped `issues` entirely**. + + Now: + + - A new `errorFromThrown(e, fallbackStatus)` dispatcher helper preserves the + error's own `status` (so validation surfaces as **422**, not a downgraded 400) + and attaches `{ code, issues }` under `error.details` when present. Errors that + carry neither behave exactly as before. Used by the metadata **save** (`PUT +/meta/:type/:name`) and **publish** (`POST /packages/:id/publish-drafts`) + catch sites. + - `publishPackageDrafts` now carries `issues` into each `failed[]` entry, so a + validation failure during publish is field-anchored too (it previously kept + only the message). + + This is the server half of "surface validation at the save/publish moment, on + the field" — the Studio can now map each issue back to its input instead of + showing a wall-of-text banner. Purely additive to the error payload; the only + behavior change is the more-correct 422 (was 400) for a failed metadata save. + +- 806a40a: Stop runtime view personalization from permanently removing views from the switcher. + + A console personalization PUT (grid column sort, inline edit, …) sends only the raw + view config — no top-level `viewKind`/`object`. Persisted verbatim, the overlay row + replaced the flattened package entry wholesale on read, stripping the identity fields + every switcher-style consumer filters on (`viewKind && object`) — one sort click and + the view vanished until the DB row was deleted (#2555). + + Two independent guards: `saveMetaItem` now inherits the missing `viewKind`/`object`/ + `label` from the registry entry the overlay shadows before persisting, and + `getMetaItems` heals identity-less rows already in the DB the same way on read. The + overlay's own fields always win; `defineView` container bodies are untouched. + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + - @objectstack/metadata-core@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/metadata-protocol/package.json b/packages/metadata-protocol/package.json index 3c2ef9a1f0..a36d582924 100644 --- a/packages/metadata-protocol/package.json +++ b/packages/metadata-protocol/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-protocol", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack metadata management protocol: sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics (ADR-0076).", "type": "module", diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md index 1c3a74df7f..fadae6d74b 100644 --- a/packages/metadata/CHANGELOG.md +++ b/packages/metadata/CHANGELOG.md @@ -1,5 +1,34 @@ # @objectstack/metadata +## 12.0.0 + +### Patch Changes + +- 9860de4: Surface view-key collisions during view container expansion instead of renaming silently. + + `expandViewContainer` keeps its backward-compatible rename behaviour (`.` → + `._2` on collision) but now stamps a machine-readable + `_diagnostics.warnings` entry on the renamed `ExpandedViewItem`, explaining that + references targeting the requested name (form action targets, navigation `viewName`s) + will resolve to the _other_ view. Both flattening loaders — the ObjectQL engine and the + MetadataPlugin — log these warnings at boot so the collision is visible instead of + manifesting as a form action opening a list view (#2554). + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/metadata-core@12.0.0 + - @objectstack/types@12.0.0 + - @objectstack/metadata-fs@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/metadata/package.json b/packages/metadata/package.json index 2a96f6ebe3..534623ee32 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Metadata loading, saving, and persistence for ObjectStack", "type": "module", diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md index a3dbce2285..29270879f0 100644 --- a/packages/objectql/CHANGELOG.md +++ b/packages/objectql/CHANGELOG.md @@ -1,5 +1,57 @@ # @objectstack/objectql +## 12.0.0 + +### Patch Changes + +- 24b62ee: Enforce array shape for multi-value fields in the write pipeline (#2552). Lone scalars sent at a `multiselect` / `checkboxes` / `tags` field — or at a `select` / `radio` / `lookup` / `user` / `file` / `image` field flagged `multiple: true` — are now normalized into single-element arrays before validation instead of being stored verbatim (which silently corrupted the column shape), un-wrappable shapes are rejected with a new `invalid_type` validation code, and a legal array at a `select`+`multiple` field is no longer mis-rejected as `invalid_option`. +- c2fdbf9: fix(objectql): surface the human validation message in `ValidationError.message`, not a `field (code)` digest + + When an object-level validation rule (ADR-0020 `validations[]`) rejected a + save, the console toast showed the generic English string + `Validation failed for 1 field(s): _record (rule_violation)` instead of the + rule author's own `message` (often localized, e.g. 最小水深不能大于最大水深。). + + The author's message was always transported in `ValidationError.fields[].message` + through the whole chain (rule-validator → REST envelope `fields[]` → client SDK + `error.details`), but every generic UI surface displays the top-level + `Error.message`, which only contained the `field (code)` pairs. + + Fix at the single choke point — the `ValidationError` constructor now builds its + top-level message from the per-field human messages (joined with `; `), falling + back to `field (code)` only when a field error has no message. Machine-readable + `code` and `fields[]` are unchanged, so programmatic consumers and the REST + envelope shape are unaffected; every client (console toast, CLI, SDK callers) + now sees the author-written message with no client-side change needed. + +- 9860de4: Surface view-key collisions during view container expansion instead of renaming silently. + + `expandViewContainer` keeps its backward-compatible rename behaviour (`.` → + `._2` on collision) but now stamps a machine-readable + `_diagnostics.warnings` entry on the renamed `ExpandedViewItem`, explaining that + references targeting the requested name (form action targets, navigation `viewName`s) + will resolve to the _other_ view. Both flattening loaders — the ObjectQL engine and the + MetadataPlugin — log these warnings at boot so the collision is visible instead of + manifesting as a form action opening a list view (#2554). + +- Updated dependencies [e695fe0] +- Updated dependencies [9796e7c] +- Updated dependencies [7c09621] +- Updated dependencies [b5be479] +- Updated dependencies [e3498fb] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [806a40a] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/metadata-protocol@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + - @objectstack/metadata-core@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/objectql/package.json b/packages/objectql/package.json index 1be92d5d36..566f9ba32f 100644 --- a/packages/objectql/package.json +++ b/packages/objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/objectql", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Isomorphic ObjectQL Engine for ObjectStack", "main": "dist/index.js", diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md index 7c50116a17..a19061fa6d 100644 --- a/packages/observability/CHANGELOG.md +++ b/packages/observability/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/observability +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/observability/package.json b/packages/observability/package.json index 9f7d3eaaab..9f792b47a8 100644 --- a/packages/observability/package.json +++ b/packages/observability/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/observability", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.", "type": "module", diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md index fe0534206a..fc0e04c689 100644 --- a/packages/platform-objects/CHANGELOG.md +++ b/packages/platform-objects/CHANGELOG.md @@ -1,5 +1,38 @@ # @objectstack/platform-objects +## 12.0.0 + +### Minor Changes + +- 07f055c: feat(auth): last-login audit fields — sys_user.last_login_at / last_login_ip (ADR-0069 D7) + + Completes the ADR-0069 D7 identity-field set: `sys_user.last_login_at` and + `sys_user.last_login_ip` are stamped on every successful `/sign-in/email` by + `AuthManager.stampLastLogin` (a best-effort after-hook, independent of the + lockout-accounting path so it runs even when lockout is disabled). The IP is + taken from the trusted forwarded headers (`x-forwarded-for` → + `cf-connecting-ip` → `x-real-ip`), the same precedence as the D5 IP allow-list + middleware, and capped to the 45-char column width. Both fields are + system-managed, read-only, and land in the Admin group of `sys_user`. + + The rest of ADR-0069 P1 (password complexity/history/expiry, HIBP, account + lockout, enforced MFA) was already implemented; this fills the one missing D7 + field pair. ADR-0069 status updated Proposed → Accepted (P1/P2 implemented) + with an implementation-status matrix reflecting what is landed vs the remaining + P2 gaps (per-org IP ranges, shared-store rate limiting). + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/metadata-core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json index 05c885ca98..c59c139a87 100644 --- a/packages/platform-objects/package.json +++ b/packages/platform-objects/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/platform-objects", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects", "main": "dist/index.js", diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md index 7cbda95622..96af0ab806 100644 --- a/packages/plugins/driver-memory/CHANGELOG.md +++ b/packages/plugins/driver-memory/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/driver-memory +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json index cc2481c2b8..25a20beddf 100644 --- a/packages/plugins/driver-memory/package.json +++ b/packages/plugins/driver-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-memory", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "In-Memory Driver for ObjectStack (Reference Implementation)", "main": "dist/index.js", diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md index cbbbfa9e51..4388090eed 100644 --- a/packages/plugins/driver-mongodb/CHANGELOG.md +++ b/packages/plugins/driver-mongodb/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/driver-mongodb +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json index 26b8cf96b0..39473fc4bd 100644 --- a/packages/plugins/driver-mongodb/package.json +++ b/packages/plugins/driver-mongodb/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-mongodb", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client", "main": "dist/index.js", diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md index 9c84406a5b..af5ef1bb4c 100644 --- a/packages/plugins/driver-sql/CHANGELOG.md +++ b/packages/plugins/driver-sql/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/driver-sql +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json index 5f7bc8b23c..2b5fb4ea94 100644 --- a/packages/plugins/driver-sql/package.json +++ b/packages/plugins/driver-sql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sql", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex", "main": "dist/index.js", diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md index a9a7f26cbc..88f48992c7 100644 --- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md +++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/driver-sqlite-wasm +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/driver-sql@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json index 56fcfd52f6..0c8347d0b7 100644 --- a/packages/plugins/driver-sqlite-wasm/package.json +++ b/packages/plugins/driver-sqlite-wasm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sqlite-wasm", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings", "keywords": [ diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md index 49649582fb..4600726366 100644 --- a/packages/plugins/embedder-openai/CHANGELOG.md +++ b/packages/plugins/embedder-openai/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/embedder-openai +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json index b043e07b7c..071f477cf7 100644 --- a/packages/plugins/embedder-openai/package.json +++ b/packages/plugins/embedder-openai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/embedder-openai", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md index a4fd61aa3a..f96cb31835 100644 --- a/packages/plugins/knowledge-memory/CHANGELOG.md +++ b/packages/plugins/knowledge-memory/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/knowledge-memory +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/service-knowledge@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json index 297ca932a1..033edff999 100644 --- a/packages/plugins/knowledge-memory/package.json +++ b/packages/plugins/knowledge-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-memory", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md index 46b055a122..4714e1e5a1 100644 --- a/packages/plugins/knowledge-ragflow/CHANGELOG.md +++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/knowledge-ragflow +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/service-knowledge@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json index 05aa4832c8..18561d1487 100644 --- a/packages/plugins/knowledge-ragflow/package.json +++ b/packages/plugins/knowledge-ragflow/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-ragflow", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md index 13bc1c5041..6281955541 100644 --- a/packages/plugins/plugin-approvals/CHANGELOG.md +++ b/packages/plugins/plugin-approvals/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/plugin-approvals +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + - @objectstack/metadata-core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json index dc414d2773..db22f07564 100644 --- a/packages/plugins/plugin-approvals/package.json +++ b/packages/plugins/plugin-approvals/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-approvals", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md index 0f5ce8fceb..7e17c7be60 100644 --- a/packages/plugins/plugin-audit/CHANGELOG.md +++ b/packages/plugins/plugin-audit/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-audit +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json index e5ed219f9a..7a59c991fc 100644 --- a/packages/plugins/plugin-audit/package.json +++ b/packages/plugins/plugin-audit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-audit", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Audit Plugin for ObjectStack — System audit log object and audit trail", "main": "dist/index.js", diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md index 8605f1308a..dcfbc490fc 100644 --- a/packages/plugins/plugin-auth/CHANGELOG.md +++ b/packages/plugins/plugin-auth/CHANGELOG.md @@ -1,5 +1,61 @@ # Changelog +## 12.0.0 + +### Minor Changes + +- 07f055c: feat(auth): last-login audit fields — sys_user.last_login_at / last_login_ip (ADR-0069 D7) + + Completes the ADR-0069 D7 identity-field set: `sys_user.last_login_at` and + `sys_user.last_login_ip` are stamped on every successful `/sign-in/email` by + `AuthManager.stampLastLogin` (a best-effort after-hook, independent of the + lockout-accounting path so it runs even when lockout is disabled). The IP is + taken from the trusted forwarded headers (`x-forwarded-for` → + `cf-connecting-ip` → `x-real-ip`), the same precedence as the D5 IP allow-list + middleware, and capped to the 45-char column width. Both fields are + system-managed, read-only, and land in the Admin group of `sys_user`. + + The rest of ADR-0069 P1 (password complexity/history/expiry, HIBP, account + lockout, enforced MFA) was already implemented; this fills the one missing D7 + field pair. ADR-0069 status updated Proposed → Accepted (P1/P2 implemented) + with an implementation-status matrix reflecting what is landed vs the remaining + P2 gaps (per-org IP ranges, shared-store rate limiting). + +- 1b1b34e: feat(auth): shared cross-node rate-limit + session store via the cache service (ADR-0069 D2) + + Multi-node deployments previously rate-limited **per process** — better-auth's + default `rateLimit` store is in-memory, so each node counted independently and + an attacker could rotate nodes to bypass the limit. `AuthPlugin` now wires the + kernel `cache` service as better-auth's `secondaryStorage` and flips + `rateLimit.storage` to `'secondary-storage'`, so rate-limit counters (and the + session cache) are enforced against **one shared store across every node** — + shared iff the cache service is (Redis adapter in a cluster; memory single-node, + where behavior is unchanged). When no cache service is registered the plugin + logs a warning that a multi-node deployment needs a shared cache (ADR-0069 + honesty — no silent per-process limiting presented as global). + + New `cacheSecondaryStorage(cache)` adapter (`ICacheService` → better-auth + `SecondaryStorage`). Note: the cache has no atomic increment, so under high + concurrency the get→set counter path can slightly over-count — acceptable for a + rate limiter and strictly better than independent per-node counters; a future + cache adapter exposing atomic INCR can add an `increment` method for exact + counting. + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index f7ecd899a7..723dcdeda2 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-auth", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Authentication & Identity Plugin for ObjectStack", "main": "dist/index.js", diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md index bf1d909b0d..b9cc8815b3 100644 --- a/packages/plugins/plugin-dev/CHANGELOG.md +++ b/packages/plugins/plugin-dev/CHANGELOG.md @@ -1,5 +1,40 @@ # @objectstack/plugin-dev +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [1b1b34e] +- Updated dependencies [9796e7c] +- Updated dependencies [9693a36] +- Updated dependencies [7c09621] +- Updated dependencies [e3498fb] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [48ad533] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/plugin-auth@12.0.0 + - @objectstack/plugin-security@12.0.0 + - @objectstack/runtime@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/rest@12.0.0 + - @objectstack/account@12.0.0 + - @objectstack/setup@12.0.0 + - @objectstack/studio@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/driver-memory@12.0.0 + - @objectstack/plugin-hono-server@12.0.0 + - @objectstack/plugin-org-scoping@12.0.0 + - @objectstack/service-i18n@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json index 24c3eea34a..80781385e4 100644 --- a/packages/plugins/plugin-dev/package.json +++ b/packages/plugins/plugin-dev/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-dev", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations", "main": "dist/index.js", diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md index 8eb77fbae2..fb2582b7ec 100644 --- a/packages/plugins/plugin-email/CHANGELOG.md +++ b/packages/plugins/plugin-email/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/plugin-email +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json index f8456e2d9b..25f6488df6 100644 --- a/packages/plugins/plugin-email/package.json +++ b/packages/plugins/plugin-email/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-email", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md index 59b8bf9d4d..86fef5d2dc 100644 --- a/packages/plugins/plugin-hono-server/CHANGELOG.md +++ b/packages/plugins/plugin-hono-server/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-hono-server +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/observability@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json index b4b5efd8fd..37b09059a1 100644 --- a/packages/plugins/plugin-hono-server/package.json +++ b/packages/plugins/plugin-hono-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-hono-server", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Standard Hono Server Adapter for ObjectStack Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-org-scoping/CHANGELOG.md b/packages/plugins/plugin-org-scoping/CHANGELOG.md index bb35d1c9a7..b07e500656 100644 --- a/packages/plugins/plugin-org-scoping/CHANGELOG.md +++ b/packages/plugins/plugin-org-scoping/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-org-scoping +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-org-scoping/package.json b/packages/plugins/plugin-org-scoping/package.json index 6cd6fa57d2..76cbdf0c0c 100644 --- a/packages/plugins/plugin-org-scoping/package.json +++ b/packages/plugins/plugin-org-scoping/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-org-scoping", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Organization-Scoping Plugin for ObjectStack — row-level Organization isolation, per-org seed replay, default-org bootstrap", "main": "dist/index.js", diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md index 46a89287e1..f3da3812a2 100644 --- a/packages/plugins/plugin-reports/CHANGELOG.md +++ b/packages/plugins/plugin-reports/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-reports +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json index 3266024f9e..68168e33fa 100644 --- a/packages/plugins/plugin-reports/package.json +++ b/packages/plugins/plugin-reports/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-reports", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md index dc00e4a2d4..3b1adcf882 100644 --- a/packages/plugins/plugin-security/CHANGELOG.md +++ b/packages/plugins/plugin-security/CHANGELOG.md @@ -1,5 +1,100 @@ # @objectstack/plugin-security +## 12.0.0 + +### Minor Changes + +- 9796e7c: feat(security): two-doors separation for permission sets (ADR-0086 P2) + + Splits who may change a permission set into two non-overlapping doors, enforced + at the data layer instead of by convention: + + **块 1 — the package door (publish-time materialization).** + `ObjectStackProtocolImplementation` gains a generic publish-time materializer + registry (`registerPublishMaterializer(type, fn)`). When a draft of a registered + type is published, its body is projected into a data-plane row and the result is + surfaced on the publish response as `materializeApplied` (best-effort, never + thrown — same contract as `seedApplied`). `promoteDraft` now returns the draft's + `packageId` so the materializer can stamp the owning package. `plugin-security` + registers a `permission` materializer that upserts the published set into + `sys_permission_set` with `managed_by:'package'` + `package_id` — so a set + authored through the studio package door (saved as a `permission` draft, then + published) lands in the admin surface with the exact provenance the boot seeder + already stamps, now on the runtime publish path too. The single-set upsert is + shared with `bootstrapDeclaredPermissions` (`upsertPackagePermissionSet`), so + both paths apply the same own-row / foreign-package / env-authored rules. + + **块 2 — the admin door (data-layer write gate).** + The security middleware now refuses any admin-door write + (`update`/`delete`/`transfer`/`restore`/`purge`) to a `sys_permission_set` row + with `managed_by:'package'`, and refuses an `insert` that forges + `managed_by:'package'`. The gate fails closed regardless of the caller's grants + (a platform admin with `modifyAllRecords` is blocked just the same), so it is a + real data-layer boundary rather than a UI hint. System/boot writes carry + `isSystem` and bypass the whole middleware, so the boot seeder and the publish + materializer are unaffected. Env-authored sets (`managed_by` `user`/`platform` + or absent) stay freely editable through the admin door — the two doors never + overwrite each other. + +- 7c09621: feat(security): pre-map `transfer`/`restore`/`purge` to their RBAC bits (#1883) + + The permission evaluator now maps the destructive record-lifecycle operations + to their spec permission bits (`transfer` → `allowTransfer`, `restore` → + `allowRestore`, `purge` → `allowPurge`) and extends the `modifyAllRecords` + super-user bypass to cover them. The ObjectQL operations themselves are still + roadmap M2 — but the gate now exists ahead of them: the moment such an + operation is dispatched through the security middleware it is denied unless a + resolved permission set grants the matching bit. Unmapped destructive + operations continue to fail closed (ADR-0049). Spec descriptions updated from + `[EXPERIMENTAL — not enforced]` to `[RBAC-gated; operation pending M2]`. + +- 7709db4: feat(security): permission-set package provenance + declared-permission seeding (ADR-0086 P1) + + Packages now ship working default access for their own objects, with a + machine-checkable metadata↔config boundary: + + - **Spec (ADR-0086 D3)**: `PermissionSetSchema.packageId` (owning package for + a package-shipped set; absent = env-authored) and per-record provenance + `managedBy: 'package' | 'platform' | 'user'` on the existing + metadata-persistence axis. Persisted on `sys_permission_set` as + `package_id` / `managed_by` (new columns + `package_id` index). + - **Seeding (ADR-0086 D5)**: new `bootstrapDeclaredPermissions` — the sibling + of `bootstrapDeclaredRoles` — materializes `stack.permissions` into + `sys_permission_set` at boot with `managed_by:'package'` + `package_id`. + Idempotent and upgrade-aware: rows the seeder owns are re-seeded to the + shipped declaration on every boot; rows owned by a different package are + refused loudly; env-authored `platform`/`user`/legacy rows are never + clobbered. Closes the ADR-0078 inert-metadata violation for + `stack.permissions` (declared sets were runtime-enforced but never + materialized — invisible to the admin surface, uninstall undefined). + - Conformance matrix row `declarative-permission-seeding` (ADR-0056 D10) + + dogfood proof pin the behavior so it cannot regress to inert. + +### Patch Changes + +- 48ad533: fix(security): surface swallowed permission-set resolution failures (#2565) + + `PermissionEvaluator.resolvePermissionSets` swallowed metadata `list()` and + `sys_permission_set` dbLoader failures silently — fail-closed (unresolvable + sets grant nothing), but a transient DB error made custom permission sets + vanish with no trace, leaving the resulting 403s undiagnosable. The evaluator + now accepts an optional `{ logger }` and emits one `warn` per failed source, + naming the unresolved permission sets and the error. SecurityPlugin wires its + plugin logger into both call sites. Resolution behavior is byte-identical. + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json index 53bbf1ce14..459298eca1 100644 --- a/packages/plugins/plugin-security/package.json +++ b/packages/plugins/plugin-security/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-security", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md index 140e805d98..b8b4d6da54 100644 --- a/packages/plugins/plugin-sharing/CHANGELOG.md +++ b/packages/plugins/plugin-sharing/CHANGELOG.md @@ -1,5 +1,25 @@ # @objectstack/plugin-sharing +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json index 3bd92958c2..33def33e55 100644 --- a/packages/plugins/plugin-sharing/package.json +++ b/packages/plugins/plugin-sharing/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sharing", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md index cbb63c019b..f08e781172 100644 --- a/packages/plugins/plugin-webhooks/CHANGELOG.md +++ b/packages/plugins/plugin-webhooks/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/plugin-webhooks +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/service-messaging@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json index c56eed15f2..c169c73777 100644 --- a/packages/plugins/plugin-webhooks/package.json +++ b/packages/plugins/plugin-webhooks/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-webhooks", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.", "type": "module", diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md index 5a24a7f168..24c9f72b81 100644 --- a/packages/rest/CHANGELOG.md +++ b/packages/rest/CHANGELOG.md @@ -1,5 +1,63 @@ # @objectstack/rest +## 12.0.0 + +### Major Changes + +- 7c09621: feat(security)!: `api.requireAuth` now defaults to `true` — anonymous access to the data API is denied by default (ADR-0056 D2 flip) + + **BREAKING.** The global `requireAuth` default flipped FROM `false` TO `true` + (`RestApiConfigSchema.requireAuth` in `@objectstack/spec`, mirrored by + `RestServer.normalizeConfig` in `@objectstack/rest`). Anonymous requests to + the `/data/*` CRUD + batch endpoints are now rejected with HTTP 401 unless the + deployment explicitly opts out. (Scope note: this gate covers the REST + `/data/*` surface — the metadata read/write endpoints and the dispatcher + GraphQL route have their own pre-existing anonymous posture, tracked + separately; this flip does not change them.) + + **Migration (one line):** a deployment that intentionally serves data publicly + (demo / playground / kiosk) sets the flag on the stack config — now a declared + `ObjectStackDefinitionSchema.api` field, so it survives `defineStack` strict + parsing (previously an undeclared top-level `api` key was silently stripped): + + ```ts + export default defineStack({ + // … + api: { requireAuth: false }, + }); + ``` + + The REST plugin logs a boot warning for the explicit opt-out so a fail-open + posture is always visible. A misplaced `api.requireAuth` at the plugin level + (one nesting short) is now also called out with a boot warning instead of + being silently ignored. + + **What keeps working with no action:** + + - **Share links** — validate their token, then read under a system context. + - **Public forms** — self-authorizing via the declaration-derived + `publicFormGrant` (create + read-back on the declared target object only); + no `guest_portal` profile needed. + - **Control plane** — `/auth`, `/health`, `/discovery` are exempt. + - **`objectstack serve` with an auth-less stack** — the CLI passes an explicit + `requireAuth: false` for stacks whose tier set has no `auth` (nothing could + authenticate against them), with the boot warning. + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/service-package@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/rest/package.json b/packages/rest/package.json index 111dfd68b7..0126f4901b 100644 --- a/packages/rest/package.json +++ b/packages/rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/rest", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol", "type": "module", diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md index 5bcaca745e..af87140dcd 100644 --- a/packages/runtime/CHANGELOG.md +++ b/packages/runtime/CHANGELOG.md @@ -1,5 +1,104 @@ # @objectstack/runtime +## 12.0.0 + +### Patch Changes + +- 9693a36: fix(automation): bind a flow published while the server runs, without a restart + + Follow-up to #2560 (cold-boot flow binding). A flow **published while the server + is running** — the Studio online-authoring journey: author a record-triggered + automation, publish it, immediately update a matching record — did **not** fire. + Its trigger only bound on the next process restart. + + Two gaps, both fixed: + + 1. **The publish path fired no rebind signal.** `POST /packages/:id/publish-drafts` + → `protocol.publishPackageDrafts` promotes the drafts to active but emitted no + event the automation service listens to. The runtime dispatcher now announces + `metadata:reloaded` after a successful publish — the same signal a dev artifact + reload fires (`MetadataPlugin._reloadAndAnnounce`) — so boot-cached consumers + re-sync without a restart. + + 2. **The runtime re-sync read the wrong source.** The automation service's + `metadata:reloaded` re-sync pulled `metadata.list('flow')`, which returns 0 in a + real running server (it does not surface inline app flows), so even when the + hook fired it bound nothing. It now reads `protocol.getMetaItems({ type: 'flow' })` + — the same flattened flow view #2560's cold-boot bind and `GET /meta/flow` use — + while keeping the teardown of flows removed from the artifact. A failed or + unavailable protocol read is a no-op and never tears down live flows. + + Production is largely unaffected (a deploy reboots the process, so #2560's + cold-boot bind covers it); this closes the gap for dev and single-instance + Studio authoring. + + Verified end-to-end on a clean instance: authored a record-triggered flow in a + package, published it via `POST /packages/:id/publish-drafts` **without + restarting**, then updated a matching record and observed the flow fire (before + the fix it did not). New regression tests boot a kernel whose protocol serves a + flow only after boot and assert `metadata:reloaded` binds it — and that the + re-sync reads the protocol, not `metadata.list` — both failing on the pre-fix code. + +- e3498fb: fix(runtime): carry spec-validation issues (and the 422 status) through metadata save/publish errors + + `protocol.saveMetaItem` already validates a metadata draft against its spec Zod + schema and, on failure, throws a rich error: HTTP `status: 422`, `code: +'invalid_metadata'`, and a structured `issues: [{ path, message, code }]` array + (field-anchored, `superRefine` issues included). But the HTTP dispatcher's catch + blocks collapsed all of that to a single message — the save path even hardcoded + `400` — so a client could only show a generic "failed validation" banner with no + way to point at the offending field. The publish path was worse: the per-draft + catch in `publishPackageDrafts` flattened each failure into `{ type, name, error +}` and **dropped `issues` entirely**. + + Now: + + - A new `errorFromThrown(e, fallbackStatus)` dispatcher helper preserves the + error's own `status` (so validation surfaces as **422**, not a downgraded 400) + and attaches `{ code, issues }` under `error.details` when present. Errors that + carry neither behave exactly as before. Used by the metadata **save** (`PUT +/meta/:type/:name`) and **publish** (`POST /packages/:id/publish-drafts`) + catch sites. + - `publishPackageDrafts` now carries `issues` into each `failed[]` entry, so a + validation failure during publish is field-anchored too (it previously kept + only the message). + + This is the server half of "surface validation at the save/publish moment, on + the field" — the Studio can now map each issue back to its input instead of + showing a wall-of-text banner. Purely additive to the error payload; the only + behavior change is the more-correct 422 (was 400) for a failed metadata save. + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [1b1b34e] +- Updated dependencies [9796e7c] +- Updated dependencies [7c09621] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [48ad533] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/plugin-auth@12.0.0 + - @objectstack/plugin-security@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/rest@12.0.0 + - @objectstack/metadata@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + - @objectstack/observability@12.0.0 + - @objectstack/driver-memory@12.0.0 + - @objectstack/driver-sql@12.0.0 + - @objectstack/driver-sqlite-wasm@12.0.0 + - @objectstack/plugin-org-scoping@12.0.0 + - @objectstack/service-cluster@12.0.0 + - @objectstack/service-datasource@12.0.0 + - @objectstack/service-i18n@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/runtime/package.json b/packages/runtime/package.json index b4af572fad..fe3545363f 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/runtime", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack Core Runtime & Query Engine", "type": "module", diff --git a/packages/sdui-parser/CHANGELOG.md b/packages/sdui-parser/CHANGELOG.md index 446b30c34a..ed141ba8ac 100644 --- a/packages/sdui-parser/CHANGELOG.md +++ b/packages/sdui-parser/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/sdui-parser +## 12.0.0 + ## 11.10.0 ## 11.9.0 diff --git a/packages/sdui-parser/package.json b/packages/sdui-parser/package.json index e57b2dc0fb..40bae77840 100644 --- a/packages/sdui-parser/package.json +++ b/packages/sdui-parser/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/sdui-parser", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "ObjectStack constrained JSX-source → SDUI SchemaNode tree compiler (parse, never execute). Isomorphic, zero React. ADR-0080.", "main": "dist/index.js", diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md index c1cdeb9541..fcac13ff50 100644 --- a/packages/services/service-analytics/CHANGELOG.md +++ b/packages/services/service-analytics/CHANGELOG.md @@ -1,5 +1,19 @@ # Changelog — @objectstack/service-analytics +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json index 51383baff3..04c640ecf7 100644 --- a/packages/services/service-analytics/package.json +++ b/packages/services/service-analytics/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-analytics", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)", "type": "module", diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md index 6b1f992bcd..c53a358c17 100644 --- a/packages/services/service-automation/CHANGELOG.md +++ b/packages/services/service-automation/CHANGELOG.md @@ -1,5 +1,118 @@ # @objectstack/service-automation +## 12.0.0 + +### Minor Changes + +- ffafb30: feat(automation): durable run history — every terminal run leaves a queryable record with its failure reason + + Automation runs were observable **only in memory**: the engine kept the last N + `ExecutionLogEntry` records in a ring buffer, so "did this flow run, and why did + it fail?" could not be answered after a process restart (or once the buffer + evicted the entry), and a failed run surfaced no reason at all. This was the + biggest silent-trust gap for anyone authoring automations — a flow could stop + firing or start failing with nothing durable to inspect. + + `sys_automation_run` — previously the ADR-0019 store for _live suspended_ runs + only — becomes a durable **run-history** table. On every terminal run the engine + mirrors a row through the `SuspendedRunStore` (`recordTerminal`): `status` + (`completed` / `failed`), `finished_at`, `duration_ms`, and, for a failure, the + `error` message a designer needs to fix it. `listRuns()` merges this durable + history with the in-memory buffer (in-memory wins on id, newest-first) so the + Studio "Runs" surface shows runs that predate the current process. + + The design is **safe and additive**. Terminal history rows use a `run_`-prefixed + id, disjoint from live suspended runs (which key on the raw `runId` with + `status: 'paused'`), so the suspend save/load/delete/list path is untouched and + resume sweeps (`list()` filters `status: 'paused'`) never see history rows. + Persisting is **best-effort and fire-and-forget** — a history-write failure is + logged and swallowed, never breaking the run that produced it. New object fields + (`finished_at`, `duration_ms`, `error`) are all optional and the `status` enum + gains `running` / `completed` / `failed` alongside the existing `paused`. + + Verified end-to-end on a clean showcase instance: a schedule-triggered flow and + seven task-completion flows each left durable `completed` rows; a genuinely + failing flow (`showcase_resilient_sync`) left a `failed` row carrying its + `try_catch` failure reason; a live `paused` suspended run coexisted without + collision; and after a full process restart the `failed` row — reason intact — + was still queryable via `/api/v1/data/sys_automation_run`. New `run-history.test.ts` + covers completed/failed persistence, read-across-restart, and best-effort isolation. + +### Patch Changes + +- f84f8d5: fix(automation): bind flow triggers on a cold boot, not just after an HMR reload + + Record-triggered (and other trigger-typed) flows silently never fired on a + fresh process start — in dev and in production. The automation service's + boot-time flow pull reads `ql.registry.listItems('flow')`, which is **empty for + flows defined inline in an app manifest** — `registry.registerApp()` stores the + app under type `'app'` and never promotes its inline flows to standalone + registry `'flow'` items. The re-sync that _could_ see them only ran on the + `metadata:reloaded` hook, which never fires on a cold boot (`os dev` restarts + the process on recompile rather than firing it, and production never reloads). + + Net effect: after any real restart, **no flow bound its trigger**, so + record-change automations did not fire at all. + + Fix: bind flows at `kernel:ready` from `protocol.getMetaItems({ type: 'flow' })` + — the canonical flattened flow view that `GET /meta/flow` serves and that does + surface inline app flows — once every plugin has finished `init()`/`start()` + (so the app, hence its flows, is registered). `registerFlow` is idempotent, so + re-binding a flow the boot pull already registered is harmless. + + Verified end-to-end on a clean instance: before the fix, updating a record + fired **0** flows (0 bound at boot); after, a cold boot binds all flows and a + single record update fires every matching record-triggered flow. Regression + test boots a kernel with an inline-app record-triggered flow served only via + `protocol.getMetaItems` and asserts it is bound after `bootstrap()` alone with + no `metadata:reloaded` fired — it fails on the pre-fix code. + +- 9693a36: fix(automation): bind a flow published while the server runs, without a restart + + Follow-up to #2560 (cold-boot flow binding). A flow **published while the server + is running** — the Studio online-authoring journey: author a record-triggered + automation, publish it, immediately update a matching record — did **not** fire. + Its trigger only bound on the next process restart. + + Two gaps, both fixed: + + 1. **The publish path fired no rebind signal.** `POST /packages/:id/publish-drafts` + → `protocol.publishPackageDrafts` promotes the drafts to active but emitted no + event the automation service listens to. The runtime dispatcher now announces + `metadata:reloaded` after a successful publish — the same signal a dev artifact + reload fires (`MetadataPlugin._reloadAndAnnounce`) — so boot-cached consumers + re-sync without a restart. + + 2. **The runtime re-sync read the wrong source.** The automation service's + `metadata:reloaded` re-sync pulled `metadata.list('flow')`, which returns 0 in a + real running server (it does not surface inline app flows), so even when the + hook fired it bound nothing. It now reads `protocol.getMetaItems({ type: 'flow' })` + — the same flattened flow view #2560's cold-boot bind and `GET /meta/flow` use — + while keeping the teardown of flows removed from the artifact. A failed or + unavailable protocol read is a no-op and never tears down live flows. + + Production is largely unaffected (a deploy reboots the process, so #2560's + cold-boot bind covers it); this closes the gap for dev and single-instance + Studio authoring. + + Verified end-to-end on a clean instance: authored a record-triggered flow in a + package, published it via `POST /packages/:id/publish-drafts` **without + restarting**, then updated a matching record and observed the flow fire (before + the fix it did not). New regression tests boot a kernel whose protocol serves a + flow only after boot and assert `metadata:reloaded` binds it — and that the + re-sync reads the protocol, not `metadata.list` — both failing on the pre-fix code. + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/formula@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json index 0c29fd02cd..f8e6851667 100644 --- a/packages/services/service-automation/package.json +++ b/packages/services/service-automation/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-automation", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine", "type": "module", diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md index bcd8d35115..831ba24872 100644 --- a/packages/services/service-cache/CHANGELOG.md +++ b/packages/services/service-cache/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-cache +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/observability@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json index 9ec330c4c1..dcdcb6034d 100644 --- a/packages/services/service-cache/package.json +++ b/packages/services/service-cache/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cache", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters", "type": "module", diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md index 87dd5d4669..da8afd7a45 100644 --- a/packages/services/service-cluster-redis/CHANGELOG.md +++ b/packages/services/service-cluster-redis/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-cluster-redis +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/service-cluster@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json index 707f6a6bc0..38c9e1244f 100644 --- a/packages/services/service-cluster-redis/package.json +++ b/packages/services/service-cluster-redis/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster-redis", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.", "type": "module", diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md index 7efd86139a..0a4df351c4 100644 --- a/packages/services/service-cluster/CHANGELOG.md +++ b/packages/services/service-cluster/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-cluster +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json index 8dd1f76ff8..283c9bdb6e 100644 --- a/packages/services/service-cluster/package.json +++ b/packages/services/service-cluster/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.", "type": "module", diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md index e9ce02d1ed..08d76d59ed 100644 --- a/packages/services/service-datasource/CHANGELOG.md +++ b/packages/services/service-datasource/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-external-datasource +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json index e2278e696d..376efecf0c 100644 --- a/packages/services/service-datasource/package.json +++ b/packages/services/service-datasource/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-datasource", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.", "type": "module", diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md index ade1b0b927..04360e94e4 100644 --- a/packages/services/service-i18n/CHANGELOG.md +++ b/packages/services/service-i18n/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-i18n +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json index 2ed501bba6..efbf7b39f1 100644 --- a/packages/services/service-i18n/package.json +++ b/packages/services/service-i18n/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-i18n", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading", "type": "module", diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md index 011bb2ee28..4461a15dac 100644 --- a/packages/services/service-job/CHANGELOG.md +++ b/packages/services/service-job/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-job +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json index b888471baf..19d8569405 100644 --- a/packages/services/service-job/package.json +++ b/packages/services/service-job/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-job", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling", "type": "module", diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md index acb40cf31f..ed4730fd17 100644 --- a/packages/services/service-knowledge/CHANGELOG.md +++ b/packages/services/service-knowledge/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-knowledge +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json index 302105fb1f..6f08589870 100644 --- a/packages/services/service-knowledge/package.json +++ b/packages/services/service-knowledge/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-knowledge", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).", "type": "module", diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md index 5a4931c52f..986be0fac6 100644 --- a/packages/services/service-messaging/CHANGELOG.md +++ b/packages/services/service-messaging/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-messaging +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json index 1d94565376..c3366d735d 100644 --- a/packages/services/service-messaging/package.json +++ b/packages/services/service-messaging/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-messaging", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.", "type": "module", diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md index f3cd1311fe..c344664c03 100644 --- a/packages/services/service-package/CHANGELOG.md +++ b/packages/services/service-package/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-package +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json index 3cf4d5707f..6bec5ccec8 100644 --- a/packages/services/service-package/package.json +++ b/packages/services/service-package/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-package", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Package management service for ObjectStack — publish, install, and manage packages", "type": "module", diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md index 95f7efd7d0..28613556d4 100644 --- a/packages/services/service-queue/CHANGELOG.md +++ b/packages/services/service-queue/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-queue +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json index efef7cbb9c..e8c4ee7f75 100644 --- a/packages/services/service-queue/package.json +++ b/packages/services/service-queue/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-queue", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters", "type": "module", diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md index b77039d31a..26a03d3e97 100644 --- a/packages/services/service-realtime/CHANGELOG.md +++ b/packages/services/service-realtime/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-realtime +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json index a389fb973f..c823f82f4a 100644 --- a/packages/services/service-realtime/package.json +++ b/packages/services/service-realtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-realtime", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub", "type": "module", diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md index 6911d51d3d..7e76142b89 100644 --- a/packages/services/service-settings/CHANGELOG.md +++ b/packages/services/service-settings/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/service-settings +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/types@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json index 04c0c5d417..b7a62efbce 100644 --- a/packages/services/service-settings/package.json +++ b/packages/services/service-settings/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-settings", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.", "type": "module", diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md index 4250844521..0df2d10c0b 100644 --- a/packages/services/service-storage/CHANGELOG.md +++ b/packages/services/service-storage/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/service-storage +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/platform-objects@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/observability@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json index 235ed9e2d6..68f21c7160 100644 --- a/packages/services/service-storage/package.json +++ b/packages/services/service-storage/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-storage", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton", "type": "module", diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md index 809acd712c..6c801c8eb8 100644 --- a/packages/spec/CHANGELOG.md +++ b/packages/spec/CHANGELOG.md @@ -1,5 +1,153 @@ # @objectstack/spec +## 12.0.0 + +### Major Changes + +- 7c09621: feat(security)!: `api.requireAuth` now defaults to `true` — anonymous access to the data API is denied by default (ADR-0056 D2 flip) + + **BREAKING.** The global `requireAuth` default flipped FROM `false` TO `true` + (`RestApiConfigSchema.requireAuth` in `@objectstack/spec`, mirrored by + `RestServer.normalizeConfig` in `@objectstack/rest`). Anonymous requests to + the `/data/*` CRUD + batch endpoints are now rejected with HTTP 401 unless the + deployment explicitly opts out. (Scope note: this gate covers the REST + `/data/*` surface — the metadata read/write endpoints and the dispatcher + GraphQL route have their own pre-existing anonymous posture, tracked + separately; this flip does not change them.) + + **Migration (one line):** a deployment that intentionally serves data publicly + (demo / playground / kiosk) sets the flag on the stack config — now a declared + `ObjectStackDefinitionSchema.api` field, so it survives `defineStack` strict + parsing (previously an undeclared top-level `api` key was silently stripped): + + ```ts + export default defineStack({ + // … + api: { requireAuth: false }, + }); + ``` + + The REST plugin logs a boot warning for the explicit opt-out so a fail-open + posture is always visible. A misplaced `api.requireAuth` at the plugin level + (one nesting short) is now also called out with a boot warning instead of + being silently ignored. + + **What keeps working with no action:** + + - **Share links** — validate their token, then read under a system context. + - **Public forms** — self-authorizing via the declaration-derived + `publicFormGrant` (create + read-back on the declared target object only); + no `guest_portal` profile needed. + - **Control plane** — `/auth`, `/health`, `/discovery` are exempt. + - **`objectstack serve` with an auth-less stack** — the CLI passes an explicit + `requireAuth: false` for stacks whose tier set has no `auth` (nothing could + authenticate against them), with the boot warning. + +### Minor Changes + +- e695fe0: feat(spec,lint): reject userFilters on object list views (ADR-0053 phase 4) + + ADR-0053 reserves `userFilters`/`quickFilters` for page lists ("filters" mode); + on an object list view ("views" mode — where the `ViewTabBar` is the only nav + control) they are silently dropped. This lands the phase-4 guardrail as a + layered defence, so the wrong-context authoring mistake is caught without + breaking existing metadata: + + - **Type-level (author time):** new `ObjectListViewSchema` = `ListViewSchema` + minus `userFilters`. Object built-in `listViews` and `defineView` + `list`/`listViews` now use it, so `userFilters` on an object list view is a + `tsc` error. The full `ListViewSchema` (page "filters" mode) is untouched. + - **Runtime (back-compat):** the field is STRIPPED at parse (default strip, no + throw), so existing metadata keeps loading — `ObjectSchema.parse` never fails + on a stray `userFilters`. + - **Author/CI (actionable):** new `@objectstack/lint` rule + `validateListViewMode`, wired into `os validate`, reports the wrong-context + field PRE-parse (before the schema strips it) with a fix hint. + + Closes the schema half of objectui #2219; supersedes the interim runtime warn in + objectui #2220. + +- 7709db4: feat(security): permission-set package provenance + declared-permission seeding (ADR-0086 P1) + + Packages now ship working default access for their own objects, with a + machine-checkable metadata↔config boundary: + + - **Spec (ADR-0086 D3)**: `PermissionSetSchema.packageId` (owning package for + a package-shipped set; absent = env-authored) and per-record provenance + `managedBy: 'package' | 'platform' | 'user'` on the existing + metadata-persistence axis. Persisted on `sys_permission_set` as + `package_id` / `managed_by` (new columns + `package_id` index). + - **Seeding (ADR-0086 D5)**: new `bootstrapDeclaredPermissions` — the sibling + of `bootstrapDeclaredRoles` — materializes `stack.permissions` into + `sys_permission_set` at boot with `managed_by:'package'` + `package_id`. + Idempotent and upgrade-aware: rows the seeder owns are re-seeded to the + shipped declaration on every boot; rows owned by a different package are + refused loudly; env-authored `platform`/`user`/legacy rows are never + clobbered. Closes the ADR-0078 inert-metadata violation for + `stack.permissions` (declared sets were runtime-enforced but never + materialized — invisible to the admin surface, uninstall undefined). + - Conformance matrix row `declarative-permission-seeding` (ADR-0056 D10) + + dogfood proof pin the behavior so it cannot regress to inert. + +- 2082109: Detail-page related lists: `relatedList: 'primary'` prominence + optional related-list columns (#2579). + + `Field.relatedList` on a child's `lookup`/`master_detail` FK becomes a tri-state + `boolean | 'primary'`. `'primary'` marks a CORE relationship — a prominence hint + (ADR-0085), not a layout switch — that the detail page promotes to its own tab, + while non-primary children collapse into a single shared "Related" tab. + `false`/`true` keep their meaning (suppress / show in the derived default), so + the change is additive and opt-in per relationship (no primary anywhere → the + detail page is byte-for-byte the legacy stacked default). + + `RecordRelatedListProps.columns` becomes optional: when omitted the related list + derives its columns from the child object's `highlightFields` / default list + columns — a related list is just another surface that lists that object. + Required → optional is back-compat. + + Renderer + derivation changes ship in objectui: `relatedList: 'primary'` → own + tab; one related list per eligible FK (a child that references the parent + through several relationships now surfaces each, previously only the first); + self-referential relationships (hierarchies) surface a "child" list; and the + lookup-picker default columns are unified onto the same `highlightFields` + source so a picker and a related list of the same object agree with zero + per-surface config. + +- 069c205: Add a build-time view-reference lint that fails `os compile` on a broken form-view reference, and surfaces the previously-silent `_2` rename collision as a warning (#2554). + + `expandViewContainer` gains a behaviour-preserving companion `expandViewContainerWithDiagnostics` that also reports every `.` name collision. List and form views share one namespace during expansion, and the default `list` implicitly claims `.default`; a colliding key was previously renamed to `._2` **silently**, so references (form action `target`s, navigation `viewName`s) resolved to the _other_ view. + + The new `lint-view-refs` build lint consumes those diagnostics with a broken/fragile severity split, tuned so an upgrade does NOT break existing apps that merely have a colliding key: + + - **view-ref-form-target-kind** — ERROR (fails the build): a `type:'form'` action whose `target` resolves to an existing LIST view — the concrete #2554 breakage (a blank form, a silently no-op submit). High-confidence, so it fails. + - **view-key-collision** — WARNING: a key silently renamed on collision. Fragile, not broken — it breaks something only if the requested name is referenced — so it warns. + - **view-ref-form-target-missing** — WARNING: a form target resolving to no view; probably a typo, but possibly a view the lint failed to collect, so it warns rather than risk a false-positive build failure. + + This shifts objectui's runtime `viewKind` guard left to compile time: the author — very often an AI generating templates — discovers the mistake on `os compile` instead of when an end user clicks. It mirrors the existing broken/fragile two-level authoring lints (flow-patterns, autonumber, liveness). `expandViewContainer`'s runtime behaviour is unchanged; the fix is diagnostics-only plus the build gate. + +### Patch Changes + +- 7c09621: feat(security): pre-map `transfer`/`restore`/`purge` to their RBAC bits (#1883) + + The permission evaluator now maps the destructive record-lifecycle operations + to their spec permission bits (`transfer` → `allowTransfer`, `restore` → + `allowRestore`, `purge` → `allowPurge`) and extends the `modifyAllRecords` + super-user bypass to cover them. The ObjectQL operations themselves are still + roadmap M2 — but the gate now exists ahead of them: the moment such an + operation is dispatched through the security middleware it is denied unless a + resolved permission set grants the matching bit. Unmapped destructive + operations continue to fail closed (ADR-0049). Spec descriptions updated from + `[EXPERIMENTAL — not enforced]` to `[RBAC-gated; operation pending M2]`. + +- 9860de4: Surface view-key collisions during view container expansion instead of renaming silently. + + `expandViewContainer` keeps its backward-compatible rename behaviour (`.` → + `._2` on collision) but now stamps a machine-readable + `_diagnostics.warnings` entry on the renamed `ExpandedViewItem`, explaining that + references targeting the requested name (form action targets, navigation `viewName`s) + will resolve to the _other_ view. Both flattening loaders — the ObjectQL engine and the + MetadataPlugin — log these warnings at boot so the collision is visible instead of + manifesting as a form action opening a list view (#2554). + ## 11.10.0 ### Minor Changes diff --git a/packages/spec/package.json b/packages/spec/package.json index bc6ce5e725..1d705ff98f 100644 --- a/packages/spec/package.json +++ b/packages/spec/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/spec", - "version": "11.10.0", + "version": "12.0.0", "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md index 27fb2a94e9..b42fdcb8f0 100644 --- a/packages/triggers/trigger-api/CHANGELOG.md +++ b/packages/triggers/trigger-api/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/trigger-api +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json index fc0e2e80ab..058698c93c 100644 --- a/packages/triggers/trigger-api/package.json +++ b/packages/triggers/trigger-api/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-api", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md index f2fcba98fd..a20d0b6cb0 100644 --- a/packages/triggers/trigger-record-change/CHANGELOG.md +++ b/packages/triggers/trigger-record-change/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-trigger-record-change +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json index 998938a0b7..8f0285e0c0 100644 --- a/packages/triggers/trigger-record-change/package.json +++ b/packages/triggers/trigger-record-change/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-record-change", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md index 79f43c0f1b..734d4aac46 100644 --- a/packages/triggers/trigger-schedule/CHANGELOG.md +++ b/packages/triggers/trigger-schedule/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-trigger-schedule +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/core@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json index 4f8b13165a..7118fde3d6 100644 --- a/packages/triggers/trigger-schedule/package.json +++ b/packages/triggers/trigger-schedule/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-schedule", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)", "main": "dist/index.js", diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md index 6fd92f640a..ff2d960b02 100644 --- a/packages/types/CHANGELOG.md +++ b/packages/types/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/types +## 12.0.0 + +### Patch Changes + +- Updated dependencies [e695fe0] +- Updated dependencies [7c09621] +- Updated dependencies [7709db4] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/types/package.json b/packages/types/package.json index 6b55c4511a..eb78239f13 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/types", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Shared interfaces describing the ObjectStack Runtime environment", "main": "dist/index.js", diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md index ca8c2f0666..3ecbf0d03c 100644 --- a/packages/verify/CHANGELOG.md +++ b/packages/verify/CHANGELOG.md @@ -1,5 +1,81 @@ # @objectstack/verify +## 12.0.0 + +### Patch Changes + +- 7c09621: feat(security)!: `api.requireAuth` now defaults to `true` — anonymous access to the data API is denied by default (ADR-0056 D2 flip) + + **BREAKING.** The global `requireAuth` default flipped FROM `false` TO `true` + (`RestApiConfigSchema.requireAuth` in `@objectstack/spec`, mirrored by + `RestServer.normalizeConfig` in `@objectstack/rest`). Anonymous requests to + the `/data/*` CRUD + batch endpoints are now rejected with HTTP 401 unless the + deployment explicitly opts out. (Scope note: this gate covers the REST + `/data/*` surface — the metadata read/write endpoints and the dispatcher + GraphQL route have their own pre-existing anonymous posture, tracked + separately; this flip does not change them.) + + **Migration (one line):** a deployment that intentionally serves data publicly + (demo / playground / kiosk) sets the flag on the stack config — now a declared + `ObjectStackDefinitionSchema.api` field, so it survives `defineStack` strict + parsing (previously an undeclared top-level `api` key was silently stripped): + + ```ts + export default defineStack({ + // … + api: { requireAuth: false }, + }); + ``` + + The REST plugin logs a boot warning for the explicit opt-out so a fail-open + posture is always visible. A misplaced `api.requireAuth` at the plugin level + (one nesting short) is now also called out with a boot warning instead of + being silently ignored. + + **What keeps working with no action:** + + - **Share links** — validate their token, then read under a system context. + - **Public forms** — self-authorizing via the declaration-derived + `publicFormGrant` (create + read-back on the declared target object only); + no `guest_portal` profile needed. + - **Control plane** — `/auth`, `/health`, `/discovery` are exempt. + - **`objectstack serve` with an auth-less stack** — the CLI passes an explicit + `requireAuth: false` for stacks whose tier set has no `auth` (nothing could + authenticate against them), with the boot warning. + +- Updated dependencies [e695fe0] +- Updated dependencies [07f055c] +- Updated dependencies [1b1b34e] +- Updated dependencies [9796e7c] +- Updated dependencies [f84f8d5] +- Updated dependencies [9693a36] +- Updated dependencies [ffafb30] +- Updated dependencies [7c09621] +- Updated dependencies [e3498fb] +- Updated dependencies [24b62ee] +- Updated dependencies [7709db4] +- Updated dependencies [48ad533] +- Updated dependencies [2082109] +- Updated dependencies [7c09621] +- Updated dependencies [c2fdbf9] +- Updated dependencies [9860de4] +- Updated dependencies [069c205] + - @objectstack/spec@12.0.0 + - @objectstack/plugin-auth@12.0.0 + - @objectstack/plugin-security@12.0.0 + - @objectstack/service-automation@12.0.0 + - @objectstack/runtime@12.0.0 + - @objectstack/objectql@12.0.0 + - @objectstack/rest@12.0.0 + - @objectstack/core@12.0.0 + - @objectstack/driver-sqlite-wasm@12.0.0 + - @objectstack/plugin-hono-server@12.0.0 + - @objectstack/plugin-org-scoping@12.0.0 + - @objectstack/plugin-sharing@12.0.0 + - @objectstack/service-analytics@12.0.0 + - @objectstack/service-datasource@12.0.0 + - @objectstack/service-settings@12.0.0 + ## 11.10.0 ### Patch Changes diff --git a/packages/verify/package.json b/packages/verify/package.json index f6d73f8f99..412914d657 100644 --- a/packages/verify/package.json +++ b/packages/verify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/verify", - "version": "11.10.0", + "version": "12.0.0", "license": "Apache-2.0", "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.", "type": "module", diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md index 3bb26fa6e5..1b161d1af1 100644 --- a/packages/vscode-objectstack/CHANGELOG.md +++ b/packages/vscode-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # objectstack-vscode +## 12.0.0 + ## 11.10.0 ## 11.9.0 diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json index d39d2211b2..b58a13e688 100644 --- a/packages/vscode-objectstack/package.json +++ b/packages/vscode-objectstack/package.json @@ -2,7 +2,7 @@ "name": "objectstack-vscode", "displayName": "ObjectStack", "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files", - "version": "11.10.0", + "version": "12.0.0", "publisher": "objectstack", "license": "Apache-2.0", "repository": {