- Updated dependencies [6289ec3]
- Updated dependencies [8efa395]
- Updated dependencies [bfa3c3f]
- Updated dependencies [ee0a499]
- Updated dependencies [62a2117]
- Updated dependencies [06ff734]
- @objectstack/spec@16.0.0-rc.1
- @objectstack/runtime@16.0.0-rc.1
- @objectstack/cloud-connection@16.0.0-rc.1
- @objectstack/connector-mcp@16.0.0-rc.1
- @objectstack/connector-openapi@16.0.0-rc.1
- @objectstack/connector-rest@16.0.0-rc.1
- @objectstack/connector-slack@16.0.0-rc.1
- @objectstack/driver-sql@16.0.0-rc.1
- @objectstack/service-datasource@16.0.0-rc.1
- Updated dependencies [b39c65d]
- Updated dependencies [f972574]
- Updated dependencies [41e703b]
- Updated dependencies [22013aa]
- Updated dependencies [3ad3dd5]
- Updated dependencies [3a18b60]
- Updated dependencies [a8aa34c]
- Updated dependencies [a3823b2]
- Updated dependencies [43a3efb]
- Updated dependencies [524696a]
- Updated dependencies [fdc244e]
- Updated dependencies [5e3301d]
- Updated dependencies [47d923c]
- Updated dependencies [46e876c]
- Updated dependencies [2ea08ee]
- Updated dependencies [d1d1c40]
- Updated dependencies [158aa14]
- Updated dependencies [d2723e2]
- Updated dependencies [fefcd54]
- Updated dependencies [efbcfe1]
- Updated dependencies [2049b6a]
- Updated dependencies [beaf2de]
- Updated dependencies [369eb6e]
- Updated dependencies [b659111]
- Updated dependencies [5754a23]
- Updated dependencies [6c270a6]
- Updated dependencies [668dd17]
- Updated dependencies [8abf133]
- Updated dependencies [e0859b1]
- Updated dependencies [92f5f19]
- Updated dependencies [a2d6555]
- Updated dependencies [3a6310c]
- Updated dependencies [32899e6]
- Updated dependencies [515f11a]
- Updated dependencies [4174a07]
- Updated dependencies [ce468c8]
- Updated dependencies [04ecd4e]
- Updated dependencies [4d5a892]
- Updated dependencies [16cebeb]
- Updated dependencies [86d30af]
- Updated dependencies [8923843]
- Updated dependencies [a2795f6]
- Updated dependencies [f16b492]
- Updated dependencies [4b6fde8]
- Updated dependencies [2018df9]
- Updated dependencies [fc5a3a2]
- @objectstack/runtime@16.0.0-rc.0
- @objectstack/spec@16.0.0-rc.0
- @objectstack/connector-openapi@16.0.0-rc.0
- @objectstack/driver-sql@16.0.0-rc.0
- @objectstack/cloud-connection@16.0.0-rc.0
- @objectstack/connector-mcp@16.0.0-rc.0
- @objectstack/connector-rest@16.0.0-rc.0
- @objectstack/connector-slack@16.0.0-rc.0
- @objectstack/service-datasource@16.0.0-rc.0
- @objectstack/runtime@15.1.1
- @objectstack/cloud-connection@15.1.1
- @objectstack/spec@15.1.1
- @objectstack/driver-sql@15.1.1
- @objectstack/connector-mcp@15.1.1
- @objectstack/connector-rest@15.1.1
- @objectstack/connector-slack@15.1.1
- @objectstack/service-datasource@15.1.1
- @objectstack/connector-openapi@15.1.1
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [3fe9df1]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [4109153]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [627f225]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- Updated dependencies [f531a26]
- @objectstack/spec@15.1.0
- @objectstack/runtime@15.1.0
- @objectstack/connector-rest@15.1.0
- @objectstack/connector-openapi@15.1.0
- @objectstack/connector-mcp@15.1.0
- @objectstack/cloud-connection@15.1.0
- @objectstack/connector-slack@15.1.0
- @objectstack/driver-sql@15.1.0
- @objectstack/service-datasource@15.1.0
- Updated dependencies [28b7c28]
- Updated dependencies [13749ec]
- Updated dependencies [e62c233]
- Updated dependencies [ed61c9b]
- Updated dependencies [31d04d4]
- @objectstack/spec@15.0.0
- @objectstack/runtime@15.0.0
- @objectstack/cloud-connection@15.0.0
- @objectstack/connector-rest@15.0.0
- @objectstack/connector-slack@15.0.0
- @objectstack/driver-sql@15.0.0
- @objectstack/service-datasource@15.0.0
- Updated dependencies [16b4bf6]
- Updated dependencies [16b4bf6]
- Updated dependencies [10e8983]
- Updated dependencies [84650c5]
- Updated dependencies [607aaf4]
- Updated dependencies [bb71321]
- @objectstack/spec@14.8.0
- @objectstack/driver-sql@14.8.0
- @objectstack/cloud-connection@14.8.0
- @objectstack/connector-rest@14.8.0
- @objectstack/connector-slack@14.8.0
- @objectstack/runtime@14.8.0
- @objectstack/service-datasource@14.8.0
- Updated dependencies [d6a72eb]
- @objectstack/spec@14.7.0
- @objectstack/cloud-connection@14.7.0
- @objectstack/connector-rest@14.7.0
- @objectstack/connector-slack@14.7.0
- @objectstack/driver-sql@14.7.0
- @objectstack/runtime@14.7.0
- Updated dependencies [609cb13]
- Updated dependencies [ce6d151]
- @objectstack/spec@14.6.0
- @objectstack/driver-sql@14.6.0
- @objectstack/cloud-connection@14.6.0
- @objectstack/connector-rest@14.6.0
- @objectstack/connector-slack@14.6.0
- @objectstack/runtime@14.6.0
- Updated dependencies [526805e]
- Updated dependencies [5f43f88]
- Updated dependencies [261aff5]
- Updated dependencies [d79ca07]
- Updated dependencies [33ebd34]
- Updated dependencies [c044f08]
- Updated dependencies [01274eb]
- @objectstack/spec@14.5.0
- @objectstack/runtime@14.5.0
- @objectstack/cloud-connection@14.5.0
- @objectstack/connector-rest@14.5.0
- @objectstack/connector-slack@14.5.0
- @objectstack/driver-sql@14.5.0
-
7449476: Permission-zoo audit follow-ups:
FLS keys must be object-qualified (
security-fls-unqualified-key, error). The runtime evaluator matches field-permission keys by<object>.<field>prefix — a barebudgetkey matches NOTHING and the declared masking silently never enforces. The showcase itself shipped exactly that bug: its contributor FLS block (barebudget/spent/budget_remaining) was a runtime no-op, and the "FLS proof" in earlier verification was actually a validation-rule rejection. Fixed: keys qualified (showcase_project.budget…), a new D7 lint rule rejects bare keys at compile time with a fix-it, and the permission-zoo dogfood now proves the served pipeline denies a contributor's budget write while allowing ordinary field edits.Release pipeline: PROTOCOL_VERSION auto-sync.
changeset versionnow runsscripts/sync-protocol-version.mjs, regenerating the handshake constant from the spec package major. Release PRs opened by changesets/action with the default GITHUB_TOKEN never trigger CI (GitHub's anti-recursion rule), so the lockstep guard could only fire AFTER a release merged — the drift class that broke main at 14.0.0 (#2769) is now fixed at version time, the one spot that cannot be skipped.D11
externalSharingModelhonestly marked. The dial has no runtime consumer yet (authoring lint + Studio badges only); its liveness entry moves from a bespokeauthorablestatus to the documentedplanned+authorWarn, and the sharing docs / design doc / showcase comments now say explicitly that evaluation of external principals lands with the principal-taxonomy phase (#2696). -
Updated dependencies [7953832]
-
Updated dependencies [82e745e]
-
Updated dependencies [f3035bd]
-
Updated dependencies [82c0d94]
-
Updated dependencies [7449476]
- @objectstack/spec@14.4.0
- @objectstack/driver-sql@14.4.0
- @objectstack/cloud-connection@14.4.0
- @objectstack/connector-rest@14.4.0
- @objectstack/connector-slack@14.4.0
- @objectstack/runtime@14.4.0
- Updated dependencies [2a71f48]
- Updated dependencies [02f6af4]
- Updated dependencies [c1064f1]
- @objectstack/spec@14.3.0
- @objectstack/runtime@14.3.0
- @objectstack/cloud-connection@14.3.0
- @objectstack/connector-rest@14.3.0
- @objectstack/connector-slack@14.3.0
- @objectstack/driver-sql@14.3.0
- Updated dependencies [ac8f029]
- Updated dependencies [4ab9958]
- @objectstack/spec@14.2.0
- @objectstack/runtime@14.2.0
- @objectstack/cloud-connection@14.2.0
- @objectstack/connector-rest@14.2.0
- @objectstack/connector-slack@14.2.0
- @objectstack/driver-sql@14.2.0
- Updated dependencies [5a8465f]
- Updated dependencies [7f8620b]
- Updated dependencies [82ba3a6]
- @objectstack/spec@14.1.0
- @objectstack/cloud-connection@14.1.0
- @objectstack/connector-rest@14.1.0
- @objectstack/connector-slack@14.1.0
- @objectstack/driver-sql@14.1.0
- @objectstack/runtime@14.1.0
-
0a8e685: ADR-0090 permission-model zoo + docs alignment.
Showcase (
@objectstack/example-showcase) now exercises the full Permission Model v2 authoring surface and is guarded by a new runtime dogfood test (showcase-permission-zoo.dogfood.test.ts): typeddefinePosition/definePermissionSet/defineSharingRulefactories; six flat positions (the stale pre-D3parentfields are gone); permission sets covering CRUD+FLS+RLS, org-depth read/write asymmetry (readScope: 'org'/writeScope: 'own'), View-All (auditor) and Modify-All (ops) bypasses,systemPermissions(setup.access), theisDefaulteveryone-suggestion (incl. personal-data grants on theprivate-OWD note object), a guest-safe set for theguestanchor (D9), and a delegated-administrationadminScopebounded to a seededsys_business_unitsubtree (D12). Objects gainexternalSharingModeldials (D11). A committedaccess-matrix.jsonopts the showcase into the D6 snapshot gate. Hierarchy depths (own_and_reports/unit/unit_and_below) are deliberately NOT authored — they are enterprise (hierarchy-security) and the open runtime fails closed; BU-shaped visibility is demonstrated via the enforcedunit_and_subordinatessharing-rule recipient instead.@objectstack/spec:defineStackstrict cross-reference validation no longer rejects permission grants or seed datasets that target platform-provided objects (sys_/cloud_/ai_prefixes) — a delegated-admin set carrying CRUD on the RBAC link tables (ADR-0090 D12) and an app seeding the business-unit tree are legitimate shapes; the typo net stays intact for the stack's own objects. Stale pre-ADR-0090 vocabulary in zod docstrings (rls/territory/ sharing/tool/agent) is rewritten; the auto-generated references (including the previously missingsecurity/explain.mdx) are regenerated.Docs:
protocol/objectql/security.mdxrewritten to the v2 model (no profiles, positions, canonical OWD four + D1 private default +externalSharingModel, position-scoped RLS, enforced sharing recipients);isProfilescrubbed from every authoring example; the dead/docs/references/identity/rolelink fixed; implementation-status and plugin READMEs aligned. Remaining rename misses are tracked in #2722 (RLSUserContext.role), #2723 (portalprofiles), #2724 (sys_record_shareroleenum). -
afa8115: ADR-0090 vocabulary leftovers (#2722, #2723, #2724) — the last "role"/"profile" surfaces are renamed one-step, no aliases (launch-window discipline).
PortalSchema.profiles→positions(#2723, D2 removal miss). FROM → TO:profiles: ['client_portal_user']→positions: ['client_portal_user']— portal admission is now position-scoped; use the built-inguestposition for anonymous-only portals. The removedprofileskey is a loud tombstone: authoring it fails with the prescription instead of silently stripping. The showcase Client Portal is migrated and now admits a real declared position (client_portal_user).RLSUserContextSchema.role→positions(#2722, D3 rename miss). FROM → TO:role: string | string[]→positions: string[]— matches the runtime shape the RLS compiler resolves ascurrent_user.positions. No runtime consumer read the old field (the compiler has its own context type); public export names are unchanged.sys_record_share.recipient_type'role'→'position'(#2724, D3). The record-share enum and theShareRecipientTypecontract type now match the already-migrated spec zod enum. No stored-data migration is required: no reader expands non-userrecord-share rows (rules materialize per-user grants), so legacy'role'rows were inert. The plugin-sharing translation bundles are regenerated — fixing the pre-stalesys_sharing_ruleoptions block too — with zh-CN/ja-JP labels patched per the generated-file contract (业务单元及下级 / ビジネスユニットと下位階層).
- Updated dependencies [57b8fe0]
- Updated dependencies [0a8e685]
- Updated dependencies [afa8115]
- Updated dependencies [80f12ca]
- Updated dependencies [e2fa074]
- Updated dependencies [23c8668]
- Updated dependencies [29f017d]
- Updated dependencies [bc26360]
- Updated dependencies [afa8115]
- Updated dependencies [216fa9a]
- Updated dependencies [6c22b12]
- Updated dependencies [bd39dc5]
- @objectstack/runtime@14.0.0
- @objectstack/spec@14.0.0
- @objectstack/driver-sql@14.0.0
- @objectstack/cloud-connection@14.0.0
- @objectstack/connector-rest@14.0.0
- @objectstack/connector-slack@14.0.0
- Updated dependencies [6d83431]
- Updated dependencies [01917c2]
- Updated dependencies [b271691]
- Updated dependencies [a5a1e41]
- Updated dependencies [466adf6]
- Updated dependencies [57b89b4]
- Updated dependencies [5be00c3]
- Updated dependencies [466adf6]
- Updated dependencies [2bee609]
- Updated dependencies [fc7e7f7]
- @objectstack/spec@13.0.0
- @objectstack/runtime@13.0.0
- @objectstack/cloud-connection@13.0.0
- @objectstack/connector-rest@13.0.0
- @objectstack/connector-slack@13.0.0
- @objectstack/driver-sql@13.0.0
- Updated dependencies [6cebf22]
- Updated dependencies [b5a87eb]
- Updated dependencies [21420d9]
- @objectstack/spec@12.6.0
- @objectstack/runtime@12.6.0
- @objectstack/driver-sql@12.6.0
- @objectstack/cloud-connection@12.6.0
- @objectstack/connector-rest@12.6.0
- @objectstack/connector-slack@12.6.0
- Updated dependencies [8b3d363]
- @objectstack/spec@12.5.0
- @objectstack/cloud-connection@12.5.0
- @objectstack/connector-rest@12.5.0
- @objectstack/connector-slack@12.5.0
- @objectstack/driver-sql@12.5.0
- @objectstack/runtime@12.5.0
- Updated dependencies [60dc3ba]
- Updated dependencies [1dd5dfd]
- @objectstack/spec@12.4.0
- @objectstack/runtime@12.4.0
- @objectstack/cloud-connection@12.4.0
- @objectstack/connector-rest@12.4.0
- @objectstack/connector-slack@12.4.0
- @objectstack/driver-sql@12.4.0
- Updated dependencies [e7eceec]
- @objectstack/spec@12.3.0
- @objectstack/runtime@12.3.0
- @objectstack/cloud-connection@12.3.0
- @objectstack/connector-rest@12.3.0
- @objectstack/connector-slack@12.3.0
- @objectstack/driver-sql@12.3.0
- Updated dependencies [fce8ff4]
- Updated dependencies [3962023]
- Updated dependencies [2bb193d]
- Updated dependencies [0426d27]
- Updated dependencies [da807f7]
- Updated dependencies [4f5b791]
- @objectstack/spec@12.2.0
- @objectstack/runtime@12.2.0
- @objectstack/cloud-connection@12.2.0
- @objectstack/connector-rest@12.2.0
- @objectstack/connector-slack@12.2.0
- @objectstack/driver-sql@12.2.0
- Updated dependencies [497bda8]
- Updated dependencies [93e6d02]
- @objectstack/runtime@12.1.0
- @objectstack/spec@12.1.0
- @objectstack/connector-rest@12.1.0
- @objectstack/connector-slack@12.1.0
- @objectstack/cloud-connection@12.1.0
- @objectstack/driver-sql@12.1.0
- Updated dependencies [a8df396]
- Updated dependencies [e695fe0]
- Updated dependencies [9693a36]
- Updated dependencies [7c09621]
- Updated dependencies [2d567cb]
- Updated dependencies [e3498fb]
- Updated dependencies [7709db4]
- Updated dependencies [2082109]
- Updated dependencies [7c09621]
- Updated dependencies [9860de4]
- Updated dependencies [069c205]
- @objectstack/spec@12.0.0
- @objectstack/runtime@12.0.0
- @objectstack/cloud-connection@12.0.0
- @objectstack/connector-rest@12.0.0
- @objectstack/connector-slack@12.0.0
- @objectstack/driver-sql@12.0.0
- Updated dependencies [6a9397e]
- Updated dependencies [c0efe5d]
- @objectstack/spec@11.10.0
- @objectstack/cloud-connection@11.10.0
- @objectstack/connector-rest@11.10.0
- @objectstack/connector-slack@11.10.0
- @objectstack/driver-sql@11.10.0
- @objectstack/runtime@11.10.0
- Updated dependencies [852bc8e]
- Updated dependencies [d3595d9]
- Updated dependencies [8d87930]
- @objectstack/runtime@11.9.0
- @objectstack/spec@11.9.0
- @objectstack/driver-sql@11.9.0
- @objectstack/cloud-connection@11.9.0
- @objectstack/connector-rest@11.9.0
- @objectstack/connector-slack@11.9.0
- @objectstack/runtime@11.8.0
- @objectstack/cloud-connection@11.8.0
- @objectstack/spec@11.8.0
- @objectstack/driver-sql@11.8.0
- @objectstack/connector-rest@11.8.0
- @objectstack/connector-slack@11.8.0
- Updated dependencies [5178906]
- @objectstack/spec@11.7.0
- @objectstack/cloud-connection@11.7.0
- @objectstack/connector-rest@11.7.0
- @objectstack/connector-slack@11.7.0
- @objectstack/driver-sql@11.7.0
- @objectstack/runtime@11.7.0
- @objectstack/spec@11.6.0
- @objectstack/cloud-connection@11.6.0
- @objectstack/runtime@11.6.0
- @objectstack/driver-sql@11.6.0
- @objectstack/connector-rest@11.6.0
- @objectstack/connector-slack@11.6.0
- Updated dependencies [6ee4f04]
- Updated dependencies [c1e3a65]
- @objectstack/spec@11.5.0
- @objectstack/cloud-connection@11.5.0
- @objectstack/connector-rest@11.5.0
- @objectstack/connector-slack@11.5.0
- @objectstack/driver-sql@11.5.0
- @objectstack/runtime@11.5.0
- Updated dependencies [5821c51]
- Updated dependencies [a0fce3f]
- @objectstack/spec@11.4.0
- @objectstack/cloud-connection@11.4.0
- @objectstack/connector-rest@11.4.0
- @objectstack/connector-slack@11.4.0
- @objectstack/driver-sql@11.4.0
- @objectstack/runtime@11.4.0
- Updated dependencies [58e8e31]
- Updated dependencies [b4a5df0]
- @objectstack/spec@11.3.0
- @objectstack/cloud-connection@11.3.0
- @objectstack/connector-rest@11.3.0
- @objectstack/connector-slack@11.3.0
- @objectstack/driver-sql@11.3.0
- @objectstack/runtime@11.3.0
- Updated dependencies [d0f4b13]
- Updated dependencies [302bdab]
- @objectstack/spec@11.2.0
- @objectstack/cloud-connection@11.2.0
- @objectstack/connector-rest@11.2.0
- @objectstack/connector-slack@11.2.0
- @objectstack/driver-sql@11.2.0
- @objectstack/runtime@11.2.0
- Updated dependencies [e011d42]
- Updated dependencies [ecf193f]
- Updated dependencies [51bec81]
- Updated dependencies [3e593a7]
- Updated dependencies [63d5403]
- Updated dependencies [7087cfe]
- Updated dependencies [69ae136]
- @objectstack/runtime@11.1.0
- @objectstack/spec@11.1.0
- @objectstack/cloud-connection@11.1.0
- @objectstack/connector-rest@11.1.0
- @objectstack/connector-slack@11.1.0
- @objectstack/driver-sql@11.1.0
- Updated dependencies [4d99a5c]
- Updated dependencies [ab5718a]
- Updated dependencies [61d441f]
- Updated dependencies [c224e18]
- Updated dependencies [4845c12]
- Updated dependencies [c1a754a]
- Updated dependencies [6fbe91f]
- Updated dependencies [715d667]
- Updated dependencies [5eef4cf]
- Updated dependencies [72759e1]
- Updated dependencies [6c4fbd9]
- Updated dependencies [ef3ed67]
- Updated dependencies [cd51229]
- Updated dependencies [7697a0e]
- Updated dependencies [e7e04f1]
- Updated dependencies [cfd5ac4]
- Updated dependencies [2be5c1f]
- Updated dependencies [ad143ce]
- Updated dependencies [5c4a8c8]
- Updated dependencies [3afaeed]
- Updated dependencies [8801c02]
- Updated dependencies [3d04e06]
- Updated dependencies [98a1535]
- Updated dependencies [bc22a89]
- Updated dependencies [8a7e9f1]
- Updated dependencies [4a84c98]
- Updated dependencies [aa33b02]
- Updated dependencies [d980f0d]
- Updated dependencies [a658523]
- Updated dependencies [82ff91c]
- Updated dependencies [638f472]
- @objectstack/runtime@11.0.0
- @objectstack/spec@11.0.0
- @objectstack/driver-sql@11.0.0
- @objectstack/cloud-connection@11.0.0
- @objectstack/connector-rest@11.0.0
- @objectstack/connector-slack@11.0.0
- Updated dependencies [5ba52b0]
- Updated dependencies [8cf4f7c]
- Updated dependencies [f2063f3]
- @objectstack/driver-sql@10.3.0
- @objectstack/runtime@10.3.0
- @objectstack/cloud-connection@10.3.0
- @objectstack/spec@10.3.0
- @objectstack/connector-rest@10.3.0
- @objectstack/connector-slack@10.3.0
- Updated dependencies [b496498]
- @objectstack/spec@10.2.0
- @objectstack/cloud-connection@10.2.0
- @objectstack/connector-rest@10.2.0
- @objectstack/connector-slack@10.2.0
- @objectstack/driver-sql@10.2.0
- @objectstack/runtime@10.2.0
- Updated dependencies [49da36e]
- Updated dependencies [ac79f16]
- Updated dependencies [94d2161]
- Updated dependencies [517dad9]
- @objectstack/spec@10.1.0
- @objectstack/runtime@10.1.0
- @objectstack/driver-sql@10.1.0
- @objectstack/cloud-connection@10.1.0
- @objectstack/connector-rest@10.1.0
- @objectstack/connector-slack@10.1.0
- Updated dependencies [d7ff626]
- Updated dependencies [92db3e5]
- Updated dependencies [2a1b16b]
- Updated dependencies [e16f2a8]
- Updated dependencies [e411a82]
- Updated dependencies [a581385]
- Updated dependencies [47d978a]
- Updated dependencies [220ce5b]
- Updated dependencies [3efe334]
- Updated dependencies [feead7e]
- Updated dependencies [6ca20b3]
- Updated dependencies [5f875fe]
- Updated dependencies [b469950]
- @objectstack/spec@10.0.0
- @objectstack/driver-sql@10.0.0
- @objectstack/runtime@10.0.0
- @objectstack/cloud-connection@10.0.0
- @objectstack/connector-rest@10.0.0
- @objectstack/connector-slack@10.0.0
-
37e9acb: feat(app-showcase): declarative OWD scenarios — owner-private + public-read (ADR-0056)
Adds the two canonical Org-Wide-Default scenarios, each declaring its access policy in ONE word with no authored RLS:
showcase_private_note—sharingModel: 'private': a user sees and edits only the notes they own (owner-only read + write).showcase_announcement—sharingModel: 'read': every member reads every announcement, but only the owner may edit/delete it (public-read).
Both derive scoping from the OWD baseline + the auto-stamped
owner_id— the declarative counterpart to the invoice's hand-writtenowner = current_user.emailescape-hatch. Proven end-to-end (two users, real HTTP) by the newshowcase-private-owdandshowcase-public-read-owddogfood tests, which together demonstrate the OWD read-visibility axis (privatehides others' rows;readshows them but still protects writes).
-
e7f6539: feat(spec,sharing): canonical OWD vocabulary on
object.sharingModel(ADR-0056 D1)Reconciles the Org-Wide-Default naming so authors use ONE vocabulary.
object.sharingModelnow accepts the canonical OWD names —private|public_read|public_read_write|controlled_by_parent— alongside the legacyread/read_write/fullaliases (kept, non-breaking). The sharing runtime maps them onto the three enforced behaviours (public_read≡ legacyread= everyone reads / owner writes;public_read_write= unscoped). Unknown values remain rejected by the enum (authoring-time, fail-closed). The showcase announcement now declares the canonicalpublic_read, exercised end-to-end by the public-read dogfood proof. -
5a5a9fe: feat(security): public-form demo (Option A) + app-declared default profile wiring (ADR-0056 D7)
Wires ADR-0056's app-declarable default profile through the CLI so it actually takes effect under
pnpm dev.@objectstack/plugin-securityexports a newappDefaultProfileName(permissions)helper that extracts the firstisProfile && isDefaultprofile name from a stack;@objectstack/cli(serve.ts) passes it as the SecurityPluginfallbackPermissionSet(undefined → built-inmember_defaultpreserved, so apps that declare no default are unaffected).The showcase gains a working web-to-lead public form (
showcase_inquiry+ anallowAnonymousFormView authorized by the declaration-derivedpublicFormGrant, noguest_portalprofile) and an app-declared default profile (showcase_member_default), each covered by a dogfood proof over the real HTTP stack. -
2afb612: feat(security): resolve
current_user.emailin RLS owner policiesRLS
usingpredicates can now referencecurrent_user.email— a unique, human-readable, seedable owner anchor (owner = current_user.email). Previously the RLS compiler resolved onlycurrent_user.id/organization_id/roles/org_user_ids, so any owner-by-name/email predicate silently compiled to the deny sentinel (fail-closed → the user saw nothing). Email is sourced for free from the auth session (with a boundedsys_userfallback for the API-key path) and threaded onto theExecutionContextin both identity resolvers — the REST data path (rest-server) and the dispatcher path (resolve-execution-context).Display
nameis deliberately not exposed to RLS: names collide, and a collision on an ownership predicate is an access-control leak. Only unique identifiers (id,email) are resolvable.This makes owner-scoped row-level security work with seed data (no per-user ids needed) and, combined with
controlled_by_parent(ADR-0055), lets a master's owner scoping flow to its detail records. The example-showcase demonstrates it:showcase_invoicecarries anowneremail + an owner RLS policy, its lines are controlled-by-parent, and invoices/lines are seeded per owner. It also fixes the showcase's previously inert owner predicates (they used==andcurrent_user.name, neither of which the compiler accepts) to= current_user.email. -
Updated dependencies [e7f6539]
-
Updated dependencies [2365d07]
-
Updated dependencies [6595b53]
-
Updated dependencies [fa8964d]
-
Updated dependencies [36138c7]
-
Updated dependencies [a8e4f3b]
-
Updated dependencies [4c213c2]
-
Updated dependencies [2afb612]
- @objectstack/spec@9.11.0
- @objectstack/runtime@9.11.0
- @objectstack/cloud-connection@9.11.0
- @objectstack/connector-rest@9.11.0
- @objectstack/connector-slack@9.11.0
- Updated dependencies [db02bd5]
- Updated dependencies [641675d]
- Updated dependencies [94e9040]
- Updated dependencies [1f88fd9]
- Updated dependencies [1f88fd9]
- Updated dependencies [e2b5324]
- @objectstack/spec@9.10.0
- @objectstack/runtime@9.10.0
- @objectstack/cloud-connection@9.10.0
- @objectstack/connector-rest@9.10.0
- @objectstack/connector-slack@9.10.0
- @objectstack/spec@9.9.1
- @objectstack/cloud-connection@9.9.1
- @objectstack/runtime@9.9.1
- @objectstack/connector-rest@9.9.1
- @objectstack/connector-slack@9.9.1
- Updated dependencies [84249a4]
- Updated dependencies [11af299]
- Updated dependencies [d5774b5]
- Updated dependencies [83fd318]
- Updated dependencies [134043a]
- Updated dependencies [90108e0]
- Updated dependencies [9afeb2d]
- Updated dependencies [6bec07e]
- Updated dependencies [601cc11]
- Updated dependencies [575448d]
- @objectstack/spec@9.9.0
- @objectstack/runtime@9.9.0
- @objectstack/cloud-connection@9.9.0
- @objectstack/connector-rest@9.9.0
- @objectstack/connector-slack@9.9.0
- Updated dependencies [97c55b3]
- Updated dependencies [1b1f490]
- @objectstack/spec@9.8.0
- @objectstack/runtime@9.8.0
- @objectstack/cloud-connection@9.8.0
- @objectstack/connector-rest@9.8.0
- @objectstack/connector-slack@9.8.0
- @objectstack/runtime@9.7.0
- @objectstack/cloud-connection@9.7.0
- @objectstack/connector-rest@9.7.0
- @objectstack/connector-slack@9.7.0
- @objectstack/spec@9.7.0
- Updated dependencies [d1e930a]
- Updated dependencies [71578f2]
- Updated dependencies [5e3a301]
- Updated dependencies [5db2742]
- @objectstack/spec@9.6.0
- @objectstack/runtime@9.6.0
- @objectstack/cloud-connection@9.6.0
- @objectstack/connector-rest@9.6.0
- @objectstack/connector-slack@9.6.0
- Updated dependencies [ee72aae]
- @objectstack/spec@9.5.1
- @objectstack/cloud-connection@9.5.1
- @objectstack/connector-rest@9.5.1
- @objectstack/connector-slack@9.5.1
- @objectstack/runtime@9.5.1
- Updated dependencies [d08551c]
- Updated dependencies [707aeed]
- Updated dependencies [7a103d4]
- Updated dependencies [4b01250]
- Updated dependencies [08a11f7]
- @objectstack/spec@9.5.0
- @objectstack/cloud-connection@9.5.0
- @objectstack/connector-rest@9.5.0
- @objectstack/connector-slack@9.5.0
- @objectstack/runtime@9.5.0
- Updated dependencies [060467a]
- Updated dependencies [0856476]
- Updated dependencies [b678d8c]
- Updated dependencies [b678d8c]
- Updated dependencies [b678d8c]
- @objectstack/spec@9.4.0
- @objectstack/runtime@9.4.0
- @objectstack/cloud-connection@9.4.0
- @objectstack/connector-rest@9.4.0
- @objectstack/connector-slack@9.4.0
- Updated dependencies [1ada658]
- Updated dependencies [3219191]
- Updated dependencies [290f631]
- Updated dependencies [50b7b47]
- Updated dependencies [f15d6f6]
- Updated dependencies [f8684ea]
- Updated dependencies [998c4e4]
- Updated dependencies [b8e4232]
- Updated dependencies [9fea621]
- Updated dependencies [3786f15]
- Updated dependencies [8950204]
- Updated dependencies [9b4e870]
- Updated dependencies [17ffc74]
- Updated dependencies [c802327]
- Updated dependencies [b4765be]
- Updated dependencies [48051ff]
- Updated dependencies [d01c427]
- @objectstack/spec@9.3.0
- @objectstack/runtime@9.3.0
- @objectstack/cloud-connection@9.3.0
- @objectstack/connector-rest@9.3.0
- @objectstack/connector-slack@9.3.0
- Updated dependencies [2f57b75]
- Updated dependencies [2f57b75]
- @objectstack/spec@9.2.0
- @objectstack/connector-rest@9.2.0
- @objectstack/connector-slack@9.2.0
- @objectstack/runtime@9.2.0
- Updated dependencies [b9062c9]
- @objectstack/spec@9.1.0
- @objectstack/connector-rest@9.1.0
- @objectstack/connector-slack@9.1.0
- @objectstack/runtime@9.1.0
- Updated dependencies [1817845]
- @objectstack/spec@9.0.1
- @objectstack/connector-rest@9.0.1
- @objectstack/connector-slack@9.0.1
- @objectstack/runtime@9.0.1
- 4b0fdba: The showcase Chart Gallery now shows one widget per chart family the renderer
draws DISTINCTLY (27 → 17 widgets). Families that fell back to a near-relative
(grouped/stacked/bi-polar bars, stacked-area, step-line, spline, pyramid,
bubble) and the dial-less performance variants (kpi/gauge/solid-gauge/bullet,
identical to
metric) were removed — advertising a type that renders as something else is misleading. Bundles the objectui console build that routes each widget to its true chart renderer (pie/donut/funnel/line/area/scatter/ radar/treemap/sankey/table/pivot). - Updated dependencies [4c3f693]
- Updated dependencies [0bf39f1]
- Updated dependencies [f533f42]
- Updated dependencies [1c83ee8]
- @objectstack/spec@9.0.0
- @objectstack/connector-rest@9.0.0
- @objectstack/connector-slack@9.0.0
- @objectstack/runtime@9.0.0
- @objectstack/spec@8.0.1
- @objectstack/runtime@8.0.1
- @objectstack/connector-rest@8.0.1
- @objectstack/connector-slack@8.0.1
- Updated dependencies [a46c017]
- Updated dependencies [f68be58]
- Updated dependencies [b990b89]
- Updated dependencies [99111ec]
- Updated dependencies [d5a8161]
- Updated dependencies [5cf1f1b]
- Updated dependencies [9ef89d4]
- Updated dependencies [bc0d85b]
- Updated dependencies [2537e28]
- Updated dependencies [0ec7717]
- Updated dependencies [3306d2f]
- Updated dependencies [c262301]
- Updated dependencies [bc44195]
- Updated dependencies [9e2e229]
- @objectstack/spec@8.0.0
- @objectstack/runtime@8.0.0
- @objectstack/connector-rest@8.0.0
- @objectstack/connector-slack@8.0.0
- Updated dependencies [ac1fc4c]
- Updated dependencies [ac1fc4c]
- @objectstack/runtime@7.9.0
- @objectstack/spec@7.9.0
- @objectstack/connector-rest@7.9.0
- @objectstack/connector-slack@7.9.0
-
6b60068: fix(cli):
objectstack devpersists data by default (no more:memory:wipe on restart)objectstack devhistorically fell back to a:memory:SQLite database when no--database/OS_DATABASE_URLwas given, so every restart silently wiped all data and AI-authored metadata — you'd build an app, restart, and it would be gone, which makes local app-building unusable.devnow defaults to a persistent, project-anchored SQLite file at<cwd>/.objectstack/data/dev.db(gitignored, per-project). Existing opt-outs are unchanged and take precedence:--fresh(ephemeral temp DB),--database <url>,OS_DATABASE_URL/DATABASE_URL, or an explicit in-memory driver (--database-driver memory/OS_DATABASE_DRIVER=memory). Resolution is extracted into the testableresolveDefaultDevDbUrl()helper.The app-showcase example drops its explicit
:memory:datasource override (which would otherwise route data back to memory and defeat the new default), so it persists across restarts out of the box. -
Updated dependencies [06f2bbb]
-
Updated dependencies [a75823a]
-
Updated dependencies [4fbb86a]
-
Updated dependencies [e631f1e]
-
Updated dependencies [36719db]
-
Updated dependencies [424ab26]
- @objectstack/spec@7.8.0
- @objectstack/runtime@7.8.0
- @objectstack/connector-rest@7.8.0
- @objectstack/connector-slack@7.8.0
- Updated dependencies [b391955]
- Updated dependencies [f06b64e]
- Updated dependencies [023bf93]
- @objectstack/spec@7.7.0
- @objectstack/connector-rest@7.7.0
- @objectstack/connector-slack@7.7.0
- @objectstack/runtime@7.7.0
- Updated dependencies [955d4c8]
- Updated dependencies [c4a4cbd]
- Updated dependencies [b046ec2]
- Updated dependencies [2170ad9]
- Updated dependencies [02d6359]
- Updated dependencies [7648242]
- Updated dependencies [8fa1e7f]
- Updated dependencies [55866f5]
- Updated dependencies [8e539cc]
- Updated dependencies [60f9c45]
- @objectstack/spec@7.6.0
- @objectstack/runtime@7.6.0
- @objectstack/connector-rest@7.6.0
- @objectstack/connector-slack@7.6.0
- @objectstack/connector-rest@7.5.0
- @objectstack/connector-slack@7.5.0
- @objectstack/spec@7.5.0
- @objectstack/runtime@7.5.0
- @objectstack/spec@7.4.1
- @objectstack/runtime@7.4.1
- @objectstack/connector-rest@7.4.1
- @objectstack/connector-slack@7.4.1
- Updated dependencies [23c7107]
- Updated dependencies [c72daad]
- Updated dependencies [13632b1]
- Updated dependencies [f115182]
- Updated dependencies [2faf9f2]
- Updated dependencies [2faf9f2]
- Updated dependencies [2faf9f2]
- Updated dependencies [2faf9f2]
- Updated dependencies [58b450b]
- Updated dependencies [394d34f]
- Updated dependencies [82eb6cf]
- Updated dependencies [13d8653]
- Updated dependencies [ff3d006]
- Updated dependencies [5e831de]
- @objectstack/spec@7.4.0
- @objectstack/runtime@7.4.0
- @objectstack/connector-rest@7.4.0
- @objectstack/connector-slack@7.4.0