From 1307b790b3c4ec274f658750da2c2a081b5882e9 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 9 Jul 2026 01:15:09 +0000 Subject: [PATCH] chore: version packages --- .changeset/capability-reference-lint.md | 31 ------ .changeset/fls-mask-write-response.md | 10 -- .../hono-server-405-method-not-allowed.md | 17 --- .../per-operation-required-permissions.md | 22 ---- .changeset/redos-email-regex-validators.md | 13 --- .../remove-dead-compliance-subsystems.md | 36 ------ .../secure-by-default-system-objects.md | 34 ------ .changeset/studio-namespace-prefix.md | 29 ----- examples/app-crm/CHANGELOG.md | 11 ++ examples/app-crm/package.json | 2 +- examples/app-showcase/CHANGELOG.md | 15 +++ examples/app-showcase/package.json | 2 +- examples/app-todo/CHANGELOG.md | 19 ++++ examples/app-todo/package.json | 2 +- examples/embed-objectql/CHANGELOG.md | 13 +++ examples/embed-objectql/package.json | 2 +- packages/adapters/hono/CHANGELOG.md | 9 ++ packages/adapters/hono/package.json | 2 +- packages/apps/account/CHANGELOG.md | 12 ++ packages/apps/account/package.json | 2 +- packages/apps/setup/CHANGELOG.md | 12 ++ packages/apps/setup/package.json | 2 +- packages/apps/studio/CHANGELOG.md | 12 ++ packages/apps/studio/package.json | 2 +- packages/cli/CHANGELOG.md | 83 ++++++++++++++ packages/cli/package.json | 2 +- packages/client-react/CHANGELOG.md | 12 ++ packages/client-react/package.json | 2 +- packages/client/CHANGELOG.md | 11 ++ packages/client/package.json | 2 +- packages/cloud-connection/CHANGELOG.md | 13 +++ packages/cloud-connection/package.json | 2 +- .../connectors/connector-mcp/CHANGELOG.md | 11 ++ .../connectors/connector-mcp/package.json | 2 +- .../connectors/connector-openapi/CHANGELOG.md | 11 ++ .../connectors/connector-openapi/package.json | 2 +- .../connectors/connector-rest/CHANGELOG.md | 11 ++ .../connectors/connector-rest/package.json | 2 +- .../connectors/connector-slack/CHANGELOG.md | 11 ++ .../connectors/connector-slack/package.json | 2 +- packages/console/CHANGELOG.md | 2 + packages/console/package.json | 2 +- packages/core/CHANGELOG.md | 10 ++ packages/core/package.json | 2 +- packages/create-objectstack/CHANGELOG.md | 2 + packages/create-objectstack/package.json | 2 +- packages/dogfood/CHANGELOG.md | 17 +++ packages/dogfood/package.json | 2 +- packages/downstream-contract/CHANGELOG.md | 10 ++ packages/downstream-contract/package.json | 2 +- packages/formula/CHANGELOG.md | 10 ++ packages/formula/package.json | 2 +- packages/lint/CHANGELOG.md | 39 +++++++ packages/lint/package.json | 2 +- packages/mcp/CHANGELOG.md | 12 ++ packages/mcp/package.json | 2 +- packages/metadata-core/CHANGELOG.md | 10 ++ packages/metadata-core/package.json | 2 +- packages/metadata-fs/CHANGELOG.md | 6 + packages/metadata-fs/package.json | 2 +- packages/metadata-protocol/CHANGELOG.md | 41 +++++++ packages/metadata-protocol/package.json | 2 +- packages/metadata/CHANGELOG.md | 16 +++ packages/metadata/package.json | 2 +- packages/objectql/CHANGELOG.md | 24 ++++ packages/objectql/package.json | 2 +- packages/observability/CHANGELOG.md | 10 ++ packages/observability/package.json | 2 +- packages/platform-objects/CHANGELOG.md | 44 ++++++++ packages/platform-objects/package.json | 2 +- packages/plugins/driver-memory/CHANGELOG.md | 11 ++ packages/plugins/driver-memory/package.json | 2 +- packages/plugins/driver-mongodb/CHANGELOG.md | 11 ++ packages/plugins/driver-mongodb/package.json | 2 +- packages/plugins/driver-sql/CHANGELOG.md | 12 ++ packages/plugins/driver-sql/package.json | 2 +- .../plugins/driver-sqlite-wasm/CHANGELOG.md | 12 ++ .../plugins/driver-sqlite-wasm/package.json | 2 +- packages/plugins/embedder-openai/CHANGELOG.md | 10 ++ packages/plugins/embedder-openai/package.json | 2 +- .../plugins/knowledge-memory/CHANGELOG.md | 12 ++ .../plugins/knowledge-memory/package.json | 2 +- .../plugins/knowledge-ragflow/CHANGELOG.md | 12 ++ .../plugins/knowledge-ragflow/package.json | 2 +- .../plugins/plugin-approvals/CHANGELOG.md | 15 +++ .../plugins/plugin-approvals/package.json | 2 +- packages/plugins/plugin-audit/CHANGELOG.md | 13 +++ packages/plugins/plugin-audit/package.json | 2 +- packages/plugins/plugin-auth/CHANGELOG.md | 14 +++ packages/plugins/plugin-auth/package.json | 2 +- packages/plugins/plugin-dev/CHANGELOG.md | 26 +++++ packages/plugins/plugin-dev/package.json | 2 +- packages/plugins/plugin-email/CHANGELOG.md | 23 ++++ packages/plugins/plugin-email/package.json | 2 +- .../plugins/plugin-hono-server/CHANGELOG.md | 27 +++++ .../plugins/plugin-hono-server/package.json | 2 +- .../plugins/plugin-org-scoping/CHANGELOG.md | 13 +++ .../plugins/plugin-org-scoping/package.json | 2 +- packages/plugins/plugin-reports/CHANGELOG.md | 13 +++ packages/plugins/plugin-reports/package.json | 2 +- packages/plugins/plugin-security/CHANGELOG.md | 65 +++++++++++ packages/plugins/plugin-security/package.json | 2 +- packages/plugins/plugin-sharing/CHANGELOG.md | 16 +++ packages/plugins/plugin-sharing/package.json | 2 +- packages/plugins/plugin-webhooks/CHANGELOG.md | 12 ++ packages/plugins/plugin-webhooks/package.json | 2 +- packages/rest/CHANGELOG.md | 14 +++ packages/rest/package.json | 2 +- packages/runtime/CHANGELOG.md | 28 +++++ packages/runtime/package.json | 2 +- packages/sdui-parser/CHANGELOG.md | 2 + packages/sdui-parser/package.json | 2 +- .../services/service-analytics/CHANGELOG.md | 11 ++ .../services/service-analytics/package.json | 2 +- .../services/service-automation/CHANGELOG.md | 12 ++ .../services/service-automation/package.json | 2 +- packages/services/service-cache/CHANGELOG.md | 12 ++ packages/services/service-cache/package.json | 2 +- .../service-cluster-redis/CHANGELOG.md | 11 ++ .../service-cluster-redis/package.json | 2 +- .../services/service-cluster/CHANGELOG.md | 11 ++ .../services/service-cluster/package.json | 2 +- .../services/service-datasource/CHANGELOG.md | 11 ++ .../services/service-datasource/package.json | 2 +- packages/services/service-i18n/CHANGELOG.md | 11 ++ packages/services/service-i18n/package.json | 2 +- packages/services/service-job/CHANGELOG.md | 13 +++ packages/services/service-job/package.json | 2 +- .../services/service-knowledge/CHANGELOG.md | 11 ++ .../services/service-knowledge/package.json | 2 +- .../services/service-messaging/CHANGELOG.md | 11 ++ .../services/service-messaging/package.json | 2 +- .../services/service-package/CHANGELOG.md | 11 ++ .../services/service-package/package.json | 2 +- packages/services/service-queue/CHANGELOG.md | 13 +++ packages/services/service-queue/package.json | 2 +- .../services/service-realtime/CHANGELOG.md | 13 +++ .../services/service-realtime/package.json | 2 +- .../services/service-settings/CHANGELOG.md | 14 +++ .../services/service-settings/package.json | 2 +- .../services/service-storage/CHANGELOG.md | 14 +++ .../services/service-storage/package.json | 2 +- packages/spec/CHANGELOG.md | 105 ++++++++++++++++++ packages/spec/package.json | 2 +- packages/triggers/trigger-api/CHANGELOG.md | 11 ++ packages/triggers/trigger-api/package.json | 2 +- .../trigger-record-change/CHANGELOG.md | 11 ++ .../trigger-record-change/package.json | 2 +- .../triggers/trigger-schedule/CHANGELOG.md | 11 ++ .../triggers/trigger-schedule/package.json | 2 +- packages/types/CHANGELOG.md | 10 ++ packages/types/package.json | 2 +- packages/verify/CHANGELOG.md | 27 +++++ packages/verify/package.json | 2 +- packages/vscode-objectstack/CHANGELOG.md | 2 + packages/vscode-objectstack/package.json | 2 +- 156 files changed, 1310 insertions(+), 266 deletions(-) delete mode 100644 .changeset/capability-reference-lint.md delete mode 100644 .changeset/fls-mask-write-response.md delete mode 100644 .changeset/hono-server-405-method-not-allowed.md delete mode 100644 .changeset/per-operation-required-permissions.md delete mode 100644 .changeset/redos-email-regex-validators.md delete mode 100644 .changeset/remove-dead-compliance-subsystems.md delete mode 100644 .changeset/secure-by-default-system-objects.md delete mode 100644 .changeset/studio-namespace-prefix.md diff --git a/.changeset/capability-reference-lint.md b/.changeset/capability-reference-lint.md deleted file mode 100644 index de67396dc4..0000000000 --- a/.changeset/capability-reference-lint.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -'@objectstack/spec': minor -'@objectstack/lint': minor -'@objectstack/plugin-security': patch -'@objectstack/cli': patch ---- - -Author-time capability-reference lint (ADR-0066 ⑨) — `os validate` / `os lint` -now warn when a `requiredPermissions` names a capability that is registered -nowhere. - -`requiredPermissions` (on objects, fields, apps, actions) is a free string, so a -typo like `mange_users` is schema-valid and fails closed at runtime (the caller -is denied) — safe, but silent. The new `validateCapabilityReferences` rule -(`@objectstack/lint`) resolves every reference against the author-time known set -and warns on the unresolved ones: - -- built-in platform capabilities — now sourced from a single canonical list in - `@objectstack/spec` (`security/capabilities.ts`: `PLATFORM_CAPABILITIES` / - `PLATFORM_CAPABILITY_NAMES`), which `@objectstack/plugin-security`'s - `bootstrapSystemCapabilities` also seeds from (one source of truth, no drift), -- any capability a permission set in the stack grants via `systemPermissions` - (granting is what declares it — mirrors the runtime derived-defaults rule), and -- any `sys_capability` row shipped as seed data. - -It is a **warning**, not an error: a single package can't see capabilities -declared by other installed packages, and the reference fails closed anyway. -`systemPermissions` itself is never flagged — it is the declaration side, and a -package legitimately introduces new capabilities there. The object case also -understands the per-operation `requiredPermissions` map form (ADR-0066 ⑤) and -points a finding at the exact operation slice. diff --git a/.changeset/fls-mask-write-response.md b/.changeset/fls-mask-write-response.md deleted file mode 100644 index 45077be17b..0000000000 --- a/.changeset/fls-mask-write-response.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@objectstack/plugin-security": patch ---- - -Fix field-level-security read leak on mutation responses. The security -middleware only masked read-protected fields on `find`/`findOne` results, so a -caller with edit-but-not-field-read could `insert`/`update` a record and read a -read-protected field back out of the echoed post-image (field WRITES were -already blocked, but the response image was not masked). The mask now also -covers `insert`/`update` results, matching read behavior. diff --git a/.changeset/hono-server-405-method-not-allowed.md b/.changeset/hono-server-405-method-not-allowed.md deleted file mode 100644 index ba2a932f16..0000000000 --- a/.changeset/hono-server-405-method-not-allowed.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/plugin-hono-server': patch ---- - -Return `405 Method Not Allowed` (with an accurate `Allow` header and a -descriptive body) instead of an opaque `{"error":"Not found"}` 404 when a -request hits a registered path under the wrong HTTP method. - -Hono routes a method mismatch to the same `notFound` sink as a genuinely -missing path, so a `POST` to a `PUT`-only route (e.g. the metadata save -endpoint `PUT /api/v1/meta/:type/:name`) gave callers no hint that the path -exists under another verb (#2684). The server now tracks every registered -`(method, pattern)` pair and re-matches the request path in the `notFound` -handler: matching another method yields a 405; matching nothing stays a 404. -This is framework-wide — every registered endpoint benefits. Static/SPA -catch-alls registered straight on the raw Hono app are not tracked and never -produce a spurious 405. diff --git a/.changeset/per-operation-required-permissions.md b/.changeset/per-operation-required-permissions.md deleted file mode 100644 index de8f466056..0000000000 --- a/.changeset/per-operation-required-permissions.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -'@objectstack/spec': minor -'@objectstack/plugin-security': minor ---- - -Per-operation object `requiredPermissions` (ADR-0066 ⑤) — an object can now be -read-open / write-gated instead of gating all of CRUD on one capability set. - -`Object.requiredPermissions` accepts either the original `string[]` (capabilities -required for **all** operations) **or** a `{ read?, create?, update?, delete? }` -map that gates each operation class independently — mirroring how Salesforce and -Dataverse separate capability by operation. plugin-security enforces the caps for -the request's operation class as the same D3 AND-gate (checked before the CRUD -grant, fail-closed). The mapping folds `transfer`/`restore` into `update` and -`purge` into `delete`, derived from the existing CRUD permission bits so it stays -in lockstep with them. - -Backward-compatible: the `string[]` form keeps its gate-every-operation semantics -(normalized into an `all` bucket that unions with the per-operation bucket), so -existing objects are unaffected. The per-operation map's keys are validated -`.strict()`, so a mistyped key (e.g. `reads`) is rejected at author time rather -than silently ignored. diff --git a/.changeset/redos-email-regex-validators.md b/.changeset/redos-email-regex-validators.md deleted file mode 100644 index 27fa418c32..0000000000 --- a/.changeset/redos-email-regex-validators.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"@objectstack/objectql": patch -"@objectstack/plugin-email": patch ---- - -fix(validation): remove polynomial ReDoS in email validation regexes - -The email validators used `/^[^\s@]+@[^\s@]+\.[^\s@]+$/`, whose quantifiers -around `\.` overlap (the literal dot is also matched by `[^\s@]`) and backtrack -polynomially on adversarial input. The domain part is rewritten as -`[^\s@.]+(?:\.[^\s@.]+)+` so labels exclude `.` and matching is linear. Valid -addresses (including multi-label domains) are unaffected; addresses with an -empty label such as `a@b..c` are now correctly rejected. diff --git a/.changeset/remove-dead-compliance-subsystems.md b/.changeset/remove-dead-compliance-subsystems.md deleted file mode 100644 index 096e23071c..0000000000 --- a/.changeset/remove-dead-compliance-subsystems.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -'@objectstack/spec': minor ---- - -BREAKING (pre-launch): remove the three declared-but-never-enforced compliance -subsystems per ADR-0056 D8 ("design + enforce, or remove"), and mark the AI -agent `visibility` property EXPERIMENTAL (#1901). - -Removed — none of these were read by any runtime path, and compliance-grade -configuration must never merely look live: - -- `ComplianceConfigSchema` / `GDPRConfigSchema` / `HIPAAConfigSchema` (and the - rest of `system/compliance.zod.ts`) — there is no data-subject-rights engine, - retention enforcer, or BAA gate. FROM `import { ComplianceConfigSchema } from - '@objectstack/spec/system'` TO: delete the reference — a real compliance - subsystem will be designed top-down when scheduled. -- `MaskingConfigSchema` / `MaskingRuleSchema` (`system/masking.zod.ts`) — no - redaction layer applies them. FROM masking config TO: field-level security - (permission-set field rules, enforced by plugin-security's field masker); a - subtractive masking/deny layer arrives with ADR-0066 ⑦/⑧ if needed. -- `RLSConfigSchema` / `RLSAuditEventSchema` / `RLSAuditConfigSchema` - (`security/rls.zod.ts`) — the enforced RLS path never read the global config. - FROM global `RLSConfig` TO: per-policy `RowLevelSecurityPolicySchema` (the - live, enforced surface — unchanged). - -Kept, still `[EXPERIMENTAL]`: `EncryptionConfigSchema` (at-rest field -encryption) — a real enterprise roadmap item with a stable shape; carrying it -marked costs less than remove-and-re-add (ADR-0087). - -Marked `[EXPERIMENTAL — NOT ENFORCED]` (#1901): `AgentSchema.visibility` — the -chat-access evaluator deliberately excludes it and the agent list route does -not filter by it, so `private` does not hide an agent. The schema description -and the authoring form now say so; use `access` / `permissions` (both enforced -at the chat route since #1884) for real gating. The ADR-0056 D10 conformance -matrix tracks all dispositions (`agent-visibility` experimental; -`compliance-configs` / `data-masking` / `rls-config-global` removed). diff --git a/.changeset/secure-by-default-system-objects.md b/.changeset/secure-by-default-system-objects.md deleted file mode 100644 index eb3c895db1..0000000000 --- a/.changeset/secure-by-default-system-objects.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -'@objectstack/platform-objects': minor ---- - -Secure-by-default posture for sensitive system objects (ADR-0066 ④, system-object -slice) — the platform's raw secret/credential stores no longer ride the wildcard -`'*'` permission grant. - -`sys_secret` (encrypted settings/datasource secrets), `sys_jwks` (JWT signing -keys), `sys_verification` (password-reset / verify tokens), -`sys_oauth_access_token`, `sys_oauth_refresh_token` (live bearer credentials), -and `sys_device_code` (pending device-grant codes) now declare -`access: { default: 'private' }`: an ordinary member's generic data-layer -read/write gets 403 instead of being covered by `member_default`'s -`'*': allowRead`. Platform admins retain access via the posture-gated -`viewAllRecords`/`modifyAllRecords` superuser bypass, and every runtime consumer -is unaffected — better-auth reads via its adapter (system context), -`engine.resolveSecret` reads at driver level, and SettingsService / the -datasource secret-binder read principal-less (middleware falls open for internal -calls). - -`sys_scim_provider` (SCIM bearer-token config) gains the object-level -`requiredPermissions: ['manage_platform_settings']` capability gate, mirroring -its sibling `sys_sso_provider`. The Setup nav item for Signing Keys (JWKS) is -now capability-gated like API Keys, so non-admins don't see a menu entry that -can only 403. - -Member self-service objects (`sys_session`, `sys_api_key`, -`sys_oauth_application`, `sys_two_factor`) deliberately keep the public posture — -the Account app ("My Sessions" / "My API Keys" / "My Apps" / 2FA "My -Enrollment") reads them through the generic data layer as the member; row -scoping remains their guard. The declarations are pinned by -`platform-objects.test.ts` and the ADR-0056 D10 conformance-matrix row -`secure-by-default-posture`, so dropping the flag from a secret store fails CI. diff --git a/.changeset/studio-namespace-prefix.md b/.changeset/studio-namespace-prefix.md deleted file mode 100644 index e6966cc3e4..0000000000 --- a/.changeset/studio-namespace-prefix.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -"@objectstack/metadata-protocol": minor -"@objectstack/spec": minor ---- - -Enforce the package namespace-prefix rule for Studio-authored packages. - -The protocol requires every object name in a package to carry the package's -`manifest.namespace` prefix (`crm_account`); `defineStack()` enforces this at -compile time via `validateNamespacePrefix`. Studio/runtime-authored packages -never take that path, and they were created without a namespace at all — so the -rule was silently inert and objects published with bare, collision-prone names. - -Two runtime changes close the gap: - -- `protocol.installPackage` now derives a default namespace from the package id - (`com.example.leave` → `leave`) when the manifest declares none, and persists - it on the manifest (in-memory registry + `sys_packages`). An explicitly - declared namespace always wins (e.g. HotCRM's `crm`). -- `protocol.publishPackageDrafts` now rejects any object draft whose name lacks - the package namespace prefix, before promoting anything (atomic), with an - actionable message (`Rename it to 'leave_ticket'`). Packages that declare no - namespace are grandfathered — mirroring `defineStack`, the rule is not - invented at enforcement time. - -The per-object prefix check and the id→namespace derivation are extracted into -`@objectstack/spec/kernel` (`validateObjectNamespacePrefix`, -`deriveNamespaceFromPackageId`) as the single source shared by `defineStack` and -the runtime publish path, so the two enforcement points cannot drift. diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md index 02f5fb4abf..f79c589318 100644 --- a/examples/app-crm/CHANGELOG.md +++ b/examples/app-crm/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/example-crm +## 4.0.77 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/runtime@12.7.0 + ## 4.0.76 ### Patch Changes diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json index c41ff59dfa..acd7acfb06 100644 --- a/examples/app-crm/package.json +++ b/examples/app-crm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-crm", - "version": "4.0.76", + "version": "4.0.77", "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md index 4b6b1e0f50..62f8f93449 100644 --- a/examples/app-showcase/CHANGELOG.md +++ b/examples/app-showcase/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/example-showcase +## 0.2.23 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/cloud-connection@12.7.0 + - @objectstack/connector-rest@12.7.0 + - @objectstack/connector-slack@12.7.0 + - @objectstack/driver-sql@12.7.0 + - @objectstack/runtime@12.7.0 + ## 0.2.22 ### Patch Changes diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json index 2dd3c1ff5c..1c64fa5759 100644 --- a/examples/app-showcase/package.json +++ b/examples/app-showcase/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-showcase", - "version": "0.2.22", + "version": "0.2.23", "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, analytics). Built for demonstration, debugging, and coverage-driven verification.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md index 390ad016d1..9a272243b5 100644 --- a/examples/app-todo/CHANGELOG.md +++ b/examples/app-todo/CHANGELOG.md @@ -1,5 +1,24 @@ # @objectstack/example-todo +## 4.0.77 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/client@12.7.0 + - @objectstack/mcp@12.7.0 + - @objectstack/metadata@12.7.0 + - @objectstack/driver-sqlite-wasm@12.7.0 + - @objectstack/knowledge-memory@12.7.0 + - @objectstack/runtime@12.7.0 + - @objectstack/service-knowledge@12.7.0 + ## 4.0.76 ### Patch Changes diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json index c7bdd9d407..3d8a7d2113 100644 --- a/examples/app-todo/package.json +++ b/examples/app-todo/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-todo", - "version": "4.0.76", + "version": "4.0.77", "description": "Example Todo App using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/examples/embed-objectql/CHANGELOG.md b/examples/embed-objectql/CHANGELOG.md index f89524b814..4ba5e53fe0 100644 --- a/examples/embed-objectql/CHANGELOG.md +++ b/examples/embed-objectql/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/example-embed-objectql +## 0.0.17 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/driver-memory@12.7.0 + ## 0.0.16 ### Patch Changes diff --git a/examples/embed-objectql/package.json b/examples/embed-objectql/package.json index 1508bc5c70..e74b3cfa1c 100644 --- a/examples/embed-objectql/package.json +++ b/examples/embed-objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-embed-objectql", - "version": "0.0.16", + "version": "0.0.17", "private": true, "description": "Embed the ObjectQL engine as a plain library via @objectstack/objectql/core — no kernel, no plugins, no metadata protocol (ADR-0076).", "type": "module", diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md index 75e4d9ae73..a37f40afdb 100644 --- a/packages/adapters/hono/CHANGELOG.md +++ b/packages/adapters/hono/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/hono +## 12.7.0 + +### Patch Changes + +- Updated dependencies [b1081b8] + - @objectstack/plugin-hono-server@12.7.0 + - @objectstack/runtime@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json index 95f7bbac8c..74a0c865bb 100644 --- a/packages/adapters/hono/package.json +++ b/packages/adapters/hono/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/hono", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md index f05ee20b9a..f7011557b7 100644 --- a/packages/apps/account/CHANGELOG.md +++ b/packages/apps/account/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/account +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json index bc88d09741..4c87f31b7b 100644 --- a/packages/apps/account/package.json +++ b/packages/apps/account/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/account", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md index b212b993b3..d47114cfc6 100644 --- a/packages/apps/setup/CHANGELOG.md +++ b/packages/apps/setup/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/setup +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json index a546b192fd..55fdcd4472 100644 --- a/packages/apps/setup/package.json +++ b/packages/apps/setup/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/setup", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md index 7b965a3304..01bdc67ac6 100644 --- a/packages/apps/studio/CHANGELOG.md +++ b/packages/apps/studio/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/studio +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json index e8ea5ffc67..c8dfca330f 100644 --- a/packages/apps/studio/package.json +++ b/packages/apps/studio/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/studio", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index fe7829062c..1ad1dbc003 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,88 @@ # @objectstack/cli +## 12.7.0 + +### Patch Changes + +- 466adf6: Author-time capability-reference lint (ADR-0066 ⑨) — `os validate` / `os lint` + now warn when a `requiredPermissions` names a capability that is registered + nowhere. + + `requiredPermissions` (on objects, fields, apps, actions) is a free string, so a + typo like `mange_users` is schema-valid and fails closed at runtime (the caller + is denied) — safe, but silent. The new `validateCapabilityReferences` rule + (`@objectstack/lint`) resolves every reference against the author-time known set + and warns on the unresolved ones: + + - built-in platform capabilities — now sourced from a single canonical list in + `@objectstack/spec` (`security/capabilities.ts`: `PLATFORM_CAPABILITIES` / + `PLATFORM_CAPABILITY_NAMES`), which `@objectstack/plugin-security`'s + `bootstrapSystemCapabilities` also seeds from (one source of truth, no drift), + - any capability a permission set in the stack grants via `systemPermissions` + (granting is what declares it — mirrors the runtime derived-defaults rule), and + - any `sys_capability` row shipped as seed data. + + It is a **warning**, not an error: a single package can't see capabilities + declared by other installed packages, and the reference fails closed anyway. + `systemPermissions` itself is never flagged — it is the declaration side, and a + package legitimately introduces new capabilities there. The object case also + understands the per-operation `requiredPermissions` map form (ADR-0066 ⑤) and + points a finding at the exact operation slice. + +- Updated dependencies [466adf6] +- Updated dependencies [799b285] +- Updated dependencies [b1081b8] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/lint@12.7.0 + - @objectstack/plugin-security@12.7.0 + - @objectstack/plugin-hono-server@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/plugin-email@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/account@12.7.0 + - @objectstack/setup@12.7.0 + - @objectstack/client@12.7.0 + - @objectstack/cloud-connection@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + - @objectstack/mcp@12.7.0 + - @objectstack/observability@12.7.0 + - @objectstack/driver-memory@12.7.0 + - @objectstack/driver-mongodb@12.7.0 + - @objectstack/driver-sql@12.7.0 + - @objectstack/driver-sqlite-wasm@12.7.0 + - @objectstack/plugin-approvals@12.7.0 + - @objectstack/plugin-audit@12.7.0 + - @objectstack/plugin-auth@12.7.0 + - @objectstack/plugin-org-scoping@12.7.0 + - @objectstack/plugin-reports@12.7.0 + - @objectstack/plugin-sharing@12.7.0 + - @objectstack/plugin-webhooks@12.7.0 + - @objectstack/rest@12.7.0 + - @objectstack/runtime@12.7.0 + - @objectstack/service-analytics@12.7.0 + - @objectstack/service-automation@12.7.0 + - @objectstack/service-cache@12.7.0 + - @objectstack/service-datasource@12.7.0 + - @objectstack/service-job@12.7.0 + - @objectstack/service-messaging@12.7.0 + - @objectstack/service-package@12.7.0 + - @objectstack/service-queue@12.7.0 + - @objectstack/service-realtime@12.7.0 + - @objectstack/service-settings@12.7.0 + - @objectstack/service-storage@12.7.0 + - @objectstack/trigger-api@12.7.0 + - @objectstack/trigger-record-change@12.7.0 + - @objectstack/trigger-schedule@12.7.0 + - @objectstack/types@12.7.0 + - @objectstack/verify@12.7.0 + - @objectstack/console@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index df35d6e2bc..b3d85736aa 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cli", - "version": "12.6.0", + "version": "12.7.0", "description": "Command Line Interface for ObjectStack Protocol", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md index ab04344454..49ffca3599 100644 --- a/packages/client-react/CHANGELOG.md +++ b/packages/client-react/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/client-react +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/client@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/client-react/package.json b/packages/client-react/package.json index 947ecdafdc..6ab0b88411 100644 --- a/packages/client-react/package.json +++ b/packages/client-react/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client-react", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "React hooks for ObjectStack Client SDK", "main": "dist/index.js", diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index 7a7a221829..e281774702 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/client +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/client/package.json b/packages/client/package.json index 4686156690..ddea8d196b 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Official Client SDK for ObjectStack Protocol", "main": "dist/index.js", diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md index 271cff3222..24642f781b 100644 --- a/packages/cloud-connection/CHANGELOG.md +++ b/packages/cloud-connection/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/cloud-connection +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/runtime@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json index 775cb4d57c..8d0b41bd20 100644 --- a/packages/cloud-connection/package.json +++ b/packages/cloud-connection/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cloud-connection", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.", "type": "module", diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md index 403a7c4e6d..e49a1202ac 100644 --- a/packages/connectors/connector-mcp/CHANGELOG.md +++ b/packages/connectors/connector-mcp/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/connector-mcp +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json index fc47ece42c..bae5a870df 100644 --- a/packages/connectors/connector-mcp/package.json +++ b/packages/connectors/connector-mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-mcp", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).", "main": "dist/index.js", diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md index 12025f1b29..4a7cd1a3f5 100644 --- a/packages/connectors/connector-openapi/CHANGELOG.md +++ b/packages/connectors/connector-openapi/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/connector-openapi +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json index ebc0c1953c..371278b202 100644 --- a/packages/connectors/connector-openapi/package.json +++ b/packages/connectors/connector-openapi/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-openapi", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).", "main": "dist/index.js", diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md index 52f9d897b9..afb59fbe52 100644 --- a/packages/connectors/connector-rest/CHANGELOG.md +++ b/packages/connectors/connector-rest/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/connector-rest +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json index 0a0f124538..f7b6d04daf 100644 --- a/packages/connectors/connector-rest/package.json +++ b/packages/connectors/connector-rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-rest", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).", "main": "dist/index.js", diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md index 0818fb09ef..e9b7212743 100644 --- a/packages/connectors/connector-slack/CHANGELOG.md +++ b/packages/connectors/connector-slack/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/connector-slack +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json index c72859dd01..cd0b6f1b25 100644 --- a/packages/connectors/connector-slack/package.json +++ b/packages/connectors/connector-slack/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-slack", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).", "main": "dist/index.js", diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md index c340ac9446..725e3f6ead 100644 --- a/packages/console/CHANGELOG.md +++ b/packages/console/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/console +## 12.7.0 + ## 12.6.0 ## 12.5.0 diff --git a/packages/console/package.json b/packages/console/package.json index 986243e2ab..c78726ab22 100644 --- a/packages/console/package.json +++ b/packages/console/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/console", - "version": "12.6.0", + "version": "12.7.0", "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).", "license": "Apache-2.0", "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index eade839a26..37a6096348 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/core +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + ## 12.6.0 ### Minor Changes diff --git a/packages/core/package.json b/packages/core/package.json index 849debdb06..cf7ff35f80 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/core", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Microkernel Core for ObjectStack", "type": "module", diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md index 3695748d39..86d048238c 100644 --- a/packages/create-objectstack/CHANGELOG.md +++ b/packages/create-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # create-objectstack +## 12.7.0 + ## 12.6.0 ## 12.5.0 diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index 48f1b02f8d..0d64238ca4 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -1,6 +1,6 @@ { "name": "create-objectstack", - "version": "12.6.0", + "version": "12.7.0", "description": "Create a new ObjectStack project — npx create-objectstack", "bin": { "create-objectstack": "./bin/create-objectstack.js" diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md index fbbb833aa8..ccaa69a1eb 100644 --- a/packages/dogfood/CHANGELOG.md +++ b/packages/dogfood/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/dogfood +## 0.0.25 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [799b285] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/plugin-security@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/example-crm@4.0.77 + - @objectstack/example-showcase@0.2.23 + - @objectstack/verify@12.7.0 + ## 0.0.24 ### Patch Changes diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json index e3a6fa7273..0540beff0f 100644 --- a/packages/dogfood/package.json +++ b/packages/dogfood/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/dogfood", - "version": "0.0.24", + "version": "0.0.25", "private": true, "license": "Apache-2.0", "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.", diff --git a/packages/downstream-contract/CHANGELOG.md b/packages/downstream-contract/CHANGELOG.md index abb6e34e99..7d9071f3f3 100644 --- a/packages/downstream-contract/CHANGELOG.md +++ b/packages/downstream-contract/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/downstream-contract +## 0.0.23 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + ## 0.0.22 ### Patch Changes diff --git a/packages/downstream-contract/package.json b/packages/downstream-contract/package.json index 7f83534a39..bc776781f5 100644 --- a/packages/downstream-contract/package.json +++ b/packages/downstream-contract/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/downstream-contract", - "version": "0.0.22", + "version": "0.0.23", "description": "Frozen third-party consumer fixture — a backward-compatibility gate for @objectstack/spec. Authored the way an external project on a published release authors metadata; if a spec change breaks it, that change is breaking (#2035).", "license": "Apache-2.0", "private": true, diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md index 9736aae31c..7e0ced09c8 100644 --- a/packages/formula/CHANGELOG.md +++ b/packages/formula/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/formula +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/formula/package.json b/packages/formula/package.json index b3675f536c..2138107f09 100644 --- a/packages/formula/package.json +++ b/packages/formula/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/formula", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry", "main": "dist/index.js", diff --git a/packages/lint/CHANGELOG.md b/packages/lint/CHANGELOG.md index 452c29d4e8..5e0841c10c 100644 --- a/packages/lint/CHANGELOG.md +++ b/packages/lint/CHANGELOG.md @@ -1,5 +1,44 @@ # @objectstack/lint +## 12.7.0 + +### Minor Changes + +- 466adf6: Author-time capability-reference lint (ADR-0066 ⑨) — `os validate` / `os lint` + now warn when a `requiredPermissions` names a capability that is registered + nowhere. + + `requiredPermissions` (on objects, fields, apps, actions) is a free string, so a + typo like `mange_users` is schema-valid and fails closed at runtime (the caller + is denied) — safe, but silent. The new `validateCapabilityReferences` rule + (`@objectstack/lint`) resolves every reference against the author-time known set + and warns on the unresolved ones: + + - built-in platform capabilities — now sourced from a single canonical list in + `@objectstack/spec` (`security/capabilities.ts`: `PLATFORM_CAPABILITIES` / + `PLATFORM_CAPABILITY_NAMES`), which `@objectstack/plugin-security`'s + `bootstrapSystemCapabilities` also seeds from (one source of truth, no drift), + - any capability a permission set in the stack grants via `systemPermissions` + (granting is what declares it — mirrors the runtime derived-defaults rule), and + - any `sys_capability` row shipped as seed data. + + It is a **warning**, not an error: a single package can't see capabilities + declared by other installed packages, and the reference fails closed anyway. + `systemPermissions` itself is never flagged — it is the declaration side, and a + package legitimately introduces new capabilities there. The object case also + understands the per-operation `requiredPermissions` map form (ADR-0066 ⑤) and + points a finding at the exact operation slice. + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/formula@12.7.0 + - @objectstack/sdui-parser@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/lint/package.json b/packages/lint/package.json index 0f7c410855..ce84ff0333 100644 --- a/packages/lint/package.json +++ b/packages/lint/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/lint", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Static, build-time validation for an ObjectStack metadata graph — dashboard widget bindings, CEL/predicate expressions, and more. Pure (stack) => Issue[] functions shared by the CLI's `os validate` and any other consumer (e.g. AI authoring). Depends on @objectstack/spec; never on a runtime.", "type": "module", diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md index f212a7aa6b..c9925c41b6 100644 --- a/packages/mcp/CHANGELOG.md +++ b/packages/mcp/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/plugin-mcp-server +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/mcp/package.json b/packages/mcp/package.json index a4b58b9d1a..a6707bb841 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/mcp", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)", "type": "module", diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md index 0ffb2cfc4f..878115d674 100644 --- a/packages/metadata-core/CHANGELOG.md +++ b/packages/metadata-core/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/metadata-core +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json index 741f9cd3b9..2225d55027 100644 --- a/packages/metadata-core/package.json +++ b/packages/metadata-core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-core", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).", "type": "module", diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md index 8e02ca7b14..e279223674 100644 --- a/packages/metadata-fs/CHANGELOG.md +++ b/packages/metadata-fs/CHANGELOG.md @@ -1,5 +1,11 @@ # @objectstack/metadata-fs +## 12.7.0 + +### Patch Changes + +- @objectstack/metadata-core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json index 065d004758..37eddbcf0c 100644 --- a/packages/metadata-fs/package.json +++ b/packages/metadata-fs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-fs", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).", "type": "module", diff --git a/packages/metadata-protocol/CHANGELOG.md b/packages/metadata-protocol/CHANGELOG.md index 690cca638f..0cf8b555de 100644 --- a/packages/metadata-protocol/CHANGELOG.md +++ b/packages/metadata-protocol/CHANGELOG.md @@ -1,5 +1,46 @@ # @objectstack/metadata-protocol +## 12.7.0 + +### Minor Changes + +- fc7e7f7: Enforce the package namespace-prefix rule for Studio-authored packages. + + The protocol requires every object name in a package to carry the package's + `manifest.namespace` prefix (`crm_account`); `defineStack()` enforces this at + compile time via `validateNamespacePrefix`. Studio/runtime-authored packages + never take that path, and they were created without a namespace at all — so the + rule was silently inert and objects published with bare, collision-prone names. + + Two runtime changes close the gap: + + - `protocol.installPackage` now derives a default namespace from the package id + (`com.example.leave` → `leave`) when the manifest declares none, and persists + it on the manifest (in-memory registry + `sys_packages`). An explicitly + declared namespace always wins (e.g. HotCRM's `crm`). + - `protocol.publishPackageDrafts` now rejects any object draft whose name lacks + the package namespace prefix, before promoting anything (atomic), with an + actionable message (`Rename it to 'leave_ticket'`). Packages that declare no + namespace are grandfathered — mirroring `defineStack`, the rule is not + invented at enforcement time. + + The per-object prefix check and the id→namespace derivation are extracted into + `@objectstack/spec/kernel` (`validateObjectNamespacePrefix`, + `deriveNamespaceFromPackageId`) as the single source shared by `defineStack` and + the runtime publish path, so the two enforcement points cannot drift. + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + - @objectstack/metadata-core@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Minor Changes diff --git a/packages/metadata-protocol/package.json b/packages/metadata-protocol/package.json index a89c175082..59efeb8c4d 100644 --- a/packages/metadata-protocol/package.json +++ b/packages/metadata-protocol/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-protocol", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack metadata management protocol: sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics (ADR-0076).", "type": "module", diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md index 84a04ed2c1..7cff9db56f 100644 --- a/packages/metadata/CHANGELOG.md +++ b/packages/metadata/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/metadata +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/metadata-core@12.7.0 + - @objectstack/types@12.7.0 + - @objectstack/metadata-fs@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/metadata/package.json b/packages/metadata/package.json index 0afb0364a5..ad3d7e6597 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Metadata loading, saving, and persistence for ObjectStack", "type": "module", diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md index a74059542e..2b242ea9e1 100644 --- a/packages/objectql/CHANGELOG.md +++ b/packages/objectql/CHANGELOG.md @@ -1,5 +1,29 @@ # @objectstack/objectql +## 12.7.0 + +### Patch Changes + +- a1766fe: fix(validation): remove polynomial ReDoS in email validation regexes + + The email validators used `/^[^\s@]+@[^\s@]+\.[^\s@]+$/`, whose quantifiers + around `\.` overlap (the literal dot is also matched by `[^\s@]`) and backtrack + polynomially on adversarial input. The domain part is rewritten as + `[^\s@.]+(?:\.[^\s@.]+)+` so labels exclude `.` and matching is linear. Valid + addresses (including multi-label domains) are unaffected; addresses with an + empty label such as `a@b..c` are now correctly rejected. + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/metadata-protocol@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + - @objectstack/metadata-core@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/objectql/package.json b/packages/objectql/package.json index 0758316043..68b0e89561 100644 --- a/packages/objectql/package.json +++ b/packages/objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/objectql", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Isomorphic ObjectQL Engine for ObjectStack", "main": "dist/index.js", diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md index 4cadaacf78..32a4b2d388 100644 --- a/packages/observability/CHANGELOG.md +++ b/packages/observability/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/observability +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/observability/package.json b/packages/observability/package.json index f70c5ec599..422d1a30a8 100644 --- a/packages/observability/package.json +++ b/packages/observability/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/observability", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.", "type": "module", diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md index 19c3dfc044..53970e1984 100644 --- a/packages/platform-objects/CHANGELOG.md +++ b/packages/platform-objects/CHANGELOG.md @@ -1,5 +1,49 @@ # @objectstack/platform-objects +## 12.7.0 + +### Minor Changes + +- 9fa84f9: Secure-by-default posture for sensitive system objects (ADR-0066 ④, system-object + slice) — the platform's raw secret/credential stores no longer ride the wildcard + `'*'` permission grant. + + `sys_secret` (encrypted settings/datasource secrets), `sys_jwks` (JWT signing + keys), `sys_verification` (password-reset / verify tokens), + `sys_oauth_access_token`, `sys_oauth_refresh_token` (live bearer credentials), + and `sys_device_code` (pending device-grant codes) now declare + `access: { default: 'private' }`: an ordinary member's generic data-layer + read/write gets 403 instead of being covered by `member_default`'s + `'*': allowRead`. Platform admins retain access via the posture-gated + `viewAllRecords`/`modifyAllRecords` superuser bypass, and every runtime consumer + is unaffected — better-auth reads via its adapter (system context), + `engine.resolveSecret` reads at driver level, and SettingsService / the + datasource secret-binder read principal-less (middleware falls open for internal + calls). + + `sys_scim_provider` (SCIM bearer-token config) gains the object-level + `requiredPermissions: ['manage_platform_settings']` capability gate, mirroring + its sibling `sys_sso_provider`. The Setup nav item for Signing Keys (JWKS) is + now capability-gated like API Keys, so non-admins don't see a menu entry that + can only 403. + + Member self-service objects (`sys_session`, `sys_api_key`, + `sys_oauth_application`, `sys_two_factor`) deliberately keep the public posture — + the Account app ("My Sessions" / "My API Keys" / "My Apps" / 2FA "My + Enrollment") reads them through the generic data layer as the member; row + scoping remains their guard. The declarations are pinned by + `platform-objects.test.ts` and the ADR-0056 D10 conformance-matrix row + `secure-by-default-posture`, so dropping the flag from a secret store fails CI. + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/metadata-core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json index cf1d1e753e..89f0cd6117 100644 --- a/packages/platform-objects/package.json +++ b/packages/platform-objects/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/platform-objects", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects", "main": "dist/index.js", diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md index 780bf21e79..c4ae4c2c71 100644 --- a/packages/plugins/driver-memory/CHANGELOG.md +++ b/packages/plugins/driver-memory/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/driver-memory +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json index 6e8a505306..6690c68ab1 100644 --- a/packages/plugins/driver-memory/package.json +++ b/packages/plugins/driver-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-memory", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "In-Memory Driver for ObjectStack (Reference Implementation)", "main": "dist/index.js", diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md index 1ed1770b15..002bd89d7f 100644 --- a/packages/plugins/driver-mongodb/CHANGELOG.md +++ b/packages/plugins/driver-mongodb/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/driver-mongodb +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json index 03f0faa24e..8b7a86f400 100644 --- a/packages/plugins/driver-mongodb/package.json +++ b/packages/plugins/driver-mongodb/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-mongodb", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client", "main": "dist/index.js", diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md index 1b5bb92265..90cd3f204e 100644 --- a/packages/plugins/driver-sql/CHANGELOG.md +++ b/packages/plugins/driver-sql/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/driver-sql +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json index 54c064f4d6..92b12915ad 100644 --- a/packages/plugins/driver-sql/package.json +++ b/packages/plugins/driver-sql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sql", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex", "main": "dist/index.js", diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md index ab228658a0..43e3a70271 100644 --- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md +++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/driver-sqlite-wasm +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/driver-sql@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json index 65dadd2701..68cb444f3d 100644 --- a/packages/plugins/driver-sqlite-wasm/package.json +++ b/packages/plugins/driver-sqlite-wasm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sqlite-wasm", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings", "keywords": [ diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md index f965d915ab..487ddfbba6 100644 --- a/packages/plugins/embedder-openai/CHANGELOG.md +++ b/packages/plugins/embedder-openai/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/embedder-openai +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json index f59e931ab9..0ca97c136a 100644 --- a/packages/plugins/embedder-openai/package.json +++ b/packages/plugins/embedder-openai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/embedder-openai", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md index e4f5a77bf7..cbfc5738dd 100644 --- a/packages/plugins/knowledge-memory/CHANGELOG.md +++ b/packages/plugins/knowledge-memory/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/knowledge-memory +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/service-knowledge@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json index ebe436f7ca..86042b170a 100644 --- a/packages/plugins/knowledge-memory/package.json +++ b/packages/plugins/knowledge-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-memory", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md index 1d8cba4f3a..b083eb6b98 100644 --- a/packages/plugins/knowledge-ragflow/CHANGELOG.md +++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/knowledge-ragflow +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/service-knowledge@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json index fe25fe8aac..e8be3877b7 100644 --- a/packages/plugins/knowledge-ragflow/package.json +++ b/packages/plugins/knowledge-ragflow/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-ragflow", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md index 4a53241c23..165b50e968 100644 --- a/packages/plugins/plugin-approvals/CHANGELOG.md +++ b/packages/plugins/plugin-approvals/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/plugin-approvals +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + - @objectstack/metadata-core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json index 4c4e15e200..08ad5d2ecf 100644 --- a/packages/plugins/plugin-approvals/package.json +++ b/packages/plugins/plugin-approvals/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-approvals", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md index 2778a32c7f..475ae81d22 100644 --- a/packages/plugins/plugin-audit/CHANGELOG.md +++ b/packages/plugins/plugin-audit/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-audit +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json index 3153059dfc..aac995d6bc 100644 --- a/packages/plugins/plugin-audit/package.json +++ b/packages/plugins/plugin-audit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-audit", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Audit Plugin for ObjectStack — System audit log object and audit trail", "main": "dist/index.js", diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md index baff8b719c..69834c00f0 100644 --- a/packages/plugins/plugin-auth/CHANGELOG.md +++ b/packages/plugins/plugin-auth/CHANGELOG.md @@ -1,5 +1,19 @@ # Changelog +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index 37818b8def..186f3fe46d 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-auth", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Authentication & Identity Plugin for ObjectStack", "main": "dist/index.js", diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md index 0e2cf549c6..361647681d 100644 --- a/packages/plugins/plugin-dev/CHANGELOG.md +++ b/packages/plugins/plugin-dev/CHANGELOG.md @@ -1,5 +1,31 @@ # @objectstack/plugin-dev +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [799b285] +- Updated dependencies [b1081b8] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/plugin-security@12.7.0 + - @objectstack/plugin-hono-server@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/account@12.7.0 + - @objectstack/setup@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/driver-memory@12.7.0 + - @objectstack/plugin-auth@12.7.0 + - @objectstack/plugin-org-scoping@12.7.0 + - @objectstack/rest@12.7.0 + - @objectstack/runtime@12.7.0 + - @objectstack/service-i18n@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json index daf621b318..4d35425c18 100644 --- a/packages/plugins/plugin-dev/package.json +++ b/packages/plugins/plugin-dev/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-dev", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations", "main": "dist/index.js", diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md index 522dc01972..0554765c20 100644 --- a/packages/plugins/plugin-email/CHANGELOG.md +++ b/packages/plugins/plugin-email/CHANGELOG.md @@ -1,5 +1,28 @@ # @objectstack/plugin-email +## 12.7.0 + +### Patch Changes + +- a1766fe: fix(validation): remove polynomial ReDoS in email validation regexes + + The email validators used `/^[^\s@]+@[^\s@]+\.[^\s@]+$/`, whose quantifiers + around `\.` overlap (the literal dot is also matched by `[^\s@]`) and backtrack + polynomially on adversarial input. The domain part is rewritten as + `[^\s@.]+(?:\.[^\s@.]+)+` so labels exclude `.` and matching is linear. Valid + addresses (including multi-label domains) are unaffected; addresses with an + empty label such as `a@b..c` are now correctly rejected. + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json index 83fb37c1af..7327e45ec1 100644 --- a/packages/plugins/plugin-email/package.json +++ b/packages/plugins/plugin-email/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-email", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md index 891067a8b9..911fe5d5bc 100644 --- a/packages/plugins/plugin-hono-server/CHANGELOG.md +++ b/packages/plugins/plugin-hono-server/CHANGELOG.md @@ -1,5 +1,32 @@ # @objectstack/plugin-hono-server +## 12.7.0 + +### Patch Changes + +- b1081b8: Return `405 Method Not Allowed` (with an accurate `Allow` header and a + descriptive body) instead of an opaque `{"error":"Not found"}` 404 when a + request hits a registered path under the wrong HTTP method. + + Hono routes a method mismatch to the same `notFound` sink as a genuinely + missing path, so a `POST` to a `PUT`-only route (e.g. the metadata save + endpoint `PUT /api/v1/meta/:type/:name`) gave callers no hint that the path + exists under another verb (#2684). The server now tracks every registered + `(method, pattern)` pair and re-matches the request path in the `notFound` + handler: matching another method yields a 405; matching nothing stays a 404. + This is framework-wide — every registered endpoint benefits. Static/SPA + catch-alls registered straight on the raw Hono app are not tracked and never + produce a spurious 405. + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/observability@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json index 8974a4fd46..b83f524c07 100644 --- a/packages/plugins/plugin-hono-server/package.json +++ b/packages/plugins/plugin-hono-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-hono-server", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Standard Hono Server Adapter for ObjectStack Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-org-scoping/CHANGELOG.md b/packages/plugins/plugin-org-scoping/CHANGELOG.md index b460ba41fd..df1f464cc9 100644 --- a/packages/plugins/plugin-org-scoping/CHANGELOG.md +++ b/packages/plugins/plugin-org-scoping/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-org-scoping +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-org-scoping/package.json b/packages/plugins/plugin-org-scoping/package.json index c82194d91b..8105900ccb 100644 --- a/packages/plugins/plugin-org-scoping/package.json +++ b/packages/plugins/plugin-org-scoping/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-org-scoping", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Organization-Scoping Plugin for ObjectStack — row-level Organization isolation, per-org seed replay, default-org bootstrap", "main": "dist/index.js", diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md index 9ae12b86d4..e80694acee 100644 --- a/packages/plugins/plugin-reports/CHANGELOG.md +++ b/packages/plugins/plugin-reports/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-reports +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json index 2fed24d2eb..9e99b64ce3 100644 --- a/packages/plugins/plugin-reports/package.json +++ b/packages/plugins/plugin-reports/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-reports", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md index aaad2a7ef5..1d8ce039e6 100644 --- a/packages/plugins/plugin-security/CHANGELOG.md +++ b/packages/plugins/plugin-security/CHANGELOG.md @@ -1,5 +1,70 @@ # @objectstack/plugin-security +## 12.7.0 + +### Minor Changes + +- 466adf6: Per-operation object `requiredPermissions` (ADR-0066 ⑤) — an object can now be + read-open / write-gated instead of gating all of CRUD on one capability set. + + `Object.requiredPermissions` accepts either the original `string[]` (capabilities + required for **all** operations) **or** a `{ read?, create?, update?, delete? }` + map that gates each operation class independently — mirroring how Salesforce and + Dataverse separate capability by operation. plugin-security enforces the caps for + the request's operation class as the same D3 AND-gate (checked before the CRUD + grant, fail-closed). The mapping folds `transfer`/`restore` into `update` and + `purge` into `delete`, derived from the existing CRUD permission bits so it stays + in lockstep with them. + + Backward-compatible: the `string[]` form keeps its gate-every-operation semantics + (normalized into an `all` bucket that unions with the per-operation bucket), so + existing objects are unaffected. The per-operation map's keys are validated + `.strict()`, so a mistyped key (e.g. `reads`) is rejected at author time rather + than silently ignored. + +### Patch Changes + +- 466adf6: Author-time capability-reference lint (ADR-0066 ⑨) — `os validate` / `os lint` + now warn when a `requiredPermissions` names a capability that is registered + nowhere. + + `requiredPermissions` (on objects, fields, apps, actions) is a free string, so a + typo like `mange_users` is schema-valid and fails closed at runtime (the caller + is denied) — safe, but silent. The new `validateCapabilityReferences` rule + (`@objectstack/lint`) resolves every reference against the author-time known set + and warns on the unresolved ones: + + - built-in platform capabilities — now sourced from a single canonical list in + `@objectstack/spec` (`security/capabilities.ts`: `PLATFORM_CAPABILITIES` / + `PLATFORM_CAPABILITY_NAMES`), which `@objectstack/plugin-security`'s + `bootstrapSystemCapabilities` also seeds from (one source of truth, no drift), + - any capability a permission set in the stack grants via `systemPermissions` + (granting is what declares it — mirrors the runtime derived-defaults rule), and + - any `sys_capability` row shipped as seed data. + + It is a **warning**, not an error: a single package can't see capabilities + declared by other installed packages, and the reference fails closed anyway. + `systemPermissions` itself is never flagged — it is the declaration side, and a + package legitimately introduces new capabilities there. The object case also + understands the per-operation `requiredPermissions` map form (ADR-0066 ⑤) and + points a finding at the exact operation slice. + +- 799b285: Fix field-level-security read leak on mutation responses. The security + middleware only masked read-protected fields on `find`/`findOne` results, so a + caller with edit-but-not-field-read could `insert`/`update` a record and read a + read-protected field back out of the echoed post-image (field WRITES were + already blocked, but the response image was not masked). The mask now also + covers `insert`/`update` results, matching read behavior. +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json index 51babb3f4d..b4430dea27 100644 --- a/packages/plugins/plugin-security/package.json +++ b/packages/plugins/plugin-security/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-security", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md index 1d51ba8047..eb782d9d3b 100644 --- a/packages/plugins/plugin-sharing/CHANGELOG.md +++ b/packages/plugins/plugin-sharing/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-sharing +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json index cb50961c66..d78a099097 100644 --- a/packages/plugins/plugin-sharing/package.json +++ b/packages/plugins/plugin-sharing/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sharing", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md index 2d94b465a5..dadaa519f4 100644 --- a/packages/plugins/plugin-webhooks/CHANGELOG.md +++ b/packages/plugins/plugin-webhooks/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/plugin-webhooks +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/service-messaging@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json index 7b71f1bdd1..009c2e654c 100644 --- a/packages/plugins/plugin-webhooks/package.json +++ b/packages/plugins/plugin-webhooks/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-webhooks", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.", "type": "module", diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md index 9c8b7cb2d9..91a9fe8277 100644 --- a/packages/rest/CHANGELOG.md +++ b/packages/rest/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/rest +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/service-package@12.7.0 + ## 12.6.0 ### Minor Changes diff --git a/packages/rest/package.json b/packages/rest/package.json index aab3475e0e..70a2e9f98e 100644 --- a/packages/rest/package.json +++ b/packages/rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/rest", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol", "type": "module", diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md index d4e7000b5d..ccb6d6c758 100644 --- a/packages/runtime/CHANGELOG.md +++ b/packages/runtime/CHANGELOG.md @@ -1,5 +1,33 @@ # @objectstack/runtime +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [799b285] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/plugin-security@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + - @objectstack/metadata@12.7.0 + - @objectstack/observability@12.7.0 + - @objectstack/driver-memory@12.7.0 + - @objectstack/driver-sql@12.7.0 + - @objectstack/driver-sqlite-wasm@12.7.0 + - @objectstack/plugin-auth@12.7.0 + - @objectstack/plugin-org-scoping@12.7.0 + - @objectstack/rest@12.7.0 + - @objectstack/service-cluster@12.7.0 + - @objectstack/service-datasource@12.7.0 + - @objectstack/service-i18n@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/runtime/package.json b/packages/runtime/package.json index 416ad71a74..cf40371cbf 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/runtime", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack Core Runtime & Query Engine", "type": "module", diff --git a/packages/sdui-parser/CHANGELOG.md b/packages/sdui-parser/CHANGELOG.md index 40bc3dd046..1d37e7bdfd 100644 --- a/packages/sdui-parser/CHANGELOG.md +++ b/packages/sdui-parser/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/sdui-parser +## 12.7.0 + ## 12.6.0 ## 12.5.0 diff --git a/packages/sdui-parser/package.json b/packages/sdui-parser/package.json index 5277114f94..1837eacbe1 100644 --- a/packages/sdui-parser/package.json +++ b/packages/sdui-parser/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/sdui-parser", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "ObjectStack constrained JSX-source → SDUI SchemaNode tree compiler (parse, never execute). Isomorphic, zero React. ADR-0080.", "main": "dist/index.js", diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md index 33a9a98d5e..4739ef2987 100644 --- a/packages/services/service-analytics/CHANGELOG.md +++ b/packages/services/service-analytics/CHANGELOG.md @@ -1,5 +1,16 @@ # Changelog — @objectstack/service-analytics +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json index c00de93d46..3e2ec164e9 100644 --- a/packages/services/service-analytics/package.json +++ b/packages/services/service-analytics/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-analytics", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)", "type": "module", diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md index 0a30f0099f..0b37705a2d 100644 --- a/packages/services/service-automation/CHANGELOG.md +++ b/packages/services/service-automation/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-automation +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/formula@12.7.0 + ## 12.6.0 ### Minor Changes diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json index 5cffef888d..a18883cebb 100644 --- a/packages/services/service-automation/package.json +++ b/packages/services/service-automation/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-automation", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine", "type": "module", diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md index e10cbfdbe5..0c74ebe83d 100644 --- a/packages/services/service-cache/CHANGELOG.md +++ b/packages/services/service-cache/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-cache +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/observability@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json index 0f640c8fc2..ceec7d1216 100644 --- a/packages/services/service-cache/package.json +++ b/packages/services/service-cache/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cache", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters", "type": "module", diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md index 49248d6a5c..d211b785a6 100644 --- a/packages/services/service-cluster-redis/CHANGELOG.md +++ b/packages/services/service-cluster-redis/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-cluster-redis +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/service-cluster@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json index 1df1084c81..ee8c3be345 100644 --- a/packages/services/service-cluster-redis/package.json +++ b/packages/services/service-cluster-redis/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster-redis", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.", "type": "module", diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md index d9b8b00c95..72998c4150 100644 --- a/packages/services/service-cluster/CHANGELOG.md +++ b/packages/services/service-cluster/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-cluster +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json index 0f7f01ce3c..b56fb20a5d 100644 --- a/packages/services/service-cluster/package.json +++ b/packages/services/service-cluster/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.", "type": "module", diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md index 94a17df7f9..9a4a071b5d 100644 --- a/packages/services/service-datasource/CHANGELOG.md +++ b/packages/services/service-datasource/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-external-datasource +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json index 5084e4f1f8..b98be7aa82 100644 --- a/packages/services/service-datasource/package.json +++ b/packages/services/service-datasource/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-datasource", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.", "type": "module", diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md index c0fd417a88..0d8ae44dfd 100644 --- a/packages/services/service-i18n/CHANGELOG.md +++ b/packages/services/service-i18n/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-i18n +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json index 22160bedb0..276e73107d 100644 --- a/packages/services/service-i18n/package.json +++ b/packages/services/service-i18n/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-i18n", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading", "type": "module", diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md index 0b8db31962..b5d0d2b049 100644 --- a/packages/services/service-job/CHANGELOG.md +++ b/packages/services/service-job/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-job +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json index 3bb0a62173..43221f597a 100644 --- a/packages/services/service-job/package.json +++ b/packages/services/service-job/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-job", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling", "type": "module", diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md index 25869bc319..184accd8a3 100644 --- a/packages/services/service-knowledge/CHANGELOG.md +++ b/packages/services/service-knowledge/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-knowledge +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json index 2bf739e6fb..a84d80a70e 100644 --- a/packages/services/service-knowledge/package.json +++ b/packages/services/service-knowledge/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-knowledge", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).", "type": "module", diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md index 505f7711c5..585e43c6fc 100644 --- a/packages/services/service-messaging/CHANGELOG.md +++ b/packages/services/service-messaging/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-messaging +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json index e49989d5c5..8757350098 100644 --- a/packages/services/service-messaging/package.json +++ b/packages/services/service-messaging/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-messaging", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.", "type": "module", diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md index b32c7437ee..b389d404df 100644 --- a/packages/services/service-package/CHANGELOG.md +++ b/packages/services/service-package/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/service-package +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json index e556e61a47..e84729e4d0 100644 --- a/packages/services/service-package/package.json +++ b/packages/services/service-package/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-package", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Package management service for ObjectStack — publish, install, and manage packages", "type": "module", diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md index 8b6b050dfc..aaad093ef5 100644 --- a/packages/services/service-queue/CHANGELOG.md +++ b/packages/services/service-queue/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-queue +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json index c5e50b8359..652f207cad 100644 --- a/packages/services/service-queue/package.json +++ b/packages/services/service-queue/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-queue", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters", "type": "module", diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md index f898f27709..8d84bea681 100644 --- a/packages/services/service-realtime/CHANGELOG.md +++ b/packages/services/service-realtime/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-realtime +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json index 2ff5076bfa..0efaed1307 100644 --- a/packages/services/service-realtime/package.json +++ b/packages/services/service-realtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-realtime", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub", "type": "module", diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md index 9def2e8945..fc33da8301 100644 --- a/packages/services/service-settings/CHANGELOG.md +++ b/packages/services/service-settings/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-settings +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/types@12.7.0 + ## 12.6.0 ### Minor Changes diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json index ffa5693417..81cdffc590 100644 --- a/packages/services/service-settings/package.json +++ b/packages/services/service-settings/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-settings", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.", "type": "module", diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md index d6d543b5dc..841068d6e9 100644 --- a/packages/services/service-storage/CHANGELOG.md +++ b/packages/services/service-storage/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-storage +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [9fa84f9] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/platform-objects@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/observability@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json index 2e99ce695b..9a26e39b2e 100644 --- a/packages/services/service-storage/package.json +++ b/packages/services/service-storage/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-storage", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton", "type": "module", diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md index 20114e7d45..9a85bdbf15 100644 --- a/packages/spec/CHANGELOG.md +++ b/packages/spec/CHANGELOG.md @@ -1,5 +1,110 @@ # @objectstack/spec +## 12.7.0 + +### Minor Changes + +- 466adf6: Author-time capability-reference lint (ADR-0066 ⑨) — `os validate` / `os lint` + now warn when a `requiredPermissions` names a capability that is registered + nowhere. + + `requiredPermissions` (on objects, fields, apps, actions) is a free string, so a + typo like `mange_users` is schema-valid and fails closed at runtime (the caller + is denied) — safe, but silent. The new `validateCapabilityReferences` rule + (`@objectstack/lint`) resolves every reference against the author-time known set + and warns on the unresolved ones: + + - built-in platform capabilities — now sourced from a single canonical list in + `@objectstack/spec` (`security/capabilities.ts`: `PLATFORM_CAPABILITIES` / + `PLATFORM_CAPABILITY_NAMES`), which `@objectstack/plugin-security`'s + `bootstrapSystemCapabilities` also seeds from (one source of truth, no drift), + - any capability a permission set in the stack grants via `systemPermissions` + (granting is what declares it — mirrors the runtime derived-defaults rule), and + - any `sys_capability` row shipped as seed data. + + It is a **warning**, not an error: a single package can't see capabilities + declared by other installed packages, and the reference fails closed anyway. + `systemPermissions` itself is never flagged — it is the declaration side, and a + package legitimately introduces new capabilities there. The object case also + understands the per-operation `requiredPermissions` map form (ADR-0066 ⑤) and + points a finding at the exact operation slice. + +- 466adf6: Per-operation object `requiredPermissions` (ADR-0066 ⑤) — an object can now be + read-open / write-gated instead of gating all of CRUD on one capability set. + + `Object.requiredPermissions` accepts either the original `string[]` (capabilities + required for **all** operations) **or** a `{ read?, create?, update?, delete? }` + map that gates each operation class independently — mirroring how Salesforce and + Dataverse separate capability by operation. plugin-security enforces the caps for + the request's operation class as the same D3 AND-gate (checked before the CRUD + grant, fail-closed). The mapping folds `transfer`/`restore` into `update` and + `purge` into `delete`, derived from the existing CRUD permission bits so it stays + in lockstep with them. + + Backward-compatible: the `string[]` form keeps its gate-every-operation semantics + (normalized into an `all` bucket that unions with the per-operation bucket), so + existing objects are unaffected. The per-operation map's keys are validated + `.strict()`, so a mistyped key (e.g. `reads`) is rejected at author time rather + than silently ignored. + +- 2bee609: BREAKING (pre-launch): remove the three declared-but-never-enforced compliance + subsystems per ADR-0056 D8 ("design + enforce, or remove"), and mark the AI + agent `visibility` property EXPERIMENTAL (#1901). + + Removed — none of these were read by any runtime path, and compliance-grade + configuration must never merely look live: + + - `ComplianceConfigSchema` / `GDPRConfigSchema` / `HIPAAConfigSchema` (and the + rest of `system/compliance.zod.ts`) — there is no data-subject-rights engine, + retention enforcer, or BAA gate. FROM `import { ComplianceConfigSchema } from +'@objectstack/spec/system'` TO: delete the reference — a real compliance + subsystem will be designed top-down when scheduled. + - `MaskingConfigSchema` / `MaskingRuleSchema` (`system/masking.zod.ts`) — no + redaction layer applies them. FROM masking config TO: field-level security + (permission-set field rules, enforced by plugin-security's field masker); a + subtractive masking/deny layer arrives with ADR-0066 ⑦/⑧ if needed. + - `RLSConfigSchema` / `RLSAuditEventSchema` / `RLSAuditConfigSchema` + (`security/rls.zod.ts`) — the enforced RLS path never read the global config. + FROM global `RLSConfig` TO: per-policy `RowLevelSecurityPolicySchema` (the + live, enforced surface — unchanged). + + Kept, still `[EXPERIMENTAL]`: `EncryptionConfigSchema` (at-rest field + encryption) — a real enterprise roadmap item with a stable shape; carrying it + marked costs less than remove-and-re-add (ADR-0087). + + Marked `[EXPERIMENTAL — NOT ENFORCED]` (#1901): `AgentSchema.visibility` — the + chat-access evaluator deliberately excludes it and the agent list route does + not filter by it, so `private` does not hide an agent. The schema description + and the authoring form now say so; use `access` / `permissions` (both enforced + at the chat route since #1884) for real gating. The ADR-0056 D10 conformance + matrix tracks all dispositions (`agent-visibility` experimental; + `compliance-configs` / `data-masking` / `rls-config-global` removed). + +- fc7e7f7: Enforce the package namespace-prefix rule for Studio-authored packages. + + The protocol requires every object name in a package to carry the package's + `manifest.namespace` prefix (`crm_account`); `defineStack()` enforces this at + compile time via `validateNamespacePrefix`. Studio/runtime-authored packages + never take that path, and they were created without a namespace at all — so the + rule was silently inert and objects published with bare, collision-prone names. + + Two runtime changes close the gap: + + - `protocol.installPackage` now derives a default namespace from the package id + (`com.example.leave` → `leave`) when the manifest declares none, and persists + it on the manifest (in-memory registry + `sys_packages`). An explicitly + declared namespace always wins (e.g. HotCRM's `crm`). + - `protocol.publishPackageDrafts` now rejects any object draft whose name lacks + the package namespace prefix, before promoting anything (atomic), with an + actionable message (`Rename it to 'leave_ticket'`). Packages that declare no + namespace are grandfathered — mirroring `defineStack`, the rule is not + invented at enforcement time. + + The per-object prefix check and the id→namespace derivation are extracted into + `@objectstack/spec/kernel` (`validateObjectNamespacePrefix`, + `deriveNamespaceFromPackageId`) as the single source shared by `defineStack` and + the runtime publish path, so the two enforcement points cannot drift. + ## 12.6.0 ### Minor Changes diff --git a/packages/spec/package.json b/packages/spec/package.json index b1dc36cb0d..44846cd2f8 100644 --- a/packages/spec/package.json +++ b/packages/spec/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/spec", - "version": "12.6.0", + "version": "12.7.0", "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md index c105ee7da3..b0f6f68506 100644 --- a/packages/triggers/trigger-api/CHANGELOG.md +++ b/packages/triggers/trigger-api/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/trigger-api +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json index 8982dbf2a6..cd85bbca88 100644 --- a/packages/triggers/trigger-api/package.json +++ b/packages/triggers/trigger-api/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-api", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md index 7ae20a3855..c8705cc2a5 100644 --- a/packages/triggers/trigger-record-change/CHANGELOG.md +++ b/packages/triggers/trigger-record-change/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/plugin-trigger-record-change +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json index 55867f110f..d7ab3c90f8 100644 --- a/packages/triggers/trigger-record-change/package.json +++ b/packages/triggers/trigger-record-change/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-record-change", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md index 574e6f9cc8..9571011843 100644 --- a/packages/triggers/trigger-schedule/CHANGELOG.md +++ b/packages/triggers/trigger-schedule/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/plugin-trigger-schedule +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/core@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json index 992b9e7a1a..47cd8e7ddd 100644 --- a/packages/triggers/trigger-schedule/package.json +++ b/packages/triggers/trigger-schedule/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-schedule", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)", "main": "dist/index.js", diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md index f24016d7d0..08e4fa42c7 100644 --- a/packages/types/CHANGELOG.md +++ b/packages/types/CHANGELOG.md @@ -1,5 +1,15 @@ # @objectstack/types +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [466adf6] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + ## 12.6.0 ### Patch Changes diff --git a/packages/types/package.json b/packages/types/package.json index c65b938fef..5be48cd017 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/types", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Shared interfaces describing the ObjectStack Runtime environment", "main": "dist/index.js", diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md index f0ec105d22..8389237e4d 100644 --- a/packages/verify/CHANGELOG.md +++ b/packages/verify/CHANGELOG.md @@ -1,5 +1,32 @@ # @objectstack/verify +## 12.7.0 + +### Patch Changes + +- Updated dependencies [466adf6] +- Updated dependencies [799b285] +- Updated dependencies [b1081b8] +- Updated dependencies [466adf6] +- Updated dependencies [a1766fe] +- Updated dependencies [2bee609] +- Updated dependencies [fc7e7f7] + - @objectstack/spec@12.7.0 + - @objectstack/plugin-security@12.7.0 + - @objectstack/plugin-hono-server@12.7.0 + - @objectstack/objectql@12.7.0 + - @objectstack/core@12.7.0 + - @objectstack/driver-sqlite-wasm@12.7.0 + - @objectstack/plugin-auth@12.7.0 + - @objectstack/plugin-org-scoping@12.7.0 + - @objectstack/plugin-sharing@12.7.0 + - @objectstack/rest@12.7.0 + - @objectstack/runtime@12.7.0 + - @objectstack/service-analytics@12.7.0 + - @objectstack/service-automation@12.7.0 + - @objectstack/service-datasource@12.7.0 + - @objectstack/service-settings@12.7.0 + ## 12.6.0 ### Minor Changes diff --git a/packages/verify/package.json b/packages/verify/package.json index 2e8a676206..16c0ccd20b 100644 --- a/packages/verify/package.json +++ b/packages/verify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/verify", - "version": "12.6.0", + "version": "12.7.0", "license": "Apache-2.0", "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.", "type": "module", diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md index 5990175a61..56fa280672 100644 --- a/packages/vscode-objectstack/CHANGELOG.md +++ b/packages/vscode-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # objectstack-vscode +## 12.7.0 + ## 12.6.0 ## 12.5.0 diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json index ebd0a29f5d..13086920ad 100644 --- a/packages/vscode-objectstack/package.json +++ b/packages/vscode-objectstack/package.json @@ -2,7 +2,7 @@ "name": "objectstack-vscode", "displayName": "ObjectStack", "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files", - "version": "12.6.0", + "version": "12.7.0", "publisher": "objectstack", "license": "Apache-2.0", "repository": {