Changelog

10.3.0

Patch Changes

@objectstack/spec@10.3.0
@objectstack/core@10.3.0
@objectstack/types@10.3.0
@objectstack/platform-objects@10.3.0

10.2.0

Patch Changes

Updated dependencies [b496498]
- @objectstack/spec@10.2.0
- @objectstack/core@10.2.0
- @objectstack/platform-objects@10.2.0
- @objectstack/types@10.2.0

10.1.0

Patch Changes

Updated dependencies [49da36e]
Updated dependencies [ac79f16]
- @objectstack/spec@10.1.0
- @objectstack/core@10.1.0
- @objectstack/platform-objects@10.1.0
- @objectstack/types@10.1.0

10.0.0

Patch Changes

Updated dependencies [d7ff626]
Updated dependencies [2a1b16b]
Updated dependencies [2256e93]
Updated dependencies [7108ff3]
Updated dependencies [30c0313]
Updated dependencies [e16f2a8]
Updated dependencies [e411a82]
Updated dependencies [ae271d0]
Updated dependencies [61ed5c7]
Updated dependencies [a581385]
Updated dependencies [d5f6d29]
Updated dependencies [220ce5b]
Updated dependencies [3efe334]
Updated dependencies [0df063e]
Updated dependencies [ce13bb8]
Updated dependencies [feead7e]
Updated dependencies [6ca20b3]
Updated dependencies [5f875fe]
Updated dependencies [b469950]
Updated dependencies [47d978a]
- @objectstack/spec@10.0.0
- @objectstack/platform-objects@10.0.0
- @objectstack/core@10.0.0
- @objectstack/types@10.0.0

9.11.0

Patch Changes

Updated dependencies [e7f6539]
Updated dependencies [2365d07]
Updated dependencies [6595b53]
Updated dependencies [fa8964d]
Updated dependencies [36138c7]
Updated dependencies [a8e4f3b]
Updated dependencies [4c213c2]
Updated dependencies [2afb612]
- @objectstack/spec@9.11.0
- @objectstack/core@9.11.0
- @objectstack/platform-objects@9.11.0
- @objectstack/types@9.11.0

9.10.0

Patch Changes

Updated dependencies [db02bd5]
Updated dependencies [641675d]
Updated dependencies [94e9040]
Updated dependencies [4331adb]
Updated dependencies [1f88fd9]
Updated dependencies [1f88fd9]
- @objectstack/spec@9.10.0
- @objectstack/platform-objects@9.10.0
- @objectstack/core@9.10.0
- @objectstack/types@9.10.0

9.9.1

Patch Changes

@objectstack/spec@9.9.1
@objectstack/core@9.9.1
@objectstack/types@9.9.1
@objectstack/platform-objects@9.9.1

9.9.0

Minor Changes

0d4e3f3: feat(auth): password-policy & session settings — live, enforced (P0 security)

Extends the existing auth settings manifest (global scope) with the security policy keys that are genuinely enforced today, rather than standing up a new security namespace full of non-functional toggles (which would be false surface):
- Password policy — password_min_length (default 8), password_max_length (default 128). Enforced by better-auth on sign-up and password reset.
- Sessions — session_expiry_days (default 7, absolute lifetime), session_refresh_days (default 1, refresh threshold).
These ride the existing AuthPlugin.bindAuthSettings → AuthManager.applyConfigPatch path (read on kernel:ready, re-applied live via settings.subscribe('auth'), which invalidates the cached better-auth instance). Days are converted to seconds for better-auth's session.{expiresIn,updateAge}; unset (source: 'default') and malformed/non-positive values are ignored so the provider default holds. Ships en + zh-CN translations.

Deliberately out of scope (no enforcement exists, so they're not declared as settings): MFA-required, IP allowlist, SSO/SAML, SCIM, API rate limits, password complexity/rotation/history. These are real features to be built, not settings toggles.

Patch Changes

Updated dependencies [84249a4]
Updated dependencies [11af299]
Updated dependencies [d5774b5]
Updated dependencies [134043a]
Updated dependencies [90108e0]
Updated dependencies [9afeb2d]
Updated dependencies [6bec07e]
Updated dependencies [601cc11]
Updated dependencies [575448d]
- @objectstack/spec@9.9.0
- @objectstack/core@9.9.0
- @objectstack/platform-objects@9.9.0
- @objectstack/types@9.9.0

9.8.0

Patch Changes

Updated dependencies [97c55b3]
Updated dependencies [1b1f490]
- @objectstack/spec@9.8.0
- @objectstack/core@9.8.0
- @objectstack/platform-objects@9.8.0
- @objectstack/types@9.8.0

9.7.0

Patch Changes

@objectstack/spec@9.7.0
@objectstack/core@9.7.0
@objectstack/types@9.7.0
@objectstack/platform-objects@9.7.0

9.6.0

Patch Changes

1b82b64: auth: expose isPlatformAdmin on the customSession user payload

The session already derives a coarse admin role for platform admins or active-org admins, but never surfaced the underlying platform-admin signal. Console action visible CEL predicates need it to gate platform-admin-only object actions (e.g. sys_environment.change_plan) without hiding org-admin actions. Both customSession return paths now carry the boolean; org-admins who are not platform admins correctly get isPlatformAdmin: false.
Updated dependencies [d1e930a]
Updated dependencies [71578f2]
Updated dependencies [5e3a301]
Updated dependencies [5db2742]
- @objectstack/spec@9.6.0
- @objectstack/core@9.6.0
- @objectstack/platform-objects@9.6.0
- @objectstack/types@9.6.0

9.5.1

Patch Changes

Updated dependencies [ee72aae]
- @objectstack/spec@9.5.1
- @objectstack/core@9.5.1
- @objectstack/platform-objects@9.5.1
- @objectstack/types@9.5.1

9.5.0

Patch Changes

Updated dependencies [d08551c]
Updated dependencies [5be7102]
Updated dependencies [707aeed]
Updated dependencies [7a103d4]
Updated dependencies [4b01250]
- @objectstack/spec@9.5.0
- @objectstack/platform-objects@9.5.0
- @objectstack/core@9.5.0
- @objectstack/types@9.5.0

9.4.0

Patch Changes

Updated dependencies [060467a]
Updated dependencies [0856476]
Updated dependencies [b678d8c]
Updated dependencies [b678d8c]
Updated dependencies [b678d8c]
- @objectstack/spec@9.4.0
- @objectstack/core@9.4.0
- @objectstack/platform-objects@9.4.0
- @objectstack/types@9.4.0

9.3.0

Patch Changes

Updated dependencies [1ada658]
Updated dependencies [3219191]
Updated dependencies [290f631]
Updated dependencies [50b7b47]
Updated dependencies [f15d6f6]
Updated dependencies [f8684ea]
Updated dependencies [c802327]
Updated dependencies [b4765be]
- @objectstack/spec@9.3.0
- @objectstack/platform-objects@9.3.0
- @objectstack/core@9.3.0
- @objectstack/types@9.3.0

9.2.0

Patch Changes

Updated dependencies [2f57b75]
Updated dependencies [2f57b75]
- @objectstack/spec@9.2.0
- @objectstack/core@9.2.0
- @objectstack/platform-objects@9.2.0
- @objectstack/types@9.2.0

9.1.0

Patch Changes

Updated dependencies [b9062c9]
- @objectstack/spec@9.1.0
- @objectstack/core@9.1.0
- @objectstack/platform-objects@9.1.0
- @objectstack/types@9.1.0

9.0.1

Patch Changes

Updated dependencies [1817845]
- @objectstack/spec@9.0.1
- @objectstack/core@9.0.1
- @objectstack/platform-objects@9.0.1
- @objectstack/types@9.0.1

9.0.0

Minor Changes

f533f42: Settings namespace environment overrides now use the canonical ObjectStack OS_<NAMESPACE>_<KEY> form, with no unprefixed aliases. For example, ai.openai_base_url is now OS_AI_OPENAI_BASE_URL, and feature_flags.ai_enabled is now OS_FEATURE_FLAGS_AI_ENABLED.

The AI service now treats a stored or env-locked provider=memory setting as an explicit override, while the manifest default still leaves boot-time provider auto-detection intact.

The auth plugin now binds the auth settings namespace to better-auth runtime configuration, exposes an extension hook for provider packages, and includes a basic Google sign-in implementation configured either in Setup → Authentication or by deployment-level GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.

Patch Changes

Updated dependencies [4c3f693]
Updated dependencies [0bf39f1]
Updated dependencies [f533f42]
Updated dependencies [1c83ee8]
- @objectstack/spec@9.0.0
- @objectstack/core@9.0.0
- @objectstack/platform-objects@9.0.0
- @objectstack/types@9.0.0

8.0.1

Patch Changes

@objectstack/spec@8.0.1
@objectstack/core@8.0.1
@objectstack/types@8.0.1
@objectstack/platform-objects@8.0.1

8.0.0

Patch Changes

1e8b680: fix(security): close four P0 launch-readiness findings
- plugin-auth (P0-1): generateSecret() now throws (fails boot) when no OS_AUTH_SECRET is set and NODE_ENV==='production', instead of silently falling back to a predictable dev-secret-<timestamp> (session forgery). The dev/test fallback is unchanged.
- plugin-security (P0-2): the permission-resolution catch now fails closed — it logs at ERROR and throws PermissionDeniedError rather than return next(). A degraded metadata service can no longer let every authenticated request bypass RBAC/RLS. System operations still bypass as before.
- driver-sql (P0-3): the contains / $contains operator now escapes LIKE metacharacters (% / _ / \) in the user value and binds an explicit ESCAPE '\', so a value of % matches literally instead of every row (filter bypass). Correct across SQLite/MySQL/Postgres.
- driver-mongodb (P0-4): the field-operator translator now rejects unknown $-operators instead of passing them through, blocking $where / $function / $expr (server-side JS execution / query-intent bypass). All legitimate ObjectQL operators remain allowlisted.
+12 regression tests across the four packages.
Updated dependencies [a46c017]
Updated dependencies [b990b89]
Updated dependencies [99111ec]
Updated dependencies [d5a8161]
Updated dependencies [5cf1f1b]
Updated dependencies [9ef89d4]
Updated dependencies [3306d2f]
Updated dependencies [c262301]
Updated dependencies [bc44195]
Updated dependencies [9e2e229]
- @objectstack/spec@8.0.0
- @objectstack/core@8.0.0
- @objectstack/platform-objects@8.0.0
- @objectstack/types@8.0.0

7.9.0

Patch Changes

@objectstack/spec@7.9.0
@objectstack/core@7.9.0
@objectstack/types@7.9.0
@objectstack/platform-objects@7.9.0

7.8.0

Patch Changes

Updated dependencies [06f2bbb]
Updated dependencies [36719db]
Updated dependencies [424ab26]
- @objectstack/spec@7.8.0
- @objectstack/core@7.8.0
- @objectstack/platform-objects@7.8.0
- @objectstack/types@7.8.0

7.7.0

Patch Changes

Updated dependencies [b391955]
Updated dependencies [f06b64e]
Updated dependencies [023bf93]
Updated dependencies [764c747]
- @objectstack/spec@7.7.0
- @objectstack/platform-objects@7.7.0
- @objectstack/core@7.7.0
- @objectstack/types@7.7.0

7.6.0

Patch Changes

8c01eea: fix(dev): seed the dev admin in-process and fix the port-drift seed failure.

os dev (and pnpm dev:showcase) seeded the admin over HTTP against a hard-coded localhost:3000. In dev, serve auto-shifts off a busy port, so the seed POST hit the wrong server (or nothing) and the running instance never got an admin. A second, divergent seed in plugin-dev inserted a credential-less sys_user row that could not log in.

Consolidate to a single in-process seed:
- @objectstack/plugin-auth — maybeSeedDevAdmin() runs on kernel:ready and creates admin@objectos.ai / admin123 through better-auth's real signUpEmail pipeline (hashed credential), so the account is loginable; plugin-security then promotes it to platform admin. Empty-DB only (excludes the system service account), idempotent, never overwrites an existing account. Hard-gated to NODE_ENV=development; opt out with OS_SEED_ADMIN=0.
- @objectstack/cli — removed the HTTP seed; --seed-admin now passes OS_SEED_ADMIN[_EMAIL|_PASSWORD] to the serve child. serve publishes its actually-bound port over IPC and to a runtime.<env>.json state file under OS_HOME.
- @objectstack/plugin-dev — removed the credential-less raw insert; seedAdminUser maps to the unified OS_SEED_ADMIN toggle.
b7a4f14: fix(dev): surface the seeded dev-admin credentials in the serve startup banner.

When the runtime seeds the dev admin on an empty DB, the confirmation was emitted via ctx.logger during runtime.start() — inside serve's boot-quiet window — so it was swallowed and never reached the console. plugin-auth now records the seed result on the auth service and serve prints it in the ready banner (after stdout is restored), e.g.:
```
  🔑  Dev admin: admin@objectos.ai / admin123
      seeded on empty DB · dev only — do not use in production
```
Shown only when an admin was actually seeded this boot (empty DB) — never on a DB that already had a user, so stale credentials are never displayed. Visible in both serve --dev and os dev (the child's stdout is inherited).
Updated dependencies [955d4c8]
Updated dependencies [c4a4cbd]
Updated dependencies [b046ec2]
Updated dependencies [2170ad9]
Updated dependencies [02d6359]
Updated dependencies [7648242]
Updated dependencies [8fa1e7f]
Updated dependencies [7ae6abc]
Updated dependencies [55866f5]
Updated dependencies [60f9c45]
- @objectstack/spec@7.6.0
- @objectstack/platform-objects@7.6.0
- @objectstack/core@7.6.0
- @objectstack/types@7.6.0

7.5.0

Patch Changes

@objectstack/spec@7.5.0
@objectstack/core@7.5.0
@objectstack/types@7.5.0
@objectstack/platform-objects@7.5.0

7.4.1

Patch Changes

@objectstack/spec@7.4.1
@objectstack/core@7.4.1
@objectstack/types@7.4.1
@objectstack/platform-objects@7.4.1

7.4.0

Minor Changes

c72daad: ADR-0029 D7 — Setup app navigation contributions.

Adds the UI-layer analog of object own/extend: a package can contribute navigation items into an app it does not own, so a shared admin app can be a thin shell while each capability plugin ships the menu for the objects it owns.
- @objectstack/spec — new NavigationContributionSchema ({ app, group?, priority, items }) and an optional navigationContributions field on the manifest.
- @objectstack/objectql — SchemaRegistry.registerAppNavContribution() plus lazy merge in getApp / getAllApps (by target group id + priority, cloning so the stored app is never mutated); the engine wires manifest.navigationContributions during app registration.
- @objectstack/platform-objects — the Setup app becomes a shell of empty group anchors; its entries for platform-objects-owned objects move to SETUP_NAV_CONTRIBUTIONS.
- @objectstack/plugin-auth — registers SETUP_NAV_CONTRIBUTIONS alongside the Setup app it already registers.
- @objectstack/plugin-webhooks — contributes its Webhooks / Webhook Deliveries entries into the Setup group_integrations slot (it owns sys_webhook / sys_webhook_delivery per K2.a), demonstrating end-to-end cross-plugin contribution.
The rendered Setup nav is identical to the former static artifact — just assembled from its owners. A disabled/absent capability contributes nothing and its slot stays empty (in addition to the existing requiresObject gating). This unblocks moving each remaining K2 domain's menu out of the monolith with its objects.

Patch Changes

Updated dependencies [23c7107]
Updated dependencies [c72daad]
Updated dependencies [4404572]
Updated dependencies [eea3f1b]
Updated dependencies [e478e0c]
Updated dependencies [4cc2ced]
Updated dependencies [13632b1]
Updated dependencies [f115182]
Updated dependencies [2faf9f2]
Updated dependencies [2faf9f2]
Updated dependencies [2faf9f2]
Updated dependencies [58b450b]
Updated dependencies [82eb6cf]
Updated dependencies [c381977]
Updated dependencies [13d8653]
Updated dependencies [ff3d006]
Updated dependencies [5e831de]
- @objectstack/spec@7.4.0
- @objectstack/platform-objects@7.4.0
- @objectstack/core@7.4.0
- @objectstack/types@7.4.0

7.3.0

Patch Changes

Updated dependencies [5e7c554]
- @objectstack/spec@7.3.0
- @objectstack/core@7.3.0
- @objectstack/platform-objects@7.3.0
- @objectstack/types@7.3.0

7.2.1

Patch Changes

9096dfe: OS_ env-var prefix migration (issue #1382).

All ObjectStack-owned environment variables now use the OS_ prefix. Legacy names still work for one release and emit a one-shot deprecation warning via the new readEnvWithDeprecation() helper in @objectstack/types.

Renamed (with legacy fallback):

New	Legacy (deprecated)
`OS_AUTH_SECRET`	`AUTH_SECRET`, `BETTER_AUTH_SECRET`
`OS_AUTH_URL`	`AUTH_BASE_URL`, `BETTER_AUTH_URL`, `OS_AUTH_BASE_URL`
`OS_PORT`	`PORT`
`OS_DATABASE_URL`	`DATABASE_URL`
`OS_ROOT_DOMAIN`	`ROOT_DOMAIN`
`OS_MULTI_ORG_ENABLED`	`OS_MULTI_TENANT`
`OS_CORS_ENABLED`	`CORS_ENABLED`
`OS_CORS_ORIGIN`	`CORS_ORIGIN`
`OS_CORS_CREDENTIALS`	`CORS_CREDENTIALS`
`OS_CORS_MAX_AGE`	`CORS_MAX_AGE`
`OS_AI_MODEL`	`AI_MODEL`
`OS_MCP_SERVER_ENABLED`	`MCP_SERVER_ENABLED`
`OS_MCP_SERVER_NAME`	`MCP_SERVER_NAME`
`OS_MCP_SERVER_TRANSPORT`	`MCP_SERVER_TRANSPORT`
`OS_NODE_ID`	`OBJECTSTACK_NODE_ID`
`OS_METADATA_WRITABLE`	`OBJECTSTACK_METADATA_WRITABLE`
`OS_DEV_CRYPTO_KEY`	`OBJECTSTACK_DEV_CRYPTO_KEY`
`OS_HOME`	`OBJECTSTACK_HOME`

Migration: rename in your .env. Legacy names continue to work this release and will be removed in a future major. Industry-standard names (NODE_ENV, HOME, OPENAI_API_KEY, TURSO_*, OAuth *_CLIENT_ID/SECRET, RESEND_API_KEY, POSTMARK_TOKEN, AI_GATEWAY_*, SMTP_*) are NOT renamed.

Updated dependencies [9096dfe]
- @objectstack/types@7.2.1
- @objectstack/spec@7.2.1
- @objectstack/core@7.2.1
- @objectstack/platform-objects@7.2.1

7.2.0

Patch Changes

@objectstack/spec@7.2.0
@objectstack/core@7.2.0
@objectstack/platform-objects@7.2.0

7.1.0

Patch Changes

Updated dependencies [6228609]
Updated dependencies [47a92f4]
- @objectstack/platform-objects@7.1.0
- @objectstack/spec@7.1.0
- @objectstack/core@7.1.0

7.0.0

Patch Changes

74470ad: New account App for self-service identity management + App.hidden shell hint

Adds a dedicated Account App (name: 'account', icon user-circle) that exposes the three end-user identity surfaces:
- Two-Factor Authentication — sys_two_factor
- Linked Accounts — sys_account
- OAuth Applications — sys_oauth_application
The app declares no requiredPermissions, so every authenticated user can reach it — unlike Setup, which requires setup.access and therefore excludes the default member_default permission set. Combined with the C-tier resultDialog actions already shipped on these objects (2FA QR + backup codes, OAuth client_secret reveal, link_social redirect), this replaces the legacy standalone apps/account SPA with a single console + metadata-driven surface.

New App.hidden: boolean field (packages/spec/src/ui/app.zod.ts) hides an app from the top-level App Switcher. Hidden apps stay fully routable and permission-checked; the shell is expected to surface them through the avatar / user dropdown instead. Mirrors the GitHub Settings / Google account chip / Salesforce Personal Settings pattern. The Account app is the first user.

Wiring: plugin-auth registers ACCOUNT_APP alongside SETUP_APP / STUDIO_APP (packages/plugins/plugin-auth/src/auth-plugin.ts). The legacy duplicate entries inside Setup's Advanced group are kept unchanged — they remain admin-only for tenant-wide inspection.

Follow-up for objectui: the shell's AppSwitcher and avatar DropdownMenu need updating to honour app.hidden (filter hidden apps out of the switcher; render them as dropdown menu entries). Tracked separately.
257954d: Organization detail page — Members / Invitations / Teams tabs (slotted Page)

Adds a record-detail Page for sys_organization (SysOrganizationDetailPage) so admins can manage the entire membership graph from a single record view instead of switching between three separate Setup list views.

The page uses kind: 'slotted' and overrides only the tabs slot — header, actions, highlights, details and discussion fall through to the synthesized default, so the existing record-header actions (Set Active, Edit, Delete, Leave Organization) are preserved unchanged.

Three tabs, each a record:related_list scoped by organization_id:
- Members — sys_member (user, role, joined)
- Invitations — sys_invitation (email, role, status, expires, inviter)
- Teams — sys_team (name, created, updated)
Per-row actions defined on each child object (invite_user, cancel_invitation, remove_member, transfer_ownership, create_team, …) are inherited unchanged — no admin endpoint is re-declared here.

Deliberately omitted:
- OAuth Apps — sys_oauth_application is owned by user_id, not organization_id; it surfaces on the user's Account view instead.
- SSO — no sys_sso* object exists yet; will become a fourth tab when better-auth's SSO plugin lands.
Package wiring:
- @objectstack/platform-objects exposes a new ./pages subpath export and re-exports SysOrganizationDetailPage from the root.
- plugin-auth registers it via the existing manifest.register({ ..., pages: [SysOrganizationDetailPage] }) call alongside the platform apps and dashboards.
Verified end-to-end on the console-starter shell against example-crm — the three tabs render and the Members/Teams tables populate with the rows better-auth creates automatically when an org is provisioned.
Updated dependencies [74470ad]
Updated dependencies [d29617e]
Updated dependencies [dc72172]
Updated dependencies [d29617e]
Updated dependencies [010757b]
Updated dependencies [257954d]
- @objectstack/spec@7.0.0
- @objectstack/platform-objects@7.0.0
- @objectstack/core@7.0.0

6.9.0

Patch Changes

@objectstack/spec@6.9.0
@objectstack/core@6.9.0
@objectstack/platform-objects@6.9.0

6.8.1

Patch Changes

@objectstack/spec@6.8.1
@objectstack/core@6.8.1
@objectstack/platform-objects@6.8.1

6.8.0

Patch Changes

Updated dependencies [6e88f77]
Updated dependencies [c8b9f57]
Updated dependencies [45d27c5]
- @objectstack/spec@6.8.0
- @objectstack/platform-objects@6.8.0
- @objectstack/core@6.8.0

6.7.1

Patch Changes

@objectstack/spec@6.7.1
@objectstack/core@6.7.1
@objectstack/platform-objects@6.7.1

6.7.0

Patch Changes

Updated dependencies [430067b]
Updated dependencies [4f9e9d4]
Updated dependencies [4f9e9d4]
- @objectstack/spec@6.7.0
- @objectstack/platform-objects@6.7.0
- @objectstack/core@6.7.0

6.6.0

Patch Changes

Updated dependencies [a49cfc2]
- @objectstack/spec@6.6.0
- @objectstack/core@6.6.0
- @objectstack/platform-objects@6.6.0

6.5.1

Patch Changes

de239ef: Fix WebContainer (StackBlitz) sign-up / sign-in failing with INTERNAL_SERVER_ERROR: No request state found. Please make sure you are calling this function within a runWithRequestState callback.

WebContainer reports itself as Node.js but its node:async_hooks implementation does not propagate AsyncLocalStorage context across await boundaries. As a result, better-auth's runWithRequestState wrap installed by handleRequest was lost as soon as the inner customSession → getSession() call chain awaited anything, and every endpoint that reads request state (e.g. should-session-refresh, oauth) threw "No request state found".

AuthManager now detects WebContainer and pre-populates better-auth's global requestStateAsyncStorage slot with a synchronous polyfill before better-auth instantiates its own. The polyfill correctly propagates the store through awaited promises within a single run() call, which is sufficient for WebContainer's single-flight dev server. Production environments (real Node, Bun, edge runtimes) continue to use the native AsyncLocalStorage and are unaffected.
- @objectstack/spec@6.5.1
- @objectstack/core@6.5.1
- @objectstack/platform-objects@6.5.1

6.5.0

Patch Changes

@objectstack/spec@6.5.0
@objectstack/core@6.5.0
@objectstack/platform-objects@6.5.0

6.4.0

Patch Changes

0bf6f9a: Add explicit @better-auth/core dependency.

plugin-auth already pulled @better-auth/core transitively via @better-auth/oauth-provider, but several call sites in auth-manager.ts import from it directly. Promote it to a first-class dependency so the resolved version is stable across the workspace and pnpm install doesn't surface "module not found" against the transitive copy under stricter peer resolution.

No behaviour change.
Updated dependencies [f8651cc]
Updated dependencies [f8651cc]
Updated dependencies [0bf6f9a]
- @objectstack/spec@6.4.0
- @objectstack/core@6.4.0
- @objectstack/platform-objects@6.4.0

6.3.0

Patch Changes

@objectstack/spec@6.3.0
@objectstack/core@6.3.0
@objectstack/platform-objects@6.3.0

6.2.0

Minor Changes

b4c74a9: WebContainer (StackBlitz) signup compatibility: AuthManager now auto-detects WebContainer runtimes at construction time and swaps better-auth's default node:crypto.scrypt-based password hasher for the pure-JS hasher from @better-auth/utils/password (which uses @noble/hashes/scrypt under the hood).

Why: WebContainer's node:crypto polyfill ships an incomplete scrypt implementation that throws TypeError: y.run is not a function on every signup, blocking template demos on StackBlitz. The pure-JS implementation is byte-compatible with the Node hasher (same scrypt params, same salt:keyHex storage format), so accounts created under either hasher remain mutually verifiable — no migration, no template changes.

Scope: detection short-circuits to undefined on real Node, so production deployments are completely unaffected — the JS fallback module is only dynamically imported when one of process.versions.webcontainer, SHELL containing jsh, or STACKBLITZ env is present.

Templates (@template/todo, @template/contracts, …) require no changes; the fix lives entirely inside @objectstack/plugin-auth.

Patch Changes

Updated dependencies [b4c74a9]
- @objectstack/spec@6.2.0
- @objectstack/core@6.2.0
- @objectstack/platform-objects@6.2.0

6.1.1

Patch Changes

@objectstack/spec@6.1.1
@objectstack/core@6.1.1
@objectstack/platform-objects@6.1.1

6.1.0

Patch Changes

Updated dependencies [93c0589]
- @objectstack/spec@6.1.0
- @objectstack/core@6.1.0
- @objectstack/platform-objects@6.1.0

6.0.0

Patch Changes

Updated dependencies [629a716]
Updated dependencies [dbc4f7d]
Updated dependencies [944f187]
- @objectstack/spec@6.0.0
- @objectstack/platform-objects@6.0.0
- @objectstack/core@6.0.0

5.2.0

Patch Changes

Updated dependencies [bab2b20]
Updated dependencies [fa011d8]
Updated dependencies [f0f7c27]
Updated dependencies [b806f58]
- @objectstack/platform-objects@5.2.0
- @objectstack/spec@5.2.0
- @objectstack/core@5.2.0

5.1.0

Patch Changes

Updated dependencies [75f4ee6]
Updated dependencies [823d559]
- @objectstack/spec@5.1.0
- @objectstack/platform-objects@5.1.0
- @objectstack/core@5.1.0

5.0.0

Patch Changes

Updated dependencies [888a5c1]
Updated dependencies [2f9073a]
- @objectstack/platform-objects@5.0.0
- @objectstack/spec@5.0.0
- @objectstack/core@5.0.0

4.2.0

Patch Changes

Updated dependencies [2869891]
- @objectstack/spec@4.2.0
- @objectstack/core@4.2.0
- @objectstack/platform-objects@4.2.0

4.1.1

Patch Changes

@objectstack/spec@4.1.1
@objectstack/core@4.1.1
@objectstack/platform-objects@4.1.1

4.1.0

Patch Changes

Updated dependencies [2108c30]
Updated dependencies [23db640]
- @objectstack/spec@4.1.0
- @objectstack/core@4.1.0
- @objectstack/platform-objects@4.1.0

4.0.5

Patch Changes

15e0df6: chore: unify all package versions to a single patch release
Updated dependencies [15e0df6]
- @objectstack/spec@4.0.5
- @objectstack/core@4.0.5
- @objectstack/platform-objects@4.0.5

Unreleased

Minor Changes

Always register better-auth's bearer() plugin so cross-origin browsers (where third-party cookies are blocked) and native mobile clients can authenticate via Authorization: Bearer <token> headers and pick up rotated tokens from the set-auth-token response header (fixes #1172).

4.0.4

Patch Changes

Updated dependencies [326b66b]
- @objectstack/spec@4.0.4
- @objectstack/core@4.0.4

4.0.3

Patch Changes

@objectstack/spec@4.0.3
@objectstack/core@4.0.3

4.0.2

Patch Changes

Updated dependencies [5f659e9]
- @objectstack/spec@4.0.2
- @objectstack/core@4.0.2

4.0.0

Patch Changes

e0b0a78: Deprecate DataEngineQueryOptions in favor of QueryAST-aligned EngineQueryOptions.

Engine, Protocol, and Client now use standard QueryAST parameter names:
- filter → where
- select → fields
- sort → orderBy
- skip → offset
- populate → expand
- top → limit
The old DataEngine* schemas and types are preserved with @deprecated markers for backward compatibility.
Updated dependencies [f08ffc3]
Updated dependencies [e0b0a78]
- @objectstack/spec@4.0.0
- @objectstack/core@4.0.0

3.3.1

Patch Changes

@objectstack/spec@3.3.1
@objectstack/core@3.3.1

3.3.0

Minor Changes

814a6c4: sql driver

Patch Changes

@objectstack/spec@3.3.0
@objectstack/core@3.3.0

3.2.9

Patch Changes

@objectstack/spec@3.2.9
@objectstack/core@3.2.9

3.2.8

Patch Changes

1fe5612: fix vercel
- @objectstack/spec@3.2.8
- @objectstack/core@3.2.8

3.2.7

Patch Changes

35a1ebb: fix auth
- @objectstack/spec@3.2.7
- @objectstack/core@3.2.7

3.2.6

Patch Changes

@objectstack/spec@3.2.6
@objectstack/core@3.2.6

3.2.5

Patch Changes

e854538: fix beyyer-auth
- @objectstack/spec@3.2.5
- @objectstack/core@3.2.5

3.2.4

Patch Changes

f490991: fix better-auth
- @objectstack/spec@3.2.4
- @objectstack/core@3.2.4

3.2.3

Patch Changes

0b1d7c9: fix auth
- @objectstack/spec@3.2.3
- @objectstack/core@3.2.3

3.2.2

Patch Changes

cfaabbb: fix: AuthPlugin error handling & database adapter config
- AuthManager.handleRequest() now inspects response.status >= 500 and logs the error body via console.error, since better-auth catches internal errors and returns 500 Responses without throwing.
- AuthPlugin.registerAuthRoutes() also logs 500+ responses via ctx.logger.error for structured plugin logging.
- createDatabaseConfig() now wraps the ObjectQL adapter as a DBAdapterInstance factory function so better-auth's getBaseAdapter() correctly recognises it (via typeof database === "function" check) instead of falling through to the Kysely adapter path.
Updated dependencies [46defbb]
- @objectstack/spec@3.2.2
- @objectstack/core@3.2.2

3.2.1

Patch Changes

Updated dependencies [850b546]
- @objectstack/spec@3.2.1
- @objectstack/core@3.2.1

3.2.0

Patch Changes

Updated dependencies [5901c29]
- @objectstack/spec@3.2.0
- @objectstack/core@3.2.0

3.1.1

Patch Changes

Updated dependencies [953d667]
- @objectstack/spec@3.1.1
- @objectstack/core@3.1.1

3.1.0

Patch Changes

Updated dependencies [0088830]
- @objectstack/spec@3.1.0
- @objectstack/core@3.1.0

3.0.11

Patch Changes

Updated dependencies [92d9d99]
- @objectstack/spec@3.0.11
- @objectstack/core@3.0.11

3.0.10

Patch Changes

Updated dependencies [d1e5d31]
- @objectstack/spec@3.0.10
- @objectstack/core@3.0.10

3.0.9

Patch Changes

Updated dependencies [15e0df6]
- @objectstack/spec@3.0.9
- @objectstack/core@3.0.9

3.0.8

Patch Changes

Updated dependencies [5a968a2]
- @objectstack/spec@3.0.8
- @objectstack/core@3.0.8

3.0.7

Patch Changes

Updated dependencies [0119bd7]
Updated dependencies [5426bdf]
- @objectstack/spec@3.0.7
- @objectstack/core@3.0.7

3.0.6

Patch Changes

Updated dependencies [5df254c]
- @objectstack/spec@3.0.6
- @objectstack/core@3.0.6

3.0.5

Patch Changes

Updated dependencies [23a4a68]
- @objectstack/spec@3.0.5
- @objectstack/core@3.0.5

3.0.4

Patch Changes

Updated dependencies [d738987]
- @objectstack/spec@3.0.4
- @objectstack/core@3.0.4

3.0.3

Patch Changes

c7267f6: Patch release for maintenance updates and improvements.
Updated dependencies [c7267f6]
- @objectstack/spec@3.0.3
- @objectstack/core@3.0.3

3.0.2

Patch Changes

Updated dependencies [28985f5]
- @objectstack/spec@3.0.2
- @objectstack/core@3.0.2

3.0.1

Patch Changes

Updated dependencies [389725a]
- @objectstack/spec@3.0.1
- @objectstack/core@3.0.1

3.0.0

Major Changes

Release v3.0.0 — unified version bump for all ObjectStack packages.

Patch Changes

Updated dependencies
- @objectstack/spec@3.0.0
- @objectstack/core@3.0.0

2.0.7

Patch Changes

Updated dependencies
- @objectstack/spec@2.0.7
- @objectstack/core@2.0.7

2.0.6

Patch Changes

Patch release for maintenance and stability improvements
Updated dependencies
- @objectstack/spec@2.0.6
- @objectstack/core@2.0.6

2.0.5

Patch Changes

Unify all package versions with a patch release
Updated dependencies
- @objectstack/spec@2.0.5
- @objectstack/core@2.0.5

2.0.3

Patch Changes

Updated dependencies
- @objectstack/spec@2.0.4
- @objectstack/core@2.0.4

All notable changes to @objectstack/plugin-auth will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

2.0.2 - 2026-02-10

Added

Initial release of Auth Plugin
Integration with better-auth library for robust authentication
Session management and user authentication
Support for OAuth providers (Google, GitHub, Microsoft, etc.)
Organization/team support for multi-tenant applications
Two-factor authentication (2FA)
Passkey support
Magic link authentication
Configurable session expiry and refresh
Automatic HTTP route registration
Comprehensive test coverage

Security

Secure session token management
Encrypted secrets support
Rate limiting capabilities
CSRF protection

Uh oh!

FilesExpand file tree

CHANGELOG.md

Latest commit

History

CHANGELOG.md

File metadata and controls

Changelog

10.3.0

Patch Changes

10.2.0

Patch Changes

10.1.0

Patch Changes

10.0.0

Patch Changes

9.11.0

Patch Changes

9.10.0

Patch Changes

9.9.1

Patch Changes

9.9.0

Minor Changes

Patch Changes

9.8.0

Patch Changes

9.7.0

Patch Changes

9.6.0

Patch Changes

9.5.1

Patch Changes

9.5.0

Patch Changes

9.4.0

Patch Changes

9.3.0

Patch Changes

9.2.0

Patch Changes

9.1.0

Patch Changes

9.0.1

Patch Changes

9.0.0

Minor Changes

Patch Changes

8.0.1

Patch Changes

8.0.0

Patch Changes

7.9.0

Patch Changes

7.8.0

Patch Changes

7.7.0

Patch Changes

7.6.0

Patch Changes

7.5.0

Patch Changes

7.4.1

Patch Changes

7.4.0

Minor Changes

Patch Changes

7.3.0

Patch Changes

7.2.1

Patch Changes

7.2.0

Patch Changes

7.1.0

Patch Changes

7.0.0

Patch Changes

6.9.0

Patch Changes

6.8.1