CHANGELOG.md

@objectstack/verify

11.1.0

Patch Changes

• Updated dependencies [574e7a3]
• Updated dependencies [cbc8c02]
• Updated dependencies [18f9713]
• Updated dependencies [7cf81a7]
• Updated dependencies [d7a88df]
• Updated dependencies [4f8f108]
• Updated dependencies [ce0b4f6]
• Updated dependencies [90bce88]
• Updated dependencies [3209ec6]
• Updated dependencies [8c84c97]
• Updated dependencies [e011d42]
• Updated dependencies [6e5bdd5]
• Updated dependencies [13dbcf2]
• Updated dependencies [9ccfcd6]
• Updated dependencies [dc2990f]
• Updated dependencies [ecf193f]
• Updated dependencies [51bec81]
• Updated dependencies [3e593a7]
• Updated dependencies [fdb41c0]
• Updated dependencies [63d5403]
• Updated dependencies [7087cfe]
• Updated dependencies [69ae136]
  • @objectstack/plugin-security@11.1.0
  • @objectstack/plugin-auth@11.1.0
  • @objectstack/core@11.1.0
  • @objectstack/service-settings@11.1.0
  • @objectstack/rest@11.1.0
  • @objectstack/runtime@11.1.0
  • @objectstack/objectql@11.1.0
  • @objectstack/plugin-hono-server@11.1.0
  • @objectstack/spec@11.1.0
  • @objectstack/plugin-org-scoping@11.1.0
  • @objectstack/plugin-sharing@11.1.0
  • @objectstack/driver-sqlite-wasm@11.1.0
  • @objectstack/service-analytics@11.1.0
  • @objectstack/service-automation@11.1.0
  • @objectstack/service-datasource@11.1.0

11.0.0

Patch Changes

• Updated dependencies [caa3ef4]
• Updated dependencies [22b32c1]
• Updated dependencies [4d99a5c]
• Updated dependencies [21b3208]
• Updated dependencies [9b5bf3d]
• Updated dependencies [cb5b393]
• Updated dependencies [ab5718a]
• Updated dependencies [61d441f]
• Updated dependencies [c224e18]
• Updated dependencies [d616e1d]
• Updated dependencies [910a8f0]
• Updated dependencies [1e8a813]
• Updated dependencies [4845c12]
• Updated dependencies [c1a754a]
• Updated dependencies [6fbe91f]
• Updated dependencies [715d667]
• Updated dependencies [715d667]
• Updated dependencies [5eef4cf]
• Updated dependencies [4b5ec6e]
• Updated dependencies [b6a4972]
• Updated dependencies [72759e1]
• Updated dependencies [6c4fbd9]
• Updated dependencies [ef3ed67]
• Updated dependencies [359c0aa]
• Updated dependencies [cd51229]
• Updated dependencies [7697a0e]
• Updated dependencies [e7e04f1]
• Updated dependencies [cfd5ac4]
• Updated dependencies [2be5c1f]
• Updated dependencies [9a810f8]
• Updated dependencies [ad143ce]
• Updated dependencies [5c4a8c8]
• Updated dependencies [3afaeed]
• Updated dependencies [a619a3a]
• Updated dependencies [8801c02]
• Updated dependencies [3d04e06]
• Updated dependencies [4a84c98]
• Updated dependencies [c715d25]
• Updated dependencies [aa33b02]
• Updated dependencies [d980f0d]
• Updated dependencies [a658523]
• Updated dependencies [82ff91c]
• Updated dependencies [638f472]
  • @objectstack/plugin-auth@11.0.0
  • @objectstack/objectql@11.0.0
  • @objectstack/runtime@11.0.0
  • @objectstack/service-settings@11.0.0
  • @objectstack/spec@11.0.0
  • @objectstack/service-analytics@11.0.0
  • @objectstack/service-automation@11.0.0
  • @objectstack/rest@11.0.0
  • @objectstack/core@11.0.0
  • @objectstack/plugin-sharing@11.0.0
  • @objectstack/plugin-org-scoping@11.0.0
  • @objectstack/plugin-security@11.0.0
  • @objectstack/driver-sqlite-wasm@11.0.0
  • @objectstack/plugin-hono-server@11.0.0
  • @objectstack/service-datasource@11.0.0

10.3.0

Patch Changes

• Updated dependencies [f73d40a]
• Updated dependencies [211425e]
• Updated dependencies [c121d73]
• Updated dependencies [8cf4f7c]
• Updated dependencies [f2063f3]
  • @objectstack/service-analytics@10.3.0
  • @objectstack/objectql@10.3.0
  • @objectstack/service-settings@10.3.0
  • @objectstack/runtime@10.3.0
  • @objectstack/service-datasource@10.3.0
  • @objectstack/driver-sqlite-wasm@10.3.0
  • @objectstack/plugin-sharing@10.3.0
  • @objectstack/spec@10.3.0
  • @objectstack/core@10.3.0
  • @objectstack/rest@10.3.0
  • @objectstack/plugin-auth@10.3.0
  • @objectstack/plugin-hono-server@10.3.0
  • @objectstack/plugin-org-scoping@10.3.0
  • @objectstack/plugin-security@10.3.0
  • @objectstack/service-automation@10.3.0

10.2.0

Patch Changes

• Updated dependencies [b496498]
  • @objectstack/spec@10.2.0
  • @objectstack/core@10.2.0
  • @objectstack/objectql@10.2.0
  • @objectstack/driver-sqlite-wasm@10.2.0
  • @objectstack/plugin-auth@10.2.0
  • @objectstack/plugin-hono-server@10.2.0
  • @objectstack/plugin-org-scoping@10.2.0
  • @objectstack/plugin-security@10.2.0
  • @objectstack/plugin-sharing@10.2.0
  • @objectstack/rest@10.2.0
  • @objectstack/runtime@10.2.0
  • @objectstack/service-analytics@10.2.0
  • @objectstack/service-automation@10.2.0
  • @objectstack/service-datasource@10.2.0
  • @objectstack/service-settings@10.2.0

10.1.0

Minor Changes

• 49da36e: feat(datasource): reject field.columnName on external objects + drop showcase onEnable bridge (ADR-0062 Phase 4, D7/D8)

  D7 — reconcile column mapping. os compile/build (validateStackExpressions) now rejects field.columnName on a federated (external) object with a corrective message: the driver's query pipeline ignores field.columnName for external objects, so external.columnMap is the single authoritative mechanism. Managed objects are untouched.

  D8 — drop the canonical example's driver bridge. examples/app-showcase declares its external datasource with no onEnable driver registration — the declared datasource auto-connects at boot (ADR-0062 D1). onEnable now only provisions the "remote" fixture tables. To cover this end-to-end, the @objectstack/verify harness wires the datasource-admin plugin (registering the 'datasource-connection' service) when an app declares datasources, so it mirrors objectstack dev/serve; a new dogfood test reads the federated objects through the real REST stack (incl. the remoteName remap). onEnable + ctx.drivers.register remains supported as an escape hatch for drivers built dynamically at runtime.

Patch Changes

• Updated dependencies [49da36e]
• Updated dependencies [49da36e]
• Updated dependencies [ac79f16]
• Updated dependencies [94d2161]
• Updated dependencies [517dad9]
  • @objectstack/spec@10.1.0
  • @objectstack/service-analytics@10.1.0
  • @objectstack/service-datasource@10.1.0
  • @objectstack/runtime@10.1.0
  • @objectstack/rest@10.1.0
  • @objectstack/core@10.1.0
  • @objectstack/objectql@10.1.0
  • @objectstack/driver-sqlite-wasm@10.1.0
  • @objectstack/plugin-auth@10.1.0
  • @objectstack/plugin-hono-server@10.1.0
  • @objectstack/plugin-org-scoping@10.1.0
  • @objectstack/plugin-security@10.1.0
  • @objectstack/plugin-sharing@10.1.0
  • @objectstack/service-automation@10.1.0
  • @objectstack/service-settings@10.1.0

10.0.0

Minor Changes

• ee86099: ADR-0060 P1 — add the reusable conformance-ledger helper. @objectstack/verify now exports checkLedger(rows, opts) + ConformanceRow: the static complement to its runtime harness, encoding the shared invariants the platform had hand-written twice (unique ids / valid state / enforced-has-site / experimental·removed-has-note / proof-file-exists / high-risk-has-proof / exactly-one-cover / discover ratchet). The ADR-0056 authz and ADR-0058 expression ledgers are refactored onto it.

Patch Changes

• 0feea92: fix(verify): skip read-only federated (external) objects in CRUD verification.

  objectstack verify probe-inserts a record into every object. A federated object on an external datasource is read-only unless BOTH the datasource and the object opt into writes (ADR-0015 write gate), so that insert is correctly rejected — which verify was reporting as a create-failed runtime failure. deriveCrudCases now marks such objects blocked (skipped), matching the write gate's double opt-in rule, so the dogfood gate stays honest while supporting external datasource example apps.

• Updated dependencies [d7ff626]

• Updated dependencies [2a1b16b]

• Updated dependencies [2256e93]

• Updated dependencies [30c0313]

• Updated dependencies [e16f2a8]

• Updated dependencies [cfd86ce]

• Updated dependencies [e411a82]

• Updated dependencies [70609af]

• Updated dependencies [3187952]

• Updated dependencies [a581385]

• Updated dependencies [47d978a]

• Updated dependencies [d5f6d29]

• Updated dependencies [220ce5b]

• Updated dependencies [3efe334]

• Updated dependencies [3754f80]

• Updated dependencies [ce13bb8]

• Updated dependencies [feead7e]

• Updated dependencies [00c32f2]

• Updated dependencies [6ca20b3]

• Updated dependencies [5f875fe]

• Updated dependencies [b469950]

  • @objectstack/spec@10.0.0
  • @objectstack/objectql@10.0.0
  • @objectstack/rest@10.0.0
  • @objectstack/plugin-sharing@10.0.0
  • @objectstack/plugin-security@10.0.0
  • @objectstack/runtime@10.0.0
  • @objectstack/service-analytics@10.0.0
  • @objectstack/core@10.0.0
  • @objectstack/plugin-hono-server@10.0.0
  • @objectstack/driver-sqlite-wasm@10.0.0
  • @objectstack/plugin-auth@10.0.0
  • @objectstack/plugin-org-scoping@10.0.0
  • @objectstack/service-automation@10.0.0
  • @objectstack/service-settings@10.0.0

9.11.0

Minor Changes

• 4c213c2: Master-detail "controlled by parent" permissions (ADR-0055).

  A detail object can now declare sharingModel: 'controlled_by_parent': its read/write access is derived from its master record, with no authored RLS.

  • @objectstack/spec: controlled_by_parent added to the authorable object.sharingModel enum.
  • @objectstack/plugin-security: reads inject masterFK IN (accessible master ids) (resolved from the master's own RLS, reusing the existing filter machinery — zero RLS-compiler changes); by-id writes (insert/update/delete) to a detail now require edit access to its master, closing the #1994-class by-id hole for derived access.
  • @objectstack/verify: related-record topological synthesis — deriveCrudCases no longer skips objects with required relations; it builds the object dependency graph, orders it topologically, and threads real target ids, so relationship-dense objects (and the master-detail RLS proof) are verifiable. Honest blocked verdicts remain for required-reference cycles and external/missing targets.

  v1 limits (per ADR-0055): the accessible-master id set is unbounded (large-tenant scale is a documented future limit), and master-detail chains are single-level (not transitively traversed).

• a8e4f3b: bootStack gains an opt-in automation boot option. When set, it registers @objectstack/service-automation so the app's authored flows are pulled from the registry and POST /api/v1/automation/:name/trigger actually executes their nodes against the real in-process stack. This makes flow-node execution + variable wiring verifiable end-to-end (ADR-0054 Phase 2), mirroring the existing multiTenant opt-in. Default is false, so the standard boot stays lean for apps that don't exercise flows.

• fd2e1a2: Add @objectstack/verify — boot any ObjectStack app in-process and verify it through the real HTTP stack: auto-derived CRUD round-trip fidelity (runCrudVerification) plus the cross-owner RLS invariant (runRlsProofs, "you can't write what you can't read"). Also adds an objectstack verify CLI command that runs these proofs against an app config and exits non-zero on real failures.

  Extracted from the internal dogfood regression gate so third-party and template authors can run the same runtime proofs against their own apps. The private @objectstack/dogfood package now consumes this library for its golden regression tests.

Patch Changes

• Updated dependencies [e7f6539]
• Updated dependencies [e7f6539]
• Updated dependencies [fa8964d]
• Updated dependencies [2365d07]
• Updated dependencies [6595b53]
• Updated dependencies [fa8964d]
• Updated dependencies [751f5cf]
• Updated dependencies [5a5a9fe]
• Updated dependencies [36138c7]
• Updated dependencies [a8e4f3b]
• Updated dependencies [4c213c2]
• Updated dependencies [2afb612]
  • @objectstack/spec@9.11.0
  • @objectstack/plugin-sharing@9.11.0
  • @objectstack/rest@9.11.0
  • @objectstack/plugin-security@9.11.0
  • @objectstack/objectql@9.11.0
  • @objectstack/runtime@9.11.0
  • @objectstack/core@9.11.0
  • @objectstack/driver-sqlite-wasm@9.11.0
  • @objectstack/plugin-auth@9.11.0
  • @objectstack/plugin-hono-server@9.11.0
  • @objectstack/plugin-org-scoping@9.11.0
  • @objectstack/service-analytics@9.11.0
  • @objectstack/service-automation@9.11.0
  • @objectstack/service-settings@9.11.0