From 89e80b46218f4940e60a4b28a7b01544ac7b61e1 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 28 Jun 2026 07:36:24 +0000 Subject: [PATCH] chore: version packages --- .../adr-0024-betterauth-obj-visibility.md | 11 -- .../adr-0024-sso-domain-verification.md | 26 ---- .changeset/adr-0024-sso-list-visibility.md | 13 -- .changeset/adr-0024-sso-nav.md | 7 - .changeset/adr-0024-sso-provider-org-scope.md | 9 -- .changeset/adr-0024-sso-quality.md | 9 -- .changeset/adr-0024-sso-register-form.md | 13 -- .changeset/adr-0069-d1-password-expiry.md | 21 --- .changeset/adr-0069-d3-enforced-mfa.md | 17 --- .changeset/adr-0069-d4-session-controls.md | 17 --- .changeset/adr-0069-d5-ip-allowlist.md | 15 -- .changeset/adr-0069-mfa-tails.md | 14 -- .changeset/adr0069-saml-sso.md | 13 -- .changeset/extract-metadata-protocol.md | 16 -- .changeset/perf-execctx-request-memo.md | 31 ---- .changeset/server-timing-perf-tuning.md | 10 -- .changeset/spec-action-open-in.md | 33 ----- .changeset/v11-a2-trivial-deadprops.md | 14 -- .../v11-remove-driverinterface-alias.md | 19 --- .changeset/v11-remove-env-aliases.md | 22 --- .changeset/v11-remove-policyschema.md | 22 --- .changeset/v11-remove-unused-adapters.md | 23 --- .changeset/v12-docs-adapter-accuracy.md | 12 -- examples/app-crm/CHANGELOG.md | 14 ++ examples/app-crm/package.json | 2 +- examples/app-showcase/CHANGELOG.md | 18 +++ examples/app-showcase/package.json | 2 +- examples/app-todo/CHANGELOG.md | 23 +++ examples/app-todo/package.json | 2 +- packages/adapters/hono/CHANGELOG.md | 13 ++ packages/adapters/hono/package.json | 2 +- packages/apps/account/CHANGELOG.md | 20 +++ packages/apps/account/package.json | 2 +- packages/apps/setup/CHANGELOG.md | 20 +++ packages/apps/setup/package.json | 2 +- packages/apps/studio/CHANGELOG.md | 20 +++ packages/apps/studio/package.json | 2 +- packages/cli/CHANGELOG.md | 93 ++++++++++++ packages/cli/package.json | 2 +- packages/client-react/CHANGELOG.md | 15 ++ packages/client-react/package.json | 2 +- packages/client/CHANGELOG.md | 34 +++++ packages/client/package.json | 2 +- packages/cloud-connection/CHANGELOG.md | 19 +++ packages/cloud-connection/package.json | 2 +- .../connectors/connector-mcp/CHANGELOG.md | 13 ++ .../connectors/connector-mcp/package.json | 2 +- .../connectors/connector-openapi/CHANGELOG.md | 13 ++ .../connectors/connector-openapi/package.json | 2 +- .../connectors/connector-rest/CHANGELOG.md | 13 ++ .../connectors/connector-rest/package.json | 2 +- .../connectors/connector-slack/CHANGELOG.md | 13 ++ .../connectors/connector-slack/package.json | 2 +- packages/console/CHANGELOG.md | 2 + packages/console/package.json | 2 +- packages/core/CHANGELOG.md | 67 +++++++++ packages/core/package.json | 2 +- packages/create-objectstack/CHANGELOG.md | 2 + packages/create-objectstack/package.json | 2 +- packages/dogfood/CHANGELOG.md | 18 +++ packages/dogfood/package.json | 2 +- packages/downstream-contract/CHANGELOG.md | 10 ++ packages/downstream-contract/package.json | 2 +- packages/formula/CHANGELOG.md | 10 ++ packages/formula/package.json | 2 +- packages/lint/CHANGELOG.md | 11 ++ packages/lint/package.json | 2 +- packages/mcp/CHANGELOG.md | 15 ++ packages/mcp/package.json | 2 +- packages/metadata-core/CHANGELOG.md | 10 ++ packages/metadata-core/package.json | 2 +- packages/metadata-fs/CHANGELOG.md | 6 + packages/metadata-fs/package.json | 2 +- packages/metadata-protocol/CHANGELOG.md | 32 ++++ packages/metadata-protocol/package.json | 2 +- packages/metadata/CHANGELOG.md | 26 ++++ packages/metadata/package.json | 2 +- packages/objectql/CHANGELOG.md | 64 ++++++++ packages/objectql/package.json | 2 +- packages/observability/CHANGELOG.md | 18 +++ packages/observability/package.json | 2 +- packages/platform-objects/CHANGELOG.md | 116 +++++++++++++++ packages/platform-objects/package.json | 2 +- packages/plugins/driver-memory/CHANGELOG.md | 21 +++ packages/plugins/driver-memory/package.json | 2 +- packages/plugins/driver-mongodb/CHANGELOG.md | 13 ++ packages/plugins/driver-mongodb/package.json | 2 +- packages/plugins/driver-sql/CHANGELOG.md | 15 ++ packages/plugins/driver-sql/package.json | 2 +- .../plugins/driver-sqlite-wasm/CHANGELOG.md | 14 ++ .../plugins/driver-sqlite-wasm/package.json | 2 +- packages/plugins/embedder-openai/CHANGELOG.md | 10 ++ packages/plugins/embedder-openai/package.json | 2 +- .../plugins/knowledge-memory/CHANGELOG.md | 14 ++ .../plugins/knowledge-memory/package.json | 2 +- .../plugins/knowledge-ragflow/CHANGELOG.md | 14 ++ .../plugins/knowledge-ragflow/package.json | 2 +- .../plugins/plugin-approvals/CHANGELOG.md | 24 +++ .../plugins/plugin-approvals/package.json | 2 +- packages/plugins/plugin-audit/CHANGELOG.md | 22 +++ packages/plugins/plugin-audit/package.json | 2 +- packages/plugins/plugin-auth/CHANGELOG.md | 139 ++++++++++++++++++ packages/plugins/plugin-auth/package.json | 2 +- packages/plugins/plugin-dev/CHANGELOG.md | 42 ++++++ packages/plugins/plugin-dev/package.json | 2 +- packages/plugins/plugin-email/CHANGELOG.md | 23 +++ packages/plugins/plugin-email/package.json | 2 +- .../plugins/plugin-hono-server/CHANGELOG.md | 25 ++++ .../plugins/plugin-hono-server/package.json | 2 +- .../plugins/plugin-org-scoping/CHANGELOG.md | 22 +++ .../plugins/plugin-org-scoping/package.json | 2 +- packages/plugins/plugin-reports/CHANGELOG.md | 22 +++ packages/plugins/plugin-reports/package.json | 2 +- packages/plugins/plugin-security/CHANGELOG.md | 31 ++++ packages/plugins/plugin-security/package.json | 2 +- packages/plugins/plugin-sharing/CHANGELOG.md | 26 ++++ packages/plugins/plugin-sharing/package.json | 2 +- packages/plugins/plugin-webhooks/CHANGELOG.md | 14 ++ packages/plugins/plugin-webhooks/package.json | 2 +- packages/rest/CHANGELOG.md | 57 +++++++ packages/rest/package.json | 2 +- packages/runtime/CHANGELOG.md | 81 ++++++++++ packages/runtime/package.json | 2 +- .../services/service-analytics/CHANGELOG.md | 13 ++ .../services/service-analytics/package.json | 2 +- .../services/service-automation/CHANGELOG.md | 14 ++ .../services/service-automation/package.json | 2 +- packages/services/service-cache/CHANGELOG.md | 15 ++ packages/services/service-cache/package.json | 2 +- .../service-cluster-redis/CHANGELOG.md | 11 ++ .../service-cluster-redis/package.json | 2 +- .../services/service-cluster/CHANGELOG.md | 13 ++ .../services/service-cluster/package.json | 2 +- .../services/service-datasource/CHANGELOG.md | 13 ++ .../services/service-datasource/package.json | 2 +- packages/services/service-i18n/CHANGELOG.md | 13 ++ packages/services/service-i18n/package.json | 2 +- packages/services/service-job/CHANGELOG.md | 22 +++ packages/services/service-job/package.json | 2 +- .../services/service-knowledge/CHANGELOG.md | 13 ++ .../services/service-knowledge/package.json | 2 +- .../services/service-messaging/CHANGELOG.md | 13 ++ .../services/service-messaging/package.json | 2 +- .../services/service-package/CHANGELOG.md | 13 ++ .../services/service-package/package.json | 2 +- packages/services/service-queue/CHANGELOG.md | 22 +++ packages/services/service-queue/package.json | 2 +- .../services/service-realtime/CHANGELOG.md | 22 +++ .../services/service-realtime/package.json | 2 +- .../services/service-settings/CHANGELOG.md | 75 ++++++++++ .../services/service-settings/package.json | 2 +- .../services/service-storage/CHANGELOG.md | 24 +++ .../services/service-storage/package.json | 2 +- packages/spec/CHANGELOG.md | 78 ++++++++++ packages/spec/package.json | 2 +- packages/triggers/trigger-api/CHANGELOG.md | 13 ++ packages/triggers/trigger-api/package.json | 2 +- .../trigger-record-change/CHANGELOG.md | 13 ++ .../trigger-record-change/package.json | 2 +- .../triggers/trigger-schedule/CHANGELOG.md | 13 ++ .../triggers/trigger-schedule/package.json | 2 +- packages/types/CHANGELOG.md | 29 ++++ packages/types/package.json | 2 +- packages/verify/CHANGELOG.md | 42 ++++++ packages/verify/package.json | 2 +- packages/vscode-objectstack/CHANGELOG.md | 2 + packages/vscode-objectstack/package.json | 2 +- 167 files changed, 1935 insertions(+), 459 deletions(-) delete mode 100644 .changeset/adr-0024-betterauth-obj-visibility.md delete mode 100644 .changeset/adr-0024-sso-domain-verification.md delete mode 100644 .changeset/adr-0024-sso-list-visibility.md delete mode 100644 .changeset/adr-0024-sso-nav.md delete mode 100644 .changeset/adr-0024-sso-provider-org-scope.md delete mode 100644 .changeset/adr-0024-sso-quality.md delete mode 100644 .changeset/adr-0024-sso-register-form.md delete mode 100644 .changeset/adr-0069-d1-password-expiry.md delete mode 100644 .changeset/adr-0069-d3-enforced-mfa.md delete mode 100644 .changeset/adr-0069-d4-session-controls.md delete mode 100644 .changeset/adr-0069-d5-ip-allowlist.md delete mode 100644 .changeset/adr-0069-mfa-tails.md delete mode 100644 .changeset/adr0069-saml-sso.md delete mode 100644 .changeset/extract-metadata-protocol.md delete mode 100644 .changeset/perf-execctx-request-memo.md delete mode 100644 .changeset/server-timing-perf-tuning.md delete mode 100644 .changeset/spec-action-open-in.md delete mode 100644 .changeset/v11-a2-trivial-deadprops.md delete mode 100644 .changeset/v11-remove-driverinterface-alias.md delete mode 100644 .changeset/v11-remove-env-aliases.md delete mode 100644 .changeset/v11-remove-policyschema.md delete mode 100644 .changeset/v11-remove-unused-adapters.md delete mode 100644 .changeset/v12-docs-adapter-accuracy.md create mode 100644 packages/metadata-protocol/CHANGELOG.md diff --git a/.changeset/adr-0024-betterauth-obj-visibility.md b/.changeset/adr-0024-betterauth-obj-visibility.md deleted file mode 100644 index d36fd7e415..0000000000 --- a/.changeset/adr-0024-betterauth-obj-visibility.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -'@objectstack/plugin-security': patch ---- - -Security: platform admins see all rows of better-auth-managed identity objects (ADR-0024 / cloud#551) - -Identity tables managed by the auth library (`managedBy: 'better-auth'` — `sys_oauth_application`, `sys_account`, `sys_session`, `sys_sso_provider`, …) are written by better-auth's own adapter with **no tenant context**, so `organization_id` is never stamped and `member_default`'s wildcard `tenant_isolation` RLS denies every row — a platform admin's Setup list (OAuth Applications, Identity Links, …) renders **empty**. - -These objects now get the **same posture-gated superuser bypass** as `private` / `tenancy.enabled:false` objects, so a platform admin's `viewAllRecords` sees all identity rows env-wide. This is **admin-only**: non-admins never trigger the bypass — their `_self` carve-outs / `tenant_isolation` still apply (verified by a regression test that a member stays tenant-scoped), and the flag is deliberately **not** used for the wildcard-policy drop, so it can never leak rows to members. - -Fixes the empty-list symptom across all better-auth-managed Setup objects without per-object `tenancy` changes (which would risk the control plane, where some of these objects ARE cross-env-isolated). diff --git a/.changeset/adr-0024-sso-domain-verification.md b/.changeset/adr-0024-sso-domain-verification.md deleted file mode 100644 index ad3119afbd..0000000000 --- a/.changeset/adr-0024-sso-domain-verification.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -"@objectstack/plugin-auth": minor -"@objectstack/platform-objects": minor ---- - -feat(auth): opt-in SSO domain verification (ADR-0024 ②) - -Add DNS-TXT domain-ownership verification for external SSO providers, gated -behind a new `OS_SSO_DOMAIN_VERIFICATION` flag (off by default — today's -register→login behavior is unchanged). When enabled, `@better-auth/sso` mounts -`/sso/request-domain-verification` + `/sso/verify-domain` and enforces that a -provider's email domain be DNS-verified before it may complete a login. - -- `auth-manager.ts`: new `ssoDomainVerification` enabled-flag (readBooleanEnv) → - passes `domainVerification: { enabled: true }` to `sso()`; public - `isSsoDomainVerificationEnabled()` helper. -- `register-sso-provider.ts`: `runRequestDomainVerification` / - `runVerifyDomain` bridges — re-dispatch through the gated better-auth - endpoints and reshape the response into the `{ success, data }` envelope the - `sys_sso_provider` action `resultDialog` reads (request → ready-to-paste DNS - TXT record; verify → clear success/error). A bare 404 from the inner endpoint - is surfaced as "not enabled for this environment". -- `auth-plugin.ts`: mount the two bridges as rawApp routes - (`/admin/sso/{request-domain-verification,verify-domain}`). -- `sys_sso_provider`: `domain_verified` field + list column + the two actions; - `domainVerified` documented in `AUTH_SSO_PROVIDER_SCHEMA`. diff --git a/.changeset/adr-0024-sso-list-visibility.md b/.changeset/adr-0024-sso-list-visibility.md deleted file mode 100644 index d7f2a52649..0000000000 --- a/.changeset/adr-0024-sso-list-visibility.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -'@objectstack/platform-objects': patch ---- - -Auth: make the SSO Providers list visible to admins (ADR-0024 / cloud#551) - -The `sys_sso_provider` Setup list rendered empty even after an admin registered a provider: `member_default`'s wildcard `tenant_isolation` RLS (`organization_id == current_user.organization_id`) denied every row, because better-auth writes these via its adapter with no tenantId context so `organization_id` is never stamped, and the platform-admin `viewAllRecords` superuser bypass is gated to private/non-tenant objects. - -`sys_sso_provider` is env-global, admin-only identity config, so it now declares: -- `tenancy: { enabled: false }` — opts out of multi-tenancy (the env IS the tenant; providers are env-wide), letting a platform admin's `viewAllRecords` bypass see every provider. -- `requiredPermissions: ['manage_platform_settings']` — object-level capability gate so ordinary members are denied (without it, tenancy-disabled + `member_default`'s `'*': allowRead` would expose providers to every authenticated user). - -Verified E2E: an admin sees all env providers in the Setup → Access Control → SSO Providers list; a non-admin gets 403. (Env-only object — no control-plane cross-tenant impact. The sibling `sys_oauth_application` / `sys_account` nav entries share the same empty-list symptom but span the control plane and need separate per-object analysis.) diff --git a/.changeset/adr-0024-sso-nav.md b/.changeset/adr-0024-sso-nav.md deleted file mode 100644 index 717fc91ddd..0000000000 --- a/.changeset/adr-0024-sso-nav.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@objectstack/plugin-auth': patch ---- - -Auth: surface "SSO Providers" in the Setup app nav when SSO is enabled (ADR-0024 / cloud#551) - -The `sys_sso_provider` admin object (register / list / delete external OIDC IdPs) had no navigation entry, so an admin could only reach it by direct URL. `AuthPlugin` now contributes an **"SSO Providers"** entry into the Setup app's **Access Control** group — but only when the external-IdP RP is wired (`AuthManager.isSsoWired()`, which captures both self-host `OS_SSO_ENABLED` and the cloud per-env `planAllowsSso` arriving via `plugins.sso`). Owning-plugin-contributes pattern (ADR-0029 K2), mirroring `plugin-security`. `isSsoWired()` is made public for this gate. diff --git a/.changeset/adr-0024-sso-provider-org-scope.md b/.changeset/adr-0024-sso-provider-org-scope.md deleted file mode 100644 index 40b59a201e..0000000000 --- a/.changeset/adr-0024-sso-provider-org-scope.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@objectstack/plugin-auth': patch ---- - -Auth: org-scope registered SSO/SAML providers so any org admin can manage them (ADR-0024 / cloud#551) - -`@better-auth/sso`'s provider-management endpoints (delete / update / domain verification) gate ORG-LESS providers on `provider.userId === caller` — only the original registrar could manage them, so a second org admin couldn't delete or verify an IdP someone else registered. The register bridges now resolve the caller's active organization (best-effort, via a `/get-session` re-dispatch) and scope the provider to it, so management gates on `isOrgAdmin` instead — **any** org owner/admin can manage the environment's IdPs. Falls back to org-less (no behavior change) when no active org is set. - -Verified E2E: an OIDC provider registered through the form lands with `organization_id` set to the env's org (was null); register + delete still succeed. diff --git a/.changeset/adr-0024-sso-quality.md b/.changeset/adr-0024-sso-quality.md deleted file mode 100644 index cd8d27f148..0000000000 --- a/.changeset/adr-0024-sso-quality.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -'@objectstack/plugin-auth': patch -'@objectstack/platform-objects': patch ---- - -Auth: SSO quality polish (ADR-0024 / cloud#551) - -- **plugin-auth**: `OS_OIDC_PROVIDER_ENABLED` / `OS_SSO_ENABLED` / `OS_SCIM_ENABLED` now parse with the shared `readBooleanEnv` helper (same as `OS_AUTH_TWO_FACTOR` etc.), so the platform-standard truthy set works (`true`/`1`/`yes`/`on`, case-insensitive) instead of only the literal `'true'` — a repeated operator footgun where `OS_SSO_ENABLED=1` silently parsed as disabled. Added unit tests. -- **platform-objects**: `sys_sso_provider`'s list view gets a per-object empty state ("No SSO providers yet" + a pointer to "Register SSO Provider"), replacing the shared identity-object copy ("records are created automatically … cannot be added here") which is wrong for this object — it HAS a register action. diff --git a/.changeset/adr-0024-sso-register-form.md b/.changeset/adr-0024-sso-register-form.md deleted file mode 100644 index 79543f75f9..0000000000 --- a/.changeset/adr-0024-sso-register-form.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -'@objectstack/plugin-auth': patch -'@objectstack/platform-objects': patch ---- - -Auth: make the open-source SSO-provider registration form produce a usable IdP (ADR-0024 / cloud#551) - -The `sys_sso_provider` `register_sso_provider` UI action posted FLAT form fields to `@better-auth/sso`'s `/sso/register`, which expects the OIDC fields NESTED under `oidcConfig`. The top-level `clientId`/`clientSecret` were Zod-stripped, so the form persisted an `oidc_config = null` provider that could never complete a login ("Invalid SSO provider"). - -- **plugin-auth**: new shared `runRegisterSsoProviderFromForm` helper reshapes the flat form body into the nested shape and re-dispatches it through the real `/sso/register` (so the admin gate, the public-routable `trustedOrigins` allowance, discovery hydration, and secret handling all still run). Exposed via a new `/admin/sso/register` bridge route on the host `AuthPlugin`. (The cloud per-env runtime mounts the same helper in its `AuthProxyPlugin` — mirrors `set-initial-password`.) -- **platform-objects**: `register_sso_provider` retargets to `/api/v1/auth/admin/sso/register` and gains `discoveryEndpoint`, `scopes`, and attribute-mapping (`mapId`/`mapEmail`/`mapName`) fields. Open mechanism — keeps runtime IdP registration self-service in the OSS edition. - -Verified E2E: an admin registers an external OIDC IdP from the flat form → a member logs in through it (JIT-provisioned, `sys_account.provider_id` set); a non-admin is rejected (403) before discovery runs. diff --git a/.changeset/adr-0069-d1-password-expiry.md b/.changeset/adr-0069-d1-password-expiry.md deleted file mode 100644 index 37448a4184..0000000000 --- a/.changeset/adr-0069-d1-password-expiry.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -'@objectstack/core': minor -'@objectstack/platform-objects': minor -'@objectstack/service-settings': minor -'@objectstack/plugin-auth': minor -'@objectstack/rest': minor ---- - -Auth: password expiry — the session-validation gate (ADR-0069 D1, P1) - -Builds the **authentication-policy session gate** ADR-0069 needs and uses it for password expiry. When `password_expiry_days` (new `auth` setting, 0 = off) is exceeded, an authenticated user is blocked from protected REST resources with `403 PASSWORD_EXPIRED` until they change their password — while auth + remediation paths stay reachable. - -- **core**: new pure `evaluateAuthGate` / `isAuthGateAllowlisted` helper (`@objectstack/core/security`) — single source of truth for the allow-list (auth endpoints, change-password, health, UI-bootstrap reads). -- **plugin-auth**: `customSession` computes the gate posture once and attaches `user.authGate`; `computeAuthGate` reads `sys_user.password_changed_at` vs the configured window; `password_changed_at` is stamped on sign-up / change / reset; `isAuthGateActive()` keeps the gate **zero-overhead** when off. -- **platform-objects**: new `sys_user.password_changed_at` column. -- **rest**: `resolveExecCtx` carries `authGate`; `enforceAuth` blocks gated sessions (independent of `requireAuth`) using the core allow-list. -- **service-settings**: new `password_expiry_days` field. - -Default-off / additive (no upgrade behavior change); a null `password_changed_at` never expires (existing users). Per ADR-0049 the setting ships with its enforcement; timestamps written as `Date` (ADR-0074). - -This gate is the shared seam for **enforced MFA** (ADR-0069 D3), which lands next as a small addition (a second `authGate` branch). The dispatcher/MCP path is a follow-up (tracked in #2375); the REST surface the Console uses is fully gated here. diff --git a/.changeset/adr-0069-d3-enforced-mfa.md b/.changeset/adr-0069-d3-enforced-mfa.md deleted file mode 100644 index f6d60d5ca3..0000000000 --- a/.changeset/adr-0069-d3-enforced-mfa.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/platform-objects': minor -'@objectstack/service-settings': minor -'@objectstack/plugin-auth': minor ---- - -Auth: enforced MFA (ADR-0069 D3, P1) - -Completes the session-validation gate: when `mfa_required` (new `auth` setting) is on, an authenticated user without TOTP enrolled is blocked from protected resources with `403 MFA_REQUIRED` once their `mfa_grace_period_days` (default 7) window elapses — while the two-factor enrollment endpoints stay reachable so they can comply. Reuses the `authGate` seam shipped in #2388 (a second posture branch in `computeAuthGate`). - -- New `auth` settings `mfa_required` (toggle) + `mfa_grace_period_days`; enabling `mfa_required` also force-enables the `twoFactor` plugin so `/two-factor/*` enrollment exists. -- New `sys_user.mfa_required_at` column — the grace clock, stamped lazily the first time a user is seen required-but-unenrolled. -- `isAuthGateActive()` now also trips on `mfa_required` (still zero-overhead when off). - -Default-off / additive (no upgrade behavior change); per ADR-0049 the setting ships with its enforcement. - -**Needs an objectui follow-up**: the Console should handle a `403 MFA_REQUIRED` by showing the TOTP-enrollment prompt. Per-org `sys_organization.require_mfa` and the dispatcher/MCP gate remain follow-ups (#2375). diff --git a/.changeset/adr-0069-d4-session-controls.md b/.changeset/adr-0069-d4-session-controls.md deleted file mode 100644 index 403dfcbb83..0000000000 --- a/.changeset/adr-0069-d4-session-controls.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/platform-objects': minor -'@objectstack/service-settings': minor -'@objectstack/plugin-auth': minor ---- - -Auth: session controls — idle timeout, absolute max lifetime, concurrent cap (ADR-0069 D4, P2) - -Adds three `auth` session-control settings (all 0 = off): - -- `session_idle_timeout_minutes` — sign a user out after inactivity. Enforced in `customSession`: touches `sys_session.last_activity_at` (throttled to once a minute) and, once the idle window is exceeded, revokes the session. -- `session_absolute_max_hours` — cap total session lifetime regardless of refresh; revoked once `created_at` is older than the cap. -- `max_concurrent_sessions_per_user` — on sign-in, keep the newest N live sessions and revoke the rest (oldest first). - -Revocation expires the session in place (`expires_at` set to the past + `revoked_at` / `revoke_reason` stamped on new `sys_session` columns), so better-auth returns no session on the next request → the Console's existing 401 → login redirect handles it (no client change). Note: better-auth garbage-collects expired sessions, so the `revoke_reason` audit row is best-effort; the enforcement (session killed) is not. - -Default-off / additive (no upgrade behavior change); per ADR-0049 each setting ships with its enforcement. diff --git a/.changeset/adr-0069-d5-ip-allowlist.md b/.changeset/adr-0069-d5-ip-allowlist.md deleted file mode 100644 index 15f6190b57..0000000000 --- a/.changeset/adr-0069-d5-ip-allowlist.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -'@objectstack/service-settings': minor -'@objectstack/plugin-auth': minor ---- - -Auth: IP allow-list — network gating on the auth routes (ADR-0069 D5, P2) - -Adds an `allowed_ip_ranges` auth setting (CIDR ranges or exact IPs; empty = no restriction). A Hono middleware registered ahead of the better-auth handler in the auth-route registration rejects auth requests from a client IP outside the ranges with `403 IP_NOT_ALLOWED`, before they reach better-auth. - -- Client IP is read trust-proxy-aware from `x-forwarded-for` (first hop) / `cf-connecting-ip` / `x-real-ip`. -- The public render helpers (`/config`, `/bootstrap-status`) are exempt so a blocked client still gets a clean login page + a clear error. -- **Fails OPEN** when the client IP can't be determined (no proxy header), so a misconfigured proxy is a no-op rather than a lockout — an admin enabling this must ensure forwarded headers are trusted. -- IPv4 CIDR (`a.b.c.d/n`) + exact IPv4/IPv6 matching. - -Default-off / additive; per ADR-0049 the setting ships with its enforcement. diff --git a/.changeset/adr-0069-mfa-tails.md b/.changeset/adr-0069-mfa-tails.md deleted file mode 100644 index 9215c60491..0000000000 --- a/.changeset/adr-0069-mfa-tails.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -'@objectstack/platform-objects': minor -'@objectstack/plugin-auth': minor -'@objectstack/runtime': minor ---- - -Auth: per-org MFA + dispatcher/MCP gate — complete the ADR-0069 enforced-MFA story - -Two follow-ups that make enforced MFA total: - -- **Per-org `sys_organization.require_mfa`** — an org may require MFA above the global floor. `computeAuthGate` now treats the active org's `require_mfa` as an effective MFA requirement even when the global `mfa_required` is off; `isAuthGateActive()` stays cheap via a 60s-TTL "any org requires MFA" cache (lazy background refresh), so a brand-new per-org requirement activates the gate on the next request without per-request org queries. -- **Dispatcher/MCP gate** — the auth-policy gate now also runs in the runtime dispatcher (after `resolveExecutionContext`), so MCP / GraphQL / embedded data paths enforce `PASSWORD_EXPIRED` / `MFA_REQUIRED` consistently with the REST seam (reusing the shared `evaluateAuthGate` allow-list). Previously only the REST surface (the Console) was gated. - -Default-off / additive. Per ADR-0049 each setting ships with its enforcement. diff --git a/.changeset/adr0069-saml-sso.md b/.changeset/adr0069-saml-sso.md deleted file mode 100644 index 12156c64bc..0000000000 --- a/.changeset/adr0069-saml-sso.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@objectstack/plugin-auth": minor -"@objectstack/platform-objects": minor ---- - -feat(auth): SAML 2.0 SSO via @better-auth/sso (ADR-0069 P3) - -`@better-auth/sso@1.6.20` ships full SAML 2.0 (samlify-backed), so SAML needs no -custom plugin. Adds a `register_saml_provider` action on `sys_sso_provider` and a -`runRegisterSamlProviderFromForm` bridge that reshapes the flat admin form into the -nested `samlConfig` and re-dispatches through `/sso/register` (admin gate enforced), -returning the SP ACS + metadata URLs to configure on the IdP. Updates ADR-0069 to -correct the stale "SAML is out of better-auth core" premise. diff --git a/.changeset/extract-metadata-protocol.md b/.changeset/extract-metadata-protocol.md deleted file mode 100644 index 97cc7e0ebd..0000000000 --- a/.changeset/extract-metadata-protocol.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -'@objectstack/objectql': minor -'@objectstack/metadata-protocol': minor ---- - -Extract metadata management into `@objectstack/metadata-protocol` (ADR-0076) - -`protocol.ts` (the `ObjectStackProtocol` implementation — sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics) plus its `sys-metadata-repository`, `metadata-diagnostics`, `seed-loader`, and `build-probes` helpers were metadata-domain code that lived inside `@objectstack/objectql` for historical reasons. They now live in a dedicated **`@objectstack/metadata-protocol`** package. - -The protocol no longer depends on the concrete `ObjectQL` class — it is typed against an injected `MetadataHostEngine` interface (the engine is still injected at runtime). Dependency direction is now one-way (`objectql → metadata-protocol`); there is no cycle. - -**Non-breaking**: `@objectstack/objectql` re-exports every previously public symbol (`ObjectStackProtocolImplementation`, `SysMetadataRepository`, `SysMetadataEngine`, `SeedLoaderService`, `runBuildProbes`, …), so existing imports keep working. - -This is Step 1 of ADR-0076. A later step turns the protocol into a capability plugin so `objectql` itself stops depending on it (making the engine lean by construction). - -Also adds a lean **`@objectstack/objectql/core`** entry — the engine/registry/hooks/validation surface only, with no kernel plugin or metadata protocol — so a thin embedder can import just the engine and never pull `@objectstack/metadata-protocol` into its bundle. A boundary ratchet test guards the entry. diff --git a/.changeset/perf-execctx-request-memo.md b/.changeset/perf-execctx-request-memo.md deleted file mode 100644 index cad1e58463..0000000000 --- a/.changeset/perf-execctx-request-memo.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -'@objectstack/core': patch -'@objectstack/rest': patch ---- - -perf(core): authenticated requests issued ~16 sequential queries — duplicate authz + repeated localization — now request-scoped memoized - -An authenticated REST request resolves its execution context (identity + -RBAC/RLS + localization) many times in a single handler — the data operation -itself, app-nav RBAC filtering, dashboard widget gating, the ADR-0069 auth gate. -Each `resolveExecCtx` pass is the full `resolveAuthzContext` aggregation plus the -localization read (~16 sequential queries), and nothing memoized it, so a request -that resolves twice paid for duplicate authz and repeated localization. - -- **`@objectstack/rest`** — `resolveExecCtx` is now memoized per request, keyed by - the request object (a `WeakMap`, so the entry is collected with the request — no - TTL, no cross-request leak) and the input `environmentId`. The in-flight Promise - is cached so concurrent callers share one resolution. The heavy path moved to - `computeExecCtx`. Anonymous (`undefined`) resolutions are cached too. -- **`@objectstack/core`** — within a single `resolveAuthzContext` pass, `sys_user` - is now read at most once (the email fallback and the `ai_seat` synthesis shared a - duplicate query on the API-key path); `resolveLocalizationContext`'s direct-read - fallback batches `timezone`/`locale`/`currency` into one `sys_setting` query - (`$in` on `key`) instead of three sequential reads. - -No authorization-behavior change — the same roles/permissions/RLS context is -resolved, just without the redundant reads. The `sys_member` reads (per-user roles -vs. all-org-members) are intentionally left distinct (different filters/limits). - -Tests: query-counting regressions assert `sys_user` reads once and localization -reads once; new rest-server tests pin the per-request/per-environment memo contract. diff --git a/.changeset/server-timing-perf-tuning.md b/.changeset/server-timing-perf-tuning.md deleted file mode 100644 index acfd0ec41e..0000000000 --- a/.changeset/server-timing-perf-tuning.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -'@objectstack/observability': minor -'@objectstack/plugin-hono-server': minor ---- - -Observability: per-request performance timing surfaced via the `Server-Timing` response header ("perf-tuning mode"). - -`@objectstack/observability` gains a tiny, dependency-free `PerfTiming` collector plus an `AsyncLocalStorage`-backed ambient API (`runWithPerfTiming` / `currentPerfTiming` and the no-op-when-disabled free functions `measureServerTiming` / `startServerTiming` / `recordServerTiming`) and a spec-compliant `formatServerTiming` serializer that sanitizes names to tokens and quotes/escapes descriptions (no header injection). - -The Hono server plugin can now emit `Server-Timing` per request. It is **off by default** — the header discloses internal phase durations, which is a backend-fingerprinting surface — and opt-in via `new HonoServerPlugin({ serverTiming: true })` or `OS_SERVER_TIMING=true` (so it works through the default `os serve`). When enabled, every response carries `total` (measured by an outer middleware that brackets the whole request) plus the adapter-contributed `parse` and `handler` sub-phases; any code on the request's async call chain can add its own phases via the ambient API. When disabled, the timing call sites are zero-overhead no-ops. diff --git a/.changeset/spec-action-open-in.md b/.changeset/spec-action-open-in.md deleted file mode 100644 index c08dad3468..0000000000 --- a/.changeset/spec-action-open-in.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -"@objectstack/spec": minor ---- - -Add `openIn` to `ActionSchema` — a declarative new-tab control for static `type:'url'` actions. - -Counterpart to objectui issue #2043, which added a first-class `openIn?: 'self' | 'new-tab'` -field to its public `ActionSchema` and honors it in `ActionRunner.executeUrl` (read with -priority over the legacy `params.newTab` / external-URL heuristic). Until now -`@objectstack/spec`'s `ActionSchema` was a plain `z.object(...)` that **stripped** unknown -keys, so `openIn` written via `defineAction({...})` was silently dropped at build and never -reached objectui's runtime. Authors (e.g. plan-management) therefore couldn't use it. - -```ts -defineAction({ - name: 'print_a3', - label: '打印总表(A3)', - type: 'url', - target: '/print/a3?id=${record.id}', - openIn: 'new-tab', // now preserved end-to-end -}); -``` - -- `openIn: 'new-tab'` — open a **static** `target` URL in a new tab. No handler, no pre-open. -- `openIn: 'self'` — navigate in place. -- omitted — external/absolute URLs open in a new tab; relative URLs navigate in place. - -Kept distinct from the existing `opensInNewTab` / `newTabUrl` (those pre-open an -`about:blank` tab synchronously for **async** SSO-redirect handlers — not merged). It is a -static execution option and must stay OUT of `params` (which is user-input-collection only). - -Consuming projects must upgrade `@objectstack/spec` to this version for the declarative -new-tab path to work end-to-end. diff --git a/.changeset/v11-a2-trivial-deadprops.md b/.changeset/v11-a2-trivial-deadprops.md deleted file mode 100644 index 7e43480fdc..0000000000 --- a/.changeset/v11-a2-trivial-deadprops.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -"@objectstack/spec": minor ---- - -Remove a first batch of dead (unenforced, unauthored) metadata properties (#2377, ADR-0049). - -Verified set 0× / read 0× across framework + objectui + cloud + hotcrm + templates, with no test footprint outside `@objectstack/spec`: - -- **field**: `caseSensitive`, `maxRating` -- **object**: `partitioning` (+ `PartitioningConfigSchema`), `defaultDetailForm` - -Liveness ledgers (field/object) updated; api-surface regenerated (drops `PartitioningConfig`/`PartitioningConfigSchema` only). Folded into the 11 line (`minor`). - -The remaining #2377 candidates are deliberately not in this batch: overloaded names (`tags`/`active`/`versioning`/`dependencies`/`index`/…) need per-occurrence handling, and `softDelete` / `measures.certified` turned out to be set in non-spec test fixtures (analytics, mcp) — both deferred. See the issue for the full split. diff --git a/.changeset/v11-remove-driverinterface-alias.md b/.changeset/v11-remove-driverinterface-alias.md deleted file mode 100644 index 52d0ebc982..0000000000 --- a/.changeset/v11-remove-driverinterface-alias.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/core": minor -"@objectstack/objectql": minor ---- - -Remove the deprecated `DriverInterface` type alias — use `IDataDriver` (11.0). - -`DriverInterface` was a `@deprecated` alias of `IDataDriver` (the authoritative -driver contract). It is removed from `@objectstack/spec/contracts` and -`@objectstack/core`; `objectql`'s engine now types drivers as `IDataDriver` -directly (a type-identical change, since the alias *was* `IDataDriver`). - -Driver authors: replace `DriverInterface` with `IDataDriver` (same shape). - -Note: this is unrelated to the live `IDataEngine` interface (engine-layer -contract, not deprecated) and to the separate zod-derived `DriverInterface` / -`DriverInterfaceSchema` in `@objectstack/spec/data` (the runtime driver schema), -both of which are unchanged. diff --git a/.changeset/v11-remove-env-aliases.md b/.changeset/v11-remove-env-aliases.md deleted file mode 100644 index 27b06d719a..0000000000 --- a/.changeset/v11-remove-env-aliases.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -"@objectstack/types": minor -"@objectstack/objectql": minor -"@objectstack/cli": minor ---- - -Remove ObjectStack's own legacy env-var aliases (11.0); ecosystem-standard names stay. - -The framework's renamed env vars no longer accept their old ObjectStack names — -rename them: - -| removed legacy name | use | -|---|---| -| `OS_MULTI_TENANT` | `OS_MULTI_ORG_ENABLED` | -| `OBJECTSTACK_METADATA_WRITABLE` | `OS_METADATA_WRITABLE` | -| `OS_AUTH_BASE_URL`, `AUTH_BASE_URL` | `OS_AUTH_URL` | - -**Ecosystem-standard names are NOT removed** — they remain accepted (and no longer -emit a deprecation warning, since they are permanent conventions, not legacy): -`DATABASE_URL`, `AUTH_SECRET`, `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `PORT`, -`CORS_*`, `LOG_LEVEL`, `ROOT_DOMAIN`, `MCP_SERVER_*`. The generic -`readEnvWithDeprecation` helper is unchanged. diff --git a/.changeset/v11-remove-policyschema.md b/.changeset/v11-remove-policyschema.md deleted file mode 100644 index f07385e043..0000000000 --- a/.changeset/v11-remove-policyschema.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -"@objectstack/spec": minor ---- - -Remove the dead `PolicySchema` / `definePolicy` and the stack `policies` collection (#1882, ADR-0049). - -`PolicySchema` (password / network / session / audit "org security policy") was -**100% unenforced** — no runtime consumer ever read it. Per ADR-0049 -(enforce-or-remove) it is removed rather than implemented: - -- `@objectstack/spec`: delete `security/policy.zod.ts` (`PolicySchema`, - `Password/Network/Session/AuditPolicySchema`, `definePolicy`); drop the - `policies` field from the stack schema and the `policies` collection wiring - (`MAP_SUPPORTED_FIELDS`, `METADATA_ALIASES`). -- `@objectstack/downstream-contract`: drop the `DcPolicy` fixture/case (the - contract gate stays green — `SharingRule` / `PermissionSet` are unaffected). -- Examples (`app-crm`, `app-showcase`): drop their unused policy definitions. - -No migration needed for consumers: `policies` was never enforced. `SharingRule`, -`PermissionSet`, RLS, and all `*PolicySchema` siblings (retry/retention/RLS/etc.) -are unrelated and unchanged. Verified: hotcrm + templates have zero Policy-API -usage; downstream-contract gate green. diff --git a/.changeset/v11-remove-unused-adapters.md b/.changeset/v11-remove-unused-adapters.md deleted file mode 100644 index 907caee2ba..0000000000 --- a/.changeset/v11-remove-unused-adapters.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -"@objectstack/client": minor -"@objectstack/runtime": patch ---- - -Remove the unused HTTP framework adapters and the MSW plugin — the open edition ships the **Hono** adapter only. - -The `express` / `fastify` / `nextjs` / `nestjs` / `nuxt` / `sveltekit` adapters and -`@objectstack/plugin-msw` had **zero internal consumers** and were not dogfooded — -pure release/maintenance surface (and an untested-integration liability). They are -removed; `@objectstack/hono` (the adapter actually used, via `@objectstack/client`) -is kept. - -- Deleted packages: `@objectstack/express`, `@objectstack/fastify`, - `@objectstack/nextjs`, `@objectstack/nestjs`, `@objectstack/nuxt`, - `@objectstack/sveltekit`, `@objectstack/plugin-msw` (fixed group 73 → 66). -- `@objectstack/client`: dropped the `plugin-msw` / `msw` dev usage (MSW test removed). -- `HttpDispatcher` (the dispatch engine) is now used only by the Hono adapter + - the internal dispatcher-plugin, so its misleading `@deprecated → createDispatcherPlugin` - note (createDispatcherPlugin is a kernel plugin, not a drop-in) is corrected. - -Anyone needing another framework adapter can build one on the public -`HttpDispatcher` / `createDispatcherPlugin` API or maintain it out-of-tree. diff --git a/.changeset/v12-docs-adapter-accuracy.md b/.changeset/v12-docs-adapter-accuracy.md deleted file mode 100644 index 14e1281b72..0000000000 --- a/.changeset/v12-docs-adapter-accuracy.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -"@objectstack/runtime": patch -"@objectstack/driver-memory": patch ---- - -docs: align hardening / driver docs with the Hono-only adapter surface (12.0) - -Follow-up to the adapter trim (#2391): the hardening guide's rate-limit/CORS -recipes are rewritten from Fastify to **Hono** (the shipped adapter; the old -`@objectstack/fastify` import was broken), CSRF guidance points at `hono/csrf`, -and stale `@objectstack/plugin-msw` references are dropped from the driver-memory -and driver-turso docs. README framework lists narrowed to Hono. diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md index ff4069210d..447d4bad26 100644 --- a/examples/app-crm/CHANGELOG.md +++ b/examples/app-crm/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/example-crm +## 4.0.60 + +### Patch Changes + +- Updated dependencies [e011d42] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/runtime@11.1.0 + - @objectstack/spec@11.1.0 + ## 4.0.59 ### Patch Changes diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json index 5e86929bf5..bffa197af8 100644 --- a/examples/app-crm/package.json +++ b/examples/app-crm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-crm", - "version": "4.0.59", + "version": "4.0.60", "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md index 591d7e9ef2..f309efd1c6 100644 --- a/examples/app-showcase/CHANGELOG.md +++ b/examples/app-showcase/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/example-showcase +## 0.2.6 + +### Patch Changes + +- Updated dependencies [e011d42] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/runtime@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/cloud-connection@11.1.0 + - @objectstack/connector-rest@11.1.0 + - @objectstack/connector-slack@11.1.0 + - @objectstack/driver-sql@11.1.0 + ## 0.2.5 ### Patch Changes diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json index 1f65f816d1..e099937271 100644 --- a/examples/app-showcase/package.json +++ b/examples/app-showcase/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-showcase", - "version": "0.2.5", + "version": "0.2.6", "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, AI). Built for demonstration, debugging, and coverage-driven verification.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md index b07d35ad5b..afdb3d8450 100644 --- a/examples/app-todo/CHANGELOG.md +++ b/examples/app-todo/CHANGELOG.md @@ -1,5 +1,28 @@ # @objectstack/example-todo +## 4.0.60 + +### Patch Changes + +- Updated dependencies [e011d42] +- Updated dependencies [13dbcf2] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/runtime@11.1.0 + - @objectstack/objectql@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/client@11.1.0 + - @objectstack/metadata@11.1.0 + - @objectstack/mcp@11.1.0 + - @objectstack/driver-sqlite-wasm@11.1.0 + - @objectstack/knowledge-memory@11.1.0 + - @objectstack/service-knowledge@11.1.0 + ## 4.0.59 ### Patch Changes diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json index 25e5ac3a38..1f106be647 100644 --- a/examples/app-todo/package.json +++ b/examples/app-todo/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-todo", - "version": "4.0.59", + "version": "4.0.60", "description": "Example Todo App using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md index 0948672977..8ddb6d57de 100644 --- a/packages/adapters/hono/CHANGELOG.md +++ b/packages/adapters/hono/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/hono +## 11.1.0 + +### Patch Changes + +- Updated dependencies [e011d42] +- Updated dependencies [dc2990f] +- Updated dependencies [fdb41c0] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/runtime@11.1.0 + - @objectstack/plugin-hono-server@11.1.0 + - @objectstack/types@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json index 11939f9e97..329fc03e52 100644 --- a/packages/adapters/hono/package.json +++ b/packages/adapters/hono/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/hono", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md index d48eae48dd..154491fb5e 100644 --- a/packages/apps/account/CHANGELOG.md +++ b/packages/apps/account/CHANGELOG.md @@ -1,5 +1,25 @@ # @objectstack/account +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json index 1290b9bf87..2fe77a903e 100644 --- a/packages/apps/account/package.json +++ b/packages/apps/account/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/account", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md index 80c2952fb6..69209b7372 100644 --- a/packages/apps/setup/CHANGELOG.md +++ b/packages/apps/setup/CHANGELOG.md @@ -1,5 +1,25 @@ # @objectstack/setup +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json index 0a4f6c785a..fc1de7a9bc 100644 --- a/packages/apps/setup/package.json +++ b/packages/apps/setup/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/setup", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md index ab24c8b4cb..d6459c3b2a 100644 --- a/packages/apps/studio/CHANGELOG.md +++ b/packages/apps/studio/CHANGELOG.md @@ -1,5 +1,25 @@ # @objectstack/studio +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json index cfad127ff3..525da7fbf6 100644 --- a/packages/apps/studio/package.json +++ b/packages/apps/studio/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/studio", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 2b796b2438..be46522b1a 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,98 @@ # @objectstack/cli +## 11.1.0 + +### Minor Changes + +- fdb41c0: Remove ObjectStack's own legacy env-var aliases (11.0); ecosystem-standard names stay. + + The framework's renamed env vars no longer accept their old ObjectStack names — + rename them: + + | removed legacy name | use | + | ----------------------------------- | ---------------------- | + | `OS_MULTI_TENANT` | `OS_MULTI_ORG_ENABLED` | + | `OBJECTSTACK_METADATA_WRITABLE` | `OS_METADATA_WRITABLE` | + | `OS_AUTH_BASE_URL`, `AUTH_BASE_URL` | `OS_AUTH_URL` | + + **Ecosystem-standard names are NOT removed** — they remain accepted (and no longer + emit a deprecation warning, since they are permanent conventions, not legacy): + `DATABASE_URL`, `AUTH_SECRET`, `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `PORT`, + `CORS_*`, `LOG_LEVEL`, `ROOT_DOMAIN`, `MCP_SERVER_*`. The generic + `readEnvWithDeprecation` helper is unchanged. + +### Patch Changes + +- Updated dependencies [574e7a3] +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [18f9713] +- Updated dependencies [7cf81a7] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [8c84c97] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [13dbcf2] +- Updated dependencies [9ccfcd6] +- Updated dependencies [dc2990f] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/plugin-security@11.1.0 + - @objectstack/plugin-auth@11.1.0 + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/service-settings@11.1.0 + - @objectstack/rest@11.1.0 + - @objectstack/runtime@11.1.0 + - @objectstack/objectql@11.1.0 + - @objectstack/observability@11.1.0 + - @objectstack/plugin-hono-server@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + - @objectstack/client@11.1.0 + - @objectstack/driver-memory@11.1.0 + - @objectstack/verify@11.1.0 + - @objectstack/account@11.1.0 + - @objectstack/setup@11.1.0 + - @objectstack/studio@11.1.0 + - @objectstack/plugin-approvals@11.1.0 + - @objectstack/plugin-audit@11.1.0 + - @objectstack/plugin-email@11.1.0 + - @objectstack/plugin-org-scoping@11.1.0 + - @objectstack/plugin-reports@11.1.0 + - @objectstack/plugin-sharing@11.1.0 + - @objectstack/service-job@11.1.0 + - @objectstack/service-queue@11.1.0 + - @objectstack/service-realtime@11.1.0 + - @objectstack/service-storage@11.1.0 + - @objectstack/cloud-connection@11.1.0 + - @objectstack/mcp@11.1.0 + - @objectstack/driver-mongodb@11.1.0 + - @objectstack/driver-sql@11.1.0 + - @objectstack/driver-sqlite-wasm@11.1.0 + - @objectstack/plugin-webhooks@11.1.0 + - @objectstack/service-analytics@11.1.0 + - @objectstack/service-automation@11.1.0 + - @objectstack/service-cache@11.1.0 + - @objectstack/service-datasource@11.1.0 + - @objectstack/service-messaging@11.1.0 + - @objectstack/service-package@11.1.0 + - @objectstack/trigger-api@11.1.0 + - @objectstack/trigger-record-change@11.1.0 + - @objectstack/trigger-schedule@11.1.0 + - @objectstack/formula@11.1.0 + - @objectstack/lint@11.1.0 + - @objectstack/console@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index de76f17bf1..ea3fda974c 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cli", - "version": "11.0.0", + "version": "11.1.0", "description": "Command Line Interface for ObjectStack Protocol", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md index ef6dfbb637..dde7a99796 100644 --- a/packages/client-react/CHANGELOG.md +++ b/packages/client-react/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/client-react +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/client@11.1.0 + ## 11.0.0 ### Major Changes diff --git a/packages/client-react/package.json b/packages/client-react/package.json index 6a4f4788aa..7d751c7424 100644 --- a/packages/client-react/package.json +++ b/packages/client-react/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client-react", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "React hooks for ObjectStack Client SDK", "main": "dist/index.js", diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index 703d5dd599..ea6ef21073 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,39 @@ # @objectstack/client +## 11.1.0 + +### Minor Changes + +- 7087cfe: Remove the unused HTTP framework adapters and the MSW plugin — the open edition ships the **Hono** adapter only. + + The `express` / `fastify` / `nextjs` / `nestjs` / `nuxt` / `sveltekit` adapters and + `@objectstack/plugin-msw` had **zero internal consumers** and were not dogfooded — + pure release/maintenance surface (and an untested-integration liability). They are + removed; `@objectstack/hono` (the adapter actually used, via `@objectstack/client`) + is kept. + + - Deleted packages: `@objectstack/express`, `@objectstack/fastify`, + `@objectstack/nextjs`, `@objectstack/nestjs`, `@objectstack/nuxt`, + `@objectstack/sveltekit`, `@objectstack/plugin-msw` (fixed group 73 → 66). + - `@objectstack/client`: dropped the `plugin-msw` / `msw` dev usage (MSW test removed). + - `HttpDispatcher` (the dispatch engine) is now used only by the Hono adapter + + the internal dispatcher-plugin, so its misleading `@deprecated → createDispatcherPlugin` + note (createDispatcherPlugin is a kernel plugin, not a drop-in) is corrected. + + Anyone needing another framework adapter can build one on the public + `HttpDispatcher` / `createDispatcherPlugin` API or maintain it out-of-tree. + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/client/package.json b/packages/client/package.json index c0b4a9b23d..900d282e81 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Official Client SDK for ObjectStack Protocol", "main": "dist/index.js", diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md index bf0001af24..a55971d37b 100644 --- a/packages/cloud-connection/CHANGELOG.md +++ b/packages/cloud-connection/CHANGELOG.md @@ -1,5 +1,24 @@ # @objectstack/cloud-connection +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [e011d42] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/core@11.1.0 + - @objectstack/runtime@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json index 56f3cb9bc0..5fd4603364 100644 --- a/packages/cloud-connection/package.json +++ b/packages/cloud-connection/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cloud-connection", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.", "type": "module", diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md index bae5de68ef..e055942180 100644 --- a/packages/connectors/connector-mcp/CHANGELOG.md +++ b/packages/connectors/connector-mcp/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/connector-mcp +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json index 1bd3854ebc..23abf088d8 100644 --- a/packages/connectors/connector-mcp/package.json +++ b/packages/connectors/connector-mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-mcp", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).", "main": "dist/index.js", diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md index c068197599..1dc841fc32 100644 --- a/packages/connectors/connector-openapi/CHANGELOG.md +++ b/packages/connectors/connector-openapi/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/connector-openapi +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json index 0b5b0c654d..d3981107f5 100644 --- a/packages/connectors/connector-openapi/package.json +++ b/packages/connectors/connector-openapi/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-openapi", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).", "main": "dist/index.js", diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md index c802943c8e..a623d84f4d 100644 --- a/packages/connectors/connector-rest/CHANGELOG.md +++ b/packages/connectors/connector-rest/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/connector-rest +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json index bd78b7df94..0300fb641e 100644 --- a/packages/connectors/connector-rest/package.json +++ b/packages/connectors/connector-rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-rest", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).", "main": "dist/index.js", diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md index 45c046bc0a..f43955b1f4 100644 --- a/packages/connectors/connector-slack/CHANGELOG.md +++ b/packages/connectors/connector-slack/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/connector-slack +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json index b6801336b8..798be8c2f8 100644 --- a/packages/connectors/connector-slack/package.json +++ b/packages/connectors/connector-slack/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-slack", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).", "main": "dist/index.js", diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md index 912e4020f0..6456ea697e 100644 --- a/packages/console/CHANGELOG.md +++ b/packages/console/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/console +## 11.1.0 + ## 11.0.0 ## 10.3.0 diff --git a/packages/console/package.json b/packages/console/package.json index 17d0d81a8c..f9dc2a7e52 100644 --- a/packages/console/package.json +++ b/packages/console/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/console", - "version": "11.0.0", + "version": "11.1.0", "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).", "license": "Apache-2.0", "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index e2478fbaba..104531d719 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,72 @@ # @objectstack/core +## 11.1.0 + +### Minor Changes + +- ce0b4f6: Auth: password expiry — the session-validation gate (ADR-0069 D1, P1) + + Builds the **authentication-policy session gate** ADR-0069 needs and uses it for password expiry. When `password_expiry_days` (new `auth` setting, 0 = off) is exceeded, an authenticated user is blocked from protected REST resources with `403 PASSWORD_EXPIRED` until they change their password — while auth + remediation paths stay reachable. + + - **core**: new pure `evaluateAuthGate` / `isAuthGateAllowlisted` helper (`@objectstack/core/security`) — single source of truth for the allow-list (auth endpoints, change-password, health, UI-bootstrap reads). + - **plugin-auth**: `customSession` computes the gate posture once and attaches `user.authGate`; `computeAuthGate` reads `sys_user.password_changed_at` vs the configured window; `password_changed_at` is stamped on sign-up / change / reset; `isAuthGateActive()` keeps the gate **zero-overhead** when off. + - **platform-objects**: new `sys_user.password_changed_at` column. + - **rest**: `resolveExecCtx` carries `authGate`; `enforceAuth` blocks gated sessions (independent of `requireAuth`) using the core allow-list. + - **service-settings**: new `password_expiry_days` field. + + Default-off / additive (no upgrade behavior change); a null `password_changed_at` never expires (existing users). Per ADR-0049 the setting ships with its enforcement; timestamps written as `Date` (ADR-0074). + + This gate is the shared seam for **enforced MFA** (ADR-0069 D3), which lands next as a small addition (a second `authGate` branch). The dispatcher/MCP path is a follow-up (tracked in #2375); the REST surface the Console uses is fully gated here. + +- 3e593a7: Remove the deprecated `DriverInterface` type alias — use `IDataDriver` (11.0). + + `DriverInterface` was a `@deprecated` alias of `IDataDriver` (the authoritative + driver contract). It is removed from `@objectstack/spec/contracts` and + `@objectstack/core`; `objectql`'s engine now types drivers as `IDataDriver` + directly (a type-identical change, since the alias _was_ `IDataDriver`). + + Driver authors: replace `DriverInterface` with `IDataDriver` (same shape). + + Note: this is unrelated to the live `IDataEngine` interface (engine-layer + contract, not deprecated) and to the separate zod-derived `DriverInterface` / + `DriverInterfaceSchema` in `@objectstack/spec/data` (the runtime driver schema), + both of which are unchanged. + +### Patch Changes + +- 9ccfcd6: perf(core): authenticated requests issued ~16 sequential queries — duplicate authz + repeated localization — now request-scoped memoized + + An authenticated REST request resolves its execution context (identity + + RBAC/RLS + localization) many times in a single handler — the data operation + itself, app-nav RBAC filtering, dashboard widget gating, the ADR-0069 auth gate. + Each `resolveExecCtx` pass is the full `resolveAuthzContext` aggregation plus the + localization read (~16 sequential queries), and nothing memoized it, so a request + that resolves twice paid for duplicate authz and repeated localization. + + - **`@objectstack/rest`** — `resolveExecCtx` is now memoized per request, keyed by + the request object (a `WeakMap`, so the entry is collected with the request — no + TTL, no cross-request leak) and the input `environmentId`. The in-flight Promise + is cached so concurrent callers share one resolution. The heavy path moved to + `computeExecCtx`. Anonymous (`undefined`) resolutions are cached too. + - **`@objectstack/core`** — within a single `resolveAuthzContext` pass, `sys_user` + is now read at most once (the email fallback and the `ai_seat` synthesis shared a + duplicate query on the API-key path); `resolveLocalizationContext`'s direct-read + fallback batches `timezone`/`locale`/`currency` into one `sys_setting` query + (`$in` on `key`) instead of three sequential reads. + + No authorization-behavior change — the same roles/permissions/RLS context is + resolved, just without the redundant reads. The `sys_member` reads (per-user roles + vs. all-org-members) are intentionally left distinct (different filters/limits). + + Tests: query-counting regressions assert `sys_user` reads once and localization + reads once; new rest-server tests pin the per-request/per-environment memo contract. + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index 0f59aed922..5281750dd1 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/core", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Microkernel Core for ObjectStack", "type": "module", diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md index 7d55ba49bd..2b53f8e6ad 100644 --- a/packages/create-objectstack/CHANGELOG.md +++ b/packages/create-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # create-objectstack +## 11.1.0 + ## 11.0.0 ## 10.3.0 diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index bbe603a4a0..a1a8ac7d10 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -1,6 +1,6 @@ { "name": "create-objectstack", - "version": "11.0.0", + "version": "11.1.0", "description": "Create a new ObjectStack project — npx create-objectstack", "bin": { "create-objectstack": "./bin/create-objectstack.js" diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md index 93bd71d9d9..84f110744b 100644 --- a/packages/dogfood/CHANGELOG.md +++ b/packages/dogfood/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/dogfood +## 0.0.8 + +### Patch Changes + +- Updated dependencies [574e7a3] +- Updated dependencies [13dbcf2] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/plugin-security@11.1.0 + - @objectstack/objectql@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/verify@11.1.0 + - @objectstack/example-crm@4.0.60 + - @objectstack/example-showcase@0.2.6 + ## 0.0.7 ### Patch Changes diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json index 3204e20b55..0ff2080154 100644 --- a/packages/dogfood/package.json +++ b/packages/dogfood/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/dogfood", - "version": "0.0.7", + "version": "0.0.8", "private": true, "license": "Apache-2.0", "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.", diff --git a/packages/downstream-contract/CHANGELOG.md b/packages/downstream-contract/CHANGELOG.md index e94ea1c8de..d0487b4920 100644 --- a/packages/downstream-contract/CHANGELOG.md +++ b/packages/downstream-contract/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/downstream-contract +## 0.0.6 + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + ## 0.0.5 ### Patch Changes diff --git a/packages/downstream-contract/package.json b/packages/downstream-contract/package.json index 16f075a1f8..f6012c391e 100644 --- a/packages/downstream-contract/package.json +++ b/packages/downstream-contract/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/downstream-contract", - "version": "0.0.5", + "version": "0.0.6", "description": "Frozen third-party consumer fixture — a backward-compatibility gate for @objectstack/spec. Authored the way an external project on a published release authors metadata; if a spec change breaks it, that change is breaking (#2035).", "license": "Apache-2.0", "private": true, diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md index 0956afcc7a..d419d05958 100644 --- a/packages/formula/CHANGELOG.md +++ b/packages/formula/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/formula +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/formula/package.json b/packages/formula/package.json index d9fb31b3e7..fafb63521b 100644 --- a/packages/formula/package.json +++ b/packages/formula/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/formula", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry", "main": "dist/index.js", diff --git a/packages/lint/CHANGELOG.md b/packages/lint/CHANGELOG.md index 067b52d673..36b03cd547 100644 --- a/packages/lint/CHANGELOG.md +++ b/packages/lint/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/lint +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + - @objectstack/formula@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/lint/package.json b/packages/lint/package.json index 25b6b5a307..58745c9aec 100644 --- a/packages/lint/package.json +++ b/packages/lint/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/lint", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Static, build-time validation for an ObjectStack metadata graph — dashboard widget bindings, CEL/predicate expressions, and more. Pure (stack) => Issue[] functions shared by the CLI's `os validate` and any other consumer (e.g. AI authoring). Depends on @objectstack/spec; never on a runtime.", "type": "module", diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md index fe229a1feb..2c8d301e54 100644 --- a/packages/mcp/CHANGELOG.md +++ b/packages/mcp/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/plugin-mcp-server +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 49dff626b5..7ddff857e8 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/mcp", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)", "type": "module", diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md index e47ebd63b2..eb32629243 100644 --- a/packages/metadata-core/CHANGELOG.md +++ b/packages/metadata-core/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/metadata-core +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json index ee39c9887b..df99d0bbe8 100644 --- a/packages/metadata-core/package.json +++ b/packages/metadata-core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-core", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).", "type": "module", diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md index c556a0d303..a371fa4cca 100644 --- a/packages/metadata-fs/CHANGELOG.md +++ b/packages/metadata-fs/CHANGELOG.md @@ -1,5 +1,11 @@ # @objectstack/metadata-fs +## 11.1.0 + +### Patch Changes + +- @objectstack/metadata-core@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json index 04915bacfd..d2f7bba3f4 100644 --- a/packages/metadata-fs/package.json +++ b/packages/metadata-fs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-fs", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).", "type": "module", diff --git a/packages/metadata-protocol/CHANGELOG.md b/packages/metadata-protocol/CHANGELOG.md new file mode 100644 index 0000000000..6c0387fb14 --- /dev/null +++ b/packages/metadata-protocol/CHANGELOG.md @@ -0,0 +1,32 @@ +# @objectstack/metadata-protocol + +## 11.1.0 + +### Minor Changes + +- 13dbcf2: Extract metadata management into `@objectstack/metadata-protocol` (ADR-0076) + + `protocol.ts` (the `ObjectStackProtocol` implementation — sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics) plus its `sys-metadata-repository`, `metadata-diagnostics`, `seed-loader`, and `build-probes` helpers were metadata-domain code that lived inside `@objectstack/objectql` for historical reasons. They now live in a dedicated **`@objectstack/metadata-protocol`** package. + + The protocol no longer depends on the concrete `ObjectQL` class — it is typed against an injected `MetadataHostEngine` interface (the engine is still injected at runtime). Dependency direction is now one-way (`objectql → metadata-protocol`); there is no cycle. + + **Non-breaking**: `@objectstack/objectql` re-exports every previously public symbol (`ObjectStackProtocolImplementation`, `SysMetadataRepository`, `SysMetadataEngine`, `SeedLoaderService`, `runBuildProbes`, …), so existing imports keep working. + + This is Step 1 of ADR-0076. A later step turns the protocol into a capability plugin so `objectql` itself stops depending on it (making the engine lean by construction). + + Also adds a lean **`@objectstack/objectql/core`** entry — the engine/registry/hooks/validation surface only, with no kernel plugin or metadata protocol — so a thin embedder can import just the engine and never pull `@objectstack/metadata-protocol` into its bundle. A boundary ratchet test guards the entry. + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + - @objectstack/formula@11.1.0 + - @objectstack/metadata-core@11.1.0 diff --git a/packages/metadata-protocol/package.json b/packages/metadata-protocol/package.json index 1a57f13afc..f6a0161caf 100644 --- a/packages/metadata-protocol/package.json +++ b/packages/metadata-protocol/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-protocol", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack metadata management protocol: sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics (ADR-0076).", "type": "module", diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md index fb4848e62f..1f11feed9f 100644 --- a/packages/metadata/CHANGELOG.md +++ b/packages/metadata/CHANGELOG.md @@ -1,5 +1,31 @@ # @objectstack/metadata +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + - @objectstack/metadata-core@11.1.0 + - @objectstack/metadata-fs@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/metadata/package.json b/packages/metadata/package.json index cace4c460d..65d6ae769d 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Metadata loading, saving, and persistence for ObjectStack", "type": "module", diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md index 4576a98f08..f3e24376ef 100644 --- a/packages/objectql/CHANGELOG.md +++ b/packages/objectql/CHANGELOG.md @@ -1,5 +1,69 @@ # @objectstack/objectql +## 11.1.0 + +### Minor Changes + +- 13dbcf2: Extract metadata management into `@objectstack/metadata-protocol` (ADR-0076) + + `protocol.ts` (the `ObjectStackProtocol` implementation — sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics) plus its `sys-metadata-repository`, `metadata-diagnostics`, `seed-loader`, and `build-probes` helpers were metadata-domain code that lived inside `@objectstack/objectql` for historical reasons. They now live in a dedicated **`@objectstack/metadata-protocol`** package. + + The protocol no longer depends on the concrete `ObjectQL` class — it is typed against an injected `MetadataHostEngine` interface (the engine is still injected at runtime). Dependency direction is now one-way (`objectql → metadata-protocol`); there is no cycle. + + **Non-breaking**: `@objectstack/objectql` re-exports every previously public symbol (`ObjectStackProtocolImplementation`, `SysMetadataRepository`, `SysMetadataEngine`, `SeedLoaderService`, `runBuildProbes`, …), so existing imports keep working. + + This is Step 1 of ADR-0076. A later step turns the protocol into a capability plugin so `objectql` itself stops depending on it (making the engine lean by construction). + + Also adds a lean **`@objectstack/objectql/core`** entry — the engine/registry/hooks/validation surface only, with no kernel plugin or metadata protocol — so a thin embedder can import just the engine and never pull `@objectstack/metadata-protocol` into its bundle. A boundary ratchet test guards the entry. + +- 3e593a7: Remove the deprecated `DriverInterface` type alias — use `IDataDriver` (11.0). + + `DriverInterface` was a `@deprecated` alias of `IDataDriver` (the authoritative + driver contract). It is removed from `@objectstack/spec/contracts` and + `@objectstack/core`; `objectql`'s engine now types drivers as `IDataDriver` + directly (a type-identical change, since the alias _was_ `IDataDriver`). + + Driver authors: replace `DriverInterface` with `IDataDriver` (same shape). + + Note: this is unrelated to the live `IDataEngine` interface (engine-layer + contract, not deprecated) and to the separate zod-derived `DriverInterface` / + `DriverInterfaceSchema` in `@objectstack/spec/data` (the runtime driver schema), + both of which are unchanged. + +- fdb41c0: Remove ObjectStack's own legacy env-var aliases (11.0); ecosystem-standard names stay. + + The framework's renamed env vars no longer accept their old ObjectStack names — + rename them: + + | removed legacy name | use | + | ----------------------------------- | ---------------------- | + | `OS_MULTI_TENANT` | `OS_MULTI_ORG_ENABLED` | + | `OBJECTSTACK_METADATA_WRITABLE` | `OS_METADATA_WRITABLE` | + | `OS_AUTH_BASE_URL`, `AUTH_BASE_URL` | `OS_AUTH_URL` | + + **Ecosystem-standard names are NOT removed** — they remain accepted (and no longer + emit a deprecation warning, since they are permanent conventions, not legacy): + `DATABASE_URL`, `AUTH_SECRET`, `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `PORT`, + `CORS_*`, `LOG_LEVEL`, `ROOT_DOMAIN`, `MCP_SERVER_*`. The generic + `readEnvWithDeprecation` helper is unchanged. + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [13dbcf2] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/metadata-protocol@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + - @objectstack/formula@11.1.0 + - @objectstack/metadata-core@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/objectql/package.json b/packages/objectql/package.json index 7b97dade91..76f83f0d82 100644 --- a/packages/objectql/package.json +++ b/packages/objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/objectql", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Isomorphic ObjectQL Engine for ObjectStack", "main": "dist/index.js", diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md index 208d7f599d..caca5fe251 100644 --- a/packages/observability/CHANGELOG.md +++ b/packages/observability/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/observability +## 11.1.0 + +### Minor Changes + +- dc2990f: Observability: per-request performance timing surfaced via the `Server-Timing` response header ("perf-tuning mode"). + + `@objectstack/observability` gains a tiny, dependency-free `PerfTiming` collector plus an `AsyncLocalStorage`-backed ambient API (`runWithPerfTiming` / `currentPerfTiming` and the no-op-when-disabled free functions `measureServerTiming` / `startServerTiming` / `recordServerTiming`) and a spec-compliant `formatServerTiming` serializer that sanitizes names to tokens and quotes/escapes descriptions (no header injection). + + The Hono server plugin can now emit `Server-Timing` per request. It is **off by default** — the header discloses internal phase durations, which is a backend-fingerprinting surface — and opt-in via `new HonoServerPlugin({ serverTiming: true })` or `OS_SERVER_TIMING=true` (so it works through the default `os serve`). When enabled, every response carries `total` (measured by an outer middleware that brackets the whole request) plus the adapter-contributed `parse` and `handler` sub-phases; any code on the request's async call chain can add its own phases via the ambient API. When disabled, the timing call sites are zero-overhead no-ops. + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/observability/package.json b/packages/observability/package.json index b8f3ee12ad..b93cdaa063 100644 --- a/packages/observability/package.json +++ b/packages/observability/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/observability", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.", "type": "module", diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md index 74d6c6b15b..797141a132 100644 --- a/packages/platform-objects/CHANGELOG.md +++ b/packages/platform-objects/CHANGELOG.md @@ -1,5 +1,121 @@ # @objectstack/platform-objects +## 11.1.0 + +### Minor Changes + +- cbc8c02: feat(auth): opt-in SSO domain verification (ADR-0024 ②) + + Add DNS-TXT domain-ownership verification for external SSO providers, gated + behind a new `OS_SSO_DOMAIN_VERIFICATION` flag (off by default — today's + register→login behavior is unchanged). When enabled, `@better-auth/sso` mounts + `/sso/request-domain-verification` + `/sso/verify-domain` and enforces that a + provider's email domain be DNS-verified before it may complete a login. + + - `auth-manager.ts`: new `ssoDomainVerification` enabled-flag (readBooleanEnv) → + passes `domainVerification: { enabled: true }` to `sso()`; public + `isSsoDomainVerificationEnabled()` helper. + - `register-sso-provider.ts`: `runRequestDomainVerification` / + `runVerifyDomain` bridges — re-dispatch through the gated better-auth + endpoints and reshape the response into the `{ success, data }` envelope the + `sys_sso_provider` action `resultDialog` reads (request → ready-to-paste DNS + TXT record; verify → clear success/error). A bare 404 from the inner endpoint + is surfaced as "not enabled for this environment". + - `auth-plugin.ts`: mount the two bridges as rawApp routes + (`/admin/sso/{request-domain-verification,verify-domain}`). + - `sys_sso_provider`: `domain_verified` field + list column + the two actions; + `domainVerified` documented in `AUTH_SSO_PROVIDER_SCHEMA`. + +- ce0b4f6: Auth: password expiry — the session-validation gate (ADR-0069 D1, P1) + + Builds the **authentication-policy session gate** ADR-0069 needs and uses it for password expiry. When `password_expiry_days` (new `auth` setting, 0 = off) is exceeded, an authenticated user is blocked from protected REST resources with `403 PASSWORD_EXPIRED` until they change their password — while auth + remediation paths stay reachable. + + - **core**: new pure `evaluateAuthGate` / `isAuthGateAllowlisted` helper (`@objectstack/core/security`) — single source of truth for the allow-list (auth endpoints, change-password, health, UI-bootstrap reads). + - **plugin-auth**: `customSession` computes the gate posture once and attaches `user.authGate`; `computeAuthGate` reads `sys_user.password_changed_at` vs the configured window; `password_changed_at` is stamped on sign-up / change / reset; `isAuthGateActive()` keeps the gate **zero-overhead** when off. + - **platform-objects**: new `sys_user.password_changed_at` column. + - **rest**: `resolveExecCtx` carries `authGate`; `enforceAuth` blocks gated sessions (independent of `requireAuth`) using the core allow-list. + - **service-settings**: new `password_expiry_days` field. + + Default-off / additive (no upgrade behavior change); a null `password_changed_at` never expires (existing users). Per ADR-0049 the setting ships with its enforcement; timestamps written as `Date` (ADR-0074). + + This gate is the shared seam for **enforced MFA** (ADR-0069 D3), which lands next as a small addition (a second `authGate` branch). The dispatcher/MCP path is a follow-up (tracked in #2375); the REST surface the Console uses is fully gated here. + +- 90bce88: Auth: enforced MFA (ADR-0069 D3, P1) + + Completes the session-validation gate: when `mfa_required` (new `auth` setting) is on, an authenticated user without TOTP enrolled is blocked from protected resources with `403 MFA_REQUIRED` once their `mfa_grace_period_days` (default 7) window elapses — while the two-factor enrollment endpoints stay reachable so they can comply. Reuses the `authGate` seam shipped in #2388 (a second posture branch in `computeAuthGate`). + + - New `auth` settings `mfa_required` (toggle) + `mfa_grace_period_days`; enabling `mfa_required` also force-enables the `twoFactor` plugin so `/two-factor/*` enrollment exists. + - New `sys_user.mfa_required_at` column — the grace clock, stamped lazily the first time a user is seen required-but-unenrolled. + - `isAuthGateActive()` now also trips on `mfa_required` (still zero-overhead when off). + + Default-off / additive (no upgrade behavior change); per ADR-0049 the setting ships with its enforcement. + + **Needs an objectui follow-up**: the Console should handle a `403 MFA_REQUIRED` by showing the TOTP-enrollment prompt. Per-org `sys_organization.require_mfa` and the dispatcher/MCP gate remain follow-ups (#2375). + +- 3209ec6: Auth: session controls — idle timeout, absolute max lifetime, concurrent cap (ADR-0069 D4, P2) + + Adds three `auth` session-control settings (all 0 = off): + + - `session_idle_timeout_minutes` — sign a user out after inactivity. Enforced in `customSession`: touches `sys_session.last_activity_at` (throttled to once a minute) and, once the idle window is exceeded, revokes the session. + - `session_absolute_max_hours` — cap total session lifetime regardless of refresh; revoked once `created_at` is older than the cap. + - `max_concurrent_sessions_per_user` — on sign-in, keep the newest N live sessions and revoke the rest (oldest first). + + Revocation expires the session in place (`expires_at` set to the past + `revoked_at` / `revoke_reason` stamped on new `sys_session` columns), so better-auth returns no session on the next request → the Console's existing 401 → login redirect handles it (no client change). Note: better-auth garbage-collects expired sessions, so the `revoke_reason` audit row is best-effort; the enforcement (session killed) is not. + + Default-off / additive (no upgrade behavior change); per ADR-0049 each setting ships with its enforcement. + +- e011d42: Auth: per-org MFA + dispatcher/MCP gate — complete the ADR-0069 enforced-MFA story + + Two follow-ups that make enforced MFA total: + + - **Per-org `sys_organization.require_mfa`** — an org may require MFA above the global floor. `computeAuthGate` now treats the active org's `require_mfa` as an effective MFA requirement even when the global `mfa_required` is off; `isAuthGateActive()` stays cheap via a 60s-TTL "any org requires MFA" cache (lazy background refresh), so a brand-new per-org requirement activates the gate on the next request without per-request org queries. + - **Dispatcher/MCP gate** — the auth-policy gate now also runs in the runtime dispatcher (after `resolveExecutionContext`), so MCP / GraphQL / embedded data paths enforce `PASSWORD_EXPIRED` / `MFA_REQUIRED` consistently with the REST seam (reusing the shared `evaluateAuthGate` allow-list). Previously only the REST surface (the Console) was gated. + + Default-off / additive. Per ADR-0049 each setting ships with its enforcement. + +- 6e5bdd5: feat(auth): SAML 2.0 SSO via @better-auth/sso (ADR-0069 P3) + + `@better-auth/sso@1.6.20` ships full SAML 2.0 (samlify-backed), so SAML needs no + custom plugin. Adds a `register_saml_provider` action on `sys_sso_provider` and a + `runRegisterSamlProviderFromForm` bridge that reshapes the flat admin form into the + nested `samlConfig` and re-dispatches through `/sso/register` (admin gate enforced), + returning the SP ACS + metadata URLs to configure on the IdP. Updates ADR-0069 to + correct the stale "SAML is out of better-auth core" premise. + +### Patch Changes + +- 07c2773: Auth: make the SSO Providers list visible to admins (ADR-0024 / cloud#551) + + The `sys_sso_provider` Setup list rendered empty even after an admin registered a provider: `member_default`'s wildcard `tenant_isolation` RLS (`organization_id == current_user.organization_id`) denied every row, because better-auth writes these via its adapter with no tenantId context so `organization_id` is never stamped, and the platform-admin `viewAllRecords` superuser bypass is gated to private/non-tenant objects. + + `sys_sso_provider` is env-global, admin-only identity config, so it now declares: + + - `tenancy: { enabled: false }` — opts out of multi-tenancy (the env IS the tenant; providers are env-wide), letting a platform admin's `viewAllRecords` bypass see every provider. + - `requiredPermissions: ['manage_platform_settings']` — object-level capability gate so ordinary members are denied (without it, tenancy-disabled + `member_default`'s `'*': allowRead` would expose providers to every authenticated user). + + Verified E2E: an admin sees all env providers in the Setup → Access Control → SSO Providers list; a non-admin gets 403. (Env-only object — no control-plane cross-tenant impact. The sibling `sys_oauth_application` / `sys_account` nav entries share the same empty-list symptom but span the control plane and need separate per-object analysis.) + +- d7a88df: Auth: SSO quality polish (ADR-0024 / cloud#551) + + - **plugin-auth**: `OS_OIDC_PROVIDER_ENABLED` / `OS_SSO_ENABLED` / `OS_SCIM_ENABLED` now parse with the shared `readBooleanEnv` helper (same as `OS_AUTH_TWO_FACTOR` etc.), so the platform-standard truthy set works (`true`/`1`/`yes`/`on`, case-insensitive) instead of only the literal `'true'` — a repeated operator footgun where `OS_SSO_ENABLED=1` silently parsed as disabled. Added unit tests. + - **platform-objects**: `sys_sso_provider`'s list view gets a per-object empty state ("No SSO providers yet" + a pointer to "Register SSO Provider"), replacing the shared identity-object copy ("records are created automatically … cannot be added here") which is wrong for this object — it HAS a register action. + +- 4f8f108: Auth: make the open-source SSO-provider registration form produce a usable IdP (ADR-0024 / cloud#551) + + The `sys_sso_provider` `register_sso_provider` UI action posted FLAT form fields to `@better-auth/sso`'s `/sso/register`, which expects the OIDC fields NESTED under `oidcConfig`. The top-level `clientId`/`clientSecret` were Zod-stripped, so the form persisted an `oidc_config = null` provider that could never complete a login ("Invalid SSO provider"). + + - **plugin-auth**: new shared `runRegisterSsoProviderFromForm` helper reshapes the flat form body into the nested shape and re-dispatches it through the real `/sso/register` (so the admin gate, the public-routable `trustedOrigins` allowance, discovery hydration, and secret handling all still run). Exposed via a new `/admin/sso/register` bridge route on the host `AuthPlugin`. (The cloud per-env runtime mounts the same helper in its `AuthProxyPlugin` — mirrors `set-initial-password`.) + - **platform-objects**: `register_sso_provider` retargets to `/api/v1/auth/admin/sso/register` and gains `discoveryEndpoint`, `scopes`, and attribute-mapping (`mapId`/`mapEmail`/`mapName`) fields. Open mechanism — keeps runtime IdP registration self-service in the OSS edition. + + Verified E2E: an admin registers an external OIDC IdP from the flat form → a member logs in through it (JIT-provisioned, `sys_account.provider_id` set); a non-admin is rejected (403) before discovery runs. + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + - @objectstack/metadata-core@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json index b04bb8a9fb..e284c4f132 100644 --- a/packages/platform-objects/package.json +++ b/packages/platform-objects/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/platform-objects", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects", "main": "dist/index.js", diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md index 9d0b2292ba..b1b534d8f8 100644 --- a/packages/plugins/driver-memory/CHANGELOG.md +++ b/packages/plugins/driver-memory/CHANGELOG.md @@ -1,5 +1,26 @@ # @objectstack/driver-memory +## 11.1.0 + +### Patch Changes + +- 69ae136: docs: align hardening / driver docs with the Hono-only adapter surface (12.0) + + Follow-up to the adapter trim (#2391): the hardening guide's rate-limit/CORS + recipes are rewritten from Fastify to **Hono** (the shipped adapter; the old + `@objectstack/fastify` import was broken), CSRF guidance points at `hono/csrf`, + and stale `@objectstack/plugin-msw` references are dropped from the driver-memory + and driver-turso docs. README framework lists narrowed to Hono. + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json index 7376286c43..d132d49ad1 100644 --- a/packages/plugins/driver-memory/package.json +++ b/packages/plugins/driver-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-memory", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "In-Memory Driver for ObjectStack (Reference Implementation)", "main": "dist/index.js", diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md index a182cd6248..747aa14de2 100644 --- a/packages/plugins/driver-mongodb/CHANGELOG.md +++ b/packages/plugins/driver-mongodb/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/driver-mongodb +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json index fd79cd6c2a..1a470467fc 100644 --- a/packages/plugins/driver-mongodb/package.json +++ b/packages/plugins/driver-mongodb/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-mongodb", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client", "main": "dist/index.js", diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md index dd95253bc4..e52c857d80 100644 --- a/packages/plugins/driver-sql/CHANGELOG.md +++ b/packages/plugins/driver-sql/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/driver-sql +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json index a47cb1a39f..ce54912011 100644 --- a/packages/plugins/driver-sql/package.json +++ b/packages/plugins/driver-sql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sql", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex", "main": "dist/index.js", diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md index d68a4abcf0..59bbd4303c 100644 --- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md +++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/driver-sqlite-wasm +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/driver-sql@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json index 8536f67080..021c117612 100644 --- a/packages/plugins/driver-sqlite-wasm/package.json +++ b/packages/plugins/driver-sqlite-wasm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sqlite-wasm", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings", "keywords": [ diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md index 088cf80399..070b306848 100644 --- a/packages/plugins/embedder-openai/CHANGELOG.md +++ b/packages/plugins/embedder-openai/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/embedder-openai +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json index 5bc00336b3..6c0fd011f3 100644 --- a/packages/plugins/embedder-openai/package.json +++ b/packages/plugins/embedder-openai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/embedder-openai", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md index d80214a8e8..519ebec140 100644 --- a/packages/plugins/knowledge-memory/CHANGELOG.md +++ b/packages/plugins/knowledge-memory/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/knowledge-memory +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/service-knowledge@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json index bcd0becd71..6941b7a1c8 100644 --- a/packages/plugins/knowledge-memory/package.json +++ b/packages/plugins/knowledge-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-memory", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md index 90279f5589..aa833af73e 100644 --- a/packages/plugins/knowledge-ragflow/CHANGELOG.md +++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/knowledge-ragflow +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/service-knowledge@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json index 666e7eaca3..a5c3a34510 100644 --- a/packages/plugins/knowledge-ragflow/package.json +++ b/packages/plugins/knowledge-ragflow/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-ragflow", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md index b12e4ddeb0..d1c377a904 100644 --- a/packages/plugins/plugin-approvals/CHANGELOG.md +++ b/packages/plugins/plugin-approvals/CHANGELOG.md @@ -1,5 +1,29 @@ # @objectstack/plugin-approvals +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/formula@11.1.0 + - @objectstack/metadata-core@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json index f15b4d012d..b9f115360a 100644 --- a/packages/plugins/plugin-approvals/package.json +++ b/packages/plugins/plugin-approvals/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-approvals", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md index b68f39ba1e..242f0c4596 100644 --- a/packages/plugins/plugin-audit/CHANGELOG.md +++ b/packages/plugins/plugin-audit/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/plugin-audit +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json index dd16dc1c2f..753a365b74 100644 --- a/packages/plugins/plugin-audit/package.json +++ b/packages/plugins/plugin-audit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-audit", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Audit Plugin for ObjectStack — System audit log object and audit trail", "main": "dist/index.js", diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md index bb12beaea6..85f18ddc2a 100644 --- a/packages/plugins/plugin-auth/CHANGELOG.md +++ b/packages/plugins/plugin-auth/CHANGELOG.md @@ -1,5 +1,144 @@ # Changelog +## 11.1.0 + +### Minor Changes + +- cbc8c02: feat(auth): opt-in SSO domain verification (ADR-0024 ②) + + Add DNS-TXT domain-ownership verification for external SSO providers, gated + behind a new `OS_SSO_DOMAIN_VERIFICATION` flag (off by default — today's + register→login behavior is unchanged). When enabled, `@better-auth/sso` mounts + `/sso/request-domain-verification` + `/sso/verify-domain` and enforces that a + provider's email domain be DNS-verified before it may complete a login. + + - `auth-manager.ts`: new `ssoDomainVerification` enabled-flag (readBooleanEnv) → + passes `domainVerification: { enabled: true }` to `sso()`; public + `isSsoDomainVerificationEnabled()` helper. + - `register-sso-provider.ts`: `runRequestDomainVerification` / + `runVerifyDomain` bridges — re-dispatch through the gated better-auth + endpoints and reshape the response into the `{ success, data }` envelope the + `sys_sso_provider` action `resultDialog` reads (request → ready-to-paste DNS + TXT record; verify → clear success/error). A bare 404 from the inner endpoint + is surfaced as "not enabled for this environment". + - `auth-plugin.ts`: mount the two bridges as rawApp routes + (`/admin/sso/{request-domain-verification,verify-domain}`). + - `sys_sso_provider`: `domain_verified` field + list column + the two actions; + `domainVerified` documented in `AUTH_SSO_PROVIDER_SCHEMA`. + +- ce0b4f6: Auth: password expiry — the session-validation gate (ADR-0069 D1, P1) + + Builds the **authentication-policy session gate** ADR-0069 needs and uses it for password expiry. When `password_expiry_days` (new `auth` setting, 0 = off) is exceeded, an authenticated user is blocked from protected REST resources with `403 PASSWORD_EXPIRED` until they change their password — while auth + remediation paths stay reachable. + + - **core**: new pure `evaluateAuthGate` / `isAuthGateAllowlisted` helper (`@objectstack/core/security`) — single source of truth for the allow-list (auth endpoints, change-password, health, UI-bootstrap reads). + - **plugin-auth**: `customSession` computes the gate posture once and attaches `user.authGate`; `computeAuthGate` reads `sys_user.password_changed_at` vs the configured window; `password_changed_at` is stamped on sign-up / change / reset; `isAuthGateActive()` keeps the gate **zero-overhead** when off. + - **platform-objects**: new `sys_user.password_changed_at` column. + - **rest**: `resolveExecCtx` carries `authGate`; `enforceAuth` blocks gated sessions (independent of `requireAuth`) using the core allow-list. + - **service-settings**: new `password_expiry_days` field. + + Default-off / additive (no upgrade behavior change); a null `password_changed_at` never expires (existing users). Per ADR-0049 the setting ships with its enforcement; timestamps written as `Date` (ADR-0074). + + This gate is the shared seam for **enforced MFA** (ADR-0069 D3), which lands next as a small addition (a second `authGate` branch). The dispatcher/MCP path is a follow-up (tracked in #2375); the REST surface the Console uses is fully gated here. + +- 90bce88: Auth: enforced MFA (ADR-0069 D3, P1) + + Completes the session-validation gate: when `mfa_required` (new `auth` setting) is on, an authenticated user without TOTP enrolled is blocked from protected resources with `403 MFA_REQUIRED` once their `mfa_grace_period_days` (default 7) window elapses — while the two-factor enrollment endpoints stay reachable so they can comply. Reuses the `authGate` seam shipped in #2388 (a second posture branch in `computeAuthGate`). + + - New `auth` settings `mfa_required` (toggle) + `mfa_grace_period_days`; enabling `mfa_required` also force-enables the `twoFactor` plugin so `/two-factor/*` enrollment exists. + - New `sys_user.mfa_required_at` column — the grace clock, stamped lazily the first time a user is seen required-but-unenrolled. + - `isAuthGateActive()` now also trips on `mfa_required` (still zero-overhead when off). + + Default-off / additive (no upgrade behavior change); per ADR-0049 the setting ships with its enforcement. + + **Needs an objectui follow-up**: the Console should handle a `403 MFA_REQUIRED` by showing the TOTP-enrollment prompt. Per-org `sys_organization.require_mfa` and the dispatcher/MCP gate remain follow-ups (#2375). + +- 3209ec6: Auth: session controls — idle timeout, absolute max lifetime, concurrent cap (ADR-0069 D4, P2) + + Adds three `auth` session-control settings (all 0 = off): + + - `session_idle_timeout_minutes` — sign a user out after inactivity. Enforced in `customSession`: touches `sys_session.last_activity_at` (throttled to once a minute) and, once the idle window is exceeded, revokes the session. + - `session_absolute_max_hours` — cap total session lifetime regardless of refresh; revoked once `created_at` is older than the cap. + - `max_concurrent_sessions_per_user` — on sign-in, keep the newest N live sessions and revoke the rest (oldest first). + + Revocation expires the session in place (`expires_at` set to the past + `revoked_at` / `revoke_reason` stamped on new `sys_session` columns), so better-auth returns no session on the next request → the Console's existing 401 → login redirect handles it (no client change). Note: better-auth garbage-collects expired sessions, so the `revoke_reason` audit row is best-effort; the enforcement (session killed) is not. + + Default-off / additive (no upgrade behavior change); per ADR-0049 each setting ships with its enforcement. + +- 8c84c97: Auth: IP allow-list — network gating on the auth routes (ADR-0069 D5, P2) + + Adds an `allowed_ip_ranges` auth setting (CIDR ranges or exact IPs; empty = no restriction). A Hono middleware registered ahead of the better-auth handler in the auth-route registration rejects auth requests from a client IP outside the ranges with `403 IP_NOT_ALLOWED`, before they reach better-auth. + + - Client IP is read trust-proxy-aware from `x-forwarded-for` (first hop) / `cf-connecting-ip` / `x-real-ip`. + - The public render helpers (`/config`, `/bootstrap-status`) are exempt so a blocked client still gets a clean login page + a clear error. + - **Fails OPEN** when the client IP can't be determined (no proxy header), so a misconfigured proxy is a no-op rather than a lockout — an admin enabling this must ensure forwarded headers are trusted. + - IPv4 CIDR (`a.b.c.d/n`) + exact IPv4/IPv6 matching. + + Default-off / additive; per ADR-0049 the setting ships with its enforcement. + +- e011d42: Auth: per-org MFA + dispatcher/MCP gate — complete the ADR-0069 enforced-MFA story + + Two follow-ups that make enforced MFA total: + + - **Per-org `sys_organization.require_mfa`** — an org may require MFA above the global floor. `computeAuthGate` now treats the active org's `require_mfa` as an effective MFA requirement even when the global `mfa_required` is off; `isAuthGateActive()` stays cheap via a 60s-TTL "any org requires MFA" cache (lazy background refresh), so a brand-new per-org requirement activates the gate on the next request without per-request org queries. + - **Dispatcher/MCP gate** — the auth-policy gate now also runs in the runtime dispatcher (after `resolveExecutionContext`), so MCP / GraphQL / embedded data paths enforce `PASSWORD_EXPIRED` / `MFA_REQUIRED` consistently with the REST seam (reusing the shared `evaluateAuthGate` allow-list). Previously only the REST surface (the Console) was gated. + + Default-off / additive. Per ADR-0049 each setting ships with its enforcement. + +- 6e5bdd5: feat(auth): SAML 2.0 SSO via @better-auth/sso (ADR-0069 P3) + + `@better-auth/sso@1.6.20` ships full SAML 2.0 (samlify-backed), so SAML needs no + custom plugin. Adds a `register_saml_provider` action on `sys_sso_provider` and a + `runRegisterSamlProviderFromForm` bridge that reshapes the flat admin form into the + nested `samlConfig` and re-dispatches through `/sso/register` (admin gate enforced), + returning the SP ACS + metadata URLs to configure on the IdP. Updates ADR-0069 to + correct the stale "SAML is out of better-auth core" premise. + +### Patch Changes + +- 18f9713: Auth: surface "SSO Providers" in the Setup app nav when SSO is enabled (ADR-0024 / cloud#551) + + The `sys_sso_provider` admin object (register / list / delete external OIDC IdPs) had no navigation entry, so an admin could only reach it by direct URL. `AuthPlugin` now contributes an **"SSO Providers"** entry into the Setup app's **Access Control** group — but only when the external-IdP RP is wired (`AuthManager.isSsoWired()`, which captures both self-host `OS_SSO_ENABLED` and the cloud per-env `planAllowsSso` arriving via `plugins.sso`). Owning-plugin-contributes pattern (ADR-0029 K2), mirroring `plugin-security`. `isSsoWired()` is made public for this gate. + +- 7cf81a7: Auth: org-scope registered SSO/SAML providers so any org admin can manage them (ADR-0024 / cloud#551) + + `@better-auth/sso`'s provider-management endpoints (delete / update / domain verification) gate ORG-LESS providers on `provider.userId === caller` — only the original registrar could manage them, so a second org admin couldn't delete or verify an IdP someone else registered. The register bridges now resolve the caller's active organization (best-effort, via a `/get-session` re-dispatch) and scope the provider to it, so management gates on `isOrgAdmin` instead — **any** org owner/admin can manage the environment's IdPs. Falls back to org-less (no behavior change) when no active org is set. + + Verified E2E: an OIDC provider registered through the form lands with `organization_id` set to the env's org (was null); register + delete still succeed. + +- d7a88df: Auth: SSO quality polish (ADR-0024 / cloud#551) + + - **plugin-auth**: `OS_OIDC_PROVIDER_ENABLED` / `OS_SSO_ENABLED` / `OS_SCIM_ENABLED` now parse with the shared `readBooleanEnv` helper (same as `OS_AUTH_TWO_FACTOR` etc.), so the platform-standard truthy set works (`true`/`1`/`yes`/`on`, case-insensitive) instead of only the literal `'true'` — a repeated operator footgun where `OS_SSO_ENABLED=1` silently parsed as disabled. Added unit tests. + - **platform-objects**: `sys_sso_provider`'s list view gets a per-object empty state ("No SSO providers yet" + a pointer to "Register SSO Provider"), replacing the shared identity-object copy ("records are created automatically … cannot be added here") which is wrong for this object — it HAS a register action. + +- 4f8f108: Auth: make the open-source SSO-provider registration form produce a usable IdP (ADR-0024 / cloud#551) + + The `sys_sso_provider` `register_sso_provider` UI action posted FLAT form fields to `@better-auth/sso`'s `/sso/register`, which expects the OIDC fields NESTED under `oidcConfig`. The top-level `clientId`/`clientSecret` were Zod-stripped, so the form persisted an `oidc_config = null` provider that could never complete a login ("Invalid SSO provider"). + + - **plugin-auth**: new shared `runRegisterSsoProviderFromForm` helper reshapes the flat form body into the nested shape and re-dispatches it through the real `/sso/register` (so the admin gate, the public-routable `trustedOrigins` allowance, discovery hydration, and secret handling all still run). Exposed via a new `/admin/sso/register` bridge route on the host `AuthPlugin`. (The cloud per-env runtime mounts the same helper in its `AuthProxyPlugin` — mirrors `set-initial-password`.) + - **platform-objects**: `register_sso_provider` retargets to `/api/v1/auth/admin/sso/register` and gains `discoveryEndpoint`, `scopes`, and attribute-mapping (`mapId`/`mapEmail`/`mapName`) fields. Open mechanism — keeps runtime IdP registration self-service in the OSS edition. + + Verified E2E: an admin registers an external OIDC IdP from the flat form → a member logs in through it (JIT-provisioned, `sys_account.provider_id` set); a non-admin is rejected (403) before discovery runs. + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index 2e38c0801b..3091b9061a 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-auth", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Authentication & Identity Plugin for ObjectStack", "main": "dist/index.js", diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md index d2928ad6c6..7b3efe63fd 100644 --- a/packages/plugins/plugin-dev/CHANGELOG.md +++ b/packages/plugins/plugin-dev/CHANGELOG.md @@ -1,5 +1,47 @@ # @objectstack/plugin-dev +## 11.1.0 + +### Patch Changes + +- Updated dependencies [574e7a3] +- Updated dependencies [cbc8c02] +- Updated dependencies [18f9713] +- Updated dependencies [7cf81a7] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [8c84c97] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [13dbcf2] +- Updated dependencies [9ccfcd6] +- Updated dependencies [dc2990f] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/plugin-security@11.1.0 + - @objectstack/plugin-auth@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/rest@11.1.0 + - @objectstack/runtime@11.1.0 + - @objectstack/objectql@11.1.0 + - @objectstack/plugin-hono-server@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + - @objectstack/driver-memory@11.1.0 + - @objectstack/account@11.1.0 + - @objectstack/setup@11.1.0 + - @objectstack/studio@11.1.0 + - @objectstack/plugin-org-scoping@11.1.0 + - @objectstack/service-i18n@11.1.0 + ## 11.0.0 ### Major Changes diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json index 8eb9a69584..69dbc1ddee 100644 --- a/packages/plugins/plugin-dev/package.json +++ b/packages/plugins/plugin-dev/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-dev", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations", "main": "dist/index.js", diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md index 39d32d17e5..ca3d5ae26e 100644 --- a/packages/plugins/plugin-email/CHANGELOG.md +++ b/packages/plugins/plugin-email/CHANGELOG.md @@ -1,5 +1,28 @@ # @objectstack/plugin-email +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/formula@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json index 6cdfbce11e..fb5369b32b 100644 --- a/packages/plugins/plugin-email/package.json +++ b/packages/plugins/plugin-email/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-email", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md index b802bfe312..8d1c582b15 100644 --- a/packages/plugins/plugin-hono-server/CHANGELOG.md +++ b/packages/plugins/plugin-hono-server/CHANGELOG.md @@ -1,5 +1,30 @@ # @objectstack/plugin-hono-server +## 11.1.0 + +### Minor Changes + +- dc2990f: Observability: per-request performance timing surfaced via the `Server-Timing` response header ("perf-tuning mode"). + + `@objectstack/observability` gains a tiny, dependency-free `PerfTiming` collector plus an `AsyncLocalStorage`-backed ambient API (`runWithPerfTiming` / `currentPerfTiming` and the no-op-when-disabled free functions `measureServerTiming` / `startServerTiming` / `recordServerTiming`) and a spec-compliant `formatServerTiming` serializer that sanitizes names to tokens and quotes/escapes descriptions (no header injection). + + The Hono server plugin can now emit `Server-Timing` per request. It is **off by default** — the header discloses internal phase durations, which is a backend-fingerprinting surface — and opt-in via `new HonoServerPlugin({ serverTiming: true })` or `OS_SERVER_TIMING=true` (so it works through the default `os serve`). When enabled, every response carries `total` (measured by an outer middleware that brackets the whole request) plus the adapter-contributed `parse` and `handler` sub-phases; any code on the request's async call chain can add its own phases via the ambient API. When disabled, the timing call sites are zero-overhead no-ops. + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [dc2990f] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/observability@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json index 3b4acb228c..ff316f45e5 100644 --- a/packages/plugins/plugin-hono-server/package.json +++ b/packages/plugins/plugin-hono-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-hono-server", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Standard Hono Server Adapter for ObjectStack Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-org-scoping/CHANGELOG.md b/packages/plugins/plugin-org-scoping/CHANGELOG.md index 449e228721..40c7352dbd 100644 --- a/packages/plugins/plugin-org-scoping/CHANGELOG.md +++ b/packages/plugins/plugin-org-scoping/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/plugin-org-scoping +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-org-scoping/package.json b/packages/plugins/plugin-org-scoping/package.json index 686fc74c77..6125d387b9 100644 --- a/packages/plugins/plugin-org-scoping/package.json +++ b/packages/plugins/plugin-org-scoping/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-org-scoping", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Organization-Scoping Plugin for ObjectStack — row-level Organization isolation, per-org seed replay, default-org bootstrap", "main": "dist/index.js", diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md index feb35188d7..8c06c15807 100644 --- a/packages/plugins/plugin-reports/CHANGELOG.md +++ b/packages/plugins/plugin-reports/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/plugin-reports +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json index f20844da27..4504acf0f6 100644 --- a/packages/plugins/plugin-reports/package.json +++ b/packages/plugins/plugin-reports/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-reports", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md index 50b86266e1..4ac8638683 100644 --- a/packages/plugins/plugin-security/CHANGELOG.md +++ b/packages/plugins/plugin-security/CHANGELOG.md @@ -1,5 +1,36 @@ # @objectstack/plugin-security +## 11.1.0 + +### Patch Changes + +- 574e7a3: Security: platform admins see all rows of better-auth-managed identity objects (ADR-0024 / cloud#551) + + Identity tables managed by the auth library (`managedBy: 'better-auth'` — `sys_oauth_application`, `sys_account`, `sys_session`, `sys_sso_provider`, …) are written by better-auth's own adapter with **no tenant context**, so `organization_id` is never stamped and `member_default`'s wildcard `tenant_isolation` RLS denies every row — a platform admin's Setup list (OAuth Applications, Identity Links, …) renders **empty**. + + These objects now get the **same posture-gated superuser bypass** as `private` / `tenancy.enabled:false` objects, so a platform admin's `viewAllRecords` sees all identity rows env-wide. This is **admin-only**: non-admins never trigger the bypass — their `_self` carve-outs / `tenant_isolation` still apply (verified by a regression test that a member stays tenant-scoped), and the flag is deliberately **not** used for the wildcard-policy drop, so it can never leak rows to members. + + Fixes the empty-list symptom across all better-auth-managed Setup objects without per-object `tenancy` changes (which would risk the control plane, where some of these objects ARE cross-env-isolated). + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/formula@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json index 213d2974d4..5ab3acbea1 100644 --- a/packages/plugins/plugin-security/package.json +++ b/packages/plugins/plugin-security/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-security", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md index a7097caf80..0c2197484a 100644 --- a/packages/plugins/plugin-sharing/CHANGELOG.md +++ b/packages/plugins/plugin-sharing/CHANGELOG.md @@ -1,5 +1,31 @@ # @objectstack/plugin-sharing +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [13dbcf2] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/objectql@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/formula@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json index 72843cc71d..3c7a378210 100644 --- a/packages/plugins/plugin-sharing/package.json +++ b/packages/plugins/plugin-sharing/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sharing", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md index 25085d6cca..e53fd89a65 100644 --- a/packages/plugins/plugin-webhooks/CHANGELOG.md +++ b/packages/plugins/plugin-webhooks/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-webhooks +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/service-messaging@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json index 7ea2aa1e99..6395f81847 100644 --- a/packages/plugins/plugin-webhooks/package.json +++ b/packages/plugins/plugin-webhooks/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-webhooks", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.", "type": "module", diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md index 690c1a8d7c..f99f2c5ee9 100644 --- a/packages/rest/CHANGELOG.md +++ b/packages/rest/CHANGELOG.md @@ -1,5 +1,62 @@ # @objectstack/rest +## 11.1.0 + +### Minor Changes + +- ce0b4f6: Auth: password expiry — the session-validation gate (ADR-0069 D1, P1) + + Builds the **authentication-policy session gate** ADR-0069 needs and uses it for password expiry. When `password_expiry_days` (new `auth` setting, 0 = off) is exceeded, an authenticated user is blocked from protected REST resources with `403 PASSWORD_EXPIRED` until they change their password — while auth + remediation paths stay reachable. + + - **core**: new pure `evaluateAuthGate` / `isAuthGateAllowlisted` helper (`@objectstack/core/security`) — single source of truth for the allow-list (auth endpoints, change-password, health, UI-bootstrap reads). + - **plugin-auth**: `customSession` computes the gate posture once and attaches `user.authGate`; `computeAuthGate` reads `sys_user.password_changed_at` vs the configured window; `password_changed_at` is stamped on sign-up / change / reset; `isAuthGateActive()` keeps the gate **zero-overhead** when off. + - **platform-objects**: new `sys_user.password_changed_at` column. + - **rest**: `resolveExecCtx` carries `authGate`; `enforceAuth` blocks gated sessions (independent of `requireAuth`) using the core allow-list. + - **service-settings**: new `password_expiry_days` field. + + Default-off / additive (no upgrade behavior change); a null `password_changed_at` never expires (existing users). Per ADR-0049 the setting ships with its enforcement; timestamps written as `Date` (ADR-0074). + + This gate is the shared seam for **enforced MFA** (ADR-0069 D3), which lands next as a small addition (a second `authGate` branch). The dispatcher/MCP path is a follow-up (tracked in #2375); the REST surface the Console uses is fully gated here. + +### Patch Changes + +- 9ccfcd6: perf(core): authenticated requests issued ~16 sequential queries — duplicate authz + repeated localization — now request-scoped memoized + + An authenticated REST request resolves its execution context (identity + + RBAC/RLS + localization) many times in a single handler — the data operation + itself, app-nav RBAC filtering, dashboard widget gating, the ADR-0069 auth gate. + Each `resolveExecCtx` pass is the full `resolveAuthzContext` aggregation plus the + localization read (~16 sequential queries), and nothing memoized it, so a request + that resolves twice paid for duplicate authz and repeated localization. + + - **`@objectstack/rest`** — `resolveExecCtx` is now memoized per request, keyed by + the request object (a `WeakMap`, so the entry is collected with the request — no + TTL, no cross-request leak) and the input `environmentId`. The in-flight Promise + is cached so concurrent callers share one resolution. The heavy path moved to + `computeExecCtx`. Anonymous (`undefined`) resolutions are cached too. + - **`@objectstack/core`** — within a single `resolveAuthzContext` pass, `sys_user` + is now read at most once (the email fallback and the `ai_seat` synthesis shared a + duplicate query on the API-key path); `resolveLocalizationContext`'s direct-read + fallback batches `timezone`/`locale`/`currency` into one `sys_setting` query + (`$in` on `key`) instead of three sequential reads. + + No authorization-behavior change — the same roles/permissions/RLS context is + resolved, just without the redundant reads. The `sys_member` reads (per-user roles + vs. all-org-members) are intentionally left distinct (different filters/limits). + + Tests: query-counting regressions assert `sys_user` reads once and localization + reads once; new rest-server tests pin the per-request/per-environment memo contract. + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/service-package@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/rest/package.json b/packages/rest/package.json index 5a0dbd4f8c..df1caf5fa6 100644 --- a/packages/rest/package.json +++ b/packages/rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/rest", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol", "type": "module", diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md index 87dc453f41..c0d841979f 100644 --- a/packages/runtime/CHANGELOG.md +++ b/packages/runtime/CHANGELOG.md @@ -1,5 +1,86 @@ # @objectstack/runtime +## 11.1.0 + +### Minor Changes + +- e011d42: Auth: per-org MFA + dispatcher/MCP gate — complete the ADR-0069 enforced-MFA story + + Two follow-ups that make enforced MFA total: + + - **Per-org `sys_organization.require_mfa`** — an org may require MFA above the global floor. `computeAuthGate` now treats the active org's `require_mfa` as an effective MFA requirement even when the global `mfa_required` is off; `isAuthGateActive()` stays cheap via a 60s-TTL "any org requires MFA" cache (lazy background refresh), so a brand-new per-org requirement activates the gate on the next request without per-request org queries. + - **Dispatcher/MCP gate** — the auth-policy gate now also runs in the runtime dispatcher (after `resolveExecutionContext`), so MCP / GraphQL / embedded data paths enforce `PASSWORD_EXPIRED` / `MFA_REQUIRED` consistently with the REST seam (reusing the shared `evaluateAuthGate` allow-list). Previously only the REST surface (the Console) was gated. + + Default-off / additive. Per ADR-0049 each setting ships with its enforcement. + +### Patch Changes + +- 7087cfe: Remove the unused HTTP framework adapters and the MSW plugin — the open edition ships the **Hono** adapter only. + + The `express` / `fastify` / `nextjs` / `nestjs` / `nuxt` / `sveltekit` adapters and + `@objectstack/plugin-msw` had **zero internal consumers** and were not dogfooded — + pure release/maintenance surface (and an untested-integration liability). They are + removed; `@objectstack/hono` (the adapter actually used, via `@objectstack/client`) + is kept. + + - Deleted packages: `@objectstack/express`, `@objectstack/fastify`, + `@objectstack/nextjs`, `@objectstack/nestjs`, `@objectstack/nuxt`, + `@objectstack/sveltekit`, `@objectstack/plugin-msw` (fixed group 73 → 66). + - `@objectstack/client`: dropped the `plugin-msw` / `msw` dev usage (MSW test removed). + - `HttpDispatcher` (the dispatch engine) is now used only by the Hono adapter + + the internal dispatcher-plugin, so its misleading `@deprecated → createDispatcherPlugin` + note (createDispatcherPlugin is a kernel plugin, not a drop-in) is corrected. + + Anyone needing another framework adapter can build one on the public + `HttpDispatcher` / `createDispatcherPlugin` API or maintain it out-of-tree. + +- 69ae136: docs: align hardening / driver docs with the Hono-only adapter surface (12.0) + + Follow-up to the adapter trim (#2391): the hardening guide's rate-limit/CORS + recipes are rewritten from Fastify to **Hono** (the shipped adapter; the old + `@objectstack/fastify` import was broken), CSRF guidance points at `hono/csrf`, + and stale `@objectstack/plugin-msw` references are dropped from the driver-memory + and driver-turso docs. README framework lists narrowed to Hono. + +- Updated dependencies [574e7a3] +- Updated dependencies [cbc8c02] +- Updated dependencies [18f9713] +- Updated dependencies [7cf81a7] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [8c84c97] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [13dbcf2] +- Updated dependencies [9ccfcd6] +- Updated dependencies [dc2990f] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] +- Updated dependencies [69ae136] + - @objectstack/plugin-security@11.1.0 + - @objectstack/plugin-auth@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/rest@11.1.0 + - @objectstack/objectql@11.1.0 + - @objectstack/observability@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + - @objectstack/driver-memory@11.1.0 + - @objectstack/metadata@11.1.0 + - @objectstack/plugin-org-scoping@11.1.0 + - @objectstack/driver-sql@11.1.0 + - @objectstack/driver-sqlite-wasm@11.1.0 + - @objectstack/service-cluster@11.1.0 + - @objectstack/service-datasource@11.1.0 + - @objectstack/service-i18n@11.1.0 + - @objectstack/formula@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/runtime/package.json b/packages/runtime/package.json index 2f9b4b5b57..e1fc795b76 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/runtime", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "ObjectStack Core Runtime & Query Engine", "type": "module", diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md index 73cd0065b1..748e7da135 100644 --- a/packages/services/service-analytics/CHANGELOG.md +++ b/packages/services/service-analytics/CHANGELOG.md @@ -1,5 +1,18 @@ # Changelog — @objectstack/service-analytics +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json index 902618d091..d83fb7f5b8 100644 --- a/packages/services/service-analytics/package.json +++ b/packages/services/service-analytics/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-analytics", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)", "type": "module", diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md index dd613600f2..32f6bc3a7e 100644 --- a/packages/services/service-automation/CHANGELOG.md +++ b/packages/services/service-automation/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-automation +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/formula@11.1.0 + ## 11.0.0 ### Major Changes diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json index 3ac062494f..522f2a5408 100644 --- a/packages/services/service-automation/package.json +++ b/packages/services/service-automation/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-automation", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine", "type": "module", diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md index d8201751b0..280cc212b0 100644 --- a/packages/services/service-cache/CHANGELOG.md +++ b/packages/services/service-cache/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-cache +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [dc2990f] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/observability@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json index da155fbb69..55fb8e1e7b 100644 --- a/packages/services/service-cache/package.json +++ b/packages/services/service-cache/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cache", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters", "type": "module", diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md index 8518ef52bf..c22bfc090e 100644 --- a/packages/services/service-cluster-redis/CHANGELOG.md +++ b/packages/services/service-cluster-redis/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-cluster-redis +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + - @objectstack/service-cluster@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json index 3f67b9d99a..de61540d88 100644 --- a/packages/services/service-cluster-redis/package.json +++ b/packages/services/service-cluster-redis/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster-redis", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.", "type": "module", diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md index b99fd60db4..e024cbad53 100644 --- a/packages/services/service-cluster/CHANGELOG.md +++ b/packages/services/service-cluster/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-cluster +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json index 54f22a4d6e..e78d3a8d41 100644 --- a/packages/services/service-cluster/package.json +++ b/packages/services/service-cluster/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.", "type": "module", diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md index 87be476644..cabd5665d1 100644 --- a/packages/services/service-datasource/CHANGELOG.md +++ b/packages/services/service-datasource/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-external-datasource +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json index a29a2e16b3..75eaeed168 100644 --- a/packages/services/service-datasource/package.json +++ b/packages/services/service-datasource/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-datasource", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.", "type": "module", diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md index 9424b24790..93ed0181e4 100644 --- a/packages/services/service-i18n/CHANGELOG.md +++ b/packages/services/service-i18n/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-i18n +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json index 4655670082..2882b61e78 100644 --- a/packages/services/service-i18n/package.json +++ b/packages/services/service-i18n/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-i18n", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading", "type": "module", diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md index 88a10c3798..b5efb336fe 100644 --- a/packages/services/service-job/CHANGELOG.md +++ b/packages/services/service-job/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/service-job +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json index 8b02e48840..e9918675bc 100644 --- a/packages/services/service-job/package.json +++ b/packages/services/service-job/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-job", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling", "type": "module", diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md index 5a45989069..60950f676d 100644 --- a/packages/services/service-knowledge/CHANGELOG.md +++ b/packages/services/service-knowledge/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-knowledge +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json index 94824289c8..4769383de0 100644 --- a/packages/services/service-knowledge/package.json +++ b/packages/services/service-knowledge/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-knowledge", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).", "type": "module", diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md index 4b6345bce1..fd4fa1b781 100644 --- a/packages/services/service-messaging/CHANGELOG.md +++ b/packages/services/service-messaging/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-messaging +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json index 698f148dbf..a8e177b5aa 100644 --- a/packages/services/service-messaging/package.json +++ b/packages/services/service-messaging/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-messaging", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.", "type": "module", diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md index f833323cd7..df0eda50f2 100644 --- a/packages/services/service-package/CHANGELOG.md +++ b/packages/services/service-package/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-package +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json index 49dccce183..4de037d7d6 100644 --- a/packages/services/service-package/package.json +++ b/packages/services/service-package/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-package", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Package management service for ObjectStack — publish, install, and manage packages", "type": "module", diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md index 9226ee75ad..76b4f4c7aa 100644 --- a/packages/services/service-queue/CHANGELOG.md +++ b/packages/services/service-queue/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/service-queue +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json index b0599bd2dc..38b261f5ba 100644 --- a/packages/services/service-queue/package.json +++ b/packages/services/service-queue/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-queue", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters", "type": "module", diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md index b5b42c862c..0e30ea98ed 100644 --- a/packages/services/service-realtime/CHANGELOG.md +++ b/packages/services/service-realtime/CHANGELOG.md @@ -1,5 +1,27 @@ # @objectstack/service-realtime +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json index 9d445c2091..0ff2bf72f6 100644 --- a/packages/services/service-realtime/package.json +++ b/packages/services/service-realtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-realtime", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub", "type": "module", diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md index 43d3fabb46..c564ecb2d7 100644 --- a/packages/services/service-settings/CHANGELOG.md +++ b/packages/services/service-settings/CHANGELOG.md @@ -1,5 +1,80 @@ # @objectstack/service-settings +## 11.1.0 + +### Minor Changes + +- ce0b4f6: Auth: password expiry — the session-validation gate (ADR-0069 D1, P1) + + Builds the **authentication-policy session gate** ADR-0069 needs and uses it for password expiry. When `password_expiry_days` (new `auth` setting, 0 = off) is exceeded, an authenticated user is blocked from protected REST resources with `403 PASSWORD_EXPIRED` until they change their password — while auth + remediation paths stay reachable. + + - **core**: new pure `evaluateAuthGate` / `isAuthGateAllowlisted` helper (`@objectstack/core/security`) — single source of truth for the allow-list (auth endpoints, change-password, health, UI-bootstrap reads). + - **plugin-auth**: `customSession` computes the gate posture once and attaches `user.authGate`; `computeAuthGate` reads `sys_user.password_changed_at` vs the configured window; `password_changed_at` is stamped on sign-up / change / reset; `isAuthGateActive()` keeps the gate **zero-overhead** when off. + - **platform-objects**: new `sys_user.password_changed_at` column. + - **rest**: `resolveExecCtx` carries `authGate`; `enforceAuth` blocks gated sessions (independent of `requireAuth`) using the core allow-list. + - **service-settings**: new `password_expiry_days` field. + + Default-off / additive (no upgrade behavior change); a null `password_changed_at` never expires (existing users). Per ADR-0049 the setting ships with its enforcement; timestamps written as `Date` (ADR-0074). + + This gate is the shared seam for **enforced MFA** (ADR-0069 D3), which lands next as a small addition (a second `authGate` branch). The dispatcher/MCP path is a follow-up (tracked in #2375); the REST surface the Console uses is fully gated here. + +- 90bce88: Auth: enforced MFA (ADR-0069 D3, P1) + + Completes the session-validation gate: when `mfa_required` (new `auth` setting) is on, an authenticated user without TOTP enrolled is blocked from protected resources with `403 MFA_REQUIRED` once their `mfa_grace_period_days` (default 7) window elapses — while the two-factor enrollment endpoints stay reachable so they can comply. Reuses the `authGate` seam shipped in #2388 (a second posture branch in `computeAuthGate`). + + - New `auth` settings `mfa_required` (toggle) + `mfa_grace_period_days`; enabling `mfa_required` also force-enables the `twoFactor` plugin so `/two-factor/*` enrollment exists. + - New `sys_user.mfa_required_at` column — the grace clock, stamped lazily the first time a user is seen required-but-unenrolled. + - `isAuthGateActive()` now also trips on `mfa_required` (still zero-overhead when off). + + Default-off / additive (no upgrade behavior change); per ADR-0049 the setting ships with its enforcement. + + **Needs an objectui follow-up**: the Console should handle a `403 MFA_REQUIRED` by showing the TOTP-enrollment prompt. Per-org `sys_organization.require_mfa` and the dispatcher/MCP gate remain follow-ups (#2375). + +- 3209ec6: Auth: session controls — idle timeout, absolute max lifetime, concurrent cap (ADR-0069 D4, P2) + + Adds three `auth` session-control settings (all 0 = off): + + - `session_idle_timeout_minutes` — sign a user out after inactivity. Enforced in `customSession`: touches `sys_session.last_activity_at` (throttled to once a minute) and, once the idle window is exceeded, revokes the session. + - `session_absolute_max_hours` — cap total session lifetime regardless of refresh; revoked once `created_at` is older than the cap. + - `max_concurrent_sessions_per_user` — on sign-in, keep the newest N live sessions and revoke the rest (oldest first). + + Revocation expires the session in place (`expires_at` set to the past + `revoked_at` / `revoke_reason` stamped on new `sys_session` columns), so better-auth returns no session on the next request → the Console's existing 401 → login redirect handles it (no client change). Note: better-auth garbage-collects expired sessions, so the `revoke_reason` audit row is best-effort; the enforcement (session killed) is not. + + Default-off / additive (no upgrade behavior change); per ADR-0049 each setting ships with its enforcement. + +- 8c84c97: Auth: IP allow-list — network gating on the auth routes (ADR-0069 D5, P2) + + Adds an `allowed_ip_ranges` auth setting (CIDR ranges or exact IPs; empty = no restriction). A Hono middleware registered ahead of the better-auth handler in the auth-route registration rejects auth requests from a client IP outside the ranges with `403 IP_NOT_ALLOWED`, before they reach better-auth. + + - Client IP is read trust-proxy-aware from `x-forwarded-for` (first hop) / `cf-connecting-ip` / `x-real-ip`. + - The public render helpers (`/config`, `/bootstrap-status`) are exempt so a blocked client still gets a clean login page + a clear error. + - **Fails OPEN** when the client IP can't be determined (no proxy header), so a misconfigured proxy is a no-op rather than a lockout — an admin enabling this must ensure forwarded headers are trusted. + - IPv4 CIDR (`a.b.c.d/n`) + exact IPv4/IPv6 matching. + + Default-off / additive; per ADR-0049 the setting ships with its enforcement. + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/types@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json index 3746fb2f89..37187b251a 100644 --- a/packages/services/service-settings/package.json +++ b/packages/services/service-settings/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-settings", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.", "type": "module", diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md index b6f92e6484..cec41cd913 100644 --- a/packages/services/service-storage/CHANGELOG.md +++ b/packages/services/service-storage/CHANGELOG.md @@ -1,5 +1,29 @@ # @objectstack/service-storage +## 11.1.0 + +### Patch Changes + +- Updated dependencies [cbc8c02] +- Updated dependencies [07c2773] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [9ccfcd6] +- Updated dependencies [dc2990f] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/platform-objects@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/observability@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json index 100de8adbd..41ddbfdd5e 100644 --- a/packages/services/service-storage/package.json +++ b/packages/services/service-storage/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-storage", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton", "type": "module", diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md index 4ca935127c..314ac99924 100644 --- a/packages/spec/CHANGELOG.md +++ b/packages/spec/CHANGELOG.md @@ -1,5 +1,83 @@ # @objectstack/spec +## 11.1.0 + +### Minor Changes + +- ecf193f: Add `openIn` to `ActionSchema` — a declarative new-tab control for static `type:'url'` actions. + + Counterpart to objectui issue #2043, which added a first-class `openIn?: 'self' | 'new-tab'` + field to its public `ActionSchema` and honors it in `ActionRunner.executeUrl` (read with + priority over the legacy `params.newTab` / external-URL heuristic). Until now + `@objectstack/spec`'s `ActionSchema` was a plain `z.object(...)` that **stripped** unknown + keys, so `openIn` written via `defineAction({...})` was silently dropped at build and never + reached objectui's runtime. Authors (e.g. plan-management) therefore couldn't use it. + + ```ts + defineAction({ + name: "print_a3", + label: "打印总表(A3)", + type: "url", + target: "/print/a3?id=${record.id}", + openIn: "new-tab", // now preserved end-to-end + }); + ``` + + - `openIn: 'new-tab'` — open a **static** `target` URL in a new tab. No handler, no pre-open. + - `openIn: 'self'` — navigate in place. + - omitted — external/absolute URLs open in a new tab; relative URLs navigate in place. + + Kept distinct from the existing `opensInNewTab` / `newTabUrl` (those pre-open an + `about:blank` tab synchronously for **async** SSO-redirect handlers — not merged). It is a + static execution option and must stay OUT of `params` (which is user-input-collection only). + + Consuming projects must upgrade `@objectstack/spec` to this version for the declarative + new-tab path to work end-to-end. + +- 51bec81: Remove a first batch of dead (unenforced, unauthored) metadata properties (#2377, ADR-0049). + + Verified set 0× / read 0× across framework + objectui + cloud + hotcrm + templates, with no test footprint outside `@objectstack/spec`: + + - **field**: `caseSensitive`, `maxRating` + - **object**: `partitioning` (+ `PartitioningConfigSchema`), `defaultDetailForm` + + Liveness ledgers (field/object) updated; api-surface regenerated (drops `PartitioningConfig`/`PartitioningConfigSchema` only). Folded into the 11 line (`minor`). + + The remaining #2377 candidates are deliberately not in this batch: overloaded names (`tags`/`active`/`versioning`/`dependencies`/`index`/…) need per-occurrence handling, and `softDelete` / `measures.certified` turned out to be set in non-spec test fixtures (analytics, mcp) — both deferred. See the issue for the full split. + +- 3e593a7: Remove the deprecated `DriverInterface` type alias — use `IDataDriver` (11.0). + + `DriverInterface` was a `@deprecated` alias of `IDataDriver` (the authoritative + driver contract). It is removed from `@objectstack/spec/contracts` and + `@objectstack/core`; `objectql`'s engine now types drivers as `IDataDriver` + directly (a type-identical change, since the alias _was_ `IDataDriver`). + + Driver authors: replace `DriverInterface` with `IDataDriver` (same shape). + + Note: this is unrelated to the live `IDataEngine` interface (engine-layer + contract, not deprecated) and to the separate zod-derived `DriverInterface` / + `DriverInterfaceSchema` in `@objectstack/spec/data` (the runtime driver schema), + both of which are unchanged. + +- 63d5403: Remove the dead `PolicySchema` / `definePolicy` and the stack `policies` collection (#1882, ADR-0049). + + `PolicySchema` (password / network / session / audit "org security policy") was + **100% unenforced** — no runtime consumer ever read it. Per ADR-0049 + (enforce-or-remove) it is removed rather than implemented: + + - `@objectstack/spec`: delete `security/policy.zod.ts` (`PolicySchema`, + `Password/Network/Session/AuditPolicySchema`, `definePolicy`); drop the + `policies` field from the stack schema and the `policies` collection wiring + (`MAP_SUPPORTED_FIELDS`, `METADATA_ALIASES`). + - `@objectstack/downstream-contract`: drop the `DcPolicy` fixture/case (the + contract gate stays green — `SharingRule` / `PermissionSet` are unaffected). + - Examples (`app-crm`, `app-showcase`): drop their unused policy definitions. + + No migration needed for consumers: `policies` was never enforced. `SharingRule`, + `PermissionSet`, RLS, and all `*PolicySchema` siblings (retry/retention/RLS/etc.) + are unrelated and unchanged. Verified: hotcrm + templates have zero Policy-API + usage; downstream-contract gate green. + ## 11.0.0 ### Major Changes diff --git a/packages/spec/package.json b/packages/spec/package.json index c127f116fa..ae15620f7d 100644 --- a/packages/spec/package.json +++ b/packages/spec/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/spec", - "version": "11.0.0", + "version": "11.1.0", "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md index 3a070493fc..e19d179e55 100644 --- a/packages/triggers/trigger-api/CHANGELOG.md +++ b/packages/triggers/trigger-api/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/trigger-api +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json index cc32656437..9b207e9df7 100644 --- a/packages/triggers/trigger-api/package.json +++ b/packages/triggers/trigger-api/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-api", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md index b3e84b5050..96da6a9d60 100644 --- a/packages/triggers/trigger-record-change/CHANGELOG.md +++ b/packages/triggers/trigger-record-change/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-trigger-record-change +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Minor Changes diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json index eef93f9731..a07c56144f 100644 --- a/packages/triggers/trigger-record-change/package.json +++ b/packages/triggers/trigger-record-change/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-record-change", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md index f5d9aeb4d9..3f5cfd3dc5 100644 --- a/packages/triggers/trigger-schedule/CHANGELOG.md +++ b/packages/triggers/trigger-schedule/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-trigger-schedule +## 11.1.0 + +### Patch Changes + +- Updated dependencies [ce0b4f6] +- Updated dependencies [9ccfcd6] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/core@11.1.0 + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json index 1f234a28af..0789009b93 100644 --- a/packages/triggers/trigger-schedule/package.json +++ b/packages/triggers/trigger-schedule/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-schedule", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)", "main": "dist/index.js", diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md index 9fb003e774..3949b0ee07 100644 --- a/packages/types/CHANGELOG.md +++ b/packages/types/CHANGELOG.md @@ -1,5 +1,34 @@ # @objectstack/types +## 11.1.0 + +### Minor Changes + +- fdb41c0: Remove ObjectStack's own legacy env-var aliases (11.0); ecosystem-standard names stay. + + The framework's renamed env vars no longer accept their old ObjectStack names — + rename them: + + | removed legacy name | use | + | ----------------------------------- | ---------------------- | + | `OS_MULTI_TENANT` | `OS_MULTI_ORG_ENABLED` | + | `OBJECTSTACK_METADATA_WRITABLE` | `OS_METADATA_WRITABLE` | + | `OS_AUTH_BASE_URL`, `AUTH_BASE_URL` | `OS_AUTH_URL` | + + **Ecosystem-standard names are NOT removed** — they remain accepted (and no longer + emit a deprecation warning, since they are permanent conventions, not legacy): + `DATABASE_URL`, `AUTH_SECRET`, `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `PORT`, + `CORS_*`, `LOG_LEVEL`, `ROOT_DOMAIN`, `MCP_SERVER_*`. The generic + `readEnvWithDeprecation` helper is unchanged. + +### Patch Changes + +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [63d5403] + - @objectstack/spec@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/types/package.json b/packages/types/package.json index ed6df8bde7..6f55db78f1 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/types", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Shared interfaces describing the ObjectStack Runtime environment", "main": "dist/index.js", diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md index 485ebdd32c..ec29bdc675 100644 --- a/packages/verify/CHANGELOG.md +++ b/packages/verify/CHANGELOG.md @@ -1,5 +1,47 @@ # @objectstack/verify +## 11.1.0 + +### Patch Changes + +- Updated dependencies [574e7a3] +- Updated dependencies [cbc8c02] +- Updated dependencies [18f9713] +- Updated dependencies [7cf81a7] +- Updated dependencies [d7a88df] +- Updated dependencies [4f8f108] +- Updated dependencies [ce0b4f6] +- Updated dependencies [90bce88] +- Updated dependencies [3209ec6] +- Updated dependencies [8c84c97] +- Updated dependencies [e011d42] +- Updated dependencies [6e5bdd5] +- Updated dependencies [13dbcf2] +- Updated dependencies [9ccfcd6] +- Updated dependencies [dc2990f] +- Updated dependencies [ecf193f] +- Updated dependencies [51bec81] +- Updated dependencies [3e593a7] +- Updated dependencies [fdb41c0] +- Updated dependencies [63d5403] +- Updated dependencies [7087cfe] +- Updated dependencies [69ae136] + - @objectstack/plugin-security@11.1.0 + - @objectstack/plugin-auth@11.1.0 + - @objectstack/core@11.1.0 + - @objectstack/service-settings@11.1.0 + - @objectstack/rest@11.1.0 + - @objectstack/runtime@11.1.0 + - @objectstack/objectql@11.1.0 + - @objectstack/plugin-hono-server@11.1.0 + - @objectstack/spec@11.1.0 + - @objectstack/plugin-org-scoping@11.1.0 + - @objectstack/plugin-sharing@11.1.0 + - @objectstack/driver-sqlite-wasm@11.1.0 + - @objectstack/service-analytics@11.1.0 + - @objectstack/service-automation@11.1.0 + - @objectstack/service-datasource@11.1.0 + ## 11.0.0 ### Patch Changes diff --git a/packages/verify/package.json b/packages/verify/package.json index c16da3aa1b..43f84ce5de 100644 --- a/packages/verify/package.json +++ b/packages/verify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/verify", - "version": "11.0.0", + "version": "11.1.0", "license": "Apache-2.0", "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.", "type": "module", diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md index 951c7adf93..fea4c24981 100644 --- a/packages/vscode-objectstack/CHANGELOG.md +++ b/packages/vscode-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # objectstack-vscode +## 11.1.0 + ## 11.0.0 ## 10.3.0 diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json index 278bb6439d..5fcf36bdb5 100644 --- a/packages/vscode-objectstack/package.json +++ b/packages/vscode-objectstack/package.json @@ -2,7 +2,7 @@ "name": "objectstack-vscode", "displayName": "ObjectStack", "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files", - "version": "11.0.0", + "version": "11.1.0", "publisher": "objectstack", "license": "Apache-2.0", "repository": {