Version Packages (#949)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: RhysSullivan

.changeset/unified-auth-methods.md

@@ -1,5 +1,28 @@
 # executor
 
+## 1.5.4
+
+### Patch Changes
+
+- [#943](https://github.com/RhysSullivan/executor/pull/943) [`f485e4a`](https://github.com/RhysSullivan/executor/commit/f485e4a23cf3756b9e628cf2d9242fbc0b3da178) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - **One auth model across OpenAPI, GraphQL, and MCP**
+  - Every protocol plugin now stores the same placements-based auth methods (the new `@executor-js/sdk/http-auth` vocabulary): an API-key method carries any mix of header and query placements, each rendered from its own credential input — so one source can declare OAuth, a bearer-header-plus-team-id-query method, a plain bearer, and a query token side by side, and one connection can carry several values (e.g. both Datadog keys).
+  - MCP and GraphQL gain what only OpenAPI could do before: multi-placement methods, query-parameter credentials (servers like ui.sh's `?token=`), and multi-input connections. Rendering, catalog projection, slug normalization, and the React method editor/codec are shared instead of triplicated; the connect modal collects one value per input.
+  - Invoking with an unresolvable credential input now fails with `connection_value_missing` (naming the missing inputs) instead of silently dialing unauthenticated.
+  - Stored integration configs are rewritten to the canonical shape by a one-off migration: local and self-host run it automatically at startup; cloud operators run `bun run db:migrate-auth:prod` before deploying. Connection bindings and stored credential values are preserved exactly.
+  - Authoring: apikey methods are authored in ONE request-shaped dialect on every plugin — it reads like the request it produces: `{ type: "apiKey", headers: { Authorization: ["Bearer ", variable("token")] }, queryParams: { team_id: [variable("team_id")] } }` (`variable()` is exported from each plugin; a plain-string value is a static literal). Inputs normalize to the canonical placements model, which is what stored configs and the catalog read as. Authoring is strict where the renderer is: a value carries at most one variable, as the final part.
+  - Every method is keyed by `kind` — OpenAPI's oauth templates re-key from the retired `type: "oauth"` spelling to `kind: "oauth2"` (matching MCP/GraphQL); the one-off migration rewrites stored entries.
+  - Breaking (wire): the retired single-placement inputs (`headerName` on MCP, `in`/`name` on GraphQL), raw canonical-placement inputs, and `type: "oauth"` oauth inputs are rejected. The `mcp.addServer` singular `auth` shorthand still works.
+
+- [#950](https://github.com/RhysSullivan/executor/pull/950) [`dbb48ec`](https://github.com/RhysSullivan/executor/commit/dbb48ec99e923b15cc39fa5041887566f4a6d2d0) Thanks [@RhysSullivan](https://github.com/RhysSullivan)! - **Fix credential sharing for workspace connections**
+
+  Org-shared connections now resolve for every member of a workspace, not only the member who created them. Existing connections are migrated automatically; stored secrets are unaffected.
+
+- Updated dependencies []:
+  - @executor-js/local@1.4.4
+  - @executor-js/sdk@1.5.4
+  - @executor-js/runtime-quickjs@1.5.4
+  - @executor-js/api@1.4.26
+
 ## 1.5.3
 
 ### Patch Changes

.changeset/vault-org-connection-partition.md

@@ -1,6 +1,6 @@
 {
   "name": "executor",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "private": true,
   "bin": {
     "executor": "./bin/executor.ts"

apps/cli/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @executor-js/cloud
 
+## 1.4.24
+
+### Patch Changes
+
+- Updated dependencies [[`f485e4a`](https://github.com/RhysSullivan/executor/commit/f485e4a23cf3756b9e628cf2d9242fbc0b3da178)]:
+  - @executor-js/react@1.4.26
+  - @executor-js/plugin-graphql@1.5.4
+  - @executor-js/plugin-mcp@1.5.4
+  - @executor-js/plugin-openapi@1.5.4
+  - @executor-js/plugin-workos-vault@0.0.2
+  - @executor-js/runtime-dynamic-worker@1.4.4
+  - @executor-js/sdk@1.5.4
+  - @executor-js/runtime-quickjs@1.5.4
+  - @executor-js/execution@1.5.4
+  - @executor-js/api@1.4.26
+  - @executor-js/vite-plugin@0.0.23
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/cloudflare@0.0.5
+
 ## 1.4.23
 
 ### Patch Changes

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/cloud",
-  "version": "1.4.23",
+  "version": "1.4.24",
   "private": true,
   "type": "module",
   "scripts": {

apps/cloud/CHANGELOG.md

@@ -1,5 +1,7 @@
 # @executor-js/desktop
 
+## 1.5.4
+
 ## 1.5.3
 
 ## 1.5.2

apps/cloud/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/desktop",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "private": true,
   "homepage": "https://github.com/RhysSullivan/executor",
   "license": "MIT",

apps/desktop/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @executor-js/host-selfhost
 
+## 0.0.5
+
+### Patch Changes
+
+- Updated dependencies [[`f485e4a`](https://github.com/RhysSullivan/executor/commit/f485e4a23cf3756b9e628cf2d9242fbc0b3da178)]:
+  - @executor-js/react@1.4.26
+  - @executor-js/app@1.4.4
+  - @executor-js/plugin-graphql@1.5.4
+  - @executor-js/plugin-mcp@1.5.4
+  - @executor-js/plugin-openapi@1.5.4
+  - @executor-js/sdk@1.5.4
+  - @executor-js/runtime-quickjs@1.5.4
+  - @executor-js/execution@1.5.4
+  - @executor-js/api@1.4.26
+  - @executor-js/host-mcp@1.4.4
+  - @executor-js/plugin-encrypted-secrets@0.0.5
+
 ## 0.0.4
 
 ### Patch Changes

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/host-selfhost",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "private": true,
   "type": "module",
   "exports": {