From 0615dcd80a76184787ab47e07ef38b215d21b904 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 21 May 2026 13:39:54 +0000 Subject: [PATCH] chore: version packages --- .changeset/action-param-required-default.md | 5 -- .changeset/artifact-first-boot.md | 14 ---- .changeset/cloud-split-cleanup.md | 17 ---- .changeset/cull-low-value-crm-reports.md | 17 ---- .changeset/highlights-rich-fields.md | 7 -- .changeset/leaner-account-setup.md | 5 -- .changeset/metadata-v3-1.md | 10 --- .changeset/raw-execute-tenant-warn.md | 6 -- .../runtime-observability-primitives.md | 25 ------ .changeset/runtime-security-primitives.md | 19 ----- .changeset/security-fls-write-enforcement.md | 28 ------- .changeset/sql-autonumber-tenant.md | 44 ---------- .changeset/sql-autonumber.md | 12 --- .changeset/sql-tenant-scope.md | 14 ---- .changeset/tenant-declarative.md | 14 ---- apps/account/CHANGELOG.md | 11 +++ apps/account/package.json | 2 +- apps/docs/CHANGELOG.md | 2 + apps/docs/package.json | 2 +- apps/studio/CHANGELOG.md | 34 ++++++++ apps/studio/package.json | 2 +- examples/app-crm/CHANGELOG.md | 29 +++++++ examples/app-crm/package.json | 2 +- examples/app-todo/CHANGELOG.md | 18 ++++ examples/app-todo/package.json | 2 +- packages/adapters/express/CHANGELOG.md | 2 + packages/adapters/express/package.json | 2 +- packages/adapters/fastify/CHANGELOG.md | 2 + packages/adapters/fastify/package.json | 2 +- packages/adapters/hono/CHANGELOG.md | 6 ++ packages/adapters/hono/package.json | 2 +- packages/adapters/nestjs/CHANGELOG.md | 2 + packages/adapters/nestjs/package.json | 2 +- packages/adapters/nextjs/CHANGELOG.md | 2 + packages/adapters/nextjs/package.json | 2 +- packages/adapters/nuxt/CHANGELOG.md | 2 + packages/adapters/nuxt/package.json | 2 +- packages/adapters/sveltekit/CHANGELOG.md | 2 + packages/adapters/sveltekit/package.json | 2 +- packages/cli/CHANGELOG.md | 72 ++++++++++++++++ packages/cli/package.json | 2 +- packages/client-react/CHANGELOG.md | 10 +++ packages/client-react/package.json | 2 +- packages/client/CHANGELOG.md | 9 ++ packages/client/package.json | 2 +- packages/core/CHANGELOG.md | 8 ++ packages/core/package.json | 2 +- packages/create-objectstack/CHANGELOG.md | 2 + packages/create-objectstack/package.json | 2 +- packages/formula/CHANGELOG.md | 8 ++ packages/formula/package.json | 2 +- packages/metadata/CHANGELOG.md | 20 +++++ packages/metadata/package.json | 2 +- packages/objectql/CHANGELOG.md | 34 ++++++++ packages/objectql/package.json | 2 +- packages/platform-objects/CHANGELOG.md | 8 ++ packages/platform-objects/package.json | 2 +- packages/plugins/driver-memory/CHANGELOG.md | 9 ++ packages/plugins/driver-memory/package.json | 2 +- packages/plugins/driver-mongodb/CHANGELOG.md | 9 ++ packages/plugins/driver-mongodb/package.json | 2 +- packages/plugins/driver-sql/CHANGELOG.md | 82 +++++++++++++++++++ packages/plugins/driver-sql/package.json | 2 +- packages/plugins/driver-turso/CHANGELOG.md | 15 ++++ packages/plugins/driver-turso/package.json | 2 +- .../plugins/plugin-approvals/CHANGELOG.md | 12 +++ .../plugins/plugin-approvals/package.json | 2 +- packages/plugins/plugin-audit/CHANGELOG.md | 10 +++ packages/plugins/plugin-audit/package.json | 2 +- packages/plugins/plugin-auth/CHANGELOG.md | 10 +++ packages/plugins/plugin-auth/package.json | 2 +- packages/plugins/plugin-dev/CHANGELOG.md | 9 ++ packages/plugins/plugin-dev/package.json | 2 +- packages/plugins/plugin-email/CHANGELOG.md | 11 +++ packages/plugins/plugin-email/package.json | 2 +- .../plugins/plugin-hono-server/CHANGELOG.md | 9 ++ .../plugins/plugin-hono-server/package.json | 2 +- .../plugins/plugin-mcp-server/CHANGELOG.md | 9 ++ .../plugins/plugin-mcp-server/package.json | 2 +- packages/plugins/plugin-msw/CHANGELOG.md | 14 ++++ packages/plugins/plugin-msw/package.json | 2 +- packages/plugins/plugin-reports/CHANGELOG.md | 11 +++ packages/plugins/plugin-reports/package.json | 2 +- packages/plugins/plugin-security/CHANGELOG.md | 37 +++++++++ packages/plugins/plugin-security/package.json | 2 +- packages/plugins/plugin-sharing/CHANGELOG.md | 15 ++++ packages/plugins/plugin-sharing/package.json | 2 +- packages/plugins/plugin-webhooks/CHANGELOG.md | 10 +++ packages/plugins/plugin-webhooks/package.json | 2 +- packages/rest/CHANGELOG.md | 10 +++ packages/rest/package.json | 2 +- packages/runtime/CHANGELOG.md | 65 +++++++++++++++ packages/runtime/package.json | 2 +- packages/services/service-ai/CHANGELOG.md | 9 ++ packages/services/service-ai/package.json | 2 +- .../services/service-analytics/CHANGELOG.md | 9 ++ .../services/service-analytics/package.json | 2 +- .../services/service-automation/CHANGELOG.md | 10 +++ .../services/service-automation/package.json | 2 +- packages/services/service-cache/CHANGELOG.md | 9 ++ packages/services/service-cache/package.json | 2 +- packages/services/service-feed/CHANGELOG.md | 9 ++ packages/services/service-feed/package.json | 2 +- packages/services/service-i18n/CHANGELOG.md | 9 ++ packages/services/service-i18n/package.json | 2 +- packages/services/service-job/CHANGELOG.md | 10 +++ packages/services/service-job/package.json | 2 +- .../services/service-package/CHANGELOG.md | 9 ++ .../services/service-package/package.json | 2 +- packages/services/service-queue/CHANGELOG.md | 10 +++ packages/services/service-queue/package.json | 2 +- .../services/service-realtime/CHANGELOG.md | 10 +++ .../services/service-realtime/package.json | 2 +- .../services/service-settings/CHANGELOG.md | 11 +++ .../services/service-settings/package.json | 22 +++-- .../services/service-storage/CHANGELOG.md | 9 ++ .../services/service-storage/package.json | 2 +- packages/services/service-tenant/CHANGELOG.md | 11 +++ packages/services/service-tenant/package.json | 2 +- packages/spec/CHANGELOG.md | 12 +++ packages/spec/package.json | 2 +- packages/types/CHANGELOG.md | 8 ++ packages/types/package.json | 2 +- packages/vscode-objectstack/CHANGELOG.md | 2 + packages/vscode-objectstack/package.json | 2 +- 125 files changed, 848 insertions(+), 296 deletions(-) delete mode 100644 .changeset/action-param-required-default.md delete mode 100644 .changeset/artifact-first-boot.md delete mode 100644 .changeset/cloud-split-cleanup.md delete mode 100644 .changeset/cull-low-value-crm-reports.md delete mode 100644 .changeset/highlights-rich-fields.md delete mode 100644 .changeset/leaner-account-setup.md delete mode 100644 .changeset/metadata-v3-1.md delete mode 100644 .changeset/raw-execute-tenant-warn.md delete mode 100644 .changeset/runtime-observability-primitives.md delete mode 100644 .changeset/runtime-security-primitives.md delete mode 100644 .changeset/security-fls-write-enforcement.md delete mode 100644 .changeset/sql-autonumber-tenant.md delete mode 100644 .changeset/sql-autonumber.md delete mode 100644 .changeset/sql-tenant-scope.md delete mode 100644 .changeset/tenant-declarative.md create mode 100644 packages/plugins/plugin-approvals/CHANGELOG.md create mode 100644 packages/plugins/plugin-email/CHANGELOG.md create mode 100644 packages/plugins/plugin-reports/CHANGELOG.md create mode 100644 packages/plugins/plugin-sharing/CHANGELOG.md create mode 100644 packages/plugins/plugin-webhooks/CHANGELOG.md create mode 100644 packages/services/service-settings/CHANGELOG.md diff --git a/.changeset/action-param-required-default.md b/.changeset/action-param-required-default.md deleted file mode 100644 index 7d64c5c951..0000000000 --- a/.changeset/action-param-required-default.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@objectstack/spec': patch ---- - -`ActionParamSchema.required` now defaults to `false` (was effectively `undefined`). Functionally equivalent for existing consumers (which check truthiness), but makes the parsed object shape complete and unblocks downstream type narrowing. Fixes pre-existing failing test `action.test.ts > should accept minimal action parameter`. diff --git a/.changeset/artifact-first-boot.md b/.changeset/artifact-first-boot.md deleted file mode 100644 index 8b97c359f6..0000000000 --- a/.changeset/artifact-first-boot.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@objectstack/runtime": minor -"@objectstack/cli": minor ---- - -Artifact-first boot: `objectstack start` (and `objectstack serve`) now boot directly from a compiled `dist/objectstack.json` when no `objectstack.config.ts` is present. - -- `@objectstack/runtime` exports `createDefaultHostConfig()` and `resolveDefaultArtifactPath()` — a standalone-only default host that wraps `createStandaloneStack()` and surfaces the artifact's `requires` / `objects` / `manifest`. No dependency on `@objectstack/service-cloud`. -- `objectstack start` accepts `OS_ARTIFACT_PATH` as a file path **or** an `http(s)://` URL. New flags `--artifact`, `--database`, `--database-driver`, `--database-auth-token`, `--auth-secret`, `--project-id`, `--port` let you specify all runtime conditions on the command line (each overrides the matching env var). -- `objectstack dev` accepts the same runtime-override flags. When `--artifact` is supplied, the auto-compile step is skipped and the dev server boots the supplied artifact directly — no `objectstack.config.ts` required in cwd. -- `objectstack start` no longer mounts Studio / Account / Console by default — those are dev/admin surfaces. Pass `--ui` to opt back in. -- `objectstack serve` falls back to the default host config when the config file is missing but an artifact is resolvable. -- `apps/objectos` (cloud / multi-project) is unchanged. - diff --git a/.changeset/cloud-split-cleanup.md b/.changeset/cloud-split-cleanup.md deleted file mode 100644 index 3fe6d33e01..0000000000 --- a/.changeset/cloud-split-cleanup.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/cli': minor ---- - -CLI no longer hard-depends on `@objectstack/service-cloud`. The control plane -(`apps/cloud` + `@objectstack/service-cloud`) and tenant runtime (`apps/objectos`) -have been split into a private companion repo `objectstack-ai/cloud`. Framework -remains pure open-core. - -User impact: -- `os serve --mode=cloud` keeps working in cloud-aware distributions — the CLI - loads `@objectstack/service-cloud` via dynamic `import()` with try/catch and - surfaces a clear "install the cloud distribution" hint when absent. -- Root `pnpm dev` / `pnpm start` / `pnpm doctor` scripts in this repo are - removed (they were thin filters of `@objectstack/objectos`, which no longer - lives here). For a runnable local stack, use one of the examples - (`pnpm --filter @example/app-crm dev`). diff --git a/.changeset/cull-low-value-crm-reports.md b/.changeset/cull-low-value-crm-reports.md deleted file mode 100644 index 6d92cfbdbd..0000000000 --- a/.changeset/cull-low-value-crm-reports.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/example-crm': patch ---- - -chore(example-crm): cull duplicate/low-value reports - -Remove three reports from the CRM example that didn't pass the -"Report vs. Dashboard" value test: - -- `LeadsBySourceReport` (single-dim count by `lead_source`) — fully - redundant with the sales dashboard's "Lead Source" pie tile. -- `ContactsByAccountReport` — really a Contact List View grouped by - account, not a report. -- `TasksByOwnerReport` — single-dim count, not navigated anywhere. - -Remaining 10 reports keep full shape coverage: summary (2), matrix (4), -joined (2), multi-pane (1) plus a chartful summary. diff --git a/.changeset/highlights-rich-fields.md b/.changeset/highlights-rich-fields.md deleted file mode 100644 index 1c39317b21..0000000000 --- a/.changeset/highlights-rich-fields.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@objectstack/spec': minor ---- - -`record:highlights` now accepts richer field items. - -Each entry in `fields` may be either a bare field name (backward compatible) or an object `{ name, label?, icon?, type? }` that lets the schema override the displayed label, attach a Lucide icon, or force a specific cell renderer without editing the underlying object metadata. Useful when the same field appears in multiple highlight strips with different framing (e.g. "Annual Revenue" vs "ARR") or when you want a tiny icon for status-like fields. diff --git a/.changeset/leaner-account-setup.md b/.changeset/leaner-account-setup.md deleted file mode 100644 index 65dc7a0f84..0000000000 --- a/.changeset/leaner-account-setup.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@objectstack/account': patch ---- - -Trim the first-run `/setup` page. Removed the optional teammate-invite section, the manually-edited org slug field, the large shield banner and the footer note. The form is now 4 fields (name + org name on one row, then email + password) with concise copy — the new owner can invite teammates from the dashboard after first login. diff --git a/.changeset/metadata-v3-1.md b/.changeset/metadata-v3-1.md deleted file mode 100644 index c5ae0d5d16..0000000000 --- a/.changeset/metadata-v3-1.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@objectstack/metadata": minor ---- - -v3.1 — Runtime controls & read-through cache. - -- Generic `LRUCache` (lazy TTL, promote-on-get, size cap, hits/misses/hitRate stats) wired into `DatabaseLoader.{load,loadMany,list,stat}` with write invalidation. Configured via `cache.databaseLoader`. -- `MetadataPluginConfig.bootstrap` modes: `eager` (default), `lazy`, `artifact-only`. `artifact-only` requires `artifactSource.mode = 'local-file'`. -- `MetadataManagerConfig.persistence` two-axis write gates: `writable` (gates `register()`) and `overlayWritable` (gates `saveOverlay()`). Both default `true`; either becomes a throw under `validation.throwOnError`. -- Single-source schema discipline: canonical `MetadataManagerConfigSchema` / `MetadataFallbackStrategySchema` live in `kernel/metadata-loader.zod.ts` and are re-exported from `system/metadata-persistence.zod.ts`. diff --git a/.changeset/raw-execute-tenant-warn.md b/.changeset/raw-execute-tenant-warn.md deleted file mode 100644 index 1f057a67ce..0000000000 --- a/.changeset/raw-execute-tenant-warn.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@objectstack/driver-sql': patch -'@objectstack/objectql': patch ---- - -Document the tenant-isolation bypass on raw `execute()` (both `SqlDriver.execute()` and `engine.execute()`). The behaviour is unchanged — `execute()` has always passed commands through verbatim — but the JSDoc now spells out the security contract so callers know they must inline `WHERE organization_id = ?` themselves or restrict raw execution to genuinely global statements (migrations, control-plane tables). diff --git a/.changeset/runtime-observability-primitives.md b/.changeset/runtime-observability-primitives.md deleted file mode 100644 index f33be05947..0000000000 --- a/.changeset/runtime-observability-primitives.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -'@objectstack/runtime': minor ---- - -Add production observability primitives. `createDispatcherPlugin` now -exposes an `observability` config that auto-instruments every mounted -route with: - -- Request-id propagation: `X-Request-Id` echo + `req.requestId` (honors - incoming header when well-formed, mints `req_` otherwise). -- `http_requests_total{method,route,status}` counter. -- `http_request_duration_ms{method,route}` histogram. -- `http_request_errors_total{method,route}` counter. -- Error reporter call for 5xx (4xx are intentionally tracked via - metrics only, not reported, to keep APM signal:noise high). - -All defaults are no-op (zero overhead). Hosts plug their own -`MetricsRegistry` (Prometheus / OTel) and `ErrorReporter` (Sentry / -Datadog) — see `docs/OBSERVABILITY.md` for adapter recipes and the -go-live checklist. - -Standalone primitives also exported for adapter-layer use: -`extractRequestId`, `resolveRequestId`, `parseTraceparent`, -`formatTraceparent`, `InMemoryMetricsRegistry`, -`InMemoryErrorReporter`, `instrumentRouteHandler`. diff --git a/.changeset/runtime-security-primitives.md b/.changeset/runtime-security-primitives.md deleted file mode 100644 index 4597c24db2..0000000000 --- a/.changeset/runtime-security-primitives.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -'@objectstack/runtime': minor ---- - -Add production HTTP hardening primitives. `createDispatcherPlugin` now -sends conservative security response headers by default -(CSP / X-Content-Type-Options / X-Frame-Options / Referrer-Policy / -Permissions-Policy / Cross-Origin-Resource-Policy). HSTS is opt-in. - -Caller can disable with `securityHeaders: false` (e.g., when an upstream -reverse proxy already injects them) or customize per-header via -`SecurityHeadersOptions`. - -Also exports a standalone token-bucket `RateLimiter` with a pluggable -`RateLimitStore` interface (in-memory default; trivially backed by -Redis) and curated `DEFAULT_RATE_LIMITS` for auth / write / read buckets. -The limiter is NOT auto-wired into the dispatcher — adapter-layer -wire-up (Fastify / Hono / Express) is recommended for proper IP/key -extraction; see `docs/HARDENING.md` for recipes. diff --git a/.changeset/security-fls-write-enforcement.md b/.changeset/security-fls-write-enforcement.md deleted file mode 100644 index 1148ed60a7..0000000000 --- a/.changeset/security-fls-write-enforcement.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -'@objectstack/plugin-security': minor ---- - -Add server-side Field-Level Security write enforcement. Client-side -ObjectForm / inline-grid already hides non-editable fields, but the -SecurityPlugin middleware previously only enforced FLS on **read** -(`maskResults` on find/findOne). Insert and update operations could -target any field — a hand-crafted POST bypassed FLS entirely. - -The middleware now runs `FieldMasker.detectForbiddenWrites` on every -insert / update payload (single record or bulk array) and throws -`PermissionDeniedError` (HTTP 403) when the payload references a field -the caller is not permitted to edit. The offending field list is -exposed via `details.forbiddenFields` for actionable client error UI. - -Allow-list semantics: only fields explicitly enumerated in a -permission set's `fields` map are constrained. System operations -(`ExecutionContext.isSystem`) continue to bypass the check. - -Why throw vs. silently stripping: silent strip hides the boundary -from honest clients (partial-save confusion) AND gives probing clients -no signal that the field exists. Throwing makes the boundary -observable in both directions. - -Also exposes `FieldMasker.detectForbiddenWrites(data, fieldPermissions)` -as a standalone helper for callers that want to do the check -out-of-band (e.g., adapters that strip-then-warn instead of fail-closed). diff --git a/.changeset/sql-autonumber-tenant.md b/.changeset/sql-autonumber-tenant.md deleted file mode 100644 index a8fbb3d48c..0000000000 --- a/.changeset/sql-autonumber-tenant.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -'@objectstack/driver-sql': minor ---- - -feat(driver-sql): tenant-isolated auto_number sequences backed by a persistent counter table - -**Breaking nothing; new behaviour is opt-in via object schema.** - -The SQL driver now generates auto_number / autonumber field values via a -dedicated `_objectstack_sequences` table keyed by -`(object, tenant_id, field)` instead of scanning the data table for the -current MAX on every insert. - -Highlights: - -- **Tenant isolation.** Objects with an `organization_id` field get a - separate counter per organization. Two tenants creating contracts at - the same time both legitimately observe `CTR-0001`, `CTR-0002`, … in - their own namespaces — they no longer interleave or skip numbers. -- **Tenant resolution.** Source order: `row[organization_id]` → - `DriverOptions.tenantId` → `__global__` sentinel for org-less objects - (e.g. setup-side singletons share one counter). -- **Bootstrap from existing data.** On the first reservation in a new - `(object, tenant, field)` tuple, the driver seeds `last_value` from the - current per-tenant MAX so legacy/seeded records keep their position - and downstream inserts pick up monotonically (gaps are tolerated). -- **Atomic increment.** Each reservation runs in a transaction with - `SELECT … FOR UPDATE` (where the dialect supports it) and a single - `UPDATE` of `last_value`. Tested with 25 concurrent inserts in one - tenant producing 25 distinct sequence values. -- **Caller overrides honoured.** A row that already has an explicit - value for the auto_number field is left untouched, and the sequence - bootstrap respects that value so future reservations advance past it. -- **Dual spelling.** Both `type: 'auto_number'` (snake) and - `type: 'autonumber'` (the spec factory output) are recognised. - -Migration notes: - -- The first time the driver handles an auto_number insert, it creates - the `_objectstack_sequences` table automatically — no manual DDL. -- Pre-existing data is not renumbered. Gaps introduced by older - cross-tenant logic (where a tenant's number could "jump" because it - inherited another tenant's MAX) remain in place; subsequent inserts - continue from `MAX + 1` in the affected tenant. diff --git a/.changeset/sql-autonumber.md b/.changeset/sql-autonumber.md deleted file mode 100644 index 4122c4069f..0000000000 --- a/.changeset/sql-autonumber.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@objectstack/driver-sql': minor ---- - -Generate `auto_number` / `autonumber` field values on insert. The driver -parses the field's `format` template (e.g. `CTR-{0000}`) to extract the -prefix and pad-width, then scans existing rows with the same prefix and -emits `prefix + padded(maxN + 1)` for any row that omits the field. - -Note: per-call MAX+1 — not atomic across concurrent writers. Fine for -seed-data and low-write demo loads; production deployments should layer -a dedicated sequence table. diff --git a/.changeset/sql-tenant-scope.md b/.changeset/sql-tenant-scope.md deleted file mode 100644 index 2b8abe861c..0000000000 --- a/.changeset/sql-tenant-scope.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -'@objectstack/driver-sql': minor -'@objectstack/objectql': minor ---- - -**Driver-level tenant isolation for objects with `organization_id`.** - -`SqlDriver` now auto-applies a `WHERE organization_id = :tenantId` predicate on every read/update/delete and auto-injects the column on insert when the caller passes `options.tenantId` and the object schema declares an `organization_id` field. `bulkCreate`, `bulkDelete`, `updateMany`, `deleteMany`, `count` and `aggregate` are all scoped. - -ObjectQL's engine now threads `ExecutionContext.tenantId` into the driver options for every CRUD entry point (including `expandRelatedRecords`), so a tenant-scoped session can no longer cross tenants — even through lookup expansion or count fallbacks. - -Backward compatible: callers that omit `tenantId` (system tasks, seed scripts) keep getting unscoped behaviour. Explicit `organization_id` on an insert row always wins over the contextual `tenantId` so admin tooling can still target a specific tenant. - -13 new tests in `sql-driver-tenant-scope.test.ts` verify cross-tenant find/findOne/update/delete/count/bulkCreate/updateMany/deleteMany isolation, the unscoped admin path, and that global objects (no `organization_id`) are not scoped. diff --git a/.changeset/tenant-declarative.md b/.changeset/tenant-declarative.md deleted file mode 100644 index 75f25b7d4d..0000000000 --- a/.changeset/tenant-declarative.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -'@objectstack/driver-sql': minor -'@objectstack/objectql': patch ---- - -**Declarative tenant scoping + audit warn for missing tenantId.** - -`SqlDriver` now reads `obj.tenancy.tenantField` first when picking the tenant column for an object, falling back to the implicit `organization_id` detection so legacy objects keep working without a spec migration. Set `tenancy: { enabled: true, strategy: 'shared', tenantField: 'workspace_id' }` on any object to use a custom column. - -Writes (`create`, `update`, `delete`, `bulkCreate`, `bulkDelete`, `updateMany`, `deleteMany`, `upsert`) that target a tenant-scoped object **without** `options.tenantId` now emit one `[tenant-audit]` warning per `{object}:{op}` so missing-context bugs surface in CI/logs instead of silently writing globally. The engine auto-silences when `ExecutionContext.isSystem === true` (boot-time seeds, kernel mirrors). Callers can opt out per-call with `options.bypassTenantAudit = true` or globally with `OS_TENANT_AUDIT=0`. - -Driver README now documents the full scope/bypass matrix and the audit warning. - -Three new tests cover the declared-tenant-field path, the audit throttle, and the bypass flag. diff --git a/apps/account/CHANGELOG.md b/apps/account/CHANGELOG.md index 04d45ab220..68681e2d36 100644 --- a/apps/account/CHANGELOG.md +++ b/apps/account/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/account +## 4.0.6 + +### Patch Changes + +- f41466a: Trim the first-run `/setup` page. Removed the optional teammate-invite section, the manually-edited org slug field, the large shield banner and the footer note. The form is now 4 fields (name + org name on one row, then email + password) with concise copy — the new owner can invite teammates from the dashboard after first login. +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/client@4.1.0 + - @objectstack/client-react@4.1.0 + ## 0.1.1 ### Patch Changes diff --git a/apps/account/package.json b/apps/account/package.json index f739634f67..400baae74e 100644 --- a/apps/account/package.json +++ b/apps/account/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/account", - "version": "4.0.5", + "version": "4.0.6", "description": "ObjectStack Account - End-user account & organization self-service portal", "license": "Apache-2.0", "private": true, diff --git a/apps/docs/CHANGELOG.md b/apps/docs/CHANGELOG.md index bc91fdabb2..8e2d4e81c7 100644 --- a/apps/docs/CHANGELOG.md +++ b/apps/docs/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/docs +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/apps/docs/package.json b/apps/docs/package.json index 235535fe75..f960d69258 100644 --- a/apps/docs/package.json +++ b/apps/docs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/docs", - "version": "4.0.5", + "version": "4.1.0", "private": true, "description": "ObjectStack Protocol Documentation Site", "license": "Apache-2.0", diff --git a/apps/studio/CHANGELOG.md b/apps/studio/CHANGELOG.md index bd2267d0c3..2c401a4c37 100644 --- a/apps/studio/CHANGELOG.md +++ b/apps/studio/CHANGELOG.md @@ -1,5 +1,39 @@ # @objectstack/studio +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [96fb108] +- Updated dependencies [23db640] +- Updated dependencies [1234920] +- Updated dependencies [5683206] +- Updated dependencies [70db902] +- Updated dependencies [70db902] +- Updated dependencies [d3b455f] +- Updated dependencies [f0b3972] +- Updated dependencies [0e63f2f] + - @objectstack/spec@4.1.0 + - @objectstack/runtime@4.1.0 + - @objectstack/metadata@4.1.0 + - @objectstack/objectql@4.1.0 + - @objectstack/plugin-security@4.1.0 + - @objectstack/client@4.1.0 + - @objectstack/client-react@4.1.0 + - @objectstack/platform-objects@4.1.0 + - @objectstack/driver-memory@4.1.0 + - @objectstack/driver-turso@4.1.0 + - @objectstack/plugin-audit@4.1.0 + - @objectstack/plugin-auth@4.1.0 + - @objectstack/plugin-msw@4.1.0 + - @objectstack/service-ai@4.1.0 + - @objectstack/service-analytics@4.1.0 + - @objectstack/service-automation@4.1.0 + - @objectstack/service-feed@4.1.0 + - @objectstack/hono@4.1.0 + - @objectstack/service-tenant@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/apps/studio/package.json b/apps/studio/package.json index f75fc3aac4..27112cdecb 100644 --- a/apps/studio/package.json +++ b/apps/studio/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/studio", - "version": "4.0.5", + "version": "4.1.0", "description": "ObjectStack Studio - A metadata-driven admin interface for managing data and configuration", "license": "Apache-2.0", "type": "module", diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md index f6c4c65ac3..4b3ca1b3a4 100644 --- a/examples/app-crm/CHANGELOG.md +++ b/examples/app-crm/CHANGELOG.md @@ -1,5 +1,34 @@ # @objectstack/example-crm +## 4.0.6 + +### Patch Changes + +- fcc54fd: chore(example-crm): cull duplicate/low-value reports + + Remove three reports from the CRM example that didn't pass the + "Report vs. Dashboard" value test: + + - `LeadsBySourceReport` (single-dim count by `lead_source`) — fully + redundant with the sales dashboard's "Lead Source" pie tile. + - `ContactsByAccountReport` — really a Contact List View grouped by + account, not a report. + - `TasksByOwnerReport` — single-dim count, not navigated anywhere. + + Remaining 10 reports keep full shape coverage: summary (2), matrix (4), + joined (2), multi-pane (1) plus a chartful summary. + +- Updated dependencies [2108c30] +- Updated dependencies [96fb108] +- Updated dependencies [23db640] +- Updated dependencies [70db902] +- Updated dependencies [70db902] + - @objectstack/spec@4.1.0 + - @objectstack/runtime@4.1.0 + - @objectstack/driver-mongodb@4.1.0 + - @objectstack/service-analytics@4.1.0 + - @objectstack/service-automation@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json index 79b4a7fd41..d4e59ea6f2 100644 --- a/examples/app-crm/package.json +++ b/examples/app-crm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-crm", - "version": "4.0.5", + "version": "4.0.6", "description": "Example CRM implementation using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md index b6d8121ca5..95304a6ebe 100644 --- a/examples/app-todo/CHANGELOG.md +++ b/examples/app-todo/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/example-todo +## 4.0.6 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [96fb108] +- Updated dependencies [23db640] +- Updated dependencies [5683206] +- Updated dependencies [70db902] +- Updated dependencies [70db902] +- Updated dependencies [f0b3972] +- Updated dependencies [0e63f2f] + - @objectstack/spec@4.1.0 + - @objectstack/runtime@4.1.0 + - @objectstack/objectql@4.1.0 + - @objectstack/client@4.1.0 + - @objectstack/driver-memory@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json index a1b6aa8c63..0273920272 100644 --- a/examples/app-todo/package.json +++ b/examples/app-todo/package.json @@ -1,6 +1,6 @@ { "name": "@example/app-todo", - "version": "4.0.5", + "version": "4.0.6", "description": "Example Todo App using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/packages/adapters/express/CHANGELOG.md b/packages/adapters/express/CHANGELOG.md index 0eab832403..d404b510d6 100644 --- a/packages/adapters/express/CHANGELOG.md +++ b/packages/adapters/express/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/express +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/adapters/express/package.json b/packages/adapters/express/package.json index 1f21a5fff2..f88dc5eead 100644 --- a/packages/adapters/express/package.json +++ b/packages/adapters/express/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/express", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/fastify/CHANGELOG.md b/packages/adapters/fastify/CHANGELOG.md index 51aba0334c..f103128447 100644 --- a/packages/adapters/fastify/CHANGELOG.md +++ b/packages/adapters/fastify/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/fastify +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/adapters/fastify/package.json b/packages/adapters/fastify/package.json index 7adb14bb33..52f150a982 100644 --- a/packages/adapters/fastify/package.json +++ b/packages/adapters/fastify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/fastify", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md index 5c29d592b0..3c901e7958 100644 --- a/packages/adapters/hono/CHANGELOG.md +++ b/packages/adapters/hono/CHANGELOG.md @@ -1,5 +1,11 @@ # @objectstack/hono +## 4.1.0 + +### Patch Changes + +- @objectstack/plugin-hono-server@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json index 5d31bcb31a..e868169ed0 100644 --- a/packages/adapters/hono/package.json +++ b/packages/adapters/hono/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/hono", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/nestjs/CHANGELOG.md b/packages/adapters/nestjs/CHANGELOG.md index bbc8184354..3a3560ef37 100644 --- a/packages/adapters/nestjs/CHANGELOG.md +++ b/packages/adapters/nestjs/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/nestjs +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/adapters/nestjs/package.json b/packages/adapters/nestjs/package.json index cd015572fc..997996bab2 100644 --- a/packages/adapters/nestjs/package.json +++ b/packages/adapters/nestjs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/nestjs", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/nextjs/CHANGELOG.md b/packages/adapters/nextjs/CHANGELOG.md index ab8e90c86b..66332b6fb7 100644 --- a/packages/adapters/nextjs/CHANGELOG.md +++ b/packages/adapters/nextjs/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/nextjs +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/adapters/nextjs/package.json b/packages/adapters/nextjs/package.json index 13a1b1a130..75ce78edfc 100644 --- a/packages/adapters/nextjs/package.json +++ b/packages/adapters/nextjs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/nextjs", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/nuxt/CHANGELOG.md b/packages/adapters/nuxt/CHANGELOG.md index ac11d472b4..4744b6f7f9 100644 --- a/packages/adapters/nuxt/CHANGELOG.md +++ b/packages/adapters/nuxt/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/nuxt +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/adapters/nuxt/package.json b/packages/adapters/nuxt/package.json index fcc62f9922..dffeca9c44 100644 --- a/packages/adapters/nuxt/package.json +++ b/packages/adapters/nuxt/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/nuxt", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/sveltekit/CHANGELOG.md b/packages/adapters/sveltekit/CHANGELOG.md index 89f1d5f4d6..928d4b177d 100644 --- a/packages/adapters/sveltekit/CHANGELOG.md +++ b/packages/adapters/sveltekit/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/sveltekit +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/adapters/sveltekit/package.json b/packages/adapters/sveltekit/package.json index 7985439246..307538c624 100644 --- a/packages/adapters/sveltekit/package.json +++ b/packages/adapters/sveltekit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/sveltekit", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index f3459e9efa..6d66e00d5d 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,77 @@ # @objectstack/cli +## 4.1.0 + +### Minor Changes + +- 96fb108: Artifact-first boot: `objectstack start` (and `objectstack serve`) now boot directly from a compiled `dist/objectstack.json` when no `objectstack.config.ts` is present. + + - `@objectstack/runtime` exports `createDefaultHostConfig()` and `resolveDefaultArtifactPath()` — a standalone-only default host that wraps `createStandaloneStack()` and surfaces the artifact's `requires` / `objects` / `manifest`. No dependency on `@objectstack/service-cloud`. + - `objectstack start` accepts `OS_ARTIFACT_PATH` as a file path **or** an `http(s)://` URL. New flags `--artifact`, `--database`, `--database-driver`, `--database-auth-token`, `--auth-secret`, `--project-id`, `--port` let you specify all runtime conditions on the command line (each overrides the matching env var). + - `objectstack dev` accepts the same runtime-override flags. When `--artifact` is supplied, the auto-compile step is skipped and the dev server boots the supplied artifact directly — no `objectstack.config.ts` required in cwd. + - `objectstack start` no longer mounts Studio / Account / Console by default — those are dev/admin surfaces. Pass `--ui` to opt back in. + - `objectstack serve` falls back to the default host config when the config file is missing but an artifact is resolvable. + - `apps/objectos` (cloud / multi-project) is unchanged. + +- 8cbc768: CLI no longer hard-depends on `@objectstack/service-cloud`. The control plane + (`apps/cloud` + `@objectstack/service-cloud`) and tenant runtime (`apps/objectos`) + have been split into a private companion repo `objectstack-ai/cloud`. Framework + remains pure open-core. + + User impact: + + - `os serve --mode=cloud` keeps working in cloud-aware distributions — the CLI + loads `@objectstack/service-cloud` via dynamic `import()` with try/catch and + surfaces a clear "install the cloud distribution" hint when absent. + - Root `pnpm dev` / `pnpm start` / `pnpm doctor` scripts in this repo are + removed (they were thin filters of `@objectstack/objectos`, which no longer + lives here). For a runnable local stack, use one of the examples + (`pnpm --filter @example/app-crm dev`). + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [96fb108] +- Updated dependencies [23db640] +- Updated dependencies [5683206] +- Updated dependencies [70db902] +- Updated dependencies [70db902] +- Updated dependencies [d3b455f] +- Updated dependencies [0cc0374] +- Updated dependencies [5b878d9] +- Updated dependencies [f0b3972] +- Updated dependencies [0e63f2f] + - @objectstack/spec@4.1.0 + - @objectstack/runtime@4.1.0 + - @objectstack/driver-sql@4.1.0 + - @objectstack/objectql@4.1.0 + - @objectstack/plugin-security@4.1.0 + - @objectstack/client@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/driver-memory@4.1.0 + - @objectstack/driver-mongodb@4.1.0 + - @objectstack/driver-turso@4.1.0 + - @objectstack/plugin-approvals@4.0.1 + - @objectstack/plugin-audit@4.1.0 + - @objectstack/plugin-auth@4.1.0 + - @objectstack/plugin-email@4.0.1 + - @objectstack/plugin-hono-server@4.1.0 + - @objectstack/plugin-mcp-server@4.1.0 + - @objectstack/plugin-reports@4.0.1 + - @objectstack/plugin-sharing@4.0.1 + - @objectstack/rest@4.1.0 + - @objectstack/service-ai@4.1.0 + - @objectstack/service-analytics@4.1.0 + - @objectstack/service-automation@4.1.0 + - @objectstack/service-cache@4.1.0 + - @objectstack/service-feed@4.1.0 + - @objectstack/service-job@4.1.0 + - @objectstack/service-package@4.1.0 + - @objectstack/service-queue@4.1.0 + - @objectstack/service-realtime@4.1.0 + - @objectstack/service-settings@0.1.1 + - @objectstack/service-storage@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index f5088e63fe..0af074feb9 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cli", - "version": "4.0.5", + "version": "4.1.0", "description": "Command Line Interface for ObjectStack Protocol", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md index 2e5c79750e..74ec7d8225 100644 --- a/packages/client-react/CHANGELOG.md +++ b/packages/client-react/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/client-react +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/client@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/client-react/package.json b/packages/client-react/package.json index 94a629f1c5..6b1f2e7ab6 100644 --- a/packages/client-react/package.json +++ b/packages/client-react/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client-react", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "React hooks for ObjectStack Client SDK", "main": "dist/index.js", diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index d06cc40cf0..75240e8f2c 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/client +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/client/package.json b/packages/client/package.json index afeb9ca6f0..a11e20664a 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Official Client SDK for ObjectStack Protocol", "main": "dist/index.js", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index d5334602f3..b9bc83d5c8 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,13 @@ # @objectstack/core +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index 6546012404..6502b94187 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/core", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Microkernel Core for ObjectStack", "type": "module", diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md index 88f52b44b4..e969b07185 100644 --- a/packages/create-objectstack/CHANGELOG.md +++ b/packages/create-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # create-objectstack +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index d9148ee892..b178a5c6d3 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -1,6 +1,6 @@ { "name": "create-objectstack", - "version": "4.0.5", + "version": "4.1.0", "description": "Create a new ObjectStack project — npx create-objectstack", "bin": { "create-objectstack": "./bin/create-objectstack.js" diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md index fcb4de7238..f1f490ee36 100644 --- a/packages/formula/CHANGELOG.md +++ b/packages/formula/CHANGELOG.md @@ -1,5 +1,13 @@ # @objectstack/formula +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/formula/package.json b/packages/formula/package.json index 5e83785181..6b5d912f8e 100644 --- a/packages/formula/package.json +++ b/packages/formula/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/formula", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry", "main": "dist/index.js", diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md index 1977cb3896..4bdae4067e 100644 --- a/packages/metadata/CHANGELOG.md +++ b/packages/metadata/CHANGELOG.md @@ -1,5 +1,25 @@ # @objectstack/metadata +## 4.1.0 + +### Minor Changes + +- 1234920: v3.1 — Runtime controls & read-through cache. + + - Generic `LRUCache` (lazy TTL, promote-on-get, size cap, hits/misses/hitRate stats) wired into `DatabaseLoader.{load,loadMany,list,stat}` with write invalidation. Configured via `cache.databaseLoader`. + - `MetadataPluginConfig.bootstrap` modes: `eager` (default), `lazy`, `artifact-only`. `artifact-only` requires `artifactSource.mode = 'local-file'`. + - `MetadataManagerConfig.persistence` two-axis write gates: `writable` (gates `register()`) and `overlayWritable` (gates `saveOverlay()`). Both default `true`; either becomes a throw under `validation.throwOnError`. + - Single-source schema discipline: canonical `MetadataManagerConfigSchema` / `MetadataFallbackStrategySchema` live in `kernel/metadata-loader.zod.ts` and are re-exported from `system/metadata-persistence.zod.ts`. + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + - @objectstack/types@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/metadata/package.json b/packages/metadata/package.json index 5919bf9c6c..f5db7aa4a4 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Metadata loading, saving, and persistence for ObjectStack", "type": "module", diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md index bdc58773d4..8f771546ae 100644 --- a/packages/objectql/CHANGELOG.md +++ b/packages/objectql/CHANGELOG.md @@ -1,5 +1,39 @@ # @objectstack/objectql +## 4.1.0 + +### Minor Changes + +- f0b3972: **Driver-level tenant isolation for objects with `organization_id`.** + + `SqlDriver` now auto-applies a `WHERE organization_id = :tenantId` predicate on every read/update/delete and auto-injects the column on insert when the caller passes `options.tenantId` and the object schema declares an `organization_id` field. `bulkCreate`, `bulkDelete`, `updateMany`, `deleteMany`, `count` and `aggregate` are all scoped. + + ObjectQL's engine now threads `ExecutionContext.tenantId` into the driver options for every CRUD entry point (including `expandRelatedRecords`), so a tenant-scoped session can no longer cross tenants — even through lookup expansion or count fallbacks. + + Backward compatible: callers that omit `tenantId` (system tasks, seed scripts) keep getting unscoped behaviour. Explicit `organization_id` on an insert row always wins over the contextual `tenantId` so admin tooling can still target a specific tenant. + + 13 new tests in `sql-driver-tenant-scope.test.ts` verify cross-tenant find/findOne/update/delete/count/bulkCreate/updateMany/deleteMany isolation, the unscoped admin path, and that global objects (no `organization_id`) are not scoped. + +### Patch Changes + +- 5683206: Document the tenant-isolation bypass on raw `execute()` (both `SqlDriver.execute()` and `engine.execute()`). The behaviour is unchanged — `execute()` has always passed commands through verbatim — but the JSDoc now spells out the security contract so callers know they must inline `WHERE organization_id = ?` themselves or restrict raw execution to genuinely global statements (migrations, control-plane tables). +- 0e63f2f: **Declarative tenant scoping + audit warn for missing tenantId.** + + `SqlDriver` now reads `obj.tenancy.tenantField` first when picking the tenant column for an object, falling back to the implicit `organization_id` detection so legacy objects keep working without a spec migration. Set `tenancy: { enabled: true, strategy: 'shared', tenantField: 'workspace_id' }` on any object to use a custom column. + + Writes (`create`, `update`, `delete`, `bulkCreate`, `bulkDelete`, `updateMany`, `deleteMany`, `upsert`) that target a tenant-scoped object **without** `options.tenantId` now emit one `[tenant-audit]` warning per `{object}:{op}` so missing-context bugs surface in CI/logs instead of silently writing globally. The engine auto-silences when `ExecutionContext.isSystem === true` (boot-time seeds, kernel mirrors). Callers can opt out per-call with `options.bypassTenantAudit = true` or globally with `OS_TENANT_AUDIT=0`. + + Driver README now documents the full scope/bypass matrix and the audit warning. + + Three new tests cover the declared-tenant-field path, the audit throttle, and the bypass flag. + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/formula@4.1.0 + - @objectstack/types@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/objectql/package.json b/packages/objectql/package.json index eae5f064da..3a45cf5028 100644 --- a/packages/objectql/package.json +++ b/packages/objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/objectql", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Isomorphic ObjectQL Engine for ObjectStack", "main": "dist/index.js", diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md index 5f1fc37b93..a9a093a411 100644 --- a/packages/platform-objects/CHANGELOG.md +++ b/packages/platform-objects/CHANGELOG.md @@ -1,5 +1,13 @@ # @objectstack/platform-objects +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json index 9b1f93b152..23e6e4e2aa 100644 --- a/packages/platform-objects/package.json +++ b/packages/platform-objects/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/platform-objects", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects", "main": "dist/index.js", diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md index e54b765061..2598005b4b 100644 --- a/packages/plugins/driver-memory/CHANGELOG.md +++ b/packages/plugins/driver-memory/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/driver-memory +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json index 40873bf15c..41aa5eb4b1 100644 --- a/packages/plugins/driver-memory/package.json +++ b/packages/plugins/driver-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-memory", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "In-Memory Driver for ObjectStack (Reference Implementation)", "main": "dist/index.js", diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md index 27fb3dd3ed..4a15e8c16d 100644 --- a/packages/plugins/driver-mongodb/CHANGELOG.md +++ b/packages/plugins/driver-mongodb/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/driver-mongodb +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json index 0859605ffa..3173f3dcd7 100644 --- a/packages/plugins/driver-mongodb/package.json +++ b/packages/plugins/driver-mongodb/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-mongodb", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client", "main": "dist/index.js", diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md index 9759a4e04b..daeea74383 100644 --- a/packages/plugins/driver-sql/CHANGELOG.md +++ b/packages/plugins/driver-sql/CHANGELOG.md @@ -1,5 +1,87 @@ # @objectstack/driver-sql +## 4.1.0 + +### Minor Changes + +- 0cc0374: feat(driver-sql): tenant-isolated auto_number sequences backed by a persistent counter table + + **Breaking nothing; new behaviour is opt-in via object schema.** + + The SQL driver now generates auto_number / autonumber field values via a + dedicated `_objectstack_sequences` table keyed by + `(object, tenant_id, field)` instead of scanning the data table for the + current MAX on every insert. + + Highlights: + + - **Tenant isolation.** Objects with an `organization_id` field get a + separate counter per organization. Two tenants creating contracts at + the same time both legitimately observe `CTR-0001`, `CTR-0002`, … in + their own namespaces — they no longer interleave or skip numbers. + - **Tenant resolution.** Source order: `row[organization_id]` → + `DriverOptions.tenantId` → `__global__` sentinel for org-less objects + (e.g. setup-side singletons share one counter). + - **Bootstrap from existing data.** On the first reservation in a new + `(object, tenant, field)` tuple, the driver seeds `last_value` from the + current per-tenant MAX so legacy/seeded records keep their position + and downstream inserts pick up monotonically (gaps are tolerated). + - **Atomic increment.** Each reservation runs in a transaction with + `SELECT … FOR UPDATE` (where the dialect supports it) and a single + `UPDATE` of `last_value`. Tested with 25 concurrent inserts in one + tenant producing 25 distinct sequence values. + - **Caller overrides honoured.** A row that already has an explicit + value for the auto_number field is left untouched, and the sequence + bootstrap respects that value so future reservations advance past it. + - **Dual spelling.** Both `type: 'auto_number'` (snake) and + `type: 'autonumber'` (the spec factory output) are recognised. + + Migration notes: + + - The first time the driver handles an auto_number insert, it creates + the `_objectstack_sequences` table automatically — no manual DDL. + - Pre-existing data is not renumbered. Gaps introduced by older + cross-tenant logic (where a tenant's number could "jump" because it + inherited another tenant's MAX) remain in place; subsequent inserts + continue from `MAX + 1` in the affected tenant. + +- 5b878d9: Generate `auto_number` / `autonumber` field values on insert. The driver + parses the field's `format` template (e.g. `CTR-{0000}`) to extract the + prefix and pad-width, then scans existing rows with the same prefix and + emits `prefix + padded(maxN + 1)` for any row that omits the field. + + Note: per-call MAX+1 — not atomic across concurrent writers. Fine for + seed-data and low-write demo loads; production deployments should layer + a dedicated sequence table. + +- f0b3972: **Driver-level tenant isolation for objects with `organization_id`.** + + `SqlDriver` now auto-applies a `WHERE organization_id = :tenantId` predicate on every read/update/delete and auto-injects the column on insert when the caller passes `options.tenantId` and the object schema declares an `organization_id` field. `bulkCreate`, `bulkDelete`, `updateMany`, `deleteMany`, `count` and `aggregate` are all scoped. + + ObjectQL's engine now threads `ExecutionContext.tenantId` into the driver options for every CRUD entry point (including `expandRelatedRecords`), so a tenant-scoped session can no longer cross tenants — even through lookup expansion or count fallbacks. + + Backward compatible: callers that omit `tenantId` (system tasks, seed scripts) keep getting unscoped behaviour. Explicit `organization_id` on an insert row always wins over the contextual `tenantId` so admin tooling can still target a specific tenant. + + 13 new tests in `sql-driver-tenant-scope.test.ts` verify cross-tenant find/findOne/update/delete/count/bulkCreate/updateMany/deleteMany isolation, the unscoped admin path, and that global objects (no `organization_id`) are not scoped. + +- 0e63f2f: **Declarative tenant scoping + audit warn for missing tenantId.** + + `SqlDriver` now reads `obj.tenancy.tenantField` first when picking the tenant column for an object, falling back to the implicit `organization_id` detection so legacy objects keep working without a spec migration. Set `tenancy: { enabled: true, strategy: 'shared', tenantField: 'workspace_id' }` on any object to use a custom column. + + Writes (`create`, `update`, `delete`, `bulkCreate`, `bulkDelete`, `updateMany`, `deleteMany`, `upsert`) that target a tenant-scoped object **without** `options.tenantId` now emit one `[tenant-audit]` warning per `{object}:{op}` so missing-context bugs surface in CI/logs instead of silently writing globally. The engine auto-silences when `ExecutionContext.isSystem === true` (boot-time seeds, kernel mirrors). Callers can opt out per-call with `options.bypassTenantAudit = true` or globally with `OS_TENANT_AUDIT=0`. + + Driver README now documents the full scope/bypass matrix and the audit warning. + + Three new tests cover the declared-tenant-field path, the audit throttle, and the bypass flag. + +### Patch Changes + +- 5683206: Document the tenant-isolation bypass on raw `execute()` (both `SqlDriver.execute()` and `engine.execute()`). The behaviour is unchanged — `execute()` has always passed commands through verbatim — but the JSDoc now spells out the security contract so callers know they must inline `WHERE organization_id = ?` themselves or restrict raw execution to genuinely global statements (migrations, control-plane tables). +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json index 159a0a66a2..aad0adae81 100644 --- a/packages/plugins/driver-sql/package.json +++ b/packages/plugins/driver-sql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sql", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex", "main": "dist/index.js", diff --git a/packages/plugins/driver-turso/CHANGELOG.md b/packages/plugins/driver-turso/CHANGELOG.md index 06da73ab71..a3a7ca71b4 100644 --- a/packages/plugins/driver-turso/CHANGELOG.md +++ b/packages/plugins/driver-turso/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/driver-turso +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] +- Updated dependencies [5683206] +- Updated dependencies [0cc0374] +- Updated dependencies [5b878d9] +- Updated dependencies [f0b3972] +- Updated dependencies [0e63f2f] + - @objectstack/spec@4.1.0 + - @objectstack/driver-sql@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/driver-turso/package.json b/packages/plugins/driver-turso/package.json index 338e903b29..431b1e8eb3 100644 --- a/packages/plugins/driver-turso/package.json +++ b/packages/plugins/driver-turso/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-turso", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Turso/libSQL Driver for ObjectStack — Edge-first SQLite with embedded replicas and multi-tenancy", "keywords": [ diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md new file mode 100644 index 0000000000..775759e95c --- /dev/null +++ b/packages/plugins/plugin-approvals/CHANGELOG.md @@ -0,0 +1,12 @@ +# @objectstack/plugin-approvals + +## 4.0.1 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/formula@4.1.0 + - @objectstack/platform-objects@4.1.0 diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json index 1216479c50..d702ba8241 100644 --- a/packages/plugins/plugin-approvals/package.json +++ b/packages/plugins/plugin-approvals/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-approvals", - "version": "4.0.0", + "version": "4.0.1", "license": "Apache-2.0", "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md index ea333fce20..912c484073 100644 --- a/packages/plugins/plugin-audit/CHANGELOG.md +++ b/packages/plugins/plugin-audit/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/plugin-audit +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json index 3dcc1395a0..236def6e85 100644 --- a/packages/plugins/plugin-audit/package.json +++ b/packages/plugins/plugin-audit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-audit", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Audit Plugin for ObjectStack — System audit log object and audit trail", "main": "dist/index.js", diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md index c93731dc50..6456385a10 100644 --- a/packages/plugins/plugin-auth/CHANGELOG.md +++ b/packages/plugins/plugin-auth/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index 8564eab33e..38f0a5cf9d 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-auth", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Authentication & Identity Plugin for ObjectStack", "main": "dist/index.js", diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md index 3c5738004c..5a5877b6ae 100644 --- a/packages/plugins/plugin-dev/CHANGELOG.md +++ b/packages/plugins/plugin-dev/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/plugin-dev +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json index d39056802e..c65008e4a2 100644 --- a/packages/plugins/plugin-dev/package.json +++ b/packages/plugins/plugin-dev/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-dev", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations", "main": "dist/index.js", diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md new file mode 100644 index 0000000000..df3d03f481 --- /dev/null +++ b/packages/plugins/plugin-email/CHANGELOG.md @@ -0,0 +1,11 @@ +# @objectstack/plugin-email + +## 4.0.1 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json index 7a25d73508..dbf6791fd0 100644 --- a/packages/plugins/plugin-email/package.json +++ b/packages/plugins/plugin-email/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-email", - "version": "4.0.0", + "version": "4.0.1", "license": "Apache-2.0", "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md index 877048dfdf..9e16a5dd2c 100644 --- a/packages/plugins/plugin-hono-server/CHANGELOG.md +++ b/packages/plugins/plugin-hono-server/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/plugin-hono-server +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json index cff0e010fe..13796b5c57 100644 --- a/packages/plugins/plugin-hono-server/package.json +++ b/packages/plugins/plugin-hono-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-hono-server", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Standard Hono Server Adapter for ObjectStack Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-mcp-server/CHANGELOG.md b/packages/plugins/plugin-mcp-server/CHANGELOG.md index bfa718e3c0..ea8abe49ce 100644 --- a/packages/plugins/plugin-mcp-server/CHANGELOG.md +++ b/packages/plugins/plugin-mcp-server/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/plugin-mcp-server +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/plugin-mcp-server/package.json b/packages/plugins/plugin-mcp-server/package.json index f0c38a665f..8196d52064 100644 --- a/packages/plugins/plugin-mcp-server/package.json +++ b/packages/plugins/plugin-mcp-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-mcp-server", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "MCP Runtime Server Plugin for ObjectStack — exposes AI tools, data resources, and agent prompts via the Model Context Protocol", "type": "module", diff --git a/packages/plugins/plugin-msw/CHANGELOG.md b/packages/plugins/plugin-msw/CHANGELOG.md index 145c845d62..2a0ea05694 100644 --- a/packages/plugins/plugin-msw/CHANGELOG.md +++ b/packages/plugins/plugin-msw/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-msw +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] +- Updated dependencies [5683206] +- Updated dependencies [f0b3972] +- Updated dependencies [0e63f2f] + - @objectstack/spec@4.1.0 + - @objectstack/objectql@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/types@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/plugin-msw/package.json b/packages/plugins/plugin-msw/package.json index 8bcce79b17..6ec9696bbd 100644 --- a/packages/plugins/plugin-msw/package.json +++ b/packages/plugins/plugin-msw/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-msw", - "version": "4.0.5", + "version": "4.1.0", "description": "MSW (Mock Service Worker) Plugin for ObjectStack Runtime", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md new file mode 100644 index 0000000000..ca2ae29b24 --- /dev/null +++ b/packages/plugins/plugin-reports/CHANGELOG.md @@ -0,0 +1,11 @@ +# @objectstack/plugin-reports + +## 4.0.1 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json index 1e8779c9a2..dd138325c6 100644 --- a/packages/plugins/plugin-reports/package.json +++ b/packages/plugins/plugin-reports/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-reports", - "version": "4.0.0", + "version": "4.0.1", "license": "Apache-2.0", "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md index d48cfd790b..c56f024501 100644 --- a/packages/plugins/plugin-security/CHANGELOG.md +++ b/packages/plugins/plugin-security/CHANGELOG.md @@ -1,5 +1,42 @@ # @objectstack/plugin-security +## 4.1.0 + +### Minor Changes + +- d3b455f: Add server-side Field-Level Security write enforcement. Client-side + ObjectForm / inline-grid already hides non-editable fields, but the + SecurityPlugin middleware previously only enforced FLS on **read** + (`maskResults` on find/findOne). Insert and update operations could + target any field — a hand-crafted POST bypassed FLS entirely. + + The middleware now runs `FieldMasker.detectForbiddenWrites` on every + insert / update payload (single record or bulk array) and throws + `PermissionDeniedError` (HTTP 403) when the payload references a field + the caller is not permitted to edit. The offending field list is + exposed via `details.forbiddenFields` for actionable client error UI. + + Allow-list semantics: only fields explicitly enumerated in a + permission set's `fields` map are constrained. System operations + (`ExecutionContext.isSystem`) continue to bypass the check. + + Why throw vs. silently stripping: silent strip hides the boundary + from honest clients (partial-save confusion) AND gives probing clients + no signal that the field exists. Throwing makes the boundary + observable in both directions. + + Also exposes `FieldMasker.detectForbiddenWrites(data, fieldPermissions)` + as a standalone helper for callers that want to do the check + out-of-band (e.g., adapters that strip-then-warn instead of fail-closed). + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json index 7b6d846bfb..b3c406ea3a 100644 --- a/packages/plugins/plugin-security/package.json +++ b/packages/plugins/plugin-security/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-security", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md new file mode 100644 index 0000000000..a338412c4b --- /dev/null +++ b/packages/plugins/plugin-sharing/CHANGELOG.md @@ -0,0 +1,15 @@ +# @objectstack/plugin-sharing + +## 4.0.1 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] +- Updated dependencies [5683206] +- Updated dependencies [f0b3972] +- Updated dependencies [0e63f2f] + - @objectstack/spec@4.1.0 + - @objectstack/objectql@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json index f6b2e1a950..03a3d6adbe 100644 --- a/packages/plugins/plugin-sharing/package.json +++ b/packages/plugins/plugin-sharing/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sharing", - "version": "4.0.0", + "version": "4.0.1", "license": "Apache-2.0", "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md new file mode 100644 index 0000000000..1fa32912ea --- /dev/null +++ b/packages/plugins/plugin-webhooks/CHANGELOG.md @@ -0,0 +1,10 @@ +# @objectstack/plugin-webhooks + +## 4.0.1 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json index b1a5501dc0..4fe2639c21 100644 --- a/packages/plugins/plugin-webhooks/package.json +++ b/packages/plugins/plugin-webhooks/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-webhooks", - "version": "4.0.0", + "version": "4.0.1", "license": "Apache-2.0", "description": "Outbound webhook delivery plugin for ObjectStack — fan-out data.record.* events to external HTTP(S) sinks with HMAC signing and retry.", "main": "dist/index.js", diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md index 60d9af5244..24f56f9b6f 100644 --- a/packages/rest/CHANGELOG.md +++ b/packages/rest/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/rest +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/service-package@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/rest/package.json b/packages/rest/package.json index f1167f3eec..c061ab3eda 100644 --- a/packages/rest/package.json +++ b/packages/rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/rest", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol", "type": "module", diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md index eebf592da5..03f280508d 100644 --- a/packages/runtime/CHANGELOG.md +++ b/packages/runtime/CHANGELOG.md @@ -1,5 +1,70 @@ # @objectstack/runtime +## 4.1.0 + +### Minor Changes + +- 96fb108: Artifact-first boot: `objectstack start` (and `objectstack serve`) now boot directly from a compiled `dist/objectstack.json` when no `objectstack.config.ts` is present. + + - `@objectstack/runtime` exports `createDefaultHostConfig()` and `resolveDefaultArtifactPath()` — a standalone-only default host that wraps `createStandaloneStack()` and surfaces the artifact's `requires` / `objects` / `manifest`. No dependency on `@objectstack/service-cloud`. + - `objectstack start` accepts `OS_ARTIFACT_PATH` as a file path **or** an `http(s)://` URL. New flags `--artifact`, `--database`, `--database-driver`, `--database-auth-token`, `--auth-secret`, `--project-id`, `--port` let you specify all runtime conditions on the command line (each overrides the matching env var). + - `objectstack dev` accepts the same runtime-override flags. When `--artifact` is supplied, the auto-compile step is skipped and the dev server boots the supplied artifact directly — no `objectstack.config.ts` required in cwd. + - `objectstack start` no longer mounts Studio / Account / Console by default — those are dev/admin surfaces. Pass `--ui` to opt back in. + - `objectstack serve` falls back to the default host config when the config file is missing but an artifact is resolvable. + - `apps/objectos` (cloud / multi-project) is unchanged. + +- 70db902: Add production observability primitives. `createDispatcherPlugin` now + exposes an `observability` config that auto-instruments every mounted + route with: + + - Request-id propagation: `X-Request-Id` echo + `req.requestId` (honors + incoming header when well-formed, mints `req_` otherwise). + - `http_requests_total{method,route,status}` counter. + - `http_request_duration_ms{method,route}` histogram. + - `http_request_errors_total{method,route}` counter. + - Error reporter call for 5xx (4xx are intentionally tracked via + metrics only, not reported, to keep APM signal:noise high). + + All defaults are no-op (zero overhead). Hosts plug their own + `MetricsRegistry` (Prometheus / OTel) and `ErrorReporter` (Sentry / + Datadog) — see `docs/OBSERVABILITY.md` for adapter recipes and the + go-live checklist. + + Standalone primitives also exported for adapter-layer use: + `extractRequestId`, `resolveRequestId`, `parseTraceparent`, + `formatTraceparent`, `InMemoryMetricsRegistry`, + `InMemoryErrorReporter`, `instrumentRouteHandler`. + +- 70db902: Add production HTTP hardening primitives. `createDispatcherPlugin` now + sends conservative security response headers by default + (CSP / X-Content-Type-Options / X-Frame-Options / Referrer-Policy / + Permissions-Policy / Cross-Origin-Resource-Policy). HSTS is opt-in. + + Caller can disable with `securityHeaders: false` (e.g., when an upstream + reverse proxy already injects them) or customize per-header via + `SecurityHeadersOptions`. + + Also exports a standalone token-bucket `RateLimiter` with a pluggable + `RateLimitStore` interface (in-memory default; trivially backed by + Redis) and curated `DEFAULT_RATE_LIMITS` for auth / write / read buckets. + The limiter is NOT auto-wired into the dispatcher — adapter-layer + wire-up (Fastify / Hono / Express) is recommended for proper IP/key + extraction; see `docs/HARDENING.md` for recipes. + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] +- Updated dependencies [d3b455f] + - @objectstack/spec@4.1.0 + - @objectstack/plugin-security@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/formula@4.1.0 + - @objectstack/plugin-auth@4.1.0 + - @objectstack/rest@4.1.0 + - @objectstack/service-i18n@4.1.0 + - @objectstack/types@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/runtime/package.json b/packages/runtime/package.json index 4100dd7ca9..ba806ccf44 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/runtime", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "ObjectStack Core Runtime & Query Engine", "type": "module", diff --git a/packages/services/service-ai/CHANGELOG.md b/packages/services/service-ai/CHANGELOG.md index 7a3a16127e..8fe71b133c 100644 --- a/packages/services/service-ai/CHANGELOG.md +++ b/packages/services/service-ai/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/service-ai +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-ai/package.json b/packages/services/service-ai/package.json index d6d3bf38ee..032f074ac1 100644 --- a/packages/services/service-ai/package.json +++ b/packages/services/service-ai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-ai", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "AI Service for ObjectStack — implements IAIService with LLM adapter layer, conversation management, tool registry, and REST/SSE routes", "type": "module", diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md index dc93543309..c198389b82 100644 --- a/packages/services/service-analytics/CHANGELOG.md +++ b/packages/services/service-analytics/CHANGELOG.md @@ -1,5 +1,14 @@ # Changelog — @objectstack/service-analytics +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json index bf5276e6ab..ac78095bc6 100644 --- a/packages/services/service-analytics/package.json +++ b/packages/services/service-analytics/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-analytics", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)", "type": "module", diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md index fb7788599c..4d7b45dfc4 100644 --- a/packages/services/service-automation/CHANGELOG.md +++ b/packages/services/service-automation/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-automation +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/formula@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json index 1956e3b910..deaf903664 100644 --- a/packages/services/service-automation/package.json +++ b/packages/services/service-automation/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-automation", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine", "type": "module", diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md index d49e2c2b4e..5265d87a40 100644 --- a/packages/services/service-cache/CHANGELOG.md +++ b/packages/services/service-cache/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/service-cache +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json index 58f389737d..7ee072d4ed 100644 --- a/packages/services/service-cache/package.json +++ b/packages/services/service-cache/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cache", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters", "type": "module", diff --git a/packages/services/service-feed/CHANGELOG.md b/packages/services/service-feed/CHANGELOG.md index 42cd5804f5..df738c1742 100644 --- a/packages/services/service-feed/CHANGELOG.md +++ b/packages/services/service-feed/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/service-feed +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-feed/package.json b/packages/services/service-feed/package.json index 357538294c..5da7120bcb 100644 --- a/packages/services/service-feed/package.json +++ b/packages/services/service-feed/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-feed", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Feed/Chatter Service for ObjectStack — implements IFeedService with in-memory adapter for comments, reactions, field changes, and record subscriptions", "type": "module", diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md index 5237ef1fb8..2ed686dfd4 100644 --- a/packages/services/service-i18n/CHANGELOG.md +++ b/packages/services/service-i18n/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/service-i18n +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json index a483a5a30a..f36ca441e3 100644 --- a/packages/services/service-i18n/package.json +++ b/packages/services/service-i18n/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-i18n", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading", "type": "module", diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md index 722917398b..5c4591dd8e 100644 --- a/packages/services/service-job/CHANGELOG.md +++ b/packages/services/service-job/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-job +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json index 965475d539..2579b08670 100644 --- a/packages/services/service-job/package.json +++ b/packages/services/service-job/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-job", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling", "type": "module", diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md index 661a19ac09..8fadb8f390 100644 --- a/packages/services/service-package/CHANGELOG.md +++ b/packages/services/service-package/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/service-package +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json index 807d3c6aa4..37337d1d99 100644 --- a/packages/services/service-package/package.json +++ b/packages/services/service-package/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-package", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Package management service for ObjectStack — publish, install, and manage packages", "type": "module", diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md index 5ded9f1657..f83c08980d 100644 --- a/packages/services/service-queue/CHANGELOG.md +++ b/packages/services/service-queue/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-queue +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json index 5ef61e4c58..6ace3fc0e9 100644 --- a/packages/services/service-queue/package.json +++ b/packages/services/service-queue/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-queue", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and BullMQ adapters", "type": "module", diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md index 78d9f4a997..a2f54fd6c1 100644 --- a/packages/services/service-realtime/CHANGELOG.md +++ b/packages/services/service-realtime/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-realtime +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json index 227cebf28e..11c1bf1177 100644 --- a/packages/services/service-realtime/package.json +++ b/packages/services/service-realtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-realtime", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub", "type": "module", diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md new file mode 100644 index 0000000000..dcd80aa31a --- /dev/null +++ b/packages/services/service-settings/CHANGELOG.md @@ -0,0 +1,11 @@ +# @objectstack/service-settings + +## 0.1.1 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json index 9b4de2a4fe..4a2b5e8401 100644 --- a/packages/services/service-settings/package.json +++ b/packages/services/service-settings/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-settings", - "version": "0.1.0", + "version": "0.1.1", "license": "Apache-2.0", "description": "Settings service for ObjectStack — manifest registry + K/V resolver (Env > Tenant > User > Default) + REST routes. See ADR-0007.", "type": "module", @@ -27,14 +27,26 @@ "typescript": "^6.0.3", "vitest": "^4.1.7" }, - "keywords": ["objectstack", "service", "settings", "config"], + "keywords": [ + "objectstack", + "service", + "settings", + "config" + ], "author": "ObjectStack", "repository": { "type": "git", "url": "https://github.com/objectstack-ai/framework.git", "directory": "packages/services/service-settings" }, - "publishConfig": { "access": "public" }, - "files": ["dist", "README.md"], - "engines": { "node": ">=18.0.0" } + "publishConfig": { + "access": "public" + }, + "files": [ + "dist", + "README.md" + ], + "engines": { + "node": ">=18.0.0" + } } diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md index 476e9bc434..a131772740 100644 --- a/packages/services/service-storage/CHANGELOG.md +++ b/packages/services/service-storage/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/service-storage +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json index 57d10c0541..d634a9d8d9 100644 --- a/packages/services/service-storage/package.json +++ b/packages/services/service-storage/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-storage", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton", "type": "module", diff --git a/packages/services/service-tenant/CHANGELOG.md b/packages/services/service-tenant/CHANGELOG.md index f4a42ff549..1f3bd1166e 100644 --- a/packages/services/service-tenant/CHANGELOG.md +++ b/packages/services/service-tenant/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-tenant +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + - @objectstack/core@4.1.0 + - @objectstack/platform-objects@4.1.0 + - @objectstack/driver-turso@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/services/service-tenant/package.json b/packages/services/service-tenant/package.json index d747be2bcb..a61302bf25 100644 --- a/packages/services/service-tenant/package.json +++ b/packages/services/service-tenant/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-tenant", - "version": "4.0.5", + "version": "4.1.0", "description": "ObjectStack Multi-Tenant Service - Tenant context management and routing", "type": "module", "main": "./dist/index.js", diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md index 51d40be4f8..3ce8e87922 100644 --- a/packages/spec/CHANGELOG.md +++ b/packages/spec/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/spec +## 4.1.0 + +### Minor Changes + +- 23db640: `record:highlights` now accepts richer field items. + + Each entry in `fields` may be either a bare field name (backward compatible) or an object `{ name, label?, icon?, type? }` that lets the schema override the displayed label, attach a Lucide icon, or force a specific cell renderer without editing the underlying object metadata. Useful when the same field appears in multiple highlight strips with different framing (e.g. "Annual Revenue" vs "ARR") or when you want a tiny icon for status-like fields. + +### Patch Changes + +- 2108c30: `ActionParamSchema.required` now defaults to `false` (was effectively `undefined`). Functionally equivalent for existing consumers (which check truthiness), but makes the parsed object shape complete and unblocks downstream type narrowing. Fixes pre-existing failing test `action.test.ts > should accept minimal action parameter`. + ## 4.0.5 ### Patch Changes diff --git a/packages/spec/package.json b/packages/spec/package.json index 02ed212be4..93c444ed51 100644 --- a/packages/spec/package.json +++ b/packages/spec/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/spec", - "version": "4.0.5", + "version": "4.1.0", "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md index 88e47954c1..ebef776b78 100644 --- a/packages/types/CHANGELOG.md +++ b/packages/types/CHANGELOG.md @@ -1,5 +1,13 @@ # @objectstack/types +## 4.1.0 + +### Patch Changes + +- Updated dependencies [2108c30] +- Updated dependencies [23db640] + - @objectstack/spec@4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/types/package.json b/packages/types/package.json index 2d80f9e6d1..ee05c5a029 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/types", - "version": "4.0.5", + "version": "4.1.0", "license": "Apache-2.0", "description": "Shared interfaces describing the ObjectStack Runtime environment", "main": "dist/index.js", diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md index 6da00183e5..797b7fd2db 100644 --- a/packages/vscode-objectstack/CHANGELOG.md +++ b/packages/vscode-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # objectstack-vscode +## 4.1.0 + ## 4.0.5 ### Patch Changes diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json index 847efb2891..56f35a23f6 100644 --- a/packages/vscode-objectstack/package.json +++ b/packages/vscode-objectstack/package.json @@ -2,7 +2,7 @@ "name": "objectstack-vscode", "displayName": "ObjectStack", "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files", - "version": "4.0.5", + "version": "4.1.0", "publisher": "objectstack", "license": "Apache-2.0", "repository": {