From 286ec771bf3b00f05f83fa3c9ce94d05670c402a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 10 Jul 2026 13:19:41 +0000 Subject: [PATCH] chore: version packages --- .../admin-user-management-and-import.md | 37 ------ .../adr-0090-docs-audience-enforcement.md | 42 ------ .../meta-resync-default-permission-sets.md | 38 ------ ...ectql-defaults-before-beforeinsert-2703.md | 28 ---- .changeset/sms-infrastructure-phone-otp.md | 38 ------ .changeset/xlsx-export-select-colours.md | 30 ----- examples/app-crm/CHANGELOG.md | 10 ++ examples/app-crm/package.json | 2 +- examples/app-showcase/CHANGELOG.md | 14 ++ examples/app-showcase/package.json | 2 +- examples/app-todo/CHANGELOG.md | 18 +++ examples/app-todo/package.json | 2 +- examples/embed-objectql/CHANGELOG.md | 12 ++ examples/embed-objectql/package.json | 2 +- packages/adapters/hono/CHANGELOG.md | 8 ++ packages/adapters/hono/package.json | 2 +- packages/apps/account/CHANGELOG.md | 10 ++ packages/apps/account/package.json | 2 +- packages/apps/setup/CHANGELOG.md | 10 ++ packages/apps/setup/package.json | 2 +- packages/apps/studio/CHANGELOG.md | 10 ++ packages/apps/studio/package.json | 2 +- packages/cli/CHANGELOG.md | 122 ++++++++++++++++++ packages/cli/package.json | 2 +- packages/client-react/CHANGELOG.md | 11 ++ packages/client-react/package.json | 2 +- packages/client/CHANGELOG.md | 10 ++ packages/client/package.json | 2 +- packages/cloud-connection/CHANGELOG.md | 12 ++ packages/cloud-connection/package.json | 2 +- .../connectors/connector-mcp/CHANGELOG.md | 10 ++ .../connectors/connector-mcp/package.json | 2 +- .../connectors/connector-openapi/CHANGELOG.md | 10 ++ .../connectors/connector-openapi/package.json | 2 +- .../connectors/connector-rest/CHANGELOG.md | 10 ++ .../connectors/connector-rest/package.json | 2 +- .../connectors/connector-slack/CHANGELOG.md | 10 ++ .../connectors/connector-slack/package.json | 2 +- packages/console/CHANGELOG.md | 2 + packages/console/package.json | 2 +- packages/core/CHANGELOG.md | 9 ++ packages/core/package.json | 2 +- packages/create-objectstack/CHANGELOG.md | 2 + packages/create-objectstack/package.json | 2 +- packages/dogfood/CHANGELOG.md | 16 +++ packages/dogfood/package.json | 2 +- packages/downstream-contract/CHANGELOG.md | 9 ++ packages/downstream-contract/package.json | 2 +- packages/formula/CHANGELOG.md | 9 ++ packages/formula/package.json | 2 +- packages/lint/CHANGELOG.md | 47 +++++++ packages/lint/package.json | 2 +- packages/mcp/CHANGELOG.md | 11 ++ packages/mcp/package.json | 2 +- packages/metadata-core/CHANGELOG.md | 9 ++ packages/metadata-core/package.json | 2 +- packages/metadata-fs/CHANGELOG.md | 6 + packages/metadata-fs/package.json | 2 +- packages/metadata-protocol/CHANGELOG.md | 13 ++ packages/metadata-protocol/package.json | 2 +- packages/metadata/CHANGELOG.md | 50 +++++++ packages/metadata/package.json | 2 +- packages/objectql/CHANGELOG.md | 39 ++++++ packages/objectql/package.json | 2 +- packages/observability/CHANGELOG.md | 9 ++ packages/observability/package.json | 2 +- packages/platform-objects/CHANGELOG.md | 77 +++++++++++ packages/platform-objects/package.json | 2 +- packages/plugins/driver-memory/CHANGELOG.md | 10 ++ packages/plugins/driver-memory/package.json | 2 +- packages/plugins/driver-mongodb/CHANGELOG.md | 10 ++ packages/plugins/driver-mongodb/package.json | 2 +- packages/plugins/driver-sql/CHANGELOG.md | 11 ++ packages/plugins/driver-sql/package.json | 2 +- .../plugins/driver-sqlite-wasm/CHANGELOG.md | 11 ++ .../plugins/driver-sqlite-wasm/package.json | 2 +- packages/plugins/embedder-openai/CHANGELOG.md | 9 ++ packages/plugins/embedder-openai/package.json | 2 +- .../plugins/knowledge-memory/CHANGELOG.md | 11 ++ .../plugins/knowledge-memory/package.json | 2 +- .../plugins/knowledge-ragflow/CHANGELOG.md | 11 ++ .../plugins/knowledge-ragflow/package.json | 2 +- .../plugins/plugin-approvals/CHANGELOG.md | 13 ++ .../plugins/plugin-approvals/package.json | 2 +- packages/plugins/plugin-audit/CHANGELOG.md | 11 ++ packages/plugins/plugin-audit/package.json | 2 +- packages/plugins/plugin-auth/CHANGELOG.md | 77 +++++++++++ packages/plugins/plugin-auth/package.json | 2 +- packages/plugins/plugin-dev/CHANGELOG.md | 24 ++++ packages/plugins/plugin-dev/package.json | 2 +- packages/plugins/plugin-email/CHANGELOG.md | 12 ++ packages/plugins/plugin-email/package.json | 2 +- .../plugins/plugin-hono-server/CHANGELOG.md | 12 ++ .../plugins/plugin-hono-server/package.json | 2 +- packages/plugins/plugin-reports/CHANGELOG.md | 11 ++ packages/plugins/plugin-reports/package.json | 2 +- packages/plugins/plugin-security/CHANGELOG.md | 82 ++++++++++++ packages/plugins/plugin-security/package.json | 2 +- packages/plugins/plugin-sharing/CHANGELOG.md | 14 ++ packages/plugins/plugin-sharing/package.json | 2 +- packages/plugins/plugin-sms/CHANGELOG.md | 43 ++++++ packages/plugins/plugin-sms/package.json | 2 +- packages/plugins/plugin-webhooks/CHANGELOG.md | 11 ++ packages/plugins/plugin-webhooks/package.json | 2 +- packages/rest/CHANGELOG.md | 107 +++++++++++++++ packages/rest/package.json | 2 +- packages/runtime/CHANGELOG.md | 27 ++++ packages/runtime/package.json | 2 +- packages/sdui-parser/CHANGELOG.md | 2 + packages/sdui-parser/package.json | 2 +- .../services/service-analytics/CHANGELOG.md | 10 ++ .../services/service-analytics/package.json | 2 +- .../services/service-automation/CHANGELOG.md | 11 ++ .../services/service-automation/package.json | 2 +- packages/services/service-cache/CHANGELOG.md | 11 ++ packages/services/service-cache/package.json | 2 +- .../service-cluster-redis/CHANGELOG.md | 10 ++ .../service-cluster-redis/package.json | 2 +- .../services/service-cluster/CHANGELOG.md | 10 ++ .../services/service-cluster/package.json | 2 +- .../services/service-datasource/CHANGELOG.md | 10 ++ .../services/service-datasource/package.json | 2 +- packages/services/service-i18n/CHANGELOG.md | 10 ++ packages/services/service-i18n/package.json | 2 +- packages/services/service-job/CHANGELOG.md | 11 ++ packages/services/service-job/package.json | 2 +- .../services/service-knowledge/CHANGELOG.md | 10 ++ .../services/service-knowledge/package.json | 2 +- .../services/service-messaging/CHANGELOG.md | 42 ++++++ .../services/service-messaging/package.json | 2 +- .../services/service-package/CHANGELOG.md | 10 ++ .../services/service-package/package.json | 2 +- packages/services/service-queue/CHANGELOG.md | 11 ++ packages/services/service-queue/package.json | 2 +- .../services/service-realtime/CHANGELOG.md | 11 ++ .../services/service-realtime/package.json | 2 +- .../services/service-settings/CHANGELOG.md | 44 +++++++ .../services/service-settings/package.json | 2 +- .../services/service-storage/CHANGELOG.md | 12 ++ .../services/service-storage/package.json | 2 +- packages/spec/CHANGELOG.md | 99 ++++++++++++++ packages/spec/package.json | 2 +- packages/triggers/trigger-api/CHANGELOG.md | 10 ++ packages/triggers/trigger-api/package.json | 2 +- .../trigger-record-change/CHANGELOG.md | 10 ++ .../trigger-record-change/package.json | 2 +- .../triggers/trigger-schedule/CHANGELOG.md | 10 ++ .../triggers/trigger-schedule/package.json | 2 +- packages/types/CHANGELOG.md | 9 ++ packages/types/package.json | 2 +- packages/verify/CHANGELOG.md | 25 ++++ packages/verify/package.json | 2 +- packages/vscode-objectstack/CHANGELOG.md | 2 + packages/vscode-objectstack/package.json | 2 +- 154 files changed, 1576 insertions(+), 287 deletions(-) delete mode 100644 .changeset/admin-user-management-and-import.md delete mode 100644 .changeset/adr-0090-docs-audience-enforcement.md delete mode 100644 .changeset/meta-resync-default-permission-sets.md delete mode 100644 .changeset/objectql-defaults-before-beforeinsert-2703.md delete mode 100644 .changeset/sms-infrastructure-phone-otp.md delete mode 100644 .changeset/xlsx-export-select-colours.md create mode 100644 packages/plugins/plugin-sms/CHANGELOG.md diff --git a/.changeset/admin-user-management-and-import.md b/.changeset/admin-user-management-and-import.md deleted file mode 100644 index 1867a14410..0000000000 --- a/.changeset/admin-user-management-and-import.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -"@objectstack/plugin-auth": minor -"@objectstack/platform-objects": minor -"@objectstack/rest": minor -"@objectstack/spec": minor ---- - -feat(auth): admin direct user management, phone sign-in, and identity bulk import (#2766, re-scoped #2758) - -`sys_user` is managed by better-auth and its generic CRUD is suppressed, so -until now the only way to add a teammate was the email-dependent invite flow. -This ships three staged capabilities: - -- **Admin direct user management** — `POST /api/v1/auth/admin/create-user` - and a wrapped `POST /api/v1/auth/admin/set-user-password` (ADR-0068 - platform-admin gate; better-auth pipeline so credentials are real). Optional - generated temporary password (returned once, never persisted or logged) and - a new `sys_user.must_change_password` flag enforced through the ADR-0069 - authGate (`403 PASSWORD_EXPIRED` until the user changes it). New - `create_user` action and upgraded `set_user_password` action on the Users - list — pure schema, no frontend changes. -- **Phone sign-in (opt-in `auth.plugins.phoneNumber`)** — better-auth - phoneNumber plugin, phone+password only (`POST /sign-in/phone-number`); - OTP flows stay off until SMS infrastructure exists. Adds - `sys_user.phone_number` (unique) / `phone_number_verified`. Phone-only - accounts get an undeliverable placeholder email - (`u-@placeholder.invalid`, never derived from the phone number); - all auth mail callbacks refuse placeholder recipients. -- **Identity bulk import** — `POST /api/v1/auth/admin/import-users` accepts - the same payloads as the generic import routes (rows/csv/xlsx, dryRun, - upsert by email or phone) but writes every row through better-auth. - Password policies: `invite` (reset-link email per created user; requires an - EmailService) and `temporary` (per-row one-time passwords + forced change). - Sync only, ≤500 rows per request; no undo; upsert updates touch profile - fields only and can never reset an existing user's password. - `prepareImportRequest` and the CSV/xlsx parsers moved from rest-server.ts - to an exported `import-prepare.ts` module (behavior unchanged). diff --git a/.changeset/adr-0090-docs-audience-enforcement.md b/.changeset/adr-0090-docs-audience-enforcement.md deleted file mode 100644 index ba9ddc6424..0000000000 --- a/.changeset/adr-0090-docs-audience-enforcement.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -'@objectstack/spec': minor -'@objectstack/rest': minor -'@objectstack/plugin-security': minor -'@objectstack/lint': minor -'@objectstack/metadata': minor -'@objectstack/platform-objects': patch ---- - -ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed. - -- **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE - the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security - properties): anonymous callers see only `public` books/docs; - `{ permissionSet }`-gated books require the caller to hold the named set; - a doc's effective audience is the union over the books that CLAIM it - (unclaimed docs default to `org`; orphan rendering never inherits `public`). - Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book` - single-item reads bypass the shared meta cache (per-caller gate vs shared ETag). -- **spec**: new pure helpers powering that gate — `audienceAllows`, - `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs` - (+ `AudienceCaller`/`AudienceBook` types). BREAKING but ships as a `minor` - per the launch-window convention (pre-1.0 semantics — breaking changes do - not burn a major version number while the whole stack is in lockstep): - `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the - registered form (the `position` type had LOST its form layout in the P1 - rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of - retired `roles`/`profiles`. -- **plugin-security**: the `security` service exposes - `resolvePermissionSetNames(ctx)` — the same resolution as data-plane - enforcement, for the docs gate. -- **metadata**: artifact ingestion maps `positions → 'position'` (the stale - `roles → 'role'` mapping matched nothing since the P1 rename, silently - dropping compiled positions from metadata registration). -- **lint**: books join the D3 role-word scan (their `audience` is a - permission-model reference now), and a new advisory rule - `security-book-audience-unknown-set` flags a `{ permissionSet }` audience - naming a set the stack does not declare (runtime fails closed — the typo - cost is "nobody can read the book", so say it at author time). -- **platform-objects**: metadata-form translations regain `position` (all four - locales) and drop the retired `role`/`profile` groups, with a vocabulary - regression test. diff --git a/.changeset/meta-resync-default-permission-sets.md b/.changeset/meta-resync-default-permission-sets.md deleted file mode 100644 index 23d670611f..0000000000 --- a/.changeset/meta-resync-default-permission-sets.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -"@objectstack/plugin-security": minor -"@objectstack/cli": minor ---- - -fix(cli,plugin-security): `os meta resync` to re-materialize default permission sets from dist (#2705) - -The default permission sets (`admin_full_access` / `member_default` / -`viewer_readonly` …) were seeded **insert-once** at boot: `bootstrapPlatformAdmin` -skipped any row that already existed and never wrote the shipped declaration -back. So editing a default set's source, recompiling, and restarting `os dev` -**without** `--fresh` left the runtime serving the OLD value — silently, because -the runtime authz resolver hydrates permission sets from the `sys_permission_set` -row (`resolve-authz-context.ts`), not from the in-memory dist. A permission-gated -surface (e.g. `setup.access`) would keep its stale behavior with no error, which -repeatedly misled debugging. Every *other* metadata seed (declared permission -sets, positions, built-in roles, capabilities) already upserts on boot, leaving -the platform-default path the lone insert-once holdout — a gap ADR-0090 widened -by persisting more facets (`system_permissions`, delegated-admin `admin_scope`) -onto the same row. - -The insert-once posture is deliberate for prod (it protects an admin's Setup -edits and keeps the defaults env-authored — the exact posture -`bootstrapDeclaredPermissions` relies on), so this is **not** switched to a blind -upsert. Instead: - -- `bootstrapPlatformAdmin` gains a `resync` option. Default boot behavior is - unchanged (insert-once). Under `resync`, an existing row is reconciled to the - shipped dist **only** when the platform still owns it (`managed_by` absent or - `'platform'`); a row an admin took over (`managed_by:'user'`) or a package owns - (`'package'`) is an intentional override and is left untouched. -- New `os meta resync` command boots the runtime, reconciles the default - permission-set rows to the compiled dist, and reports what was reconciled / - preserved / newly seeded — **without touching business data** and without a - `--fresh` wipe. Gated behind a confirmation prompt (`--yes` to skip; `--json` - for scripting). - -Prod boot is unaffected; the fix is entirely opt-in via the new command. diff --git a/.changeset/objectql-defaults-before-beforeinsert-2703.md b/.changeset/objectql-defaults-before-beforeinsert-2703.md deleted file mode 100644 index c1b6ee2e5a..0000000000 --- a/.changeset/objectql-defaults-before-beforeinsert-2703.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -'@objectstack/objectql': patch ---- - -fix(data): resolve field `defaultValue`s BEFORE the `beforeInsert` hook (#2703) - -Declarative field defaults (including the `current_user` token) were resolved -by `applyFieldDefaults` *after* the user `beforeInsert` hook ran. A hook that -DERIVED one field from another therefore read a stale `null` for any field that -was about to be defaulted — e.g. `sales_person: Field.user({ defaultValue: -'current_user' })` left `sales_person == null` inside the hook, so a derived -`current_status` computed to `unassigned` unless the client passed the field -explicitly. - -`applyFieldDefaults` now runs at record-initialization time, before -`beforeInsert`, matching the industry-standard order of execution (Salesforce -field defaults / ServiceNow dictionary defaults are populated before before- -triggers; engine-owned generation — autonumber sequences, encryption, timestamps -— stays after the hook). The hook still has final say: it runs after and may -override any defaulted field. Defaults still only fill fields left `undefined`, -so client-supplied values are untouched, and the caller's input object is no -longer mutated in place. - -Behavior note: a `beforeInsert` hook can no longer distinguish "client omitted -field X" from "field X received its default" for fields that declare a -`defaultValue` — the hook now always sees the resolved default. This matches how -Salesforce/ServiceNow behave (before logic sees a fully-initialized record) and -is the intended fix. diff --git a/.changeset/sms-infrastructure-phone-otp.md b/.changeset/sms-infrastructure-phone-otp.md deleted file mode 100644 index 14684bc5bb..0000000000 --- a/.changeset/sms-infrastructure-phone-otp.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -"@objectstack/plugin-sms": minor -"@objectstack/plugin-auth": minor -"@objectstack/service-messaging": minor -"@objectstack/service-settings": minor -"@objectstack/spec": minor -"@objectstack/cli": minor ---- - -feat(messaging/auth): SMS infrastructure + phone-number OTP first-login/reset (#2780) - -#2766 shipped phone+password sign-in but no OTP — the platform had no SMS -delivery capability. This adds the missing infrastructure end to end: - -- **New `@objectstack/plugin-sms`** — `ISmsService`/`ISmsTransport` contracts - (spec) with Aliyun SMS (ACS3-HMAC-SHA256, template-based) and Twilio - transports plus a dev log fallback. Configured through the new `sms` - settings namespace (live provider rebind, encrypted secrets, send-test - action; `OS_SMS_*` env keys win at the resolver). Deliberately NO message - persistence and NO body logging — SMS bodies carry OTP codes. -- **Messaging `sms` channel** — registered at kernel:ready when an `sms` - service is present; `notify(channels:['sms'])` resolves - `sys_user.phone_number`, renders `(topic,'sms',locale)` templates, and - inherits outbox retry/dead-letter. -- **Phone OTP flows open** — the phoneNumber plugin's `sendOTP` / - `sendPasswordResetOTP` now deliver via SMS, enabling - `/phone-number/send-otp` + `/verify` (OTP sign-in/verification) and - `/phone-number/request-password-reset` + `/reset-password` (self-service - reset). Without a deliverable SMS service they keep failing loudly - (NOT_SUPPORTED); `features.phoneNumberOtp` advertises real availability. - Shipped with the abuse hardening: explicit `allowedAttempts: 3`, always-on - per-number cooldown (60s) + rolling-hour cap (5, secondaryStorage-shared - across nodes), `/phone-number/*` in the settings-bound per-IP rate-limit - rules, and OTP codes never reach logs or error messages. -- **Import SMS invites** — `/admin/import-users`'s `invite` policy now - supports phone-only rows: a credential-free invitation SMS points the - employee at phone-OTP first sign-in followed by self-set password; mixed - files validate the reachable channel per row. diff --git a/.changeset/xlsx-export-select-colours.md b/.changeset/xlsx-export-select-colours.md deleted file mode 100644 index 7283f167e9..0000000000 --- a/.changeset/xlsx-export-select-colours.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -"@objectstack/rest": minor ---- - -feat(rest): colour select/radio cells in xlsx exports with their option colour - -The data export route (`GET /data/:object/export`) now carries a select / -radio field's option `color` into the generated Excel workbook as the cell's -**font colour** (white cell background), so an exported sheet reads like the -in-app coloured badges instead of plain black text. csv / json output is -unchanged. - -- `export-format.ts` gains `toArgb()` (hex `#RGB` / `#RRGGBB` → exceljs ARGB - `FFRRGGBB`, `undefined` for anything not plain hex) and `cellFontColor()` - (resolves the matched select/radio option's colour for one cell; returns - `undefined` — i.e. leave it unstyled — for non-option fields, unmatched - values, colourless options, or invalid hex). `ExportFieldMeta.options` now - carries the option `color`. -- `createXlsxStream(res, useStyles)` takes the flag through to exceljs' - `WorkbookWriter`; the route enables styling and sets `cell.font.color` - per-cell only for xlsx. - -Styling is heavier than a bare value dump, so it is gated behind a **10 000-row -cap** (`STYLE_ROW_CAP`): exports whose effective limit exceeds it stream -without colours (all rows intact) and set `X-Export-Styles: dropped`; coloured -exports set `X-Export-Styles: applied`. This mirrors the "formatted export has a -lower ceiling than a raw dump" pattern used by Salesforce / ServiceNow. The -existing 50 000-row hard cap is unchanged. - -Closes #2757. diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md index 3b0992b0bf..84f0b3a7e1 100644 --- a/examples/app-crm/CHANGELOG.md +++ b/examples/app-crm/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/example-crm +## 4.0.81 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/runtime@14.3.0 + ## 4.0.80 ### Patch Changes diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json index 753bd544c0..2d67ac4c9b 100644 --- a/examples/app-crm/package.json +++ b/examples/app-crm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-crm", - "version": "4.0.80", + "version": "4.0.81", "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md index 0759c2377a..763e144f4b 100644 --- a/examples/app-showcase/CHANGELOG.md +++ b/examples/app-showcase/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/example-showcase +## 0.3.3 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/runtime@14.3.0 + - @objectstack/cloud-connection@14.3.0 + - @objectstack/connector-rest@14.3.0 + - @objectstack/connector-slack@14.3.0 + - @objectstack/driver-sql@14.3.0 + ## 0.3.2 ### Patch Changes diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json index 38e2f92cd2..93cdcada31 100644 --- a/examples/app-showcase/package.json +++ b/examples/app-showcase/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-showcase", - "version": "0.3.2", + "version": "0.3.3", "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, analytics). Built for demonstration, debugging, and coverage-driven verification.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md index 3560016b3a..ea221a14c1 100644 --- a/examples/app-todo/CHANGELOG.md +++ b/examples/app-todo/CHANGELOG.md @@ -1,5 +1,23 @@ # @objectstack/example-todo +## 4.0.81 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/metadata@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/runtime@14.3.0 + - @objectstack/client@14.3.0 + - @objectstack/mcp@14.3.0 + - @objectstack/driver-sqlite-wasm@14.3.0 + - @objectstack/knowledge-memory@14.3.0 + - @objectstack/service-knowledge@14.3.0 + ## 4.0.80 ### Patch Changes diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json index 0b1bd7dbb0..dd30acf1f8 100644 --- a/examples/app-todo/package.json +++ b/examples/app-todo/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-todo", - "version": "4.0.80", + "version": "4.0.81", "description": "Example Todo App using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/examples/embed-objectql/CHANGELOG.md b/examples/embed-objectql/CHANGELOG.md index 9944249adb..fdf2392508 100644 --- a/examples/embed-objectql/CHANGELOG.md +++ b/examples/embed-objectql/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/example-embed-objectql +## 0.0.21 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/driver-memory@14.3.0 + ## 0.0.20 ### Patch Changes diff --git a/examples/embed-objectql/package.json b/examples/embed-objectql/package.json index 8a7855a41e..c3c69adde3 100644 --- a/examples/embed-objectql/package.json +++ b/examples/embed-objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-embed-objectql", - "version": "0.0.20", + "version": "0.0.21", "private": true, "description": "Embed the ObjectQL engine as a plain library via @objectstack/objectql/core — no kernel, no plugins, no metadata protocol (ADR-0076).", "type": "module", diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md index f67d61f595..cedd99b3e0 100644 --- a/packages/adapters/hono/CHANGELOG.md +++ b/packages/adapters/hono/CHANGELOG.md @@ -1,5 +1,13 @@ # @objectstack/hono +## 14.3.0 + +### Patch Changes + +- @objectstack/runtime@14.3.0 +- @objectstack/plugin-hono-server@14.3.0 +- @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json index 3dec9d5a91..5f4d3cd97f 100644 --- a/packages/adapters/hono/package.json +++ b/packages/adapters/hono/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/hono", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md index 97fe42d304..ffe79b7e52 100644 --- a/packages/apps/account/CHANGELOG.md +++ b/packages/apps/account/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/account +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json index bcabc3c4bd..37923dad8e 100644 --- a/packages/apps/account/package.json +++ b/packages/apps/account/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/account", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md index 5ab1e67aba..03c3a03d81 100644 --- a/packages/apps/setup/CHANGELOG.md +++ b/packages/apps/setup/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/setup +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json index 210149c549..100335490d 100644 --- a/packages/apps/setup/package.json +++ b/packages/apps/setup/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/setup", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md index 6be4bc4e06..38371b43f6 100644 --- a/packages/apps/studio/CHANGELOG.md +++ b/packages/apps/studio/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/studio +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json index 9277ecba91..7c212fa3f1 100644 --- a/packages/apps/studio/package.json +++ b/packages/apps/studio/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/studio", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 539b3def10..ba098cc9ba 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,127 @@ # @objectstack/cli +## 14.3.0 + +### Minor Changes + +- 8f0b9df: fix(cli,plugin-security): `os meta resync` to re-materialize default permission sets from dist (#2705) + + The default permission sets (`admin_full_access` / `member_default` / + `viewer_readonly` …) were seeded **insert-once** at boot: `bootstrapPlatformAdmin` + skipped any row that already existed and never wrote the shipped declaration + back. So editing a default set's source, recompiling, and restarting `os dev` + **without** `--fresh` left the runtime serving the OLD value — silently, because + the runtime authz resolver hydrates permission sets from the `sys_permission_set` + row (`resolve-authz-context.ts`), not from the in-memory dist. A permission-gated + surface (e.g. `setup.access`) would keep its stale behavior with no error, which + repeatedly misled debugging. Every _other_ metadata seed (declared permission + sets, positions, built-in roles, capabilities) already upserts on boot, leaving + the platform-default path the lone insert-once holdout — a gap ADR-0090 widened + by persisting more facets (`system_permissions`, delegated-admin `admin_scope`) + onto the same row. + + The insert-once posture is deliberate for prod (it protects an admin's Setup + edits and keeps the defaults env-authored — the exact posture + `bootstrapDeclaredPermissions` relies on), so this is **not** switched to a blind + upsert. Instead: + + - `bootstrapPlatformAdmin` gains a `resync` option. Default boot behavior is + unchanged (insert-once). Under `resync`, an existing row is reconciled to the + shipped dist **only** when the platform still owns it (`managed_by` absent or + `'platform'`); a row an admin took over (`managed_by:'user'`) or a package owns + (`'package'`) is an intentional override and is left untouched. + - New `os meta resync` command boots the runtime, reconciles the default + permission-set rows to the compiled dist, and reports what was reconciled / + preserved / newly seeded — **without touching business data** and without a + `--fresh` wipe. Gated behind a confirmation prompt (`--yes` to skip; `--json` + for scripting). + + Prod boot is unaffected; the fix is entirely opt-in via the new command. + +- c1064f1: feat(messaging/auth): SMS infrastructure + phone-number OTP first-login/reset (#2780) + + #2766 shipped phone+password sign-in but no OTP — the platform had no SMS + delivery capability. This adds the missing infrastructure end to end: + + - **New `@objectstack/plugin-sms`** — `ISmsService`/`ISmsTransport` contracts + (spec) with Aliyun SMS (ACS3-HMAC-SHA256, template-based) and Twilio + transports plus a dev log fallback. Configured through the new `sms` + settings namespace (live provider rebind, encrypted secrets, send-test + action; `OS_SMS_*` env keys win at the resolver). Deliberately NO message + persistence and NO body logging — SMS bodies carry OTP codes. + - **Messaging `sms` channel** — registered at kernel:ready when an `sms` + service is present; `notify(channels:['sms'])` resolves + `sys_user.phone_number`, renders `(topic,'sms',locale)` templates, and + inherits outbox retry/dead-letter. + - **Phone OTP flows open** — the phoneNumber plugin's `sendOTP` / + `sendPasswordResetOTP` now deliver via SMS, enabling + `/phone-number/send-otp` + `/verify` (OTP sign-in/verification) and + `/phone-number/request-password-reset` + `/reset-password` (self-service + reset). Without a deliverable SMS service they keep failing loudly + (NOT_SUPPORTED); `features.phoneNumberOtp` advertises real availability. + Shipped with the abuse hardening: explicit `allowedAttempts: 3`, always-on + per-number cooldown (60s) + rolling-hour cap (5, secondaryStorage-shared + across nodes), `/phone-number/*` in the settings-bound per-IP rate-limit + rules, and OTP codes never reach logs or error messages. + - **Import SMS invites** — `/admin/import-users`'s `invite` policy now + supports phone-only rows: a credential-free invitation SMS points the + employee at phone-OTP first sign-in followed by self-set password; mixed + files validate the reachable channel per row. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [8f0b9df] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] +- Updated dependencies [bea4b92] + - @objectstack/plugin-auth@14.3.0 + - @objectstack/platform-objects@14.3.0 + - @objectstack/rest@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/plugin-security@14.3.0 + - @objectstack/lint@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/plugin-sms@14.3.0 + - @objectstack/service-messaging@14.3.0 + - @objectstack/service-settings@14.3.0 + - @objectstack/runtime@14.3.0 + - @objectstack/verify@14.3.0 + - @objectstack/account@14.3.0 + - @objectstack/setup@14.3.0 + - @objectstack/plugin-approvals@14.3.0 + - @objectstack/plugin-audit@14.3.0 + - @objectstack/plugin-email@14.3.0 + - @objectstack/plugin-reports@14.3.0 + - @objectstack/plugin-sharing@14.3.0 + - @objectstack/service-job@14.3.0 + - @objectstack/service-queue@14.3.0 + - @objectstack/service-realtime@14.3.0 + - @objectstack/service-storage@14.3.0 + - @objectstack/client@14.3.0 + - @objectstack/cloud-connection@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + - @objectstack/mcp@14.3.0 + - @objectstack/observability@14.3.0 + - @objectstack/driver-memory@14.3.0 + - @objectstack/driver-mongodb@14.3.0 + - @objectstack/driver-sql@14.3.0 + - @objectstack/driver-sqlite-wasm@14.3.0 + - @objectstack/plugin-hono-server@14.3.0 + - @objectstack/plugin-webhooks@14.3.0 + - @objectstack/service-analytics@14.3.0 + - @objectstack/service-automation@14.3.0 + - @objectstack/service-cache@14.3.0 + - @objectstack/service-datasource@14.3.0 + - @objectstack/service-package@14.3.0 + - @objectstack/trigger-api@14.3.0 + - @objectstack/trigger-record-change@14.3.0 + - @objectstack/trigger-schedule@14.3.0 + - @objectstack/types@14.3.0 + - @objectstack/console@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index f4c3764554..979ff7f2f7 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cli", - "version": "14.2.0", + "version": "14.3.0", "description": "Command Line Interface for ObjectStack Protocol", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md index 41bab9ccb7..86618ce626 100644 --- a/packages/client-react/CHANGELOG.md +++ b/packages/client-react/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/client-react +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/client@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/client-react/package.json b/packages/client-react/package.json index 6f8d469953..cfa2aa45ff 100644 --- a/packages/client-react/package.json +++ b/packages/client-react/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client-react", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "React hooks for ObjectStack Client SDK", "main": "dist/index.js", diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index 9c632c637e..27c014c6e8 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/client +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/client/package.json b/packages/client/package.json index e2c613cf86..40de4615bc 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Official Client SDK for ObjectStack Protocol", "main": "dist/index.js", diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md index d5e9373e42..5b63f440c0 100644 --- a/packages/cloud-connection/CHANGELOG.md +++ b/packages/cloud-connection/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/cloud-connection +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/runtime@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json index 1127f30904..6ea95d93df 100644 --- a/packages/cloud-connection/package.json +++ b/packages/cloud-connection/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cloud-connection", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.", "type": "module", diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md index d9b1e07bfd..e9f9300238 100644 --- a/packages/connectors/connector-mcp/CHANGELOG.md +++ b/packages/connectors/connector-mcp/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/connector-mcp +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json index 9acd5a5d36..e6a3fd2cc2 100644 --- a/packages/connectors/connector-mcp/package.json +++ b/packages/connectors/connector-mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-mcp", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).", "main": "dist/index.js", diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md index 672b6ce350..8a38609c4b 100644 --- a/packages/connectors/connector-openapi/CHANGELOG.md +++ b/packages/connectors/connector-openapi/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/connector-openapi +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json index a21924627f..318242702e 100644 --- a/packages/connectors/connector-openapi/package.json +++ b/packages/connectors/connector-openapi/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-openapi", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).", "main": "dist/index.js", diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md index 3953b1570f..1ad30d8a1e 100644 --- a/packages/connectors/connector-rest/CHANGELOG.md +++ b/packages/connectors/connector-rest/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/connector-rest +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json index 807da896cc..e95666f2dc 100644 --- a/packages/connectors/connector-rest/package.json +++ b/packages/connectors/connector-rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-rest", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).", "main": "dist/index.js", diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md index dd94380cdb..0a8eafeae4 100644 --- a/packages/connectors/connector-slack/CHANGELOG.md +++ b/packages/connectors/connector-slack/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/connector-slack +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json index a7ce638379..2a1541c3c2 100644 --- a/packages/connectors/connector-slack/package.json +++ b/packages/connectors/connector-slack/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-slack", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).", "main": "dist/index.js", diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md index 1fd3a9b9e4..f9f94118dd 100644 --- a/packages/console/CHANGELOG.md +++ b/packages/console/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/console +## 14.3.0 + ## 14.2.0 ## 14.1.0 diff --git a/packages/console/package.json b/packages/console/package.json index ef331e49af..8b9ac2a5e6 100644 --- a/packages/console/package.json +++ b/packages/console/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/console", - "version": "14.2.0", + "version": "14.3.0", "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).", "license": "Apache-2.0", "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index c58aef3a3a..6a1237647d 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/core +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index 6ca9369f48..d7a8323129 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/core", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Microkernel Core for ObjectStack", "type": "module", diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md index 61c867344b..3876d173b3 100644 --- a/packages/create-objectstack/CHANGELOG.md +++ b/packages/create-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # create-objectstack +## 14.3.0 + ## 14.2.0 ## 14.1.0 diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index 7c6af30d9e..ec0b21ed46 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -1,6 +1,6 @@ { "name": "create-objectstack", - "version": "14.2.0", + "version": "14.3.0", "description": "Create a new ObjectStack project — npx create-objectstack", "bin": { "create-objectstack": "./bin/create-objectstack.js" diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md index 74b90b5d8b..c6e76f4267 100644 --- a/packages/dogfood/CHANGELOG.md +++ b/packages/dogfood/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/dogfood +## 0.0.29 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [8f0b9df] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/plugin-security@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/verify@14.3.0 + - @objectstack/example-crm@4.0.81 + - @objectstack/example-showcase@0.3.3 + ## 0.0.28 ### Patch Changes diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json index 7b30151704..8939be652c 100644 --- a/packages/dogfood/package.json +++ b/packages/dogfood/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/dogfood", - "version": "0.0.28", + "version": "0.0.29", "private": true, "license": "Apache-2.0", "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.", diff --git a/packages/downstream-contract/CHANGELOG.md b/packages/downstream-contract/CHANGELOG.md index f353dfd1c4..97d271ac42 100644 --- a/packages/downstream-contract/CHANGELOG.md +++ b/packages/downstream-contract/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/downstream-contract +## 0.0.27 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + ## 0.0.26 ### Patch Changes diff --git a/packages/downstream-contract/package.json b/packages/downstream-contract/package.json index eb38a3c608..a9ee69cfe6 100644 --- a/packages/downstream-contract/package.json +++ b/packages/downstream-contract/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/downstream-contract", - "version": "0.0.26", + "version": "0.0.27", "description": "Frozen third-party consumer fixture — a backward-compatibility gate for @objectstack/spec. Authored the way an external project on a published release authors metadata; if a spec change breaks it, that change is breaking (#2035).", "license": "Apache-2.0", "private": true, diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md index f36055899a..843b508187 100644 --- a/packages/formula/CHANGELOG.md +++ b/packages/formula/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/formula +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/formula/package.json b/packages/formula/package.json index 858f3d0a33..8594294a77 100644 --- a/packages/formula/package.json +++ b/packages/formula/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/formula", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry", "main": "dist/index.js", diff --git a/packages/lint/CHANGELOG.md b/packages/lint/CHANGELOG.md index 4c71ea7466..0ef88355fa 100644 --- a/packages/lint/CHANGELOG.md +++ b/packages/lint/CHANGELOG.md @@ -1,5 +1,52 @@ # @objectstack/lint +## 14.3.0 + +### Minor Changes + +- 02f6af4: ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed. + + - **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE + the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security + properties): anonymous callers see only `public` books/docs; + `{ permissionSet }`-gated books require the caller to hold the named set; + a doc's effective audience is the union over the books that CLAIM it + (unclaimed docs default to `org`; orphan rendering never inherits `public`). + Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book` + single-item reads bypass the shared meta cache (per-caller gate vs shared ETag). + - **spec**: new pure helpers powering that gate — `audienceAllows`, + `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs` + (+ `AudienceCaller`/`AudienceBook` types). BREAKING but ships as a `minor` + per the launch-window convention (pre-1.0 semantics — breaking changes do + not burn a major version number while the whole stack is in lockstep): + `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the + registered form (the `position` type had LOST its form layout in the P1 + rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of + retired `roles`/`profiles`. + - **plugin-security**: the `security` service exposes + `resolvePermissionSetNames(ctx)` — the same resolution as data-plane + enforcement, for the docs gate. + - **metadata**: artifact ingestion maps `positions → 'position'` (the stale + `roles → 'role'` mapping matched nothing since the P1 rename, silently + dropping compiled positions from metadata registration). + - **lint**: books join the D3 role-word scan (their `audience` is a + permission-model reference now), and a new advisory rule + `security-book-audience-unknown-set` flags a `{ permissionSet }` audience + naming a set the stack does not declare (runtime fails closed — the typo + cost is "nobody can read the book", so say it at author time). + - **platform-objects**: metadata-form translations regain `position` (all four + locales) and drop the retired `role`/`profile` groups, with a vocabulary + regression test. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/formula@14.3.0 + - @objectstack/sdui-parser@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/lint/package.json b/packages/lint/package.json index 0971a62f19..b170ef99d2 100644 --- a/packages/lint/package.json +++ b/packages/lint/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/lint", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Static, build-time validation for an ObjectStack metadata graph — dashboard widget bindings, CEL/predicate expressions, and more. Pure (stack) => Issue[] functions shared by the CLI's `os validate` and any other consumer (e.g. AI authoring). Depends on @objectstack/spec; never on a runtime.", "type": "module", diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md index ec0d6e15ea..e4b1e7c7c7 100644 --- a/packages/mcp/CHANGELOG.md +++ b/packages/mcp/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/plugin-mcp-server +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/mcp/package.json b/packages/mcp/package.json index ba76435d69..5e483804b3 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/mcp", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)", "type": "module", diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md index 4591f955d4..223e3bfc0e 100644 --- a/packages/metadata-core/CHANGELOG.md +++ b/packages/metadata-core/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/metadata-core +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json index 8d312a00d1..5248dcd80d 100644 --- a/packages/metadata-core/package.json +++ b/packages/metadata-core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-core", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).", "type": "module", diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md index a5f96ca1fc..512af58fc8 100644 --- a/packages/metadata-fs/CHANGELOG.md +++ b/packages/metadata-fs/CHANGELOG.md @@ -1,5 +1,11 @@ # @objectstack/metadata-fs +## 14.3.0 + +### Patch Changes + +- @objectstack/metadata-core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json index 1701b28f86..1d1ccc5c94 100644 --- a/packages/metadata-fs/package.json +++ b/packages/metadata-fs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-fs", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).", "type": "module", diff --git a/packages/metadata-protocol/CHANGELOG.md b/packages/metadata-protocol/CHANGELOG.md index 26872b4f63..7d4d6e7888 100644 --- a/packages/metadata-protocol/CHANGELOG.md +++ b/packages/metadata-protocol/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/metadata-protocol +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + - @objectstack/metadata-core@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/metadata-protocol/package.json b/packages/metadata-protocol/package.json index e0d2420dab..a0d38dbcbd 100644 --- a/packages/metadata-protocol/package.json +++ b/packages/metadata-protocol/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-protocol", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack metadata management protocol: sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics (ADR-0076).", "type": "module", diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md index 9660e0ab8e..5c7231c716 100644 --- a/packages/metadata/CHANGELOG.md +++ b/packages/metadata/CHANGELOG.md @@ -1,5 +1,55 @@ # @objectstack/metadata +## 14.3.0 + +### Minor Changes + +- 02f6af4: ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed. + + - **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE + the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security + properties): anonymous callers see only `public` books/docs; + `{ permissionSet }`-gated books require the caller to hold the named set; + a doc's effective audience is the union over the books that CLAIM it + (unclaimed docs default to `org`; orphan rendering never inherits `public`). + Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book` + single-item reads bypass the shared meta cache (per-caller gate vs shared ETag). + - **spec**: new pure helpers powering that gate — `audienceAllows`, + `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs` + (+ `AudienceCaller`/`AudienceBook` types). BREAKING but ships as a `minor` + per the launch-window convention (pre-1.0 semantics — breaking changes do + not burn a major version number while the whole stack is in lockstep): + `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the + registered form (the `position` type had LOST its form layout in the P1 + rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of + retired `roles`/`profiles`. + - **plugin-security**: the `security` service exposes + `resolvePermissionSetNames(ctx)` — the same resolution as data-plane + enforcement, for the docs gate. + - **metadata**: artifact ingestion maps `positions → 'position'` (the stale + `roles → 'role'` mapping matched nothing since the P1 rename, silently + dropping compiled positions from metadata registration). + - **lint**: books join the D3 role-word scan (their `audience` is a + permission-model reference now), and a new advisory rule + `security-book-audience-unknown-set` flags a `{ permissionSet }` audience + naming a set the stack does not declare (runtime fails closed — the typo + cost is "nobody can read the book", so say it at author time). + - **platform-objects**: metadata-form translations regain `position` (all four + locales) and drop the retired `role`/`profile` groups, with a vocabulary + regression test. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/metadata-core@14.3.0 + - @objectstack/types@14.3.0 + - @objectstack/metadata-fs@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/metadata/package.json b/packages/metadata/package.json index 8968c8dc8f..5dfe38efdd 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Metadata loading, saving, and persistence for ObjectStack", "type": "module", diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md index c912e4e00e..ec1aeaf6f4 100644 --- a/packages/objectql/CHANGELOG.md +++ b/packages/objectql/CHANGELOG.md @@ -1,5 +1,44 @@ # @objectstack/objectql +## 14.3.0 + +### Patch Changes + +- ff648ad: fix(data): resolve field `defaultValue`s BEFORE the `beforeInsert` hook (#2703) + + Declarative field defaults (including the `current_user` token) were resolved + by `applyFieldDefaults` _after_ the user `beforeInsert` hook ran. A hook that + DERIVED one field from another therefore read a stale `null` for any field that + was about to be defaulted — e.g. `sales_person: Field.user({ defaultValue: +'current_user' })` left `sales_person == null` inside the hook, so a derived + `current_status` computed to `unassigned` unless the client passed the field + explicitly. + + `applyFieldDefaults` now runs at record-initialization time, before + `beforeInsert`, matching the industry-standard order of execution (Salesforce + field defaults / ServiceNow dictionary defaults are populated before before- + triggers; engine-owned generation — autonumber sequences, encryption, timestamps + — stays after the hook). The hook still has final say: it runs after and may + override any defaulted field. Defaults still only fill fields left `undefined`, + so client-supplied values are untouched, and the caller's input object is no + longer mutated in place. + + Behavior note: a `beforeInsert` hook can no longer distinguish "client omitted + field X" from "field X received its default" for fields that declare a + `defaultValue` — the hook now always sees the resolved default. This matches how + Salesforce/ServiceNow behave (before logic sees a fully-initialized record) and + is the intended fix. + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + - @objectstack/metadata-core@14.3.0 + - @objectstack/metadata-protocol@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/objectql/package.json b/packages/objectql/package.json index 8f871e2fba..d35b3acb27 100644 --- a/packages/objectql/package.json +++ b/packages/objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/objectql", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Isomorphic ObjectQL Engine for ObjectStack", "main": "dist/index.js", diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md index bc00533725..997b148568 100644 --- a/packages/observability/CHANGELOG.md +++ b/packages/observability/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/observability +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/observability/package.json b/packages/observability/package.json index b292397ed8..d30d3c98d4 100644 --- a/packages/observability/package.json +++ b/packages/observability/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/observability", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.", "type": "module", diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md index 00cb5acebf..1963a83dab 100644 --- a/packages/platform-objects/CHANGELOG.md +++ b/packages/platform-objects/CHANGELOG.md @@ -1,5 +1,82 @@ # @objectstack/platform-objects +## 14.3.0 + +### Minor Changes + +- 2a71f48: feat(auth): admin direct user management, phone sign-in, and identity bulk import (#2766, re-scoped #2758) + + `sys_user` is managed by better-auth and its generic CRUD is suppressed, so + until now the only way to add a teammate was the email-dependent invite flow. + This ships three staged capabilities: + + - **Admin direct user management** — `POST /api/v1/auth/admin/create-user` + and a wrapped `POST /api/v1/auth/admin/set-user-password` (ADR-0068 + platform-admin gate; better-auth pipeline so credentials are real). Optional + generated temporary password (returned once, never persisted or logged) and + a new `sys_user.must_change_password` flag enforced through the ADR-0069 + authGate (`403 PASSWORD_EXPIRED` until the user changes it). New + `create_user` action and upgraded `set_user_password` action on the Users + list — pure schema, no frontend changes. + - **Phone sign-in (opt-in `auth.plugins.phoneNumber`)** — better-auth + phoneNumber plugin, phone+password only (`POST /sign-in/phone-number`); + OTP flows stay off until SMS infrastructure exists. Adds + `sys_user.phone_number` (unique) / `phone_number_verified`. Phone-only + accounts get an undeliverable placeholder email + (`u-@placeholder.invalid`, never derived from the phone number); + all auth mail callbacks refuse placeholder recipients. + - **Identity bulk import** — `POST /api/v1/auth/admin/import-users` accepts + the same payloads as the generic import routes (rows/csv/xlsx, dryRun, + upsert by email or phone) but writes every row through better-auth. + Password policies: `invite` (reset-link email per created user; requires an + EmailService) and `temporary` (per-row one-time passwords + forced change). + Sync only, ≤500 rows per request; no undo; upsert updates touch profile + fields only and can never reset an existing user's password. + `prepareImportRequest` and the CSV/xlsx parsers moved from rest-server.ts + to an exported `import-prepare.ts` module (behavior unchanged). + +### Patch Changes + +- 02f6af4: ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed. + + - **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE + the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security + properties): anonymous callers see only `public` books/docs; + `{ permissionSet }`-gated books require the caller to hold the named set; + a doc's effective audience is the union over the books that CLAIM it + (unclaimed docs default to `org`; orphan rendering never inherits `public`). + Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book` + single-item reads bypass the shared meta cache (per-caller gate vs shared ETag). + - **spec**: new pure helpers powering that gate — `audienceAllows`, + `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs` + (+ `AudienceCaller`/`AudienceBook` types). BREAKING but ships as a `minor` + per the launch-window convention (pre-1.0 semantics — breaking changes do + not burn a major version number while the whole stack is in lockstep): + `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the + registered form (the `position` type had LOST its form layout in the P1 + rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of + retired `roles`/`profiles`. + - **plugin-security**: the `security` service exposes + `resolvePermissionSetNames(ctx)` — the same resolution as data-plane + enforcement, for the docs gate. + - **metadata**: artifact ingestion maps `positions → 'position'` (the stale + `roles → 'role'` mapping matched nothing since the P1 rename, silently + dropping compiled positions from metadata registration). + - **lint**: books join the D3 role-word scan (their `audience` is a + permission-model reference now), and a new advisory rule + `security-book-audience-unknown-set` flags a `{ permissionSet }` audience + naming a set the stack does not declare (runtime fails closed — the typo + cost is "nobody can read the book", so say it at author time). + - **platform-objects**: metadata-form translations regain `position` (all four + locales) and drop the retired `role`/`profile` groups, with a vocabulary + regression test. + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/metadata-core@14.3.0 + ## 14.2.0 ### Minor Changes diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json index a8f049312b..5bfd0bd4fa 100644 --- a/packages/platform-objects/package.json +++ b/packages/platform-objects/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/platform-objects", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects", "main": "dist/index.js", diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md index 98c629e045..a01e6a9d0e 100644 --- a/packages/plugins/driver-memory/CHANGELOG.md +++ b/packages/plugins/driver-memory/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/driver-memory +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json index d939ca5f6b..576e24f98c 100644 --- a/packages/plugins/driver-memory/package.json +++ b/packages/plugins/driver-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-memory", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "In-Memory Driver for ObjectStack (Reference Implementation)", "main": "dist/index.js", diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md index e21e8aac80..c047128c76 100644 --- a/packages/plugins/driver-mongodb/CHANGELOG.md +++ b/packages/plugins/driver-mongodb/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/driver-mongodb +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json index 00f1f27ab5..0e2b54007c 100644 --- a/packages/plugins/driver-mongodb/package.json +++ b/packages/plugins/driver-mongodb/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-mongodb", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client", "main": "dist/index.js", diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md index 4e993e10ef..ecc4fe8d64 100644 --- a/packages/plugins/driver-sql/CHANGELOG.md +++ b/packages/plugins/driver-sql/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/driver-sql +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json index f0b949f93a..157fdac356 100644 --- a/packages/plugins/driver-sql/package.json +++ b/packages/plugins/driver-sql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sql", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex", "main": "dist/index.js", diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md index c78b047e1f..73e9eca276 100644 --- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md +++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/driver-sqlite-wasm +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/driver-sql@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json index 289dc84efd..0e8689445a 100644 --- a/packages/plugins/driver-sqlite-wasm/package.json +++ b/packages/plugins/driver-sqlite-wasm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sqlite-wasm", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings", "keywords": [ diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md index 250cd99bee..2d2d79048b 100644 --- a/packages/plugins/embedder-openai/CHANGELOG.md +++ b/packages/plugins/embedder-openai/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/embedder-openai +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json index c9234b75da..c414db18d1 100644 --- a/packages/plugins/embedder-openai/package.json +++ b/packages/plugins/embedder-openai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/embedder-openai", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md index 091cb5e3b0..b1cba57cc0 100644 --- a/packages/plugins/knowledge-memory/CHANGELOG.md +++ b/packages/plugins/knowledge-memory/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/knowledge-memory +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/service-knowledge@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json index bf669e2cff..98e43976cc 100644 --- a/packages/plugins/knowledge-memory/package.json +++ b/packages/plugins/knowledge-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-memory", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md index 9a4b1bec77..b65d55de7c 100644 --- a/packages/plugins/knowledge-ragflow/CHANGELOG.md +++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/knowledge-ragflow +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/service-knowledge@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json index 8a2f5c59ed..520d65014c 100644 --- a/packages/plugins/knowledge-ragflow/package.json +++ b/packages/plugins/knowledge-ragflow/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-ragflow", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md index a1da762949..c84457c84b 100644 --- a/packages/plugins/plugin-approvals/CHANGELOG.md +++ b/packages/plugins/plugin-approvals/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-approvals +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + - @objectstack/metadata-core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json index 838069577e..cb8a706d2f 100644 --- a/packages/plugins/plugin-approvals/package.json +++ b/packages/plugins/plugin-approvals/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-approvals", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md index f3d5560cb2..05f30ab8b9 100644 --- a/packages/plugins/plugin-audit/CHANGELOG.md +++ b/packages/plugins/plugin-audit/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/plugin-audit +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json index 7cfb3ea822..6772a705a5 100644 --- a/packages/plugins/plugin-audit/package.json +++ b/packages/plugins/plugin-audit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-audit", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Audit Plugin for ObjectStack — System audit log object and audit trail", "main": "dist/index.js", diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md index 4be1e2e535..01ae8d172b 100644 --- a/packages/plugins/plugin-auth/CHANGELOG.md +++ b/packages/plugins/plugin-auth/CHANGELOG.md @@ -1,5 +1,82 @@ # Changelog +## 14.3.0 + +### Minor Changes + +- 2a71f48: feat(auth): admin direct user management, phone sign-in, and identity bulk import (#2766, re-scoped #2758) + + `sys_user` is managed by better-auth and its generic CRUD is suppressed, so + until now the only way to add a teammate was the email-dependent invite flow. + This ships three staged capabilities: + + - **Admin direct user management** — `POST /api/v1/auth/admin/create-user` + and a wrapped `POST /api/v1/auth/admin/set-user-password` (ADR-0068 + platform-admin gate; better-auth pipeline so credentials are real). Optional + generated temporary password (returned once, never persisted or logged) and + a new `sys_user.must_change_password` flag enforced through the ADR-0069 + authGate (`403 PASSWORD_EXPIRED` until the user changes it). New + `create_user` action and upgraded `set_user_password` action on the Users + list — pure schema, no frontend changes. + - **Phone sign-in (opt-in `auth.plugins.phoneNumber`)** — better-auth + phoneNumber plugin, phone+password only (`POST /sign-in/phone-number`); + OTP flows stay off until SMS infrastructure exists. Adds + `sys_user.phone_number` (unique) / `phone_number_verified`. Phone-only + accounts get an undeliverable placeholder email + (`u-@placeholder.invalid`, never derived from the phone number); + all auth mail callbacks refuse placeholder recipients. + - **Identity bulk import** — `POST /api/v1/auth/admin/import-users` accepts + the same payloads as the generic import routes (rows/csv/xlsx, dryRun, + upsert by email or phone) but writes every row through better-auth. + Password policies: `invite` (reset-link email per created user; requires an + EmailService) and `temporary` (per-row one-time passwords + forced change). + Sync only, ≤500 rows per request; no undo; upsert updates touch profile + fields only and can never reset an existing user's password. + `prepareImportRequest` and the CSV/xlsx parsers moved from rest-server.ts + to an exported `import-prepare.ts` module (behavior unchanged). + +- c1064f1: feat(messaging/auth): SMS infrastructure + phone-number OTP first-login/reset (#2780) + + #2766 shipped phone+password sign-in but no OTP — the platform had no SMS + delivery capability. This adds the missing infrastructure end to end: + + - **New `@objectstack/plugin-sms`** — `ISmsService`/`ISmsTransport` contracts + (spec) with Aliyun SMS (ACS3-HMAC-SHA256, template-based) and Twilio + transports plus a dev log fallback. Configured through the new `sms` + settings namespace (live provider rebind, encrypted secrets, send-test + action; `OS_SMS_*` env keys win at the resolver). Deliberately NO message + persistence and NO body logging — SMS bodies carry OTP codes. + - **Messaging `sms` channel** — registered at kernel:ready when an `sms` + service is present; `notify(channels:['sms'])` resolves + `sys_user.phone_number`, renders `(topic,'sms',locale)` templates, and + inherits outbox retry/dead-letter. + - **Phone OTP flows open** — the phoneNumber plugin's `sendOTP` / + `sendPasswordResetOTP` now deliver via SMS, enabling + `/phone-number/send-otp` + `/verify` (OTP sign-in/verification) and + `/phone-number/request-password-reset` + `/reset-password` (self-service + reset). Without a deliverable SMS service they keep failing loudly + (NOT_SUPPORTED); `features.phoneNumberOtp` advertises real availability. + Shipped with the abuse hardening: explicit `allowedAttempts: 3`, always-on + per-number cooldown (60s) + rolling-hour cap (5, secondaryStorage-shared + across nodes), `/phone-number/*` in the settings-bound per-IP rate-limit + rules, and OTP codes never reach logs or error messages. + - **Import SMS invites** — `/admin/import-users`'s `invite` policy now + supports phone-only rows: a credential-free invitation SMS points the + employee at phone-OTP first sign-in followed by self-set password; mixed + files validate the reachable channel per row. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] +- Updated dependencies [bea4b92] + - @objectstack/platform-objects@14.3.0 + - @objectstack/rest@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index 01ad5e5948..97e6b9b3d0 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-auth", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Authentication & Identity Plugin for ObjectStack", "main": "dist/index.js", diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md index c69f21f9c1..27a80dc6c9 100644 --- a/packages/plugins/plugin-dev/CHANGELOG.md +++ b/packages/plugins/plugin-dev/CHANGELOG.md @@ -1,5 +1,29 @@ # @objectstack/plugin-dev +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [8f0b9df] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] +- Updated dependencies [bea4b92] + - @objectstack/plugin-auth@14.3.0 + - @objectstack/rest@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/plugin-security@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/runtime@14.3.0 + - @objectstack/account@14.3.0 + - @objectstack/setup@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/driver-memory@14.3.0 + - @objectstack/plugin-hono-server@14.3.0 + - @objectstack/service-i18n@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json index 13791d8a09..f604106d49 100644 --- a/packages/plugins/plugin-dev/package.json +++ b/packages/plugins/plugin-dev/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-dev", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations", "main": "dist/index.js", diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md index 803c28f923..6981499501 100644 --- a/packages/plugins/plugin-email/CHANGELOG.md +++ b/packages/plugins/plugin-email/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/plugin-email +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json index e451401c7d..f6e1928db5 100644 --- a/packages/plugins/plugin-email/package.json +++ b/packages/plugins/plugin-email/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-email", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md index 2e516cabf4..65cf5657bd 100644 --- a/packages/plugins/plugin-hono-server/CHANGELOG.md +++ b/packages/plugins/plugin-hono-server/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/plugin-hono-server +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/observability@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json index 7fd0908171..d2d8790b68 100644 --- a/packages/plugins/plugin-hono-server/package.json +++ b/packages/plugins/plugin-hono-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-hono-server", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Standard Hono Server Adapter for ObjectStack Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md index b48052b805..b730a5ffd3 100644 --- a/packages/plugins/plugin-reports/CHANGELOG.md +++ b/packages/plugins/plugin-reports/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/plugin-reports +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json index 2b8e3a344f..1126667f74 100644 --- a/packages/plugins/plugin-reports/package.json +++ b/packages/plugins/plugin-reports/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-reports", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md index 8b8408ad02..83fc81474b 100644 --- a/packages/plugins/plugin-security/CHANGELOG.md +++ b/packages/plugins/plugin-security/CHANGELOG.md @@ -1,5 +1,87 @@ # @objectstack/plugin-security +## 14.3.0 + +### Minor Changes + +- 02f6af4: ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed. + + - **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE + the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security + properties): anonymous callers see only `public` books/docs; + `{ permissionSet }`-gated books require the caller to hold the named set; + a doc's effective audience is the union over the books that CLAIM it + (unclaimed docs default to `org`; orphan rendering never inherits `public`). + Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book` + single-item reads bypass the shared meta cache (per-caller gate vs shared ETag). + - **spec**: new pure helpers powering that gate — `audienceAllows`, + `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs` + (+ `AudienceCaller`/`AudienceBook` types). BREAKING but ships as a `minor` + per the launch-window convention (pre-1.0 semantics — breaking changes do + not burn a major version number while the whole stack is in lockstep): + `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the + registered form (the `position` type had LOST its form layout in the P1 + rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of + retired `roles`/`profiles`. + - **plugin-security**: the `security` service exposes + `resolvePermissionSetNames(ctx)` — the same resolution as data-plane + enforcement, for the docs gate. + - **metadata**: artifact ingestion maps `positions → 'position'` (the stale + `roles → 'role'` mapping matched nothing since the P1 rename, silently + dropping compiled positions from metadata registration). + - **lint**: books join the D3 role-word scan (their `audience` is a + permission-model reference now), and a new advisory rule + `security-book-audience-unknown-set` flags a `{ permissionSet }` audience + naming a set the stack does not declare (runtime fails closed — the typo + cost is "nobody can read the book", so say it at author time). + - **platform-objects**: metadata-form translations regain `position` (all four + locales) and drop the retired `role`/`profile` groups, with a vocabulary + regression test. + +- 8f0b9df: fix(cli,plugin-security): `os meta resync` to re-materialize default permission sets from dist (#2705) + + The default permission sets (`admin_full_access` / `member_default` / + `viewer_readonly` …) were seeded **insert-once** at boot: `bootstrapPlatformAdmin` + skipped any row that already existed and never wrote the shipped declaration + back. So editing a default set's source, recompiling, and restarting `os dev` + **without** `--fresh` left the runtime serving the OLD value — silently, because + the runtime authz resolver hydrates permission sets from the `sys_permission_set` + row (`resolve-authz-context.ts`), not from the in-memory dist. A permission-gated + surface (e.g. `setup.access`) would keep its stale behavior with no error, which + repeatedly misled debugging. Every _other_ metadata seed (declared permission + sets, positions, built-in roles, capabilities) already upserts on boot, leaving + the platform-default path the lone insert-once holdout — a gap ADR-0090 widened + by persisting more facets (`system_permissions`, delegated-admin `admin_scope`) + onto the same row. + + The insert-once posture is deliberate for prod (it protects an admin's Setup + edits and keeps the defaults env-authored — the exact posture + `bootstrapDeclaredPermissions` relies on), so this is **not** switched to a blind + upsert. Instead: + + - `bootstrapPlatformAdmin` gains a `resync` option. Default boot behavior is + unchanged (insert-once). Under `resync`, an existing row is reconciled to the + shipped dist **only** when the platform still owns it (`managed_by` absent or + `'platform'`); a row an admin took over (`managed_by:'user'`) or a package owns + (`'package'`) is an intentional override and is left untouched. + - New `os meta resync` command boots the runtime, reconciles the default + permission-set rows to the compiled dist, and reports what was reconciled / + preserved / newly seeded — **without touching business data** and without a + `--fresh` wipe. Gated behind a confirmation prompt (`--yes` to skip; `--json` + for scripting). + + Prod boot is unaffected; the fix is entirely opt-in via the new command. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + ## 14.2.0 ### Minor Changes diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json index c2d3f6d1f2..8c38a79770 100644 --- a/packages/plugins/plugin-security/package.json +++ b/packages/plugins/plugin-security/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-security", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md index 8f9e23f193..0f5c26d223 100644 --- a/packages/plugins/plugin-sharing/CHANGELOG.md +++ b/packages/plugins/plugin-sharing/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-sharing +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json index 036f87e2f9..7a1bcc9178 100644 --- a/packages/plugins/plugin-sharing/package.json +++ b/packages/plugins/plugin-sharing/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sharing", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sms/CHANGELOG.md b/packages/plugins/plugin-sms/CHANGELOG.md new file mode 100644 index 0000000000..9ee02ced3c --- /dev/null +++ b/packages/plugins/plugin-sms/CHANGELOG.md @@ -0,0 +1,43 @@ +# @objectstack/plugin-sms + +## 14.3.0 + +### Minor Changes + +- c1064f1: feat(messaging/auth): SMS infrastructure + phone-number OTP first-login/reset (#2780) + + #2766 shipped phone+password sign-in but no OTP — the platform had no SMS + delivery capability. This adds the missing infrastructure end to end: + + - **New `@objectstack/plugin-sms`** — `ISmsService`/`ISmsTransport` contracts + (spec) with Aliyun SMS (ACS3-HMAC-SHA256, template-based) and Twilio + transports plus a dev log fallback. Configured through the new `sms` + settings namespace (live provider rebind, encrypted secrets, send-test + action; `OS_SMS_*` env keys win at the resolver). Deliberately NO message + persistence and NO body logging — SMS bodies carry OTP codes. + - **Messaging `sms` channel** — registered at kernel:ready when an `sms` + service is present; `notify(channels:['sms'])` resolves + `sys_user.phone_number`, renders `(topic,'sms',locale)` templates, and + inherits outbox retry/dead-letter. + - **Phone OTP flows open** — the phoneNumber plugin's `sendOTP` / + `sendPasswordResetOTP` now deliver via SMS, enabling + `/phone-number/send-otp` + `/verify` (OTP sign-in/verification) and + `/phone-number/request-password-reset` + `/reset-password` (self-service + reset). Without a deliverable SMS service they keep failing loudly + (NOT_SUPPORTED); `features.phoneNumberOtp` advertises real availability. + Shipped with the abuse hardening: explicit `allowedAttempts: 3`, always-on + per-number cooldown (60s) + rolling-hour cap (5, secondaryStorage-shared + across nodes), `/phone-number/*` in the settings-bound per-IP rate-limit + rules, and OTP codes never reach logs or error messages. + - **Import SMS invites** — `/admin/import-users`'s `invite` policy now + supports phone-only rows: a credential-free invitation SMS points the + employee at phone-OTP first sign-in followed by self-set password; mixed + files validate the reachable channel per row. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 diff --git a/packages/plugins/plugin-sms/package.json b/packages/plugins/plugin-sms/package.json index ba97409383..df9133a76c 100644 --- a/packages/plugins/plugin-sms/package.json +++ b/packages/plugins/plugin-sms/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sms", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "SMS service plugin for ObjectStack — ISmsService + transport-pluggable outbound delivery (Aliyun / Twilio / log).", "main": "dist/index.js", diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md index 48d0d76e95..5b971b5ae7 100644 --- a/packages/plugins/plugin-webhooks/CHANGELOG.md +++ b/packages/plugins/plugin-webhooks/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/plugin-webhooks +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/service-messaging@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json index 27da41f081..14b45dbb94 100644 --- a/packages/plugins/plugin-webhooks/package.json +++ b/packages/plugins/plugin-webhooks/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-webhooks", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.", "type": "module", diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md index d5b5d5bde1..aa0003eead 100644 --- a/packages/rest/CHANGELOG.md +++ b/packages/rest/CHANGELOG.md @@ -1,5 +1,112 @@ # @objectstack/rest +## 14.3.0 + +### Minor Changes + +- 2a71f48: feat(auth): admin direct user management, phone sign-in, and identity bulk import (#2766, re-scoped #2758) + + `sys_user` is managed by better-auth and its generic CRUD is suppressed, so + until now the only way to add a teammate was the email-dependent invite flow. + This ships three staged capabilities: + + - **Admin direct user management** — `POST /api/v1/auth/admin/create-user` + and a wrapped `POST /api/v1/auth/admin/set-user-password` (ADR-0068 + platform-admin gate; better-auth pipeline so credentials are real). Optional + generated temporary password (returned once, never persisted or logged) and + a new `sys_user.must_change_password` flag enforced through the ADR-0069 + authGate (`403 PASSWORD_EXPIRED` until the user changes it). New + `create_user` action and upgraded `set_user_password` action on the Users + list — pure schema, no frontend changes. + - **Phone sign-in (opt-in `auth.plugins.phoneNumber`)** — better-auth + phoneNumber plugin, phone+password only (`POST /sign-in/phone-number`); + OTP flows stay off until SMS infrastructure exists. Adds + `sys_user.phone_number` (unique) / `phone_number_verified`. Phone-only + accounts get an undeliverable placeholder email + (`u-@placeholder.invalid`, never derived from the phone number); + all auth mail callbacks refuse placeholder recipients. + - **Identity bulk import** — `POST /api/v1/auth/admin/import-users` accepts + the same payloads as the generic import routes (rows/csv/xlsx, dryRun, + upsert by email or phone) but writes every row through better-auth. + Password policies: `invite` (reset-link email per created user; requires an + EmailService) and `temporary` (per-row one-time passwords + forced change). + Sync only, ≤500 rows per request; no undo; upsert updates touch profile + fields only and can never reset an existing user's password. + `prepareImportRequest` and the CSV/xlsx parsers moved from rest-server.ts + to an exported `import-prepare.ts` module (behavior unchanged). + +- 02f6af4: ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed. + + - **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE + the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security + properties): anonymous callers see only `public` books/docs; + `{ permissionSet }`-gated books require the caller to hold the named set; + a doc's effective audience is the union over the books that CLAIM it + (unclaimed docs default to `org`; orphan rendering never inherits `public`). + Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book` + single-item reads bypass the shared meta cache (per-caller gate vs shared ETag). + - **spec**: new pure helpers powering that gate — `audienceAllows`, + `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs` + (+ `AudienceCaller`/`AudienceBook` types). BREAKING but ships as a `minor` + per the launch-window convention (pre-1.0 semantics — breaking changes do + not burn a major version number while the whole stack is in lockstep): + `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the + registered form (the `position` type had LOST its form layout in the P1 + rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of + retired `roles`/`profiles`. + - **plugin-security**: the `security` service exposes + `resolvePermissionSetNames(ctx)` — the same resolution as data-plane + enforcement, for the docs gate. + - **metadata**: artifact ingestion maps `positions → 'position'` (the stale + `roles → 'role'` mapping matched nothing since the P1 rename, silently + dropping compiled positions from metadata registration). + - **lint**: books join the D3 role-word scan (their `audience` is a + permission-model reference now), and a new advisory rule + `security-book-audience-unknown-set` flags a `{ permissionSet }` audience + naming a set the stack does not declare (runtime fails closed — the typo + cost is "nobody can read the book", so say it at author time). + - **platform-objects**: metadata-form translations regain `position` (all four + locales) and drop the retired `role`/`profile` groups, with a vocabulary + regression test. + +- bea4b92: feat(rest): colour select/radio cells in xlsx exports with their option colour + + The data export route (`GET /data/:object/export`) now carries a select / + radio field's option `color` into the generated Excel workbook as the cell's + **font colour** (white cell background), so an exported sheet reads like the + in-app coloured badges instead of plain black text. csv / json output is + unchanged. + + - `export-format.ts` gains `toArgb()` (hex `#RGB` / `#RRGGBB` → exceljs ARGB + `FFRRGGBB`, `undefined` for anything not plain hex) and `cellFontColor()` + (resolves the matched select/radio option's colour for one cell; returns + `undefined` — i.e. leave it unstyled — for non-option fields, unmatched + values, colourless options, or invalid hex). `ExportFieldMeta.options` now + carries the option `color`. + - `createXlsxStream(res, useStyles)` takes the flag through to exceljs' + `WorkbookWriter`; the route enables styling and sets `cell.font.color` + per-cell only for xlsx. + + Styling is heavier than a bare value dump, so it is gated behind a **10 000-row + cap** (`STYLE_ROW_CAP`): exports whose effective limit exceeds it stream + without colours (all rows intact) and set `X-Export-Styles: dropped`; coloured + exports set `X-Export-Styles: applied`. This mirrors the "formatted export has a + lower ceiling than a raw dump" pattern used by Salesforce / ServiceNow. The + existing 50 000-row hard cap is unchanged. + + Closes #2757. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/service-package@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/rest/package.json b/packages/rest/package.json index 83f60afddf..42ac25e123 100644 --- a/packages/rest/package.json +++ b/packages/rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/rest", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol", "type": "module", diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md index 22107da230..fa7bbf33ce 100644 --- a/packages/runtime/CHANGELOG.md +++ b/packages/runtime/CHANGELOG.md @@ -1,5 +1,32 @@ # @objectstack/runtime +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [8f0b9df] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] +- Updated dependencies [bea4b92] + - @objectstack/plugin-auth@14.3.0 + - @objectstack/rest@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/plugin-security@14.3.0 + - @objectstack/metadata@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + - @objectstack/observability@14.3.0 + - @objectstack/driver-memory@14.3.0 + - @objectstack/driver-sql@14.3.0 + - @objectstack/driver-sqlite-wasm@14.3.0 + - @objectstack/service-cluster@14.3.0 + - @objectstack/service-datasource@14.3.0 + - @objectstack/service-i18n@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/runtime/package.json b/packages/runtime/package.json index 2f39daed29..005f375a7f 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/runtime", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack Core Runtime & Query Engine", "type": "module", diff --git a/packages/sdui-parser/CHANGELOG.md b/packages/sdui-parser/CHANGELOG.md index 2c8b10b756..994592058b 100644 --- a/packages/sdui-parser/CHANGELOG.md +++ b/packages/sdui-parser/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/sdui-parser +## 14.3.0 + ## 14.2.0 ## 14.1.0 diff --git a/packages/sdui-parser/package.json b/packages/sdui-parser/package.json index 38f5f7df50..9e95bb6679 100644 --- a/packages/sdui-parser/package.json +++ b/packages/sdui-parser/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/sdui-parser", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "ObjectStack constrained JSX-source → SDUI SchemaNode tree compiler (parse, never execute). Isomorphic, zero React. ADR-0080.", "main": "dist/index.js", diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md index 90147ee9f0..93178aae98 100644 --- a/packages/services/service-analytics/CHANGELOG.md +++ b/packages/services/service-analytics/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog — @objectstack/service-analytics +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json index 9d18d1cab0..0c4c4672b2 100644 --- a/packages/services/service-analytics/package.json +++ b/packages/services/service-analytics/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-analytics", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)", "type": "module", diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md index 609f044deb..aa371003cb 100644 --- a/packages/services/service-automation/CHANGELOG.md +++ b/packages/services/service-automation/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-automation +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/formula@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json index 138f637c9a..a2865da65e 100644 --- a/packages/services/service-automation/package.json +++ b/packages/services/service-automation/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-automation", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine", "type": "module", diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md index 387a01eac8..db8150109b 100644 --- a/packages/services/service-cache/CHANGELOG.md +++ b/packages/services/service-cache/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-cache +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/observability@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json index 8583e86257..20331e437c 100644 --- a/packages/services/service-cache/package.json +++ b/packages/services/service-cache/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cache", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters", "type": "module", diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md index aa19322836..281f1124bd 100644 --- a/packages/services/service-cluster-redis/CHANGELOG.md +++ b/packages/services/service-cluster-redis/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-cluster-redis +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/service-cluster@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json index 550c3b0a63..67a7010627 100644 --- a/packages/services/service-cluster-redis/package.json +++ b/packages/services/service-cluster-redis/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster-redis", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.", "type": "module", diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md index 2566605a15..a70363a544 100644 --- a/packages/services/service-cluster/CHANGELOG.md +++ b/packages/services/service-cluster/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-cluster +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json index 246d3d252e..f55bb81ad8 100644 --- a/packages/services/service-cluster/package.json +++ b/packages/services/service-cluster/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.", "type": "module", diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md index 999ced0bf4..bd2c643b75 100644 --- a/packages/services/service-datasource/CHANGELOG.md +++ b/packages/services/service-datasource/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-external-datasource +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json index 0332cbab1b..a41f751d3a 100644 --- a/packages/services/service-datasource/package.json +++ b/packages/services/service-datasource/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-datasource", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.", "type": "module", diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md index 96b845c8e4..6fceb6155a 100644 --- a/packages/services/service-i18n/CHANGELOG.md +++ b/packages/services/service-i18n/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-i18n +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json index 1f031db7df..71ffdb2d7c 100644 --- a/packages/services/service-i18n/package.json +++ b/packages/services/service-i18n/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-i18n", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading", "type": "module", diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md index 29101e302f..10e03622c0 100644 --- a/packages/services/service-job/CHANGELOG.md +++ b/packages/services/service-job/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-job +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json index a953d8e66c..5f18442082 100644 --- a/packages/services/service-job/package.json +++ b/packages/services/service-job/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-job", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling", "type": "module", diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md index 84978ee15a..ae89abdcc8 100644 --- a/packages/services/service-knowledge/CHANGELOG.md +++ b/packages/services/service-knowledge/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-knowledge +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json index 09e32b71d0..da49597632 100644 --- a/packages/services/service-knowledge/package.json +++ b/packages/services/service-knowledge/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-knowledge", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).", "type": "module", diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md index 3d46a85204..d2525e2efe 100644 --- a/packages/services/service-messaging/CHANGELOG.md +++ b/packages/services/service-messaging/CHANGELOG.md @@ -1,5 +1,47 @@ # @objectstack/service-messaging +## 14.3.0 + +### Minor Changes + +- c1064f1: feat(messaging/auth): SMS infrastructure + phone-number OTP first-login/reset (#2780) + + #2766 shipped phone+password sign-in but no OTP — the platform had no SMS + delivery capability. This adds the missing infrastructure end to end: + + - **New `@objectstack/plugin-sms`** — `ISmsService`/`ISmsTransport` contracts + (spec) with Aliyun SMS (ACS3-HMAC-SHA256, template-based) and Twilio + transports plus a dev log fallback. Configured through the new `sms` + settings namespace (live provider rebind, encrypted secrets, send-test + action; `OS_SMS_*` env keys win at the resolver). Deliberately NO message + persistence and NO body logging — SMS bodies carry OTP codes. + - **Messaging `sms` channel** — registered at kernel:ready when an `sms` + service is present; `notify(channels:['sms'])` resolves + `sys_user.phone_number`, renders `(topic,'sms',locale)` templates, and + inherits outbox retry/dead-letter. + - **Phone OTP flows open** — the phoneNumber plugin's `sendOTP` / + `sendPasswordResetOTP` now deliver via SMS, enabling + `/phone-number/send-otp` + `/verify` (OTP sign-in/verification) and + `/phone-number/request-password-reset` + `/reset-password` (self-service + reset). Without a deliverable SMS service they keep failing loudly + (NOT_SUPPORTED); `features.phoneNumberOtp` advertises real availability. + Shipped with the abuse hardening: explicit `allowedAttempts: 3`, always-on + per-number cooldown (60s) + rolling-hour cap (5, secondaryStorage-shared + across nodes), `/phone-number/*` in the settings-bound per-IP rate-limit + rules, and OTP codes never reach logs or error messages. + - **Import SMS invites** — `/admin/import-users`'s `invite` policy now + supports phone-only rows: a credential-free invitation SMS points the + employee at phone-OTP first sign-in followed by self-set password; mixed + files validate the reachable channel per row. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json index a832c75599..fdc973a782 100644 --- a/packages/services/service-messaging/package.json +++ b/packages/services/service-messaging/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-messaging", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.", "type": "module", diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md index 04a479c7ca..719c26b785 100644 --- a/packages/services/service-package/CHANGELOG.md +++ b/packages/services/service-package/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/service-package +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json index 60032f7e13..0e84e43ead 100644 --- a/packages/services/service-package/package.json +++ b/packages/services/service-package/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-package", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Package management service for ObjectStack — publish, install, and manage packages", "type": "module", diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md index 27c430a453..9cb794b69a 100644 --- a/packages/services/service-queue/CHANGELOG.md +++ b/packages/services/service-queue/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-queue +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json index 0bff9eedc0..eaa0fdf903 100644 --- a/packages/services/service-queue/package.json +++ b/packages/services/service-queue/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-queue", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters", "type": "module", diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md index 3a518e7a0d..023434a85f 100644 --- a/packages/services/service-realtime/CHANGELOG.md +++ b/packages/services/service-realtime/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-realtime +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json index 609844b9c7..fb26e44f84 100644 --- a/packages/services/service-realtime/package.json +++ b/packages/services/service-realtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-realtime", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub", "type": "module", diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md index b17ff2a780..e572f5519e 100644 --- a/packages/services/service-settings/CHANGELOG.md +++ b/packages/services/service-settings/CHANGELOG.md @@ -1,5 +1,49 @@ # @objectstack/service-settings +## 14.3.0 + +### Minor Changes + +- c1064f1: feat(messaging/auth): SMS infrastructure + phone-number OTP first-login/reset (#2780) + + #2766 shipped phone+password sign-in but no OTP — the platform had no SMS + delivery capability. This adds the missing infrastructure end to end: + + - **New `@objectstack/plugin-sms`** — `ISmsService`/`ISmsTransport` contracts + (spec) with Aliyun SMS (ACS3-HMAC-SHA256, template-based) and Twilio + transports plus a dev log fallback. Configured through the new `sms` + settings namespace (live provider rebind, encrypted secrets, send-test + action; `OS_SMS_*` env keys win at the resolver). Deliberately NO message + persistence and NO body logging — SMS bodies carry OTP codes. + - **Messaging `sms` channel** — registered at kernel:ready when an `sms` + service is present; `notify(channels:['sms'])` resolves + `sys_user.phone_number`, renders `(topic,'sms',locale)` templates, and + inherits outbox retry/dead-letter. + - **Phone OTP flows open** — the phoneNumber plugin's `sendOTP` / + `sendPasswordResetOTP` now deliver via SMS, enabling + `/phone-number/send-otp` + `/verify` (OTP sign-in/verification) and + `/phone-number/request-password-reset` + `/reset-password` (self-service + reset). Without a deliverable SMS service they keep failing loudly + (NOT_SUPPORTED); `features.phoneNumberOtp` advertises real availability. + Shipped with the abuse hardening: explicit `allowedAttempts: 3`, always-on + per-number cooldown (60s) + rolling-hour cap (5, secondaryStorage-shared + across nodes), `/phone-number/*` in the settings-bound per-IP rate-limit + rules, and OTP codes never reach logs or error messages. + - **Import SMS invites** — `/admin/import-users`'s `invite` policy now + supports phone-only rows: a credential-free invitation SMS points the + employee at phone-OTP first sign-in followed by self-set password; mixed + files validate the reachable channel per row. + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/types@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json index cd456e8fcd..3c75be9738 100644 --- a/packages/services/service-settings/package.json +++ b/packages/services/service-settings/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-settings", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.", "type": "module", diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md index 32614c94f6..ff5f1ce2b3 100644 --- a/packages/services/service-storage/CHANGELOG.md +++ b/packages/services/service-storage/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-storage +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/platform-objects@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/observability@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json index 652a95d92c..26498658dd 100644 --- a/packages/services/service-storage/package.json +++ b/packages/services/service-storage/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-storage", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton", "type": "module", diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md index dcab4704e9..72647f5c3f 100644 --- a/packages/spec/CHANGELOG.md +++ b/packages/spec/CHANGELOG.md @@ -1,5 +1,104 @@ # @objectstack/spec +## 14.3.0 + +### Minor Changes + +- 2a71f48: feat(auth): admin direct user management, phone sign-in, and identity bulk import (#2766, re-scoped #2758) + + `sys_user` is managed by better-auth and its generic CRUD is suppressed, so + until now the only way to add a teammate was the email-dependent invite flow. + This ships three staged capabilities: + + - **Admin direct user management** — `POST /api/v1/auth/admin/create-user` + and a wrapped `POST /api/v1/auth/admin/set-user-password` (ADR-0068 + platform-admin gate; better-auth pipeline so credentials are real). Optional + generated temporary password (returned once, never persisted or logged) and + a new `sys_user.must_change_password` flag enforced through the ADR-0069 + authGate (`403 PASSWORD_EXPIRED` until the user changes it). New + `create_user` action and upgraded `set_user_password` action on the Users + list — pure schema, no frontend changes. + - **Phone sign-in (opt-in `auth.plugins.phoneNumber`)** — better-auth + phoneNumber plugin, phone+password only (`POST /sign-in/phone-number`); + OTP flows stay off until SMS infrastructure exists. Adds + `sys_user.phone_number` (unique) / `phone_number_verified`. Phone-only + accounts get an undeliverable placeholder email + (`u-@placeholder.invalid`, never derived from the phone number); + all auth mail callbacks refuse placeholder recipients. + - **Identity bulk import** — `POST /api/v1/auth/admin/import-users` accepts + the same payloads as the generic import routes (rows/csv/xlsx, dryRun, + upsert by email or phone) but writes every row through better-auth. + Password policies: `invite` (reset-link email per created user; requires an + EmailService) and `temporary` (per-row one-time passwords + forced change). + Sync only, ≤500 rows per request; no undo; upsert updates touch profile + fields only and can never reset an existing user's password. + `prepareImportRequest` and the CSV/xlsx parsers moved from rest-server.ts + to an exported `import-prepare.ts` module (behavior unchanged). + +- 02f6af4: ADR-0090 follow-through wave: enforce book audience at the read layer; finish the D2/D3 cleanup the P1 rename missed. + + - **rest**: `/meta/book`, `/meta/doc`, and `/meta/book/:name/tree` now ENFORCE + the ADR-0046 §6.7 audience model (ADR-0049 — no unenforced security + properties): anonymous callers see only `public` books/docs; + `{ permissionSet }`-gated books require the caller to hold the named set; + a doc's effective audience is the union over the books that CLAIM it + (unclaimed docs default to `org`; orphan rendering never inherits `public`). + Gated evaluation fails CLOSED when holdings cannot be resolved. `doc`/`book` + single-item reads bypass the shared meta cache (per-caller gate vs shared ETag). + - **spec**: new pure helpers powering that gate — `audienceAllows`, + `resolveDocAudiences`, `docAudienceAllows`, `resolveBookClaimedDocs` + (+ `AudienceCaller`/`AudienceBook` types). BREAKING but ships as a `minor` + per the launch-window convention (pre-1.0 semantics — breaking changes do + not burn a major version number while the whole stack is in lockstep): + `METADATA_FORM_REGISTRY` keys `role`/`profile` are gone — `position` is the + registered form (the `position` type had LOST its form layout in the P1 + rename); `EnvironmentArtifactMetadataSchema` declares `positions` instead of + retired `roles`/`profiles`. + - **plugin-security**: the `security` service exposes + `resolvePermissionSetNames(ctx)` — the same resolution as data-plane + enforcement, for the docs gate. + - **metadata**: artifact ingestion maps `positions → 'position'` (the stale + `roles → 'role'` mapping matched nothing since the P1 rename, silently + dropping compiled positions from metadata registration). + - **lint**: books join the D3 role-word scan (their `audience` is a + permission-model reference now), and a new advisory rule + `security-book-audience-unknown-set` flags a `{ permissionSet }` audience + naming a set the stack does not declare (runtime fails closed — the typo + cost is "nobody can read the book", so say it at author time). + - **platform-objects**: metadata-form translations regain `position` (all four + locales) and drop the retired `role`/`profile` groups, with a vocabulary + regression test. + +- c1064f1: feat(messaging/auth): SMS infrastructure + phone-number OTP first-login/reset (#2780) + + #2766 shipped phone+password sign-in but no OTP — the platform had no SMS + delivery capability. This adds the missing infrastructure end to end: + + - **New `@objectstack/plugin-sms`** — `ISmsService`/`ISmsTransport` contracts + (spec) with Aliyun SMS (ACS3-HMAC-SHA256, template-based) and Twilio + transports plus a dev log fallback. Configured through the new `sms` + settings namespace (live provider rebind, encrypted secrets, send-test + action; `OS_SMS_*` env keys win at the resolver). Deliberately NO message + persistence and NO body logging — SMS bodies carry OTP codes. + - **Messaging `sms` channel** — registered at kernel:ready when an `sms` + service is present; `notify(channels:['sms'])` resolves + `sys_user.phone_number`, renders `(topic,'sms',locale)` templates, and + inherits outbox retry/dead-letter. + - **Phone OTP flows open** — the phoneNumber plugin's `sendOTP` / + `sendPasswordResetOTP` now deliver via SMS, enabling + `/phone-number/send-otp` + `/verify` (OTP sign-in/verification) and + `/phone-number/request-password-reset` + `/reset-password` (self-service + reset). Without a deliverable SMS service they keep failing loudly + (NOT_SUPPORTED); `features.phoneNumberOtp` advertises real availability. + Shipped with the abuse hardening: explicit `allowedAttempts: 3`, always-on + per-number cooldown (60s) + rolling-hour cap (5, secondaryStorage-shared + across nodes), `/phone-number/*` in the settings-bound per-IP rate-limit + rules, and OTP codes never reach logs or error messages. + - **Import SMS invites** — `/admin/import-users`'s `invite` policy now + supports phone-only rows: a credential-free invitation SMS points the + employee at phone-OTP first sign-in followed by self-set password; mixed + files validate the reachable channel per row. + ## 14.2.0 ### Minor Changes diff --git a/packages/spec/package.json b/packages/spec/package.json index 7eede9c2e4..cfd840d510 100644 --- a/packages/spec/package.json +++ b/packages/spec/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/spec", - "version": "14.2.0", + "version": "14.3.0", "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md index 458deafd8f..a6b2ee7d56 100644 --- a/packages/triggers/trigger-api/CHANGELOG.md +++ b/packages/triggers/trigger-api/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/trigger-api +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json index ccc8c2a33a..22a954795c 100644 --- a/packages/triggers/trigger-api/package.json +++ b/packages/triggers/trigger-api/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-api", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md index 54c0489f4a..f56033fd4c 100644 --- a/packages/triggers/trigger-record-change/CHANGELOG.md +++ b/packages/triggers/trigger-record-change/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/plugin-trigger-record-change +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json index 40dcf94b95..b173757835 100644 --- a/packages/triggers/trigger-record-change/package.json +++ b/packages/triggers/trigger-record-change/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-record-change", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md index 7a7f96ca25..946f64962d 100644 --- a/packages/triggers/trigger-schedule/CHANGELOG.md +++ b/packages/triggers/trigger-schedule/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/plugin-trigger-schedule +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + - @objectstack/core@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json index b6312b38ca..5b7cf5ef6a 100644 --- a/packages/triggers/trigger-schedule/package.json +++ b/packages/triggers/trigger-schedule/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-schedule", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)", "main": "dist/index.js", diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md index bfe2d37750..74df93306d 100644 --- a/packages/types/CHANGELOG.md +++ b/packages/types/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/types +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [c1064f1] + - @objectstack/spec@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/types/package.json b/packages/types/package.json index 02c7491462..fc0c1b0c71 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/types", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Shared interfaces describing the ObjectStack Runtime environment", "main": "dist/index.js", diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md index d72d2bc694..20be8a71d3 100644 --- a/packages/verify/CHANGELOG.md +++ b/packages/verify/CHANGELOG.md @@ -1,5 +1,30 @@ # @objectstack/verify +## 14.3.0 + +### Patch Changes + +- Updated dependencies [2a71f48] +- Updated dependencies [02f6af4] +- Updated dependencies [8f0b9df] +- Updated dependencies [ff648ad] +- Updated dependencies [c1064f1] +- Updated dependencies [bea4b92] + - @objectstack/plugin-auth@14.3.0 + - @objectstack/rest@14.3.0 + - @objectstack/spec@14.3.0 + - @objectstack/plugin-security@14.3.0 + - @objectstack/objectql@14.3.0 + - @objectstack/service-settings@14.3.0 + - @objectstack/runtime@14.3.0 + - @objectstack/plugin-sharing@14.3.0 + - @objectstack/core@14.3.0 + - @objectstack/driver-sqlite-wasm@14.3.0 + - @objectstack/plugin-hono-server@14.3.0 + - @objectstack/service-analytics@14.3.0 + - @objectstack/service-automation@14.3.0 + - @objectstack/service-datasource@14.3.0 + ## 14.2.0 ### Patch Changes diff --git a/packages/verify/package.json b/packages/verify/package.json index 0169c5ec75..a9cd1333e3 100644 --- a/packages/verify/package.json +++ b/packages/verify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/verify", - "version": "14.2.0", + "version": "14.3.0", "license": "Apache-2.0", "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.", "type": "module", diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md index f40c36e4de..272e7954fa 100644 --- a/packages/vscode-objectstack/CHANGELOG.md +++ b/packages/vscode-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # objectstack-vscode +## 14.3.0 + ## 14.2.0 ## 14.1.0 diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json index 2cf71ec3b0..96cedef3eb 100644 --- a/packages/vscode-objectstack/package.json +++ b/packages/vscode-objectstack/package.json @@ -2,7 +2,7 @@ "name": "objectstack-vscode", "displayName": "ObjectStack", "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files", - "version": "14.2.0", + "version": "14.3.0", "publisher": "objectstack", "license": "Apache-2.0", "repository": {