From ee4e1df9c1c8bf3b5818c4f4f27028c90532d441 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 20 Jun 2026 10:06:13 +0000 Subject: [PATCH] chore: version packages --- .changeset/adr-0056-d1-owd-vocab.md | 16 -- .changeset/adr-0056-d2-anonymous-deny.md | 15 -- .changeset/adr-0056-d4-rls-no-silent-drop.md | 14 -- .changeset/adr-0056-d6-role-hierarchy.md | 17 --- .changeset/adr-0056-d7-default-profile.md | 16 -- .../adr-0056-d8-experimental-markers.md | 14 -- .changeset/autonumber-authoring-guardrails.md | 15 -- .changeset/autonumber-format-tokens.md | 61 -------- .changeset/liveness-prove-it-runs.md | 5 - .../master-detail-controlled-by-parent.md | 15 -- .changeset/rls-current-user-email.md | 30 ---- .changeset/showcase-private-owd.md | 20 --- .changeset/verify-automation-flow-proofs.md | 5 - .changeset/verify-package.md | 8 - examples/app-crm/CHANGELOG.md | 15 ++ examples/app-crm/package.json | 2 +- examples/app-showcase/CHANGELOG.md | 71 +++++++++ examples/app-showcase/package.json | 2 +- examples/app-todo/CHANGELOG.md | 22 +++ examples/app-todo/package.json | 2 +- packages/adapters/express/CHANGELOG.md | 7 + packages/adapters/express/package.json | 2 +- packages/adapters/fastify/CHANGELOG.md | 7 + packages/adapters/fastify/package.json | 2 +- packages/adapters/hono/CHANGELOG.md | 9 ++ packages/adapters/hono/package.json | 2 +- packages/adapters/nestjs/CHANGELOG.md | 7 + packages/adapters/nestjs/package.json | 2 +- packages/adapters/nextjs/CHANGELOG.md | 7 + packages/adapters/nextjs/package.json | 2 +- packages/adapters/nuxt/CHANGELOG.md | 7 + packages/adapters/nuxt/package.json | 2 +- packages/adapters/sveltekit/CHANGELOG.md | 7 + packages/adapters/sveltekit/package.json | 2 +- packages/apps/account/CHANGELOG.md | 15 ++ packages/apps/account/package.json | 2 +- packages/apps/setup/CHANGELOG.md | 15 ++ packages/apps/setup/package.json | 2 +- packages/apps/studio/CHANGELOG.md | 15 ++ packages/apps/studio/package.json | 2 +- packages/cli/CHANGELOG.md | 136 +++++++++++++++++ packages/cli/package.json | 2 +- packages/client-react/CHANGELOG.md | 16 ++ packages/client-react/package.json | 2 +- packages/client/CHANGELOG.md | 15 ++ packages/client/package.json | 2 +- packages/cloud-connection/CHANGELOG.md | 17 +++ packages/cloud-connection/package.json | 2 +- .../connectors/connector-mcp/CHANGELOG.md | 15 ++ .../connectors/connector-mcp/package.json | 2 +- .../connectors/connector-openapi/CHANGELOG.md | 15 ++ .../connectors/connector-openapi/package.json | 2 +- .../connectors/connector-rest/CHANGELOG.md | 15 ++ .../connectors/connector-rest/package.json | 2 +- .../connectors/connector-slack/CHANGELOG.md | 15 ++ .../connectors/connector-slack/package.json | 2 +- packages/console/CHANGELOG.md | 2 + packages/console/package.json | 2 +- packages/core/CHANGELOG.md | 14 ++ packages/core/package.json | 2 +- packages/create-objectstack/CHANGELOG.md | 2 + packages/create-objectstack/package.json | 2 +- packages/dogfood/CHANGELOG.md | 23 +++ packages/dogfood/package.json | 2 +- packages/formula/CHANGELOG.md | 14 ++ packages/formula/package.json | 2 +- packages/mcp/CHANGELOG.md | 16 ++ packages/mcp/package.json | 2 +- packages/metadata-core/CHANGELOG.md | 14 ++ packages/metadata-core/package.json | 2 +- packages/metadata-fs/CHANGELOG.md | 6 + packages/metadata-fs/package.json | 2 +- packages/metadata/CHANGELOG.md | 19 +++ packages/metadata/package.json | 2 +- packages/objectql/CHANGELOG.md | 75 +++++++++ packages/objectql/package.json | 2 +- packages/observability/CHANGELOG.md | 14 ++ packages/observability/package.json | 2 +- packages/platform-objects/CHANGELOG.md | 15 ++ packages/platform-objects/package.json | 2 +- packages/plugins/driver-memory/CHANGELOG.md | 15 ++ packages/plugins/driver-memory/package.json | 2 +- packages/plugins/driver-mongodb/CHANGELOG.md | 15 ++ packages/plugins/driver-mongodb/package.json | 2 +- packages/plugins/driver-sql/CHANGELOG.md | 72 +++++++++ packages/plugins/driver-sql/package.json | 2 +- .../plugins/driver-sqlite-wasm/CHANGELOG.md | 16 ++ .../plugins/driver-sqlite-wasm/package.json | 2 +- packages/plugins/embedder-openai/CHANGELOG.md | 14 ++ packages/plugins/embedder-openai/package.json | 2 +- .../plugins/knowledge-memory/CHANGELOG.md | 16 ++ .../plugins/knowledge-memory/package.json | 2 +- .../plugins/knowledge-ragflow/CHANGELOG.md | 16 ++ .../plugins/knowledge-ragflow/package.json | 2 +- .../plugins/plugin-approvals/CHANGELOG.md | 18 +++ .../plugins/plugin-approvals/package.json | 2 +- packages/plugins/plugin-audit/CHANGELOG.md | 16 ++ packages/plugins/plugin-audit/package.json | 2 +- packages/plugins/plugin-auth/CHANGELOG.md | 17 +++ packages/plugins/plugin-auth/package.json | 2 +- packages/plugins/plugin-dev/CHANGELOG.md | 30 ++++ packages/plugins/plugin-dev/package.json | 2 +- packages/plugins/plugin-email/CHANGELOG.md | 17 +++ packages/plugins/plugin-email/package.json | 2 +- .../plugins/plugin-hono-server/CHANGELOG.md | 16 ++ .../plugins/plugin-hono-server/package.json | 2 +- packages/plugins/plugin-msw/CHANGELOG.md | 18 +++ packages/plugins/plugin-msw/package.json | 2 +- .../plugins/plugin-org-scoping/CHANGELOG.md | 16 ++ .../plugins/plugin-org-scoping/package.json | 2 +- packages/plugins/plugin-reports/CHANGELOG.md | 16 ++ packages/plugins/plugin-reports/package.json | 2 +- packages/plugins/plugin-security/CHANGELOG.md | 74 +++++++++ packages/plugins/plugin-security/package.json | 2 +- packages/plugins/plugin-sharing/CHANGELOG.md | 43 ++++++ packages/plugins/plugin-sharing/package.json | 2 +- packages/plugins/plugin-webhooks/CHANGELOG.md | 16 ++ packages/plugins/plugin-webhooks/package.json | 2 +- packages/rest/CHANGELOG.md | 51 +++++++ packages/rest/package.json | 2 +- packages/runtime/CHANGELOG.md | 54 +++++++ packages/runtime/package.json | 2 +- packages/services/service-ai/CHANGELOG.md | 17 +++ packages/services/service-ai/package.json | 2 +- .../services/service-analytics/CHANGELOG.md | 15 ++ .../services/service-analytics/package.json | 2 +- .../services/service-automation/CHANGELOG.md | 16 ++ .../services/service-automation/package.json | 2 +- packages/services/service-cache/CHANGELOG.md | 16 ++ packages/services/service-cache/package.json | 2 +- .../service-cluster-redis/CHANGELOG.md | 15 ++ .../service-cluster-redis/package.json | 2 +- .../services/service-cluster/CHANGELOG.md | 15 ++ .../services/service-cluster/package.json | 2 +- .../services/service-datasource/CHANGELOG.md | 15 ++ .../services/service-datasource/package.json | 2 +- packages/services/service-i18n/CHANGELOG.md | 15 ++ packages/services/service-i18n/package.json | 2 +- packages/services/service-job/CHANGELOG.md | 16 ++ packages/services/service-job/package.json | 2 +- .../services/service-knowledge/CHANGELOG.md | 15 ++ .../services/service-knowledge/package.json | 2 +- .../services/service-messaging/CHANGELOG.md | 15 ++ .../services/service-messaging/package.json | 2 +- .../services/service-package/CHANGELOG.md | 15 ++ .../services/service-package/package.json | 2 +- packages/services/service-queue/CHANGELOG.md | 16 ++ packages/services/service-queue/package.json | 2 +- .../services/service-realtime/CHANGELOG.md | 16 ++ .../services/service-realtime/package.json | 2 +- .../services/service-settings/CHANGELOG.md | 17 +++ .../services/service-settings/package.json | 2 +- .../services/service-storage/CHANGELOG.md | 17 +++ .../services/service-storage/package.json | 2 +- packages/spec/CHANGELOG.md | 143 ++++++++++++++++++ packages/spec/package.json | 2 +- packages/triggers/trigger-api/CHANGELOG.md | 15 ++ packages/triggers/trigger-api/package.json | 2 +- .../trigger-record-change/CHANGELOG.md | 15 ++ .../trigger-record-change/package.json | 2 +- .../triggers/trigger-schedule/CHANGELOG.md | 15 ++ .../triggers/trigger-schedule/package.json | 2 +- packages/types/CHANGELOG.md | 14 ++ packages/types/package.json | 2 +- packages/verify/CHANGELOG.md | 47 ++++++ packages/verify/package.json | 15 +- packages/vscode-objectstack/CHANGELOG.md | 2 + packages/vscode-objectstack/package.json | 2 +- 168 files changed, 1818 insertions(+), 330 deletions(-) delete mode 100644 .changeset/adr-0056-d1-owd-vocab.md delete mode 100644 .changeset/adr-0056-d2-anonymous-deny.md delete mode 100644 .changeset/adr-0056-d4-rls-no-silent-drop.md delete mode 100644 .changeset/adr-0056-d6-role-hierarchy.md delete mode 100644 .changeset/adr-0056-d7-default-profile.md delete mode 100644 .changeset/adr-0056-d8-experimental-markers.md delete mode 100644 .changeset/autonumber-authoring-guardrails.md delete mode 100644 .changeset/autonumber-format-tokens.md delete mode 100644 .changeset/liveness-prove-it-runs.md delete mode 100644 .changeset/master-detail-controlled-by-parent.md delete mode 100644 .changeset/rls-current-user-email.md delete mode 100644 .changeset/showcase-private-owd.md delete mode 100644 .changeset/verify-automation-flow-proofs.md delete mode 100644 .changeset/verify-package.md create mode 100644 packages/verify/CHANGELOG.md diff --git a/.changeset/adr-0056-d1-owd-vocab.md b/.changeset/adr-0056-d1-owd-vocab.md deleted file mode 100644 index 3ce6f7f575..0000000000 --- a/.changeset/adr-0056-d1-owd-vocab.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/plugin-sharing": patch -"@objectstack/example-showcase": patch ---- - -feat(spec,sharing): canonical OWD vocabulary on `object.sharingModel` (ADR-0056 D1) - -Reconciles the Org-Wide-Default naming so authors use ONE vocabulary. `object.sharingModel` -now accepts the canonical OWD names — `private` | `public_read` | `public_read_write` | -`controlled_by_parent` — alongside the legacy `read` / `read_write` / `full` aliases (kept, -non-breaking). The sharing runtime maps them onto the three enforced behaviours -(`public_read` ≡ legacy `read` = everyone reads / owner writes; `public_read_write` = -unscoped). Unknown values remain rejected by the enum (authoring-time, fail-closed). The -showcase announcement now declares the canonical `public_read`, exercised end-to-end by the -public-read dogfood proof. diff --git a/.changeset/adr-0056-d2-anonymous-deny.md b/.changeset/adr-0056-d2-anonymous-deny.md deleted file mode 100644 index 81f396d645..0000000000 --- a/.changeset/adr-0056-d2-anonymous-deny.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@objectstack/rest": patch ---- - -feat(rest): warn on fail-open anonymous posture (ADR-0056 D2, warn→enforce) - -Secure-by-default work for the data API. The deny capability already exists -(`api.requireAuth=true` rejects anonymous via `enforceAuth`, and share-link / -`guest_portal` / control-plane routes are exempt) — but the **default is fail-open** -(`requireAuth=false`), so an object with no OWD/RLS is world-readable with no signal. -This adds a boot-time WARN when running in that posture, making it explicit -(consistent with D4/D8 honesty). The global default is deliberately NOT flipped here -— that is a release-gated decision; flipping it would 401 deployments that rely on -anonymous reads. Proven by the `showcase-anonymous-deny` dogfood test (anonymous -read+write → 401, authenticated → 200, control-plane open). diff --git a/.changeset/adr-0056-d4-rls-no-silent-drop.md b/.changeset/adr-0056-d4-rls-no-silent-drop.md deleted file mode 100644 index 0c974a5565..0000000000 --- a/.changeset/adr-0056-d4-rls-no-silent-drop.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@objectstack/plugin-security": minor ---- - -feat(security): RLS predicates that won't compile are surfaced, not silently dropped (ADR-0056 D4) - -The RLS compiler previously dropped any `using`/`check` it could not parse (e.g. `==`, -`AND`/`OR`, ranges) in silence — if it was the only policy, the object lost protection -with no signal (the class of bug that left a showcase owner predicate inert for two PRs). -Now the compiler WARNS (via the security plugin's logger) when an **unsupported-shape** -predicate is dropped, distinguishing it from the intentional "context variable absent" -fail-closed skip. Also exports `isSupportedRlsExpression(expr)` so an authoring-time gate -(`objectstack compile`) can reject a predicate the runtime would never enforce. No change -to compiled filters for valid predicates; fail-closed semantics preserved. diff --git a/.changeset/adr-0056-d6-role-hierarchy.md b/.changeset/adr-0056-d6-role-hierarchy.md deleted file mode 100644 index 710064f977..0000000000 --- a/.changeset/adr-0056-d6-role-hierarchy.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/plugin-sharing": minor ---- - -feat(sharing): configurable role-hierarchy widening — `role_and_subordinates` recipient (ADR-0056 D6) - -Role-hierarchy access widening ("a manager sees records shared with their team") is now -**implemented and configurable per sharing rule**, not a hardcoded no-op. The -`role_and_subordinates` recipient (declarable on `sys_sharing_rule.recipient_type`) expands, -at evaluation time, to the named role **plus every subordinate role** by walking the -`sys_role.parent` hierarchy via a new `RoleGraphService` (mirroring the department/team -graphs; cycle-safe). Previously `Role.parent` was declared but never consumed — a silent -no-op flagged by the ADR-0056 audit. This is the Salesforce "grant access using hierarchies" -model expressed declaratively: each rule chooses whether to roll up the hierarchy. Unit-proven -(role-graph traversal, subordinate-user expansion, cycle safety); the recipient is added to -the authoring select + the `SharingRuleRecipientType` contract. diff --git a/.changeset/adr-0056-d7-default-profile.md b/.changeset/adr-0056-d7-default-profile.md deleted file mode 100644 index 8038f40165..0000000000 --- a/.changeset/adr-0056-d7-default-profile.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/plugin-security": minor ---- - -feat(security): app-declarable default profile (`isDefault`, ADR-0056 D7) - -An app can now declare its default access posture for authenticated users who have -no explicit grants, via `isDefault: true` on a permission set — instead of always -inheriting the built-in `member_default`. The SecurityPlugin resolves the fallback -from the `isDefault` profile when no explicit `fallbackPermissionSet` is configured -(falling back to `member_default` when none is declared — non-breaking). This is the -foundation for SSO/JIT provisioning (mapping IdP claims → a declared default profile). -Proven by the `showcase-default-profile` dogfood test: a sign-up governed by a custom -default that grants only `showcase_announcement` can read it but is denied -`showcase_private_note` (which the `member_default` wildcard would have allowed). diff --git a/.changeset/adr-0056-d8-experimental-markers.md b/.changeset/adr-0056-d8-experimental-markers.md deleted file mode 100644 index 6107cbf0b7..0000000000 --- a/.changeset/adr-0056-d8-experimental-markers.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@objectstack/spec": patch ---- - -docs(spec): mark unenforced compliance/encryption/masking/RLS-config surface EXPERIMENTAL (ADR-0056 D8) - -Per ADR-0049's enforce-or-remove gate (and ADR-0056 D8), the security-adjacent -schemas that are parsed but have **no runtime consumer** now carry an explicit -`⚠️ EXPERIMENTAL — NOT ENFORCED` header so the no-op is visible to authors and the -reference docs: GDPR/HIPAA/PCI compliance configs, field-level encryption, data -masking, the unified security-context governance, and the global `RLSConfig` / -`RLSAuditEvent` (distinct from the ENFORCED `RowLevelSecurityPolicySchema`, which is -left untouched). No behaviour change — these were already inert; the marker makes -the inertness honest rather than silent. diff --git a/.changeset/autonumber-authoring-guardrails.md b/.changeset/autonumber-authoring-guardrails.md deleted file mode 100644 index 3697c240cc..0000000000 --- a/.changeset/autonumber-authoring-guardrails.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@objectstack/cli": minor ---- - -feat(cli): warn on unrecognized autonumber format tokens - -`objectstack compile` now flags `autonumber` formats whose `{...}` token is not a -counter (`{0000}`), date (`{YYYY}`/`{MM}`/…) or `{field}` token — an unrecognized -group (wrong case, spaces, punctuation, or a second sequence slot) renders -LITERALLY into the record number, which is a silent footgun for AI-authored -templates. Emitted as an advisory warning (`autonumber-unrecognized-token`), -alongside the existing `{field}`-reference checks. The `objectstack-data` skill's -`field-types` rules were also expanded to document the date/`{field}`/per-scope -tokens and the authoring rules (required interpolated fields, delimited adjacent -tokens, pad width is a minimum, date tokens are exact). diff --git a/.changeset/autonumber-format-tokens.md b/.changeset/autonumber-format-tokens.md deleted file mode 100644 index 7750854d2e..0000000000 --- a/.changeset/autonumber-format-tokens.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/objectql": minor -"@objectstack/driver-sql": minor -"@objectstack/cli": minor ---- - -feat(autonumber): date, {field} and per-scope counter reset for autonumber formats - -`autonumberFormat` previously only understood a single `{0000}` sequence slot — -everything else was a fixed literal prefix on one global counter. Real MES/eHR -record numbers need three more token classes, so the format is now tokenized by a -shared pure renderer in `@objectstack/spec` (`parseAutonumberFormat` / -`renderAutonumber`) that the engine fallback and the SQL driver both call, so they -emit byte-identical numbers (#1603 parity): - -- **Date tokens** — `{YYYY}` `{YY}` `{MM}` `{DD}` `{YYYYMMDD}` resolve the calendar - day in the request's **business timezone** (`ExecutionContext.timezone`, ADR-0053; - UTC fallback), threaded through the new `DriverOptions.timezone`. -- **`{field}` interpolation** — `{section}{island_zone}{000}` substitutes record - field values into the prefix. -- **Per-scope counter reset** — the counter's scope is the rendered prefix *before* - the sequence slot, so `AD{YYYYMMDD}{0000}` resets daily, `{section}{island_zone}{000}` - numbers per group, and `{plan_no}{000}` numbers per parent — all from one - mechanism, no separate reset config. - -Fixed-prefix formats like `CASE-{0000}` render an empty scope and keep their single -global counter, so existing sequences are unchanged. The persistent -`_objectstack_sequences` table is keyed by a `key_hash` (SHA-256 of -`object, tenant_id, field, scope`) — a single 64-char primary key that keys every -dialect uniformly, stays within MySQL's utf8mb4 index-length limit (four raw -columns would not), and lets `scope` be a generous non-indexed column. Deployments -with an older table (3-column, or an interim `scope` column) are migrated in place -on first use, carrying existing counters to `scope=''`. - -Guardrails: - -- **Empty interpolated field is a hard error, not a silent mis-number.** A - `{field}` token whose value is missing at create time would render to an empty - prefix and collapse the record into the wrong counter scope. Both the SQL driver - and the engine fallback now refuse to generate and throw a clear error naming the - empty field (shared `missingFieldValues` helper). -- **Build-time lint (`@objectstack/cli compile`).** `autonumber` formats are - checked against the object's fields: a `{field}` token naming a non-existent - field (or the autonumber field itself) **fails the build**; a token naming an - *optional* field emits an advisory warning to mark it `required: true`. -- **Migration fails safe.** If a legacy table cannot be migrated to the `key_hash` - shape, fixed-prefix sequences keep working via the legacy key and a per-scope - write raises an actionable error instead of corrupting counters. -- **Long `{field}` scopes are supported** (e.g. a long `{plan_no}`): the non-indexed - `scope` column and hashed key remove the old varchar/PK length ceiling. - -Notes on inherent semantics (documented, not bugs): - -- The counter scope IS the rendered prefix. When two records' tokens render to the - same prefix string (e.g. `{a}{b}` for `('AB','C')` and `('A','BC')`) they also - render the same visible number, so they share one counter to stay unique — the - remedy for genuinely-distinct groups is an unambiguous format (a delimiter - literal between variable tokens). -- The sequence pad width is a MINIMUM; past it the number grows (`{000}` → - `1000`), it never wraps — matching mainstream autonumber semantics. diff --git a/.changeset/liveness-prove-it-runs.md b/.changeset/liveness-prove-it-runs.md deleted file mode 100644 index 83a93104b8..0000000000 --- a/.changeset/liveness-prove-it-runs.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@objectstack/spec": patch ---- - -Add the ADR-0054 "prove-it-runs" proof field + ratchet to the spec liveness gate. A `live` ledger entry may now carry a `proof` — a reference (`#`) to a dogfood test that asserts the property's runtime behavior. A bound high-risk `live` property must carry a valid proof, validated statically by the liveness gate (the file exists and declares the matching `@proof:` tag). Four high-risk classes are bound this phase: field types (`field.type`), RLS (`permission.rowLevelSecurity.using`), flow nodes (`flow.nodes.type`), and analytics (`dataset.dimensions.dateGranularity`). The `dataset` metadata type is now governed (new `liveness/dataset.json`). The authoritative high-risk-class list lives in `scripts/liveness/proof-registry.mts`; see `liveness/README.md`. diff --git a/.changeset/master-detail-controlled-by-parent.md b/.changeset/master-detail-controlled-by-parent.md deleted file mode 100644 index 6602611a28..0000000000 --- a/.changeset/master-detail-controlled-by-parent.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -"@objectstack/plugin-security": minor -"@objectstack/spec": minor -"@objectstack/verify": minor ---- - -Master-detail "controlled by parent" permissions (ADR-0055). - -A detail object can now declare `sharingModel: 'controlled_by_parent'`: its read/write access is derived from its master record, with no authored RLS. - -- `@objectstack/spec`: `controlled_by_parent` added to the authorable `object.sharingModel` enum. -- `@objectstack/plugin-security`: reads inject `masterFK IN (accessible master ids)` (resolved from the master's own RLS, reusing the existing filter machinery — zero RLS-compiler changes); by-id writes (insert/update/delete) to a detail now require edit access to its master, closing the #1994-class by-id hole for derived access. -- `@objectstack/verify`: related-record **topological synthesis** — `deriveCrudCases` no longer skips objects with required relations; it builds the object dependency graph, orders it topologically, and threads real target ids, so relationship-dense objects (and the master-detail RLS proof) are verifiable. Honest `blocked` verdicts remain for required-reference cycles and external/missing targets. - -v1 limits (per ADR-0055): the accessible-master id set is unbounded (large-tenant scale is a documented future limit), and master-detail chains are single-level (not transitively traversed). diff --git a/.changeset/rls-current-user-email.md b/.changeset/rls-current-user-email.md deleted file mode 100644 index 17735100a4..0000000000 --- a/.changeset/rls-current-user-email.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/plugin-security": minor -"@objectstack/runtime": patch -"@objectstack/rest": patch -"@objectstack/example-showcase": patch ---- - -feat(security): resolve `current_user.email` in RLS owner policies - -RLS `using` predicates can now reference **`current_user.email`** — a unique, -human-readable, *seedable* owner anchor (`owner = current_user.email`). Previously -the RLS compiler resolved only `current_user.id` / `organization_id` / `roles` / -`org_user_ids`, so any owner-by-name/email predicate silently compiled to the -deny sentinel (fail-closed → the user saw nothing). Email is sourced for free -from the auth session (with a bounded `sys_user` fallback for the API-key path) -and threaded onto the `ExecutionContext` in both identity resolvers — the REST -data path (`rest-server`) and the dispatcher path (`resolve-execution-context`). - -Display `name` is deliberately **not** exposed to RLS: names collide, and a -collision on an ownership predicate is an access-control leak. Only unique -identifiers (`id`, `email`) are resolvable. - -This makes owner-scoped row-level security work with seed data (no per-user ids -needed) and, combined with `controlled_by_parent` (ADR-0055), lets a master's -owner scoping flow to its detail records. The example-showcase demonstrates it: -`showcase_invoice` carries an `owner` email + an owner RLS policy, its lines are -controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the -showcase's previously inert owner predicates (they used `==` and `current_user.name`, -neither of which the compiler accepts) to `= current_user.email`. diff --git a/.changeset/showcase-private-owd.md b/.changeset/showcase-private-owd.md deleted file mode 100644 index fb8e2899b8..0000000000 --- a/.changeset/showcase-private-owd.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -"@objectstack/example-showcase": minor ---- - -feat(app-showcase): declarative OWD scenarios — owner-private + public-read (ADR-0056) - -Adds the two canonical Org-Wide-Default scenarios, each declaring its access policy -in ONE word with no authored RLS: - -- `showcase_private_note` — `sharingModel: 'private'`: a user sees and edits only - the notes they own (owner-only read + write). -- `showcase_announcement` — `sharingModel: 'read'`: every member reads every - announcement, but only the owner may edit/delete it (public-read). - -Both derive scoping from the OWD baseline + the auto-stamped `owner_id` — the -declarative counterpart to the invoice's hand-written `owner = current_user.email` -escape-hatch. Proven end-to-end (two users, real HTTP) by the new -`showcase-private-owd` and `showcase-public-read-owd` dogfood tests, which together -demonstrate the OWD read-visibility axis (`private` hides others' rows; `read` -shows them but still protects writes). diff --git a/.changeset/verify-automation-flow-proofs.md b/.changeset/verify-automation-flow-proofs.md deleted file mode 100644 index 2bb6cb50e8..0000000000 --- a/.changeset/verify-automation-flow-proofs.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@objectstack/verify": minor ---- - -`bootStack` gains an opt-in `automation` boot option. When set, it registers `@objectstack/service-automation` so the app's authored flows are pulled from the registry and `POST /api/v1/automation/:name/trigger` actually executes their nodes against the real in-process stack. This makes flow-node execution + variable wiring verifiable end-to-end (ADR-0054 Phase 2), mirroring the existing `multiTenant` opt-in. Default is `false`, so the standard boot stays lean for apps that don't exercise flows. diff --git a/.changeset/verify-package.md b/.changeset/verify-package.md deleted file mode 100644 index a4bb4b73fb..0000000000 --- a/.changeset/verify-package.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -"@objectstack/verify": minor -"@objectstack/cli": minor ---- - -Add `@objectstack/verify` — boot any ObjectStack app in-process and verify it through the real HTTP stack: auto-derived CRUD round-trip fidelity (`runCrudVerification`) plus the cross-owner RLS invariant (`runRlsProofs`, "you can't write what you can't read"). Also adds an `objectstack verify` CLI command that runs these proofs against an app config and exits non-zero on real failures. - -Extracted from the internal dogfood regression gate so third-party and template authors can run the same runtime proofs against their own apps. The private `@objectstack/dogfood` package now consumes this library for its golden regression tests. diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md index a8974f7f1a..c81fcd3565 100644 --- a/examples/app-crm/CHANGELOG.md +++ b/examples/app-crm/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/example-crm +## 4.0.54 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/runtime@9.11.0 + ## 4.0.53 ### Patch Changes diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json index 2d054bdca4..8c69539c15 100644 --- a/examples/app-crm/package.json +++ b/examples/app-crm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-crm", - "version": "4.0.53", + "version": "4.0.54", "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md index 74a4790358..14e4146196 100644 --- a/examples/app-showcase/CHANGELOG.md +++ b/examples/app-showcase/CHANGELOG.md @@ -1,5 +1,76 @@ # @objectstack/example-showcase +## 0.2.0 + +### Minor Changes + +- 37e9acb: feat(app-showcase): declarative OWD scenarios — owner-private + public-read (ADR-0056) + + Adds the two canonical Org-Wide-Default scenarios, each declaring its access policy + in ONE word with no authored RLS: + + - `showcase_private_note` — `sharingModel: 'private'`: a user sees and edits only + the notes they own (owner-only read + write). + - `showcase_announcement` — `sharingModel: 'read'`: every member reads every + announcement, but only the owner may edit/delete it (public-read). + + Both derive scoping from the OWD baseline + the auto-stamped `owner_id` — the + declarative counterpart to the invoice's hand-written `owner = current_user.email` + escape-hatch. Proven end-to-end (two users, real HTTP) by the new + `showcase-private-owd` and `showcase-public-read-owd` dogfood tests, which together + demonstrate the OWD read-visibility axis (`private` hides others' rows; `read` + shows them but still protects writes). + +### Patch Changes + +- e7f6539: feat(spec,sharing): canonical OWD vocabulary on `object.sharingModel` (ADR-0056 D1) + + Reconciles the Org-Wide-Default naming so authors use ONE vocabulary. `object.sharingModel` + now accepts the canonical OWD names — `private` | `public_read` | `public_read_write` | + `controlled_by_parent` — alongside the legacy `read` / `read_write` / `full` aliases (kept, + non-breaking). The sharing runtime maps them onto the three enforced behaviours + (`public_read` ≡ legacy `read` = everyone reads / owner writes; `public_read_write` = + unscoped). Unknown values remain rejected by the enum (authoring-time, fail-closed). The + showcase announcement now declares the canonical `public_read`, exercised end-to-end by the + public-read dogfood proof. + +- 2afb612: feat(security): resolve `current_user.email` in RLS owner policies + + RLS `using` predicates can now reference **`current_user.email`** — a unique, + human-readable, _seedable_ owner anchor (`owner = current_user.email`). Previously + the RLS compiler resolved only `current_user.id` / `organization_id` / `roles` / + `org_user_ids`, so any owner-by-name/email predicate silently compiled to the + deny sentinel (fail-closed → the user saw nothing). Email is sourced for free + from the auth session (with a bounded `sys_user` fallback for the API-key path) + and threaded onto the `ExecutionContext` in both identity resolvers — the REST + data path (`rest-server`) and the dispatcher path (`resolve-execution-context`). + + Display `name` is deliberately **not** exposed to RLS: names collide, and a + collision on an ownership predicate is an access-control leak. Only unique + identifiers (`id`, `email`) are resolvable. + + This makes owner-scoped row-level security work with seed data (no per-user ids + needed) and, combined with `controlled_by_parent` (ADR-0055), lets a master's + owner scoping flow to its detail records. The example-showcase demonstrates it: + `showcase_invoice` carries an `owner` email + an owner RLS policy, its lines are + controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the + showcase's previously inert owner predicates (they used `==` and `current_user.name`, + neither of which the compiler accepts) to `= current_user.email`. + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/runtime@9.11.0 + - @objectstack/cloud-connection@9.11.0 + - @objectstack/connector-rest@9.11.0 + - @objectstack/connector-slack@9.11.0 + ## 0.1.23 ### Patch Changes diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json index 4019a45b2b..6bf0595a03 100644 --- a/examples/app-showcase/package.json +++ b/examples/app-showcase/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-showcase", - "version": "0.1.23", + "version": "0.2.0", "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, AI). Built for demonstration, debugging, and coverage-driven verification.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md index 2eca258696..73aa8afb03 100644 --- a/examples/app-todo/CHANGELOG.md +++ b/examples/app-todo/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/example-todo +## 4.0.54 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/runtime@9.11.0 + - @objectstack/client@9.11.0 + - @objectstack/metadata@9.11.0 + - @objectstack/driver-sqlite-wasm@9.11.0 + - @objectstack/knowledge-memory@9.11.0 + - @objectstack/service-ai@9.11.0 + - @objectstack/service-knowledge@9.11.0 + ## 4.0.53 ### Patch Changes diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json index e2e394eb16..1d6c45ef73 100644 --- a/examples/app-todo/package.json +++ b/examples/app-todo/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-todo", - "version": "4.0.53", + "version": "4.0.54", "description": "Example Todo App using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/packages/adapters/express/CHANGELOG.md b/packages/adapters/express/CHANGELOG.md index 566a824166..9839ba4119 100644 --- a/packages/adapters/express/CHANGELOG.md +++ b/packages/adapters/express/CHANGELOG.md @@ -1,5 +1,12 @@ # @objectstack/express +## 9.11.0 + +### Patch Changes + +- Updated dependencies [2afb612] + - @objectstack/runtime@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/adapters/express/package.json b/packages/adapters/express/package.json index 3717912a9f..e529f0aa7c 100644 --- a/packages/adapters/express/package.json +++ b/packages/adapters/express/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/express", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/fastify/CHANGELOG.md b/packages/adapters/fastify/CHANGELOG.md index 9c5522fe50..78c6fb3f10 100644 --- a/packages/adapters/fastify/CHANGELOG.md +++ b/packages/adapters/fastify/CHANGELOG.md @@ -1,5 +1,12 @@ # @objectstack/fastify +## 9.11.0 + +### Patch Changes + +- Updated dependencies [2afb612] + - @objectstack/runtime@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/adapters/fastify/package.json b/packages/adapters/fastify/package.json index 2db4c44459..e6ee7be009 100644 --- a/packages/adapters/fastify/package.json +++ b/packages/adapters/fastify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/fastify", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md index 7312252448..b643888b03 100644 --- a/packages/adapters/hono/CHANGELOG.md +++ b/packages/adapters/hono/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/hono +## 9.11.0 + +### Patch Changes + +- Updated dependencies [2afb612] + - @objectstack/runtime@9.11.0 + - @objectstack/plugin-hono-server@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json index be18ef1702..6df5a6dd68 100644 --- a/packages/adapters/hono/package.json +++ b/packages/adapters/hono/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/hono", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/nestjs/CHANGELOG.md b/packages/adapters/nestjs/CHANGELOG.md index 9a22850196..d6a368ad2d 100644 --- a/packages/adapters/nestjs/CHANGELOG.md +++ b/packages/adapters/nestjs/CHANGELOG.md @@ -1,5 +1,12 @@ # @objectstack/nestjs +## 9.11.0 + +### Patch Changes + +- Updated dependencies [2afb612] + - @objectstack/runtime@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/adapters/nestjs/package.json b/packages/adapters/nestjs/package.json index c01c5113d9..e9e1ea25d4 100644 --- a/packages/adapters/nestjs/package.json +++ b/packages/adapters/nestjs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/nestjs", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/nextjs/CHANGELOG.md b/packages/adapters/nextjs/CHANGELOG.md index a1e8ca585b..64af6fd945 100644 --- a/packages/adapters/nextjs/CHANGELOG.md +++ b/packages/adapters/nextjs/CHANGELOG.md @@ -1,5 +1,12 @@ # @objectstack/nextjs +## 9.11.0 + +### Patch Changes + +- Updated dependencies [2afb612] + - @objectstack/runtime@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/adapters/nextjs/package.json b/packages/adapters/nextjs/package.json index 6580838695..08047006a0 100644 --- a/packages/adapters/nextjs/package.json +++ b/packages/adapters/nextjs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/nextjs", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/nuxt/CHANGELOG.md b/packages/adapters/nuxt/CHANGELOG.md index e0c3d71ab9..6534c99f0e 100644 --- a/packages/adapters/nuxt/CHANGELOG.md +++ b/packages/adapters/nuxt/CHANGELOG.md @@ -1,5 +1,12 @@ # @objectstack/nuxt +## 9.11.0 + +### Patch Changes + +- Updated dependencies [2afb612] + - @objectstack/runtime@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/adapters/nuxt/package.json b/packages/adapters/nuxt/package.json index dd6adeecd8..b61dc2c44b 100644 --- a/packages/adapters/nuxt/package.json +++ b/packages/adapters/nuxt/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/nuxt", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/adapters/sveltekit/CHANGELOG.md b/packages/adapters/sveltekit/CHANGELOG.md index 4cc3b892b9..6d8abd7cf5 100644 --- a/packages/adapters/sveltekit/CHANGELOG.md +++ b/packages/adapters/sveltekit/CHANGELOG.md @@ -1,5 +1,12 @@ # @objectstack/sveltekit +## 9.11.0 + +### Patch Changes + +- Updated dependencies [2afb612] + - @objectstack/runtime@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/adapters/sveltekit/package.json b/packages/adapters/sveltekit/package.json index 94e01a20ce..5e88d40d40 100644 --- a/packages/adapters/sveltekit/package.json +++ b/packages/adapters/sveltekit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/sveltekit", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md index bad8dc2e15..04a56aebec 100644 --- a/packages/apps/account/CHANGELOG.md +++ b/packages/apps/account/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/account +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json index 997d43971c..1b67208d96 100644 --- a/packages/apps/account/package.json +++ b/packages/apps/account/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/account", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md index ca725f53d8..dc3342aea6 100644 --- a/packages/apps/setup/CHANGELOG.md +++ b/packages/apps/setup/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/setup +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json index eb826951b9..61ef337c5c 100644 --- a/packages/apps/setup/package.json +++ b/packages/apps/setup/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/setup", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md index 0b5338fe7f..3b0d39ab0b 100644 --- a/packages/apps/studio/CHANGELOG.md +++ b/packages/apps/studio/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/studio +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json index 49f6edf603..9344cd92d5 100644 --- a/packages/apps/studio/package.json +++ b/packages/apps/studio/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/studio", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index f3bf8706f7..314fa297c7 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,141 @@ # @objectstack/cli +## 9.11.0 + +### Minor Changes + +- c651f38: feat(cli): warn on unrecognized autonumber format tokens + + `objectstack compile` now flags `autonumber` formats whose `{...}` token is not a + counter (`{0000}`), date (`{YYYY}`/`{MM}`/…) or `{field}` token — an unrecognized + group (wrong case, spaces, punctuation, or a second sequence slot) renders + LITERALLY into the record number, which is a silent footgun for AI-authored + templates. Emitted as an advisory warning (`autonumber-unrecognized-token`), + alongside the existing `{field}`-reference checks. The `objectstack-data` skill's + `field-types` rules were also expanded to document the date/`{field}`/per-scope + tokens and the authoring rules (required interpolated fields, delimited adjacent + tokens, pad width is a minimum, date tokens are exact). + +- 36138c7: feat(autonumber): date, {field} and per-scope counter reset for autonumber formats + + `autonumberFormat` previously only understood a single `{0000}` sequence slot — + everything else was a fixed literal prefix on one global counter. Real MES/eHR + record numbers need three more token classes, so the format is now tokenized by a + shared pure renderer in `@objectstack/spec` (`parseAutonumberFormat` / + `renderAutonumber`) that the engine fallback and the SQL driver both call, so they + emit byte-identical numbers (#1603 parity): + + - **Date tokens** — `{YYYY}` `{YY}` `{MM}` `{DD}` `{YYYYMMDD}` resolve the calendar + day in the request's **business timezone** (`ExecutionContext.timezone`, ADR-0053; + UTC fallback), threaded through the new `DriverOptions.timezone`. + - **`{field}` interpolation** — `{section}{island_zone}{000}` substitutes record + field values into the prefix. + - **Per-scope counter reset** — the counter's scope is the rendered prefix _before_ + the sequence slot, so `AD{YYYYMMDD}{0000}` resets daily, `{section}{island_zone}{000}` + numbers per group, and `{plan_no}{000}` numbers per parent — all from one + mechanism, no separate reset config. + + Fixed-prefix formats like `CASE-{0000}` render an empty scope and keep their single + global counter, so existing sequences are unchanged. The persistent + `_objectstack_sequences` table is keyed by a `key_hash` (SHA-256 of + `object, tenant_id, field, scope`) — a single 64-char primary key that keys every + dialect uniformly, stays within MySQL's utf8mb4 index-length limit (four raw + columns would not), and lets `scope` be a generous non-indexed column. Deployments + with an older table (3-column, or an interim `scope` column) are migrated in place + on first use, carrying existing counters to `scope=''`. + + Guardrails: + + - **Empty interpolated field is a hard error, not a silent mis-number.** A + `{field}` token whose value is missing at create time would render to an empty + prefix and collapse the record into the wrong counter scope. Both the SQL driver + and the engine fallback now refuse to generate and throw a clear error naming the + empty field (shared `missingFieldValues` helper). + - **Build-time lint (`@objectstack/cli compile`).** `autonumber` formats are + checked against the object's fields: a `{field}` token naming a non-existent + field (or the autonumber field itself) **fails the build**; a token naming an + _optional_ field emits an advisory warning to mark it `required: true`. + - **Migration fails safe.** If a legacy table cannot be migrated to the `key_hash` + shape, fixed-prefix sequences keep working via the legacy key and a per-scope + write raises an actionable error instead of corrupting counters. + - **Long `{field}` scopes are supported** (e.g. a long `{plan_no}`): the non-indexed + `scope` column and hashed key remove the old varchar/PK length ceiling. + + Notes on inherent semantics (documented, not bugs): + + - The counter scope IS the rendered prefix. When two records' tokens render to the + same prefix string (e.g. `{a}{b}` for `('AB','C')` and `('A','BC')`) they also + render the same visible number, so they share one counter to stay unique — the + remedy for genuinely-distinct groups is an unambiguous format (a delimiter + literal between variable tokens). + - The sequence pad width is a MINIMUM; past it the number grows (`{000}` → + `1000`), it never wraps — matching mainstream autonumber semantics. + +- fd2e1a2: Add `@objectstack/verify` — boot any ObjectStack app in-process and verify it through the real HTTP stack: auto-derived CRUD round-trip fidelity (`runCrudVerification`) plus the cross-owner RLS invariant (`runRlsProofs`, "you can't write what you can't read"). Also adds an `objectstack verify` CLI command that runs these proofs against an app config and exits non-zero on real failures. + + Extracted from the internal dogfood regression gate so third-party and template authors can run the same runtime proofs against their own apps. The private `@objectstack/dogfood` package now consumes this library for its golden regression tests. + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [e7f6539] +- Updated dependencies [fa8964d] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] +- Updated dependencies [a8e4f3b] +- Updated dependencies [fd2e1a2] + - @objectstack/spec@9.11.0 + - @objectstack/plugin-sharing@9.11.0 + - @objectstack/rest@9.11.0 + - @objectstack/plugin-security@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/driver-sql@9.11.0 + - @objectstack/verify@9.11.0 + - @objectstack/runtime@9.11.0 + - @objectstack/account@9.11.0 + - @objectstack/setup@9.11.0 + - @objectstack/studio@9.11.0 + - @objectstack/client@9.11.0 + - @objectstack/cloud-connection@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/formula@9.11.0 + - @objectstack/mcp@9.11.0 + - @objectstack/observability@9.11.0 + - @objectstack/platform-objects@9.11.0 + - @objectstack/driver-memory@9.11.0 + - @objectstack/driver-mongodb@9.11.0 + - @objectstack/driver-sqlite-wasm@9.11.0 + - @objectstack/plugin-approvals@9.11.0 + - @objectstack/plugin-audit@9.11.0 + - @objectstack/plugin-auth@9.11.0 + - @objectstack/plugin-email@9.11.0 + - @objectstack/plugin-hono-server@9.11.0 + - @objectstack/plugin-org-scoping@9.11.0 + - @objectstack/plugin-reports@9.11.0 + - @objectstack/plugin-webhooks@9.11.0 + - @objectstack/service-ai@9.11.0 + - @objectstack/service-analytics@9.11.0 + - @objectstack/service-automation@9.11.0 + - @objectstack/service-cache@9.11.0 + - @objectstack/service-datasource@9.11.0 + - @objectstack/service-job@9.11.0 + - @objectstack/service-messaging@9.11.0 + - @objectstack/service-package@9.11.0 + - @objectstack/service-queue@9.11.0 + - @objectstack/service-realtime@9.11.0 + - @objectstack/service-settings@9.11.0 + - @objectstack/service-storage@9.11.0 + - @objectstack/trigger-api@9.11.0 + - @objectstack/trigger-record-change@9.11.0 + - @objectstack/trigger-schedule@9.11.0 + - @objectstack/types@9.11.0 + - @objectstack/console@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index d69cdd428b..1806518212 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cli", - "version": "9.10.0", + "version": "9.11.0", "description": "Command Line Interface for ObjectStack Protocol", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md index ae0b0652d8..9fcfd308a3 100644 --- a/packages/client-react/CHANGELOG.md +++ b/packages/client-react/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/client-react +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/client@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/client-react/package.json b/packages/client-react/package.json index 9fd5c18552..1fefbaa107 100644 --- a/packages/client-react/package.json +++ b/packages/client-react/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client-react", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "React hooks for ObjectStack Client SDK", "main": "dist/index.js", diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index e56b563674..fca8771262 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/client +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/client/package.json b/packages/client/package.json index f56d83a118..4a2c1a93d2 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Official Client SDK for ObjectStack Protocol", "main": "dist/index.js", diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md index 20283dc1f1..ab052474c6 100644 --- a/packages/cloud-connection/CHANGELOG.md +++ b/packages/cloud-connection/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/cloud-connection +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/runtime@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json index 48d6b130f6..592ff1d3fd 100644 --- a/packages/cloud-connection/package.json +++ b/packages/cloud-connection/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cloud-connection", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.", "type": "module", diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md index 5e0d321164..6ed8963aff 100644 --- a/packages/connectors/connector-mcp/CHANGELOG.md +++ b/packages/connectors/connector-mcp/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/connector-mcp +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json index 6980b4a6b3..c98dda423b 100644 --- a/packages/connectors/connector-mcp/package.json +++ b/packages/connectors/connector-mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-mcp", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).", "main": "dist/index.js", diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md index 56f5b2ba34..96412a5ee9 100644 --- a/packages/connectors/connector-openapi/CHANGELOG.md +++ b/packages/connectors/connector-openapi/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/connector-openapi +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json index 839dd49656..fac134fde4 100644 --- a/packages/connectors/connector-openapi/package.json +++ b/packages/connectors/connector-openapi/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-openapi", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).", "main": "dist/index.js", diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md index a44b62af2d..ea3d9688b2 100644 --- a/packages/connectors/connector-rest/CHANGELOG.md +++ b/packages/connectors/connector-rest/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/connector-rest +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json index b3f63412c2..1985fee0ce 100644 --- a/packages/connectors/connector-rest/package.json +++ b/packages/connectors/connector-rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-rest", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).", "main": "dist/index.js", diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md index bc7b1b1f36..a8f9d4ae4c 100644 --- a/packages/connectors/connector-slack/CHANGELOG.md +++ b/packages/connectors/connector-slack/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/connector-slack +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json index 0ffad72493..911a96ecb1 100644 --- a/packages/connectors/connector-slack/package.json +++ b/packages/connectors/connector-slack/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-slack", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).", "main": "dist/index.js", diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md index b94551f315..f4cacd76df 100644 --- a/packages/console/CHANGELOG.md +++ b/packages/console/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/console +## 9.11.0 + ## 9.10.0 ## 9.9.1 diff --git a/packages/console/package.json b/packages/console/package.json index 28885568e8..ad199b17d1 100644 --- a/packages/console/package.json +++ b/packages/console/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/console", - "version": "9.10.0", + "version": "9.11.0", "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).", "license": "Apache-2.0", "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index e13ae5ab57..377d7ec405 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/core +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index 0173055197..40c7279a25 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/core", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Microkernel Core for ObjectStack", "type": "module", diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md index c81c2fa675..7d706f5dfb 100644 --- a/packages/create-objectstack/CHANGELOG.md +++ b/packages/create-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # create-objectstack +## 9.11.0 + ## 9.10.0 ## 9.9.1 diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index 46a089e600..2b58f3b5ea 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -1,6 +1,6 @@ { "name": "create-objectstack", - "version": "9.10.0", + "version": "9.11.0", "description": "Create a new ObjectStack project — npx create-objectstack", "bin": { "create-objectstack": "./bin/create-objectstack.js" diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md index 2df6c2f360..4c0f8fae6c 100644 --- a/packages/dogfood/CHANGELOG.md +++ b/packages/dogfood/CHANGELOG.md @@ -1,5 +1,28 @@ # @objectstack/dogfood +## 0.0.2 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [fa8964d] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] +- Updated dependencies [37e9acb] +- Updated dependencies [a8e4f3b] +- Updated dependencies [fd2e1a2] + - @objectstack/spec@9.11.0 + - @objectstack/example-showcase@0.2.0 + - @objectstack/plugin-security@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/verify@9.11.0 + - @objectstack/example-crm@4.0.54 + ## 0.0.1 ### Patch Changes diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json index b87afe6849..49ffb0d9f0 100644 --- a/packages/dogfood/package.json +++ b/packages/dogfood/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/dogfood", - "version": "0.0.1", + "version": "0.0.2", "private": true, "license": "Apache-2.0", "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.", diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md index d509973554..d1afcb87d6 100644 --- a/packages/formula/CHANGELOG.md +++ b/packages/formula/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/formula +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + ## 9.10.0 ### Minor Changes diff --git a/packages/formula/package.json b/packages/formula/package.json index 5305539e5d..eed28407af 100644 --- a/packages/formula/package.json +++ b/packages/formula/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/formula", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry", "main": "dist/index.js", diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md index 7082082723..80c4d1d954 100644 --- a/packages/mcp/CHANGELOG.md +++ b/packages/mcp/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-mcp-server +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 5ad6a7aa66..f89b04f179 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/mcp", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)", "type": "module", diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md index 46ea0bd3cb..3e1a9f8323 100644 --- a/packages/metadata-core/CHANGELOG.md +++ b/packages/metadata-core/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/metadata-core +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json index c3192a38e2..71352530ec 100644 --- a/packages/metadata-core/package.json +++ b/packages/metadata-core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-core", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).", "type": "module", diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md index 193bbae621..e8fd51cbbd 100644 --- a/packages/metadata-fs/CHANGELOG.md +++ b/packages/metadata-fs/CHANGELOG.md @@ -1,5 +1,11 @@ # @objectstack/metadata-fs +## 9.11.0 + +### Patch Changes + +- @objectstack/metadata-core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json index 88d4c748f1..3c3e9f20e4 100644 --- a/packages/metadata-fs/package.json +++ b/packages/metadata-fs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-fs", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).", "type": "module", diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md index b3f4c47339..b8f406cdd6 100644 --- a/packages/metadata/CHANGELOG.md +++ b/packages/metadata/CHANGELOG.md @@ -1,5 +1,24 @@ # @objectstack/metadata +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/metadata-core@9.11.0 + - @objectstack/platform-objects@9.11.0 + - @objectstack/types@9.11.0 + - @objectstack/metadata-fs@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/metadata/package.json b/packages/metadata/package.json index a0c80189ee..bfe1930978 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Metadata loading, saving, and persistence for ObjectStack", "type": "module", diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md index 2fbd244e12..7fa0428541 100644 --- a/packages/objectql/CHANGELOG.md +++ b/packages/objectql/CHANGELOG.md @@ -1,5 +1,80 @@ # @objectstack/objectql +## 9.11.0 + +### Minor Changes + +- 36138c7: feat(autonumber): date, {field} and per-scope counter reset for autonumber formats + + `autonumberFormat` previously only understood a single `{0000}` sequence slot — + everything else was a fixed literal prefix on one global counter. Real MES/eHR + record numbers need three more token classes, so the format is now tokenized by a + shared pure renderer in `@objectstack/spec` (`parseAutonumberFormat` / + `renderAutonumber`) that the engine fallback and the SQL driver both call, so they + emit byte-identical numbers (#1603 parity): + + - **Date tokens** — `{YYYY}` `{YY}` `{MM}` `{DD}` `{YYYYMMDD}` resolve the calendar + day in the request's **business timezone** (`ExecutionContext.timezone`, ADR-0053; + UTC fallback), threaded through the new `DriverOptions.timezone`. + - **`{field}` interpolation** — `{section}{island_zone}{000}` substitutes record + field values into the prefix. + - **Per-scope counter reset** — the counter's scope is the rendered prefix _before_ + the sequence slot, so `AD{YYYYMMDD}{0000}` resets daily, `{section}{island_zone}{000}` + numbers per group, and `{plan_no}{000}` numbers per parent — all from one + mechanism, no separate reset config. + + Fixed-prefix formats like `CASE-{0000}` render an empty scope and keep their single + global counter, so existing sequences are unchanged. The persistent + `_objectstack_sequences` table is keyed by a `key_hash` (SHA-256 of + `object, tenant_id, field, scope`) — a single 64-char primary key that keys every + dialect uniformly, stays within MySQL's utf8mb4 index-length limit (four raw + columns would not), and lets `scope` be a generous non-indexed column. Deployments + with an older table (3-column, or an interim `scope` column) are migrated in place + on first use, carrying existing counters to `scope=''`. + + Guardrails: + + - **Empty interpolated field is a hard error, not a silent mis-number.** A + `{field}` token whose value is missing at create time would render to an empty + prefix and collapse the record into the wrong counter scope. Both the SQL driver + and the engine fallback now refuse to generate and throw a clear error naming the + empty field (shared `missingFieldValues` helper). + - **Build-time lint (`@objectstack/cli compile`).** `autonumber` formats are + checked against the object's fields: a `{field}` token naming a non-existent + field (or the autonumber field itself) **fails the build**; a token naming an + _optional_ field emits an advisory warning to mark it `required: true`. + - **Migration fails safe.** If a legacy table cannot be migrated to the `key_hash` + shape, fixed-prefix sequences keep working via the legacy key and a per-scope + write raises an actionable error instead of corrupting counters. + - **Long `{field}` scopes are supported** (e.g. a long `{plan_no}`): the non-indexed + `scope` column and hashed key remove the old varchar/PK length ceiling. + + Notes on inherent semantics (documented, not bugs): + + - The counter scope IS the rendered prefix. When two records' tokens render to the + same prefix string (e.g. `{a}{b}` for `('AB','C')` and `('A','BC')`) they also + render the same visible number, so they share one counter to stay unique — the + remedy for genuinely-distinct groups is an unambiguous format (a delimiter + literal between variable tokens). + - The sequence pad width is a MINIMUM; past it the number grows (`{000}` → + `1000`), it never wraps — matching mainstream autonumber semantics. + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/formula@9.11.0 + - @objectstack/metadata-core@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Minor Changes diff --git a/packages/objectql/package.json b/packages/objectql/package.json index 6d0ad5c477..27ca8438b2 100644 --- a/packages/objectql/package.json +++ b/packages/objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/objectql", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Isomorphic ObjectQL Engine for ObjectStack", "main": "dist/index.js", diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md index 4d9f302b4f..11c3a22f4a 100644 --- a/packages/observability/CHANGELOG.md +++ b/packages/observability/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/observability +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/observability/package.json b/packages/observability/package.json index 5382503535..0211ca97f9 100644 --- a/packages/observability/package.json +++ b/packages/observability/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/observability", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.", "type": "module", diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md index d85fbcd93e..2709eb1ac8 100644 --- a/packages/platform-objects/CHANGELOG.md +++ b/packages/platform-objects/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/platform-objects +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/metadata-core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json index da0040edb5..8e0b818acd 100644 --- a/packages/platform-objects/package.json +++ b/packages/platform-objects/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/platform-objects", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects", "main": "dist/index.js", diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md index a77e18ddfb..683d9be7bc 100644 --- a/packages/plugins/driver-memory/CHANGELOG.md +++ b/packages/plugins/driver-memory/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/driver-memory +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json index caeaa14abb..0f088cfbb3 100644 --- a/packages/plugins/driver-memory/package.json +++ b/packages/plugins/driver-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-memory", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "In-Memory Driver for ObjectStack (Reference Implementation)", "main": "dist/index.js", diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md index 0e7c784f25..c7927a4e34 100644 --- a/packages/plugins/driver-mongodb/CHANGELOG.md +++ b/packages/plugins/driver-mongodb/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/driver-mongodb +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json index 184ed98df3..67b89dfd40 100644 --- a/packages/plugins/driver-mongodb/package.json +++ b/packages/plugins/driver-mongodb/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-mongodb", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client", "main": "dist/index.js", diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md index 0499780245..3b8b986a96 100644 --- a/packages/plugins/driver-sql/CHANGELOG.md +++ b/packages/plugins/driver-sql/CHANGELOG.md @@ -1,5 +1,77 @@ # @objectstack/driver-sql +## 9.11.0 + +### Minor Changes + +- 36138c7: feat(autonumber): date, {field} and per-scope counter reset for autonumber formats + + `autonumberFormat` previously only understood a single `{0000}` sequence slot — + everything else was a fixed literal prefix on one global counter. Real MES/eHR + record numbers need three more token classes, so the format is now tokenized by a + shared pure renderer in `@objectstack/spec` (`parseAutonumberFormat` / + `renderAutonumber`) that the engine fallback and the SQL driver both call, so they + emit byte-identical numbers (#1603 parity): + + - **Date tokens** — `{YYYY}` `{YY}` `{MM}` `{DD}` `{YYYYMMDD}` resolve the calendar + day in the request's **business timezone** (`ExecutionContext.timezone`, ADR-0053; + UTC fallback), threaded through the new `DriverOptions.timezone`. + - **`{field}` interpolation** — `{section}{island_zone}{000}` substitutes record + field values into the prefix. + - **Per-scope counter reset** — the counter's scope is the rendered prefix _before_ + the sequence slot, so `AD{YYYYMMDD}{0000}` resets daily, `{section}{island_zone}{000}` + numbers per group, and `{plan_no}{000}` numbers per parent — all from one + mechanism, no separate reset config. + + Fixed-prefix formats like `CASE-{0000}` render an empty scope and keep their single + global counter, so existing sequences are unchanged. The persistent + `_objectstack_sequences` table is keyed by a `key_hash` (SHA-256 of + `object, tenant_id, field, scope`) — a single 64-char primary key that keys every + dialect uniformly, stays within MySQL's utf8mb4 index-length limit (four raw + columns would not), and lets `scope` be a generous non-indexed column. Deployments + with an older table (3-column, or an interim `scope` column) are migrated in place + on first use, carrying existing counters to `scope=''`. + + Guardrails: + + - **Empty interpolated field is a hard error, not a silent mis-number.** A + `{field}` token whose value is missing at create time would render to an empty + prefix and collapse the record into the wrong counter scope. Both the SQL driver + and the engine fallback now refuse to generate and throw a clear error naming the + empty field (shared `missingFieldValues` helper). + - **Build-time lint (`@objectstack/cli compile`).** `autonumber` formats are + checked against the object's fields: a `{field}` token naming a non-existent + field (or the autonumber field itself) **fails the build**; a token naming an + _optional_ field emits an advisory warning to mark it `required: true`. + - **Migration fails safe.** If a legacy table cannot be migrated to the `key_hash` + shape, fixed-prefix sequences keep working via the legacy key and a per-scope + write raises an actionable error instead of corrupting counters. + - **Long `{field}` scopes are supported** (e.g. a long `{plan_no}`): the non-indexed + `scope` column and hashed key remove the old varchar/PK length ceiling. + + Notes on inherent semantics (documented, not bugs): + + - The counter scope IS the rendered prefix. When two records' tokens render to the + same prefix string (e.g. `{a}{b}` for `('AB','C')` and `('A','BC')`) they also + render the same visible number, so they share one counter to stay unique — the + remedy for genuinely-distinct groups is an unambiguous format (a delimiter + literal between variable tokens). + - The sequence pad width is a MINIMUM; past it the number grows (`{000}` → + `1000`), it never wraps — matching mainstream autonumber semantics. + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json index bb0387f938..c6a4931f7d 100644 --- a/packages/plugins/driver-sql/package.json +++ b/packages/plugins/driver-sql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sql", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex", "main": "dist/index.js", diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md index 1f0b041255..c0da7a2b26 100644 --- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md +++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/driver-sqlite-wasm +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/driver-sql@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json index 373b17bf7d..4d7183c9ef 100644 --- a/packages/plugins/driver-sqlite-wasm/package.json +++ b/packages/plugins/driver-sqlite-wasm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sqlite-wasm", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings", "keywords": [ diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md index 339d2d8c41..4f1dc10fb6 100644 --- a/packages/plugins/embedder-openai/CHANGELOG.md +++ b/packages/plugins/embedder-openai/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/embedder-openai +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json index c8961cb020..07326a319a 100644 --- a/packages/plugins/embedder-openai/package.json +++ b/packages/plugins/embedder-openai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/embedder-openai", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md index 0778281d3d..f2831907db 100644 --- a/packages/plugins/knowledge-memory/CHANGELOG.md +++ b/packages/plugins/knowledge-memory/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/knowledge-memory +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/service-knowledge@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json index 176be01df8..b2580d548f 100644 --- a/packages/plugins/knowledge-memory/package.json +++ b/packages/plugins/knowledge-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-memory", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md index 1503cd7407..abeef91414 100644 --- a/packages/plugins/knowledge-ragflow/CHANGELOG.md +++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/knowledge-ragflow +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/service-knowledge@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json index 1653116fb8..d5758c8bcb 100644 --- a/packages/plugins/knowledge-ragflow/package.json +++ b/packages/plugins/knowledge-ragflow/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-ragflow", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md index 275b164f3c..71068a9a16 100644 --- a/packages/plugins/plugin-approvals/CHANGELOG.md +++ b/packages/plugins/plugin-approvals/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/plugin-approvals +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/formula@9.11.0 + - @objectstack/metadata-core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json index e09022dda6..9bc8e638b7 100644 --- a/packages/plugins/plugin-approvals/package.json +++ b/packages/plugins/plugin-approvals/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-approvals", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md index 830b1644ac..161ceaed0f 100644 --- a/packages/plugins/plugin-audit/CHANGELOG.md +++ b/packages/plugins/plugin-audit/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-audit +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json index 8e9a71ff29..01d046eb09 100644 --- a/packages/plugins/plugin-audit/package.json +++ b/packages/plugins/plugin-audit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-audit", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Audit Plugin for ObjectStack — System audit log object and audit trail", "main": "dist/index.js", diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md index 4f94073cd3..a8a90abf44 100644 --- a/packages/plugins/plugin-auth/CHANGELOG.md +++ b/packages/plugins/plugin-auth/CHANGELOG.md @@ -1,5 +1,22 @@ # Changelog +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index de7a756e55..eb7e59278b 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-auth", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Authentication & Identity Plugin for ObjectStack", "main": "dist/index.js", diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md index d35067bb22..20be06bd1f 100644 --- a/packages/plugins/plugin-dev/CHANGELOG.md +++ b/packages/plugins/plugin-dev/CHANGELOG.md @@ -1,5 +1,35 @@ # @objectstack/plugin-dev +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [e7f6539] +- Updated dependencies [fa8964d] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/rest@9.11.0 + - @objectstack/plugin-security@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/runtime@9.11.0 + - @objectstack/account@9.11.0 + - @objectstack/setup@9.11.0 + - @objectstack/studio@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/driver-memory@9.11.0 + - @objectstack/plugin-auth@9.11.0 + - @objectstack/plugin-hono-server@9.11.0 + - @objectstack/plugin-org-scoping@9.11.0 + - @objectstack/service-i18n@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json index 514209785f..b7212adfde 100644 --- a/packages/plugins/plugin-dev/package.json +++ b/packages/plugins/plugin-dev/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-dev", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations", "main": "dist/index.js", diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md index 7a5c951d62..df4cae2870 100644 --- a/packages/plugins/plugin-email/CHANGELOG.md +++ b/packages/plugins/plugin-email/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/plugin-email +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/formula@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json index 58a8efc0c7..db1d404283 100644 --- a/packages/plugins/plugin-email/package.json +++ b/packages/plugins/plugin-email/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-email", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md index 6a3f7f2ddc..332b549e07 100644 --- a/packages/plugins/plugin-hono-server/CHANGELOG.md +++ b/packages/plugins/plugin-hono-server/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-hono-server +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json index 7b18ac8b36..716a040642 100644 --- a/packages/plugins/plugin-hono-server/package.json +++ b/packages/plugins/plugin-hono-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-hono-server", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Standard Hono Server Adapter for ObjectStack Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-msw/CHANGELOG.md b/packages/plugins/plugin-msw/CHANGELOG.md index 667ee7459b..a47de04505 100644 --- a/packages/plugins/plugin-msw/CHANGELOG.md +++ b/packages/plugins/plugin-msw/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/plugin-msw +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/runtime@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-msw/package.json b/packages/plugins/plugin-msw/package.json index 71d6964170..a8c18fa020 100644 --- a/packages/plugins/plugin-msw/package.json +++ b/packages/plugins/plugin-msw/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-msw", - "version": "9.10.0", + "version": "9.11.0", "description": "MSW (Mock Service Worker) Plugin for ObjectStack Runtime", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/plugins/plugin-org-scoping/CHANGELOG.md b/packages/plugins/plugin-org-scoping/CHANGELOG.md index 1918a89943..acfc6229c8 100644 --- a/packages/plugins/plugin-org-scoping/CHANGELOG.md +++ b/packages/plugins/plugin-org-scoping/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-org-scoping +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Minor Changes diff --git a/packages/plugins/plugin-org-scoping/package.json b/packages/plugins/plugin-org-scoping/package.json index e22df14ae2..fb7653326d 100644 --- a/packages/plugins/plugin-org-scoping/package.json +++ b/packages/plugins/plugin-org-scoping/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-org-scoping", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Organization-Scoping Plugin for ObjectStack — row-level Organization isolation, per-org seed replay, default-org bootstrap", "main": "dist/index.js", diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md index e7ace0ef93..612f7627c9 100644 --- a/packages/plugins/plugin-reports/CHANGELOG.md +++ b/packages/plugins/plugin-reports/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-reports +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json index 6667b3d45b..e1588c4e95 100644 --- a/packages/plugins/plugin-reports/package.json +++ b/packages/plugins/plugin-reports/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-reports", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md index 190968561f..02be5e58f1 100644 --- a/packages/plugins/plugin-security/CHANGELOG.md +++ b/packages/plugins/plugin-security/CHANGELOG.md @@ -1,5 +1,79 @@ # @objectstack/plugin-security +## 9.11.0 + +### Minor Changes + +- fa8964d: feat(security): RLS predicates that won't compile are surfaced, not silently dropped (ADR-0056 D4) + + The RLS compiler previously dropped any `using`/`check` it could not parse (e.g. `==`, + `AND`/`OR`, ranges) in silence — if it was the only policy, the object lost protection + with no signal (the class of bug that left a showcase owner predicate inert for two PRs). + Now the compiler WARNS (via the security plugin's logger) when an **unsupported-shape** + predicate is dropped, distinguishing it from the intentional "context variable absent" + fail-closed skip. Also exports `isSupportedRlsExpression(expr)` so an authoring-time gate + (`objectstack compile`) can reject a predicate the runtime would never enforce. No change + to compiled filters for valid predicates; fail-closed semantics preserved. + +- 6595b53: feat(security): app-declarable default profile (`isDefault`, ADR-0056 D7) + + An app can now declare its default access posture for authenticated users who have + no explicit grants, via `isDefault: true` on a permission set — instead of always + inheriting the built-in `member_default`. The SecurityPlugin resolves the fallback + from the `isDefault` profile when no explicit `fallbackPermissionSet` is configured + (falling back to `member_default` when none is declared — non-breaking). This is the + foundation for SSO/JIT provisioning (mapping IdP claims → a declared default profile). + Proven by the `showcase-default-profile` dogfood test: a sign-up governed by a custom + default that grants only `showcase_announcement` can read it but is denied + `showcase_private_note` (which the `member_default` wildcard would have allowed). + +- 4c213c2: Master-detail "controlled by parent" permissions (ADR-0055). + + A detail object can now declare `sharingModel: 'controlled_by_parent'`: its read/write access is derived from its master record, with no authored RLS. + + - `@objectstack/spec`: `controlled_by_parent` added to the authorable `object.sharingModel` enum. + - `@objectstack/plugin-security`: reads inject `masterFK IN (accessible master ids)` (resolved from the master's own RLS, reusing the existing filter machinery — zero RLS-compiler changes); by-id writes (insert/update/delete) to a detail now require edit access to its master, closing the #1994-class by-id hole for derived access. + - `@objectstack/verify`: related-record **topological synthesis** — `deriveCrudCases` no longer skips objects with required relations; it builds the object dependency graph, orders it topologically, and threads real target ids, so relationship-dense objects (and the master-detail RLS proof) are verifiable. Honest `blocked` verdicts remain for required-reference cycles and external/missing targets. + + v1 limits (per ADR-0055): the accessible-master id set is unbounded (large-tenant scale is a documented future limit), and master-detail chains are single-level (not transitively traversed). + +- 2afb612: feat(security): resolve `current_user.email` in RLS owner policies + + RLS `using` predicates can now reference **`current_user.email`** — a unique, + human-readable, _seedable_ owner anchor (`owner = current_user.email`). Previously + the RLS compiler resolved only `current_user.id` / `organization_id` / `roles` / + `org_user_ids`, so any owner-by-name/email predicate silently compiled to the + deny sentinel (fail-closed → the user saw nothing). Email is sourced for free + from the auth session (with a bounded `sys_user` fallback for the API-key path) + and threaded onto the `ExecutionContext` in both identity resolvers — the REST + data path (`rest-server`) and the dispatcher path (`resolve-execution-context`). + + Display `name` is deliberately **not** exposed to RLS: names collide, and a + collision on an ownership predicate is an access-control leak. Only unique + identifiers (`id`, `email`) are resolvable. + + This makes owner-scoped row-level security work with seed data (no per-user ids + needed) and, combined with `controlled_by_parent` (ADR-0055), lets a master's + owner scoping flow to its detail records. The example-showcase demonstrates it: + `showcase_invoice` carries an `owner` email + an owner RLS policy, its lines are + controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the + showcase's previously inert owner predicates (they used `==` and `current_user.name`, + neither of which the compiler accepts) to `= current_user.email`. + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Minor Changes diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json index f931f71802..2b9b3058f9 100644 --- a/packages/plugins/plugin-security/package.json +++ b/packages/plugins/plugin-security/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-security", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md index 0f778f69cc..696c4889ce 100644 --- a/packages/plugins/plugin-sharing/CHANGELOG.md +++ b/packages/plugins/plugin-sharing/CHANGELOG.md @@ -1,5 +1,48 @@ # @objectstack/plugin-sharing +## 9.11.0 + +### Minor Changes + +- 2365d07: feat(sharing): configurable role-hierarchy widening — `role_and_subordinates` recipient (ADR-0056 D6) + + Role-hierarchy access widening ("a manager sees records shared with their team") is now + **implemented and configurable per sharing rule**, not a hardcoded no-op. The + `role_and_subordinates` recipient (declarable on `sys_sharing_rule.recipient_type`) expands, + at evaluation time, to the named role **plus every subordinate role** by walking the + `sys_role.parent` hierarchy via a new `RoleGraphService` (mirroring the department/team + graphs; cycle-safe). Previously `Role.parent` was declared but never consumed — a silent + no-op flagged by the ADR-0056 audit. This is the Salesforce "grant access using hierarchies" + model expressed declaratively: each rule chooses whether to roll up the hierarchy. Unit-proven + (role-graph traversal, subordinate-user expansion, cycle safety); the recipient is added to + the authoring select + the `SharingRuleRecipientType` contract. + +### Patch Changes + +- e7f6539: feat(spec,sharing): canonical OWD vocabulary on `object.sharingModel` (ADR-0056 D1) + + Reconciles the Org-Wide-Default naming so authors use ONE vocabulary. `object.sharingModel` + now accepts the canonical OWD names — `private` | `public_read` | `public_read_write` | + `controlled_by_parent` — alongside the legacy `read` / `read_write` / `full` aliases (kept, + non-breaking). The sharing runtime maps them onto the three enforced behaviours + (`public_read` ≡ legacy `read` = everyone reads / owner writes; `public_read_write` = + unscoped). Unknown values remain rejected by the enum (authoring-time, fail-closed). The + showcase announcement now declares the canonical `public_read`, exercised end-to-end by the + public-read dogfood proof. + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json index 9095655b3d..f1dfd18b46 100644 --- a/packages/plugins/plugin-sharing/package.json +++ b/packages/plugins/plugin-sharing/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sharing", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md index 695751bfe8..f9d0f9c31b 100644 --- a/packages/plugins/plugin-webhooks/CHANGELOG.md +++ b/packages/plugins/plugin-webhooks/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-webhooks +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/service-messaging@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json index 12ce10827f..999cf7cfe3 100644 --- a/packages/plugins/plugin-webhooks/package.json +++ b/packages/plugins/plugin-webhooks/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-webhooks", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.", "type": "module", diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md index ae00e2ccef..708e703686 100644 --- a/packages/rest/CHANGELOG.md +++ b/packages/rest/CHANGELOG.md @@ -1,5 +1,56 @@ # @objectstack/rest +## 9.11.0 + +### Patch Changes + +- e7f6539: feat(rest): warn on fail-open anonymous posture (ADR-0056 D2, warn→enforce) + + Secure-by-default work for the data API. The deny capability already exists + (`api.requireAuth=true` rejects anonymous via `enforceAuth`, and share-link / + `guest_portal` / control-plane routes are exempt) — but the **default is fail-open** + (`requireAuth=false`), so an object with no OWD/RLS is world-readable with no signal. + This adds a boot-time WARN when running in that posture, making it explicit + (consistent with D4/D8 honesty). The global default is deliberately NOT flipped here + — that is a release-gated decision; flipping it would 401 deployments that rely on + anonymous reads. Proven by the `showcase-anonymous-deny` dogfood test (anonymous + read+write → 401, authenticated → 200, control-plane open). + +- 2afb612: feat(security): resolve `current_user.email` in RLS owner policies + + RLS `using` predicates can now reference **`current_user.email`** — a unique, + human-readable, _seedable_ owner anchor (`owner = current_user.email`). Previously + the RLS compiler resolved only `current_user.id` / `organization_id` / `roles` / + `org_user_ids`, so any owner-by-name/email predicate silently compiled to the + deny sentinel (fail-closed → the user saw nothing). Email is sourced for free + from the auth session (with a bounded `sys_user` fallback for the API-key path) + and threaded onto the `ExecutionContext` in both identity resolvers — the REST + data path (`rest-server`) and the dispatcher path (`resolve-execution-context`). + + Display `name` is deliberately **not** exposed to RLS: names collide, and a + collision on an ownership predicate is an access-control leak. Only unique + identifiers (`id`, `email`) are resolvable. + + This makes owner-scoped row-level security work with seed data (no per-user ids + needed) and, combined with `controlled_by_parent` (ADR-0055), lets a master's + owner scoping flow to its detail records. The example-showcase demonstrates it: + `showcase_invoice` carries an `owner` email + an owner RLS policy, its lines are + controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the + showcase's previously inert owner predicates (they used `==` and `current_user.name`, + neither of which the compiler accepts) to `= current_user.email`. + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/service-package@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/rest/package.json b/packages/rest/package.json index 4548286d51..80ddca526c 100644 --- a/packages/rest/package.json +++ b/packages/rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/rest", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol", "type": "module", diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md index 8987ede436..ffdca6b9a2 100644 --- a/packages/runtime/CHANGELOG.md +++ b/packages/runtime/CHANGELOG.md @@ -1,5 +1,59 @@ # @objectstack/runtime +## 9.11.0 + +### Patch Changes + +- 2afb612: feat(security): resolve `current_user.email` in RLS owner policies + + RLS `using` predicates can now reference **`current_user.email`** — a unique, + human-readable, _seedable_ owner anchor (`owner = current_user.email`). Previously + the RLS compiler resolved only `current_user.id` / `organization_id` / `roles` / + `org_user_ids`, so any owner-by-name/email predicate silently compiled to the + deny sentinel (fail-closed → the user saw nothing). Email is sourced for free + from the auth session (with a bounded `sys_user` fallback for the API-key path) + and threaded onto the `ExecutionContext` in both identity resolvers — the REST + data path (`rest-server`) and the dispatcher path (`resolve-execution-context`). + + Display `name` is deliberately **not** exposed to RLS: names collide, and a + collision on an ownership predicate is an access-control leak. Only unique + identifiers (`id`, `email`) are resolvable. + + This makes owner-scoped row-level security work with seed data (no per-user ids + needed) and, combined with `controlled_by_parent` (ADR-0055), lets a master's + owner scoping flow to its detail records. The example-showcase demonstrates it: + `showcase_invoice` carries an `owner` email + an owner RLS policy, its lines are + controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the + showcase's previously inert owner predicates (they used `==` and `current_user.name`, + neither of which the compiler accepts) to `= current_user.email`. + +- Updated dependencies [e7f6539] +- Updated dependencies [e7f6539] +- Updated dependencies [fa8964d] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/rest@9.11.0 + - @objectstack/plugin-security@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/driver-sql@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/formula@9.11.0 + - @objectstack/metadata@9.11.0 + - @objectstack/observability@9.11.0 + - @objectstack/driver-memory@9.11.0 + - @objectstack/driver-sqlite-wasm@9.11.0 + - @objectstack/plugin-auth@9.11.0 + - @objectstack/plugin-org-scoping@9.11.0 + - @objectstack/service-cluster@9.11.0 + - @objectstack/service-i18n@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Minor Changes diff --git a/packages/runtime/package.json b/packages/runtime/package.json index db03305317..3479042d8b 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/runtime", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "ObjectStack Core Runtime & Query Engine", "type": "module", diff --git a/packages/services/service-ai/CHANGELOG.md b/packages/services/service-ai/CHANGELOG.md index b6d0ff29fb..b4ed7a074b 100644 --- a/packages/services/service-ai/CHANGELOG.md +++ b/packages/services/service-ai/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/service-ai +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/formula@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-ai/package.json b/packages/services/service-ai/package.json index 12fe46540e..caba20b022 100644 --- a/packages/services/service-ai/package.json +++ b/packages/services/service-ai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-ai", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "AI Service for ObjectStack — implements IAIService with LLM adapter layer, conversation management, tool registry, and REST/SSE routes", "type": "module", diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md index 7322b7366b..32b1171136 100644 --- a/packages/services/service-analytics/CHANGELOG.md +++ b/packages/services/service-analytics/CHANGELOG.md @@ -1,5 +1,20 @@ # Changelog — @objectstack/service-analytics +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json index 9af4742929..02a3c3c139 100644 --- a/packages/services/service-analytics/package.json +++ b/packages/services/service-analytics/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-analytics", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)", "type": "module", diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md index 491ad3e806..ab53043a6f 100644 --- a/packages/services/service-automation/CHANGELOG.md +++ b/packages/services/service-automation/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-automation +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/formula@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json index b87e32bf4d..70f221c225 100644 --- a/packages/services/service-automation/package.json +++ b/packages/services/service-automation/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-automation", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine", "type": "module", diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md index b6c9faced6..3b30e52b81 100644 --- a/packages/services/service-cache/CHANGELOG.md +++ b/packages/services/service-cache/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-cache +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/observability@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json index d6eb9d4db6..80ba1cb066 100644 --- a/packages/services/service-cache/package.json +++ b/packages/services/service-cache/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cache", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters", "type": "module", diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md index 31e48eab79..9c77a8cd5c 100644 --- a/packages/services/service-cluster-redis/CHANGELOG.md +++ b/packages/services/service-cluster-redis/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-cluster-redis +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/service-cluster@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json index d4b0ed73ce..5efa0aacba 100644 --- a/packages/services/service-cluster-redis/package.json +++ b/packages/services/service-cluster-redis/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster-redis", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.", "type": "module", diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md index 137c0620ff..85f5e1f9f2 100644 --- a/packages/services/service-cluster/CHANGELOG.md +++ b/packages/services/service-cluster/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-cluster +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json index 6a56dd5b9c..8b29180a00 100644 --- a/packages/services/service-cluster/package.json +++ b/packages/services/service-cluster/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.", "type": "module", diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md index 4a9db49d34..4f68d28f35 100644 --- a/packages/services/service-datasource/CHANGELOG.md +++ b/packages/services/service-datasource/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-external-datasource +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json index 41e09db39c..9243eb9aba 100644 --- a/packages/services/service-datasource/package.json +++ b/packages/services/service-datasource/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-datasource", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.", "type": "module", diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md index c191e8ffa9..991be25951 100644 --- a/packages/services/service-i18n/CHANGELOG.md +++ b/packages/services/service-i18n/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-i18n +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json index d1cac6f3ba..8cd8953c24 100644 --- a/packages/services/service-i18n/package.json +++ b/packages/services/service-i18n/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-i18n", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading", "type": "module", diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md index 57fc6441a8..40eb02aa3d 100644 --- a/packages/services/service-job/CHANGELOG.md +++ b/packages/services/service-job/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-job +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json index 95776a3297..aa5323ff70 100644 --- a/packages/services/service-job/package.json +++ b/packages/services/service-job/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-job", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling", "type": "module", diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md index 1106f5fd7f..5b34f4531c 100644 --- a/packages/services/service-knowledge/CHANGELOG.md +++ b/packages/services/service-knowledge/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-knowledge +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json index f52205943a..ce58bccfa6 100644 --- a/packages/services/service-knowledge/package.json +++ b/packages/services/service-knowledge/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-knowledge", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).", "type": "module", diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md index 5ee9059f46..3cdae0571f 100644 --- a/packages/services/service-messaging/CHANGELOG.md +++ b/packages/services/service-messaging/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-messaging +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json index 6b51fe3f63..563bbc5756 100644 --- a/packages/services/service-messaging/package.json +++ b/packages/services/service-messaging/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-messaging", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.", "type": "module", diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md index 26b86fc110..90b8525fde 100644 --- a/packages/services/service-package/CHANGELOG.md +++ b/packages/services/service-package/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-package +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json index b492be0e6b..ca4c375c54 100644 --- a/packages/services/service-package/package.json +++ b/packages/services/service-package/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-package", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Package management service for ObjectStack — publish, install, and manage packages", "type": "module", diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md index c2b2d96a18..46bb87100c 100644 --- a/packages/services/service-queue/CHANGELOG.md +++ b/packages/services/service-queue/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-queue +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json index eda5c99d66..1607c9fdad 100644 --- a/packages/services/service-queue/package.json +++ b/packages/services/service-queue/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-queue", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters", "type": "module", diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md index 444efab112..3d4852ca3d 100644 --- a/packages/services/service-realtime/CHANGELOG.md +++ b/packages/services/service-realtime/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/service-realtime +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json index 85160db630..c00b730f18 100644 --- a/packages/services/service-realtime/package.json +++ b/packages/services/service-realtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-realtime", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub", "type": "module", diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md index d97f952e54..df01364275 100644 --- a/packages/services/service-settings/CHANGELOG.md +++ b/packages/services/service-settings/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/service-settings +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/platform-objects@9.11.0 + - @objectstack/types@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json index 463b850ff7..3fb7991327 100644 --- a/packages/services/service-settings/package.json +++ b/packages/services/service-settings/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-settings", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.", "type": "module", diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md index 4a19a2249a..cf6cf80e76 100644 --- a/packages/services/service-storage/CHANGELOG.md +++ b/packages/services/service-storage/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/service-storage +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/observability@9.11.0 + - @objectstack/platform-objects@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json index 58687626f3..966547c2d9 100644 --- a/packages/services/service-storage/package.json +++ b/packages/services/service-storage/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-storage", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton", "type": "module", diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md index c66cfc2c50..cc63659a50 100644 --- a/packages/spec/CHANGELOG.md +++ b/packages/spec/CHANGELOG.md @@ -1,5 +1,148 @@ # @objectstack/spec +## 9.11.0 + +### Minor Changes + +- e7f6539: feat(spec,sharing): canonical OWD vocabulary on `object.sharingModel` (ADR-0056 D1) + + Reconciles the Org-Wide-Default naming so authors use ONE vocabulary. `object.sharingModel` + now accepts the canonical OWD names — `private` | `public_read` | `public_read_write` | + `controlled_by_parent` — alongside the legacy `read` / `read_write` / `full` aliases (kept, + non-breaking). The sharing runtime maps them onto the three enforced behaviours + (`public_read` ≡ legacy `read` = everyone reads / owner writes; `public_read_write` = + unscoped). Unknown values remain rejected by the enum (authoring-time, fail-closed). The + showcase announcement now declares the canonical `public_read`, exercised end-to-end by the + public-read dogfood proof. + +- 2365d07: feat(sharing): configurable role-hierarchy widening — `role_and_subordinates` recipient (ADR-0056 D6) + + Role-hierarchy access widening ("a manager sees records shared with their team") is now + **implemented and configurable per sharing rule**, not a hardcoded no-op. The + `role_and_subordinates` recipient (declarable on `sys_sharing_rule.recipient_type`) expands, + at evaluation time, to the named role **plus every subordinate role** by walking the + `sys_role.parent` hierarchy via a new `RoleGraphService` (mirroring the department/team + graphs; cycle-safe). Previously `Role.parent` was declared but never consumed — a silent + no-op flagged by the ADR-0056 audit. This is the Salesforce "grant access using hierarchies" + model expressed declaratively: each rule chooses whether to roll up the hierarchy. Unit-proven + (role-graph traversal, subordinate-user expansion, cycle safety); the recipient is added to + the authoring select + the `SharingRuleRecipientType` contract. + +- 6595b53: feat(security): app-declarable default profile (`isDefault`, ADR-0056 D7) + + An app can now declare its default access posture for authenticated users who have + no explicit grants, via `isDefault: true` on a permission set — instead of always + inheriting the built-in `member_default`. The SecurityPlugin resolves the fallback + from the `isDefault` profile when no explicit `fallbackPermissionSet` is configured + (falling back to `member_default` when none is declared — non-breaking). This is the + foundation for SSO/JIT provisioning (mapping IdP claims → a declared default profile). + Proven by the `showcase-default-profile` dogfood test: a sign-up governed by a custom + default that grants only `showcase_announcement` can read it but is denied + `showcase_private_note` (which the `member_default` wildcard would have allowed). + +- 36138c7: feat(autonumber): date, {field} and per-scope counter reset for autonumber formats + + `autonumberFormat` previously only understood a single `{0000}` sequence slot — + everything else was a fixed literal prefix on one global counter. Real MES/eHR + record numbers need three more token classes, so the format is now tokenized by a + shared pure renderer in `@objectstack/spec` (`parseAutonumberFormat` / + `renderAutonumber`) that the engine fallback and the SQL driver both call, so they + emit byte-identical numbers (#1603 parity): + + - **Date tokens** — `{YYYY}` `{YY}` `{MM}` `{DD}` `{YYYYMMDD}` resolve the calendar + day in the request's **business timezone** (`ExecutionContext.timezone`, ADR-0053; + UTC fallback), threaded through the new `DriverOptions.timezone`. + - **`{field}` interpolation** — `{section}{island_zone}{000}` substitutes record + field values into the prefix. + - **Per-scope counter reset** — the counter's scope is the rendered prefix _before_ + the sequence slot, so `AD{YYYYMMDD}{0000}` resets daily, `{section}{island_zone}{000}` + numbers per group, and `{plan_no}{000}` numbers per parent — all from one + mechanism, no separate reset config. + + Fixed-prefix formats like `CASE-{0000}` render an empty scope and keep their single + global counter, so existing sequences are unchanged. The persistent + `_objectstack_sequences` table is keyed by a `key_hash` (SHA-256 of + `object, tenant_id, field, scope`) — a single 64-char primary key that keys every + dialect uniformly, stays within MySQL's utf8mb4 index-length limit (four raw + columns would not), and lets `scope` be a generous non-indexed column. Deployments + with an older table (3-column, or an interim `scope` column) are migrated in place + on first use, carrying existing counters to `scope=''`. + + Guardrails: + + - **Empty interpolated field is a hard error, not a silent mis-number.** A + `{field}` token whose value is missing at create time would render to an empty + prefix and collapse the record into the wrong counter scope. Both the SQL driver + and the engine fallback now refuse to generate and throw a clear error naming the + empty field (shared `missingFieldValues` helper). + - **Build-time lint (`@objectstack/cli compile`).** `autonumber` formats are + checked against the object's fields: a `{field}` token naming a non-existent + field (or the autonumber field itself) **fails the build**; a token naming an + _optional_ field emits an advisory warning to mark it `required: true`. + - **Migration fails safe.** If a legacy table cannot be migrated to the `key_hash` + shape, fixed-prefix sequences keep working via the legacy key and a per-scope + write raises an actionable error instead of corrupting counters. + - **Long `{field}` scopes are supported** (e.g. a long `{plan_no}`): the non-indexed + `scope` column and hashed key remove the old varchar/PK length ceiling. + + Notes on inherent semantics (documented, not bugs): + + - The counter scope IS the rendered prefix. When two records' tokens render to the + same prefix string (e.g. `{a}{b}` for `('AB','C')` and `('A','BC')`) they also + render the same visible number, so they share one counter to stay unique — the + remedy for genuinely-distinct groups is an unambiguous format (a delimiter + literal between variable tokens). + - The sequence pad width is a MINIMUM; past it the number grows (`{000}` → + `1000`), it never wraps — matching mainstream autonumber semantics. + +- 4c213c2: Master-detail "controlled by parent" permissions (ADR-0055). + + A detail object can now declare `sharingModel: 'controlled_by_parent'`: its read/write access is derived from its master record, with no authored RLS. + + - `@objectstack/spec`: `controlled_by_parent` added to the authorable `object.sharingModel` enum. + - `@objectstack/plugin-security`: reads inject `masterFK IN (accessible master ids)` (resolved from the master's own RLS, reusing the existing filter machinery — zero RLS-compiler changes); by-id writes (insert/update/delete) to a detail now require edit access to its master, closing the #1994-class by-id hole for derived access. + - `@objectstack/verify`: related-record **topological synthesis** — `deriveCrudCases` no longer skips objects with required relations; it builds the object dependency graph, orders it topologically, and threads real target ids, so relationship-dense objects (and the master-detail RLS proof) are verifiable. Honest `blocked` verdicts remain for required-reference cycles and external/missing targets. + + v1 limits (per ADR-0055): the accessible-master id set is unbounded (large-tenant scale is a documented future limit), and master-detail chains are single-level (not transitively traversed). + +- 2afb612: feat(security): resolve `current_user.email` in RLS owner policies + + RLS `using` predicates can now reference **`current_user.email`** — a unique, + human-readable, _seedable_ owner anchor (`owner = current_user.email`). Previously + the RLS compiler resolved only `current_user.id` / `organization_id` / `roles` / + `org_user_ids`, so any owner-by-name/email predicate silently compiled to the + deny sentinel (fail-closed → the user saw nothing). Email is sourced for free + from the auth session (with a bounded `sys_user` fallback for the API-key path) + and threaded onto the `ExecutionContext` in both identity resolvers — the REST + data path (`rest-server`) and the dispatcher path (`resolve-execution-context`). + + Display `name` is deliberately **not** exposed to RLS: names collide, and a + collision on an ownership predicate is an access-control leak. Only unique + identifiers (`id`, `email`) are resolvable. + + This makes owner-scoped row-level security work with seed data (no per-user ids + needed) and, combined with `controlled_by_parent` (ADR-0055), lets a master's + owner scoping flow to its detail records. The example-showcase demonstrates it: + `showcase_invoice` carries an `owner` email + an owner RLS policy, its lines are + controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the + showcase's previously inert owner predicates (they used `==` and `current_user.name`, + neither of which the compiler accepts) to `= current_user.email`. + +### Patch Changes + +- fa8964d: docs(spec): mark unenforced compliance/encryption/masking/RLS-config surface EXPERIMENTAL (ADR-0056 D8) + + Per ADR-0049's enforce-or-remove gate (and ADR-0056 D8), the security-adjacent + schemas that are parsed but have **no runtime consumer** now carry an explicit + `⚠️ EXPERIMENTAL — NOT ENFORCED` header so the no-op is visible to authors and the + reference docs: GDPR/HIPAA/PCI compliance configs, field-level encryption, data + masking, the unified security-context governance, and the global `RLSConfig` / + `RLSAuditEvent` (distinct from the ENFORCED `RowLevelSecurityPolicySchema`, which is + left untouched). No behaviour change — these were already inert; the marker makes + the inertness honest rather than silent. + +- a8e4f3b: Add the ADR-0054 "prove-it-runs" proof field + ratchet to the spec liveness gate. A `live` ledger entry may now carry a `proof` — a reference (`#`) to a dogfood test that asserts the property's runtime behavior. A bound high-risk `live` property must carry a valid proof, validated statically by the liveness gate (the file exists and declares the matching `@proof:` tag). Four high-risk classes are bound this phase: field types (`field.type`), RLS (`permission.rowLevelSecurity.using`), flow nodes (`flow.nodes.type`), and analytics (`dataset.dimensions.dateGranularity`). The `dataset` metadata type is now governed (new `liveness/dataset.json`). The authoritative high-risk-class list lives in `scripts/liveness/proof-registry.mts`; see `liveness/README.md`. + ## 9.10.0 ### Minor Changes diff --git a/packages/spec/package.json b/packages/spec/package.json index 3669953e1c..999dd55a6a 100644 --- a/packages/spec/package.json +++ b/packages/spec/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/spec", - "version": "9.10.0", + "version": "9.11.0", "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md index 40814c2458..dd444390d7 100644 --- a/packages/triggers/trigger-api/CHANGELOG.md +++ b/packages/triggers/trigger-api/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/trigger-api +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json index 28c803cb89..d5eb5b640a 100644 --- a/packages/triggers/trigger-api/package.json +++ b/packages/triggers/trigger-api/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-api", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md index 8139d3ebd9..3594dd1eed 100644 --- a/packages/triggers/trigger-record-change/CHANGELOG.md +++ b/packages/triggers/trigger-record-change/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/plugin-trigger-record-change +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json index fed560fe38..a3698eb327 100644 --- a/packages/triggers/trigger-record-change/package.json +++ b/packages/triggers/trigger-record-change/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-record-change", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md index aed926eff3..801974b3b3 100644 --- a/packages/triggers/trigger-schedule/CHANGELOG.md +++ b/packages/triggers/trigger-schedule/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/plugin-trigger-schedule +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/core@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json index 382098de54..bf3d8976b3 100644 --- a/packages/triggers/trigger-schedule/package.json +++ b/packages/triggers/trigger-schedule/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-schedule", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)", "main": "dist/index.js", diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md index 00958fb18a..f28bf481e6 100644 --- a/packages/types/CHANGELOG.md +++ b/packages/types/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/types +## 9.11.0 + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + ## 9.10.0 ### Patch Changes diff --git a/packages/types/package.json b/packages/types/package.json index 4b97ef4cae..92ec854657 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/types", - "version": "9.10.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Shared interfaces describing the ObjectStack Runtime environment", "main": "dist/index.js", diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md new file mode 100644 index 0000000000..c341f4422c --- /dev/null +++ b/packages/verify/CHANGELOG.md @@ -0,0 +1,47 @@ +# @objectstack/verify + +## 9.11.0 + +### Minor Changes + +- 4c213c2: Master-detail "controlled by parent" permissions (ADR-0055). + + A detail object can now declare `sharingModel: 'controlled_by_parent'`: its read/write access is derived from its master record, with no authored RLS. + + - `@objectstack/spec`: `controlled_by_parent` added to the authorable `object.sharingModel` enum. + - `@objectstack/plugin-security`: reads inject `masterFK IN (accessible master ids)` (resolved from the master's own RLS, reusing the existing filter machinery — zero RLS-compiler changes); by-id writes (insert/update/delete) to a detail now require edit access to its master, closing the #1994-class by-id hole for derived access. + - `@objectstack/verify`: related-record **topological synthesis** — `deriveCrudCases` no longer skips objects with required relations; it builds the object dependency graph, orders it topologically, and threads real target ids, so relationship-dense objects (and the master-detail RLS proof) are verifiable. Honest `blocked` verdicts remain for required-reference cycles and external/missing targets. + + v1 limits (per ADR-0055): the accessible-master id set is unbounded (large-tenant scale is a documented future limit), and master-detail chains are single-level (not transitively traversed). + +- a8e4f3b: `bootStack` gains an opt-in `automation` boot option. When set, it registers `@objectstack/service-automation` so the app's authored flows are pulled from the registry and `POST /api/v1/automation/:name/trigger` actually executes their nodes against the real in-process stack. This makes flow-node execution + variable wiring verifiable end-to-end (ADR-0054 Phase 2), mirroring the existing `multiTenant` opt-in. Default is `false`, so the standard boot stays lean for apps that don't exercise flows. +- fd2e1a2: Add `@objectstack/verify` — boot any ObjectStack app in-process and verify it through the real HTTP stack: auto-derived CRUD round-trip fidelity (`runCrudVerification`) plus the cross-owner RLS invariant (`runRlsProofs`, "you can't write what you can't read"). Also adds an `objectstack verify` CLI command that runs these proofs against an app config and exits non-zero on real failures. + + Extracted from the internal dogfood regression gate so third-party and template authors can run the same runtime proofs against their own apps. The private `@objectstack/dogfood` package now consumes this library for its golden regression tests. + +### Patch Changes + +- Updated dependencies [e7f6539] +- Updated dependencies [e7f6539] +- Updated dependencies [fa8964d] +- Updated dependencies [2365d07] +- Updated dependencies [6595b53] +- Updated dependencies [fa8964d] +- Updated dependencies [36138c7] +- Updated dependencies [a8e4f3b] +- Updated dependencies [4c213c2] +- Updated dependencies [2afb612] + - @objectstack/spec@9.11.0 + - @objectstack/plugin-sharing@9.11.0 + - @objectstack/rest@9.11.0 + - @objectstack/plugin-security@9.11.0 + - @objectstack/objectql@9.11.0 + - @objectstack/runtime@9.11.0 + - @objectstack/core@9.11.0 + - @objectstack/driver-sqlite-wasm@9.11.0 + - @objectstack/plugin-auth@9.11.0 + - @objectstack/plugin-hono-server@9.11.0 + - @objectstack/plugin-org-scoping@9.11.0 + - @objectstack/service-analytics@9.11.0 + - @objectstack/service-automation@9.11.0 + - @objectstack/service-settings@9.11.0 diff --git a/packages/verify/package.json b/packages/verify/package.json index a89f25e664..0e7308ca9e 100644 --- a/packages/verify/package.json +++ b/packages/verify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/verify", - "version": "0.1.0", + "version": "9.11.0", "license": "Apache-2.0", "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.", "type": "module", @@ -38,7 +38,13 @@ "@types/node": "^25.9.3", "typescript": "^6.0.3" }, - "keywords": ["objectstack", "verify", "testing", "regression", "integration"], + "keywords": [ + "objectstack", + "verify", + "testing", + "regression", + "integration" + ], "author": "ObjectStack", "repository": { "type": "git", @@ -50,7 +56,10 @@ "publishConfig": { "access": "public" }, - "files": ["dist", "README.md"], + "files": [ + "dist", + "README.md" + ], "engines": { "node": ">=18.0.0" } diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md index 609887d2f3..ead6c5446d 100644 --- a/packages/vscode-objectstack/CHANGELOG.md +++ b/packages/vscode-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # objectstack-vscode +## 9.11.0 + ## 9.10.0 ## 9.9.1 diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json index 20eb99ac1c..269708068d 100644 --- a/packages/vscode-objectstack/package.json +++ b/packages/vscode-objectstack/package.json @@ -2,7 +2,7 @@ "name": "objectstack-vscode", "displayName": "ObjectStack", "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files", - "version": "9.10.0", + "version": "9.11.0", "publisher": "objectstack", "license": "Apache-2.0", "repository": {