CHANGELOG.md

@objectstack/core

10.3.0

Patch Changes

• @objectstack/spec@10.3.0

10.2.0

Patch Changes

• Updated dependencies [b496498]
  • @objectstack/spec@10.2.0

10.1.0

Patch Changes

• Updated dependencies [49da36e]
• Updated dependencies [ac79f16]
  • @objectstack/spec@10.1.0

10.0.0

Patch Changes

• d5f6d29: fix(runtime): surface code-defined datasources at GET /api/v1/datasources and GET /api/v1/meta/datasource on the standalone / host-config boot path (ADR-0015 §18, follow-up to #2111).

  A datasource declared in defineStack({ datasources: [...] }) (e.g. the showcase's showcase_external) is stamped origin: 'code' and registered by AppPlugin via metadata.registerInMemory('datasource', …) — gated on typeof metadata.registerInMemory === 'function'. On the standalone / host-config path (os dev/serve for a config whose plugins are already instantiated — isHostConfig true — so no MetadataPlugin loads) the metadata service is an in-memory fallback that implemented register/list/get but not registerInMemory. The guard was therefore false, AppPlugin silently skipped the registration, and the datasource was absent from both REST surfaces (and Setup → Integrations → Datasources) even though the boot banner counted it and its federated objects were queryable.

  Both in-memory metadata fallbacks (@objectstack/core's createMemoryMetadata and @objectstack/plugin-dev's dev stub) now implement registerInMemory (synchronous, no persistence — identical to register for these in-memory stores, matching MetadataManager's signature). The read paths (metadata.list, datasource-admin listDatasources, and protocol.getMetaItems which merges metadata.list) were already correct; this restores the write-side registration they depend on. It also makes stack-declared security metadata (roles/permissions/sharingRules/policies, registered through the same guard) listable on this path.

• Updated dependencies [d7ff626]

• Updated dependencies [2a1b16b]

• Updated dependencies [e16f2a8]

• Updated dependencies [e411a82]

• Updated dependencies [a581385]

• Updated dependencies [220ce5b]

• Updated dependencies [3efe334]

• Updated dependencies [feead7e]

• Updated dependencies [6ca20b3]

• Updated dependencies [5f875fe]

• Updated dependencies [b469950]

  • @objectstack/spec@10.0.0

9.11.0

Patch Changes

• Updated dependencies [e7f6539]
• Updated dependencies [2365d07]
• Updated dependencies [6595b53]
• Updated dependencies [fa8964d]
• Updated dependencies [36138c7]
• Updated dependencies [a8e4f3b]
• Updated dependencies [4c213c2]
• Updated dependencies [2afb612]
  • @objectstack/spec@9.11.0

9.10.0

Patch Changes

• Updated dependencies [db02bd5]
• Updated dependencies [641675d]
• Updated dependencies [94e9040]
• Updated dependencies [1f88fd9]
• Updated dependencies [1f88fd9]
  • @objectstack/spec@9.10.0

9.9.1

Patch Changes

• @objectstack/spec@9.9.1

9.9.0

Minor Changes

• 601cc11: feat(analytics): timezone-aware date bucketing (ADR-0053 Phase 2)

  Analytics day/week/month/quarter/year buckets now resolve on a reference timezone's calendar days, so a row near a tz day-boundary lands in the bucket a user in that zone would expect — identically on SQLite and Postgres.

  Per ADR-0053 decision D2, bucketing is done in-memory, uniformly for non-UTC zones rather than emitting dialect-specific date_trunc … AT TIME ZONE (SQLite has no tz database and MySQL needs tz tables loaded, so splitting by dialect would shift bucket boundaries for the same data). engine.aggregate({ timezone }) therefore forces the in-memory aggregation path when a non-UTC reference tz is set — the date-range where still goes to the driver, so only matching rows are fetched. UTC / unset keeps the native driver fast path unchanged.

  • New shared calendarPartsInTz / calendarPartsInTzOrUtc util in @objectstack/core (DST-safe via Intl.DateTimeFormat, never hand-rolled offset math; falls back to UTC for an unset/'UTC'/invalid zone).
  • EngineAggregateOptions and the analytics executeAggregate bridge / ObjectQLStrategy thread the reference timezone (sourced from the dataset selection / ExecutionContext) through to applyInMemoryAggregation → bucketDateValue, and the draft-preview evaluator's bucketDate.
  • formatDateBucket (dimension labels) stays UTC-only by design: it re-labels values that were already bucketed upstream, so re-applying a timezone there would shift a correct bucket by a day.

Patch Changes

• Updated dependencies [84249a4]
• Updated dependencies [11af299]
• Updated dependencies [d5774b5]
• Updated dependencies [134043a]
• Updated dependencies [90108e0]
• Updated dependencies [9afeb2d]
• Updated dependencies [6bec07e]
• Updated dependencies [601cc11]
• Updated dependencies [575448d]
  • @objectstack/spec@9.9.0

9.8.0

Patch Changes

• Updated dependencies [97c55b3]
• Updated dependencies [1b1f490]
  • @objectstack/spec@9.8.0

9.7.0

Patch Changes

• @objectstack/spec@9.7.0

9.6.0

Patch Changes

• Updated dependencies [d1e930a]
• Updated dependencies [71578f2]
• Updated dependencies [5e3a301]
• Updated dependencies [5db2742]
  • @objectstack/spec@9.6.0

9.5.1

Patch Changes

• Updated dependencies [ee72aae]
  • @objectstack/spec@9.5.1

9.5.0

Patch Changes

• Updated dependencies [d08551c]
• Updated dependencies [707aeed]
• Updated dependencies [7a103d4]
• Updated dependencies [4b01250]
  • @objectstack/spec@9.5.0

9.4.0

Patch Changes

• Updated dependencies [060467a]
• Updated dependencies [0856476]
• Updated dependencies [b678d8c]
• Updated dependencies [b678d8c]
• Updated dependencies [b678d8c]
  • @objectstack/spec@9.4.0

9.3.0

Patch Changes

• Updated dependencies [1ada658]
• Updated dependencies [3219191]
• Updated dependencies [290f631]
• Updated dependencies [50b7b47]
• Updated dependencies [f15d6f6]
• Updated dependencies [f8684ea]
• Updated dependencies [b4765be]
  • @objectstack/spec@9.3.0

9.2.0

Patch Changes

• Updated dependencies [2f57b75]
• Updated dependencies [2f57b75]
  • @objectstack/spec@9.2.0

9.1.0

Patch Changes

• Updated dependencies [b9062c9]
  • @objectstack/spec@9.1.0

9.0.1

Patch Changes

• Updated dependencies [1817845]
  • @objectstack/spec@9.0.1

9.0.0

Patch Changes

• Updated dependencies [4c3f693]
• Updated dependencies [0bf39f1]
• Updated dependencies [f533f42]
• Updated dependencies [1c83ee8]
  • @objectstack/spec@9.0.0

8.0.1

Patch Changes

• @objectstack/spec@8.0.1

8.0.0

Minor Changes

• c262301: fix(rest): REST data API honors sys_api_key — one shared verifier with MCP (closes #1633)

  Staging e2e found the MCP surface authenticated a sys_api_key but the REST data API (@objectstack/rest) returned 401 for the same key — its resolveExecCtx only checked the better-auth session, never the API key.

  Converged both surfaces onto ONE verifier so they can't drift:

  • @objectstack/core/security now owns the shared sys_api_key primitives (hashApiKey, generateApiKey, extractApiKey, parseScopes, isExpired) plus a new resolveApiKeyPrincipal(ql, headers, nowMs?) that hashes the inbound key, looks it up by the indexed at-rest hash, and rejects unknown / revoked / expired / owner-less keys (fail-closed). core is the natural home: both rest and runtime depend on it, it depends on neither (no cycle), and it's server-side (already uses node:crypto).
  • @objectstack/runtime — security/api-key.ts re-exports the primitives from core (stable import surface) and resolveExecutionContext now delegates its API-key branch to resolveApiKeyPrincipal.
  • @objectstack/rest — resolveExecCtx resolves the data engine once and tries resolveApiKeyPrincipal (x-api-key / Authorization: ApiKey) BEFORE the session, so /api/v1/data + /api/v1/meta now authenticate an API key under the key's permissions + RLS, exactly like the dispatcher/MCP path.

  Tests: core api-key.test.ts (primitives + verifier: valid / revoked / expired / unknown / owner-less / plaintext-not-matched / fail-closed-ql). runtime + rest suites green.

Patch Changes

• Updated dependencies [a46c017]
• Updated dependencies [b990b89]
• Updated dependencies [99111ec]
• Updated dependencies [d5a8161]
• Updated dependencies [5cf1f1b]
• Updated dependencies [9ef89d4]
• Updated dependencies [3306d2f]
• Updated dependencies [bc44195]
• Updated dependencies [9e2e229]
  • @objectstack/spec@8.0.0

7.9.0

Patch Changes

• @objectstack/spec@7.9.0

7.8.0

Patch Changes

• Updated dependencies [06f2bbb]
• Updated dependencies [36719db]
• Updated dependencies [424ab26]
  • @objectstack/spec@7.8.0

7.7.0

Patch Changes

• Updated dependencies [b391955]
• Updated dependencies [f06b64e]
• Updated dependencies [023bf93]
  • @objectstack/spec@7.7.0

7.6.0

Patch Changes

• Updated dependencies [955d4c8]
• Updated dependencies [c4a4cbd]
• Updated dependencies [b046ec2]
• Updated dependencies [2170ad9]
• Updated dependencies [02d6359]
• Updated dependencies [7648242]
• Updated dependencies [8fa1e7f]
• Updated dependencies [55866f5]
• Updated dependencies [60f9c45]
  • @objectstack/spec@7.6.0

7.5.0

Patch Changes

• @objectstack/spec@7.5.0

7.4.1

Patch Changes

• @objectstack/spec@7.4.1

7.4.0

Patch Changes

• Updated dependencies [23c7107]
• Updated dependencies [c72daad]
• Updated dependencies [f115182]
• Updated dependencies [2faf9f2]
• Updated dependencies [2faf9f2]
• Updated dependencies [2faf9f2]
• Updated dependencies [58b450b]
• Updated dependencies [82eb6cf]
• Updated dependencies [13d8653]
• Updated dependencies [ff3d006]
• Updated dependencies [5e831de]
  • @objectstack/spec@7.4.0

7.3.0

Patch Changes

• 5e7c554: Rename kernel plugin-sandbox permission schemas to remove a naming footgun (issue #1383).

  @objectstack/spec/kernel exported PermissionSchema / PermissionSetSchema (and the Permission / PermissionSet types) for the plugin-sandbox security model. Their names collided with the metadata-protocol permission set exported from @objectstack/spec/security (PermissionSetSchema), making it very easy to validate the permission/profile metadata type against the wrong schema and reject every legal payload.

  The kernel symbols are now prefixed with Plugin to reflect their specialized semantics:

  Old (@objectstack/spec/kernel)	New
  PermissionSchema	PluginPermissionSchema
  PermissionSetSchema	PluginPermissionSetSchema
  Permission (type)	PluginPermission
  PermissionSet (type)	PluginPermissionSet

  The metadata permission/profile types are unchanged — keep using PermissionSetSchema from @objectstack/spec/security.

• Updated dependencies [5e7c554]

  • @objectstack/spec@7.3.0

7.2.1

Patch Changes

• @objectstack/spec@7.2.1

7.2.0

Patch Changes

• @objectstack/spec@7.2.0

7.1.0

Patch Changes

• Updated dependencies [47a92f4]
  • @objectstack/spec@7.1.0

7.0.0

Patch Changes

• Updated dependencies [74470ad]
• Updated dependencies [d29617e]
• Updated dependencies [dc72172]
  • @objectstack/spec@7.0.0

6.9.0

Patch Changes

• @objectstack/spec@6.9.0

6.8.1

Patch Changes

• @objectstack/spec@6.8.1

6.8.0

Patch Changes

• Updated dependencies [6e88f77]
• Updated dependencies [c8b9f57]
  • @objectstack/spec@6.8.0

6.7.1

Patch Changes

• @objectstack/spec@6.7.1

6.7.0

Patch Changes

• Updated dependencies [430067b]
• Updated dependencies [4f9e9d4]
  • @objectstack/spec@6.7.0

6.6.0

Patch Changes

• Updated dependencies [a49cfc2]
  • @objectstack/spec@6.6.0

6.5.1

Patch Changes

• @objectstack/spec@6.5.1

6.5.0

Patch Changes

• @objectstack/spec@6.5.0

6.4.0

Patch Changes

• Updated dependencies [f8651cc]
• Updated dependencies [f8651cc]
• Updated dependencies [0bf6f9a]
  • @objectstack/spec@6.4.0

6.3.0

Patch Changes

• @objectstack/spec@6.3.0

6.2.0

Patch Changes

• Updated dependencies [b4c74a9]
  • @objectstack/spec@6.2.0

6.1.1

Patch Changes

• @objectstack/spec@6.1.1

6.1.0

Patch Changes

• Updated dependencies [93c0589]
  • @objectstack/spec@6.1.0

6.0.0

Patch Changes

• Updated dependencies [629a716]
• Updated dependencies [dbc4f7d]
• Updated dependencies [944f187]
  • @objectstack/spec@6.0.0

5.2.0

Patch Changes

• Updated dependencies [bab2b20]
• Updated dependencies [fa011d8]
• Updated dependencies [b806f58]
  • @objectstack/spec@5.2.0

5.1.0

Patch Changes

• Updated dependencies [75f4ee6]
• Updated dependencies [823d559]
  • @objectstack/spec@5.1.0

5.0.0

Patch Changes

• Updated dependencies [2f9073a]
  • @objectstack/spec@5.0.0

4.2.0

Patch Changes

• Updated dependencies [2869891]
  • @objectstack/spec@4.2.0

4.1.1

Patch Changes

• @objectstack/spec@4.1.1

4.1.0

Patch Changes

• Updated dependencies [2108c30]
• Updated dependencies [23db640]
  • @objectstack/spec@4.1.0

4.0.5

Patch Changes

• 15e0df6: chore: unify all package versions to a single patch release
• Updated dependencies [15e0df6]
  • @objectstack/spec@4.0.5

4.0.4

Patch Changes

• Updated dependencies [326b66b]
  • @objectstack/spec@4.0.4

4.0.3

Patch Changes

• @objectstack/spec@4.0.3

4.0.2

Patch Changes

• Updated dependencies [5f659e9]
  • @objectstack/spec@4.0.2

4.0.0

Minor Changes

• e0b0a78: Deprecate DataEngineQueryOptions in favor of QueryAST-aligned EngineQueryOptions.

  Engine, Protocol, and Client now use standard QueryAST parameter names:

  • filter → where
  • select → fields
  • sort → orderBy
  • skip → offset
  • populate → expand
  • top → limit

  The old DataEngine* schemas and types are preserved with @deprecated markers for backward compatibility.

Patch Changes

• Updated dependencies [f08ffc3]
• Updated dependencies [e0b0a78]
  • @objectstack/spec@4.0.0

3.3.1

Patch Changes

• @objectstack/spec@3.3.1

3.3.0

Patch Changes

• @objectstack/spec@3.3.0

3.2.9

Patch Changes

• @objectstack/spec@3.2.9

3.2.8

Patch Changes

• @objectstack/spec@3.2.8

3.2.7

Patch Changes

• @objectstack/spec@3.2.7

3.2.6

Patch Changes

• @objectstack/spec@3.2.6

3.2.5

Patch Changes

• @objectstack/spec@3.2.5

3.2.4

Patch Changes

• @objectstack/spec@3.2.4

3.2.3

Patch Changes

• @objectstack/spec@3.2.3

3.2.2

Patch Changes

• Updated dependencies [46defbb]
  • @objectstack/spec@3.2.2

3.2.1

Patch Changes

• Updated dependencies [850b546]
  • @objectstack/spec@3.2.1

3.2.0

Patch Changes

• Updated dependencies [5901c29]
  • @objectstack/spec@3.2.0

3.1.1

Patch Changes

• Updated dependencies [953d667]
  • @objectstack/spec@3.1.1

3.1.0

Patch Changes

• Updated dependencies [0088830]
  • @objectstack/spec@3.1.0

3.0.11

Patch Changes

• Updated dependencies [92d9d99]
  • @objectstack/spec@3.0.11

3.0.10

Patch Changes

• Updated dependencies [d1e5d31]
  • @objectstack/spec@3.0.10

3.0.9

Patch Changes

• Updated dependencies [15e0df6]
  • @objectstack/spec@3.0.9

3.0.8

Patch Changes

• Updated dependencies [5a968a2]
  • @objectstack/spec@3.0.8

3.0.7

Patch Changes

• Updated dependencies [0119bd7]
• Updated dependencies [5426bdf]
  • @objectstack/spec@3.0.7

3.0.6

Patch Changes

• Updated dependencies [5df254c]
  • @objectstack/spec@3.0.6

3.0.5

Patch Changes

• Updated dependencies [23a4a68]
  • @objectstack/spec@3.0.5

3.0.4

Patch Changes

• Updated dependencies [d738987]
  • @objectstack/spec@3.0.4

3.0.3

Patch Changes

• c7267f6: Patch release for maintenance updates and improvements.
• Updated dependencies [c7267f6]
  • @objectstack/spec@3.0.3

3.0.2

Patch Changes

• Updated dependencies [28985f5]
  • @objectstack/spec@3.0.2

3.0.1

Patch Changes

• Updated dependencies [389725a]
  • @objectstack/spec@3.0.1

3.0.0

Major Changes

• Release v3.0.0 — unified version bump for all ObjectStack packages.

Patch Changes

• Updated dependencies
  • @objectstack/spec@3.0.0

2.0.7

Patch Changes

• Updated dependencies
  • @objectstack/spec@2.0.7

2.0.6

Patch Changes

• Patch release for maintenance and stability improvements
• Updated dependencies
  • @objectstack/spec@2.0.6

2.0.5

Patch Changes

• Updated dependencies
  • @objectstack/spec@2.0.5

2.0.4

Patch Changes

• Patch release for maintenance and stability improvements
• Updated dependencies
  • @objectstack/spec@2.0.4

2.0.3

Patch Changes

• Patch release for maintenance and stability improvements
• Updated dependencies
  • @objectstack/spec@2.0.3

2.0.2

Patch Changes

• Updated dependencies [1db8559]
  • @objectstack/spec@2.0.2

2.0.1

Patch Changes

• Patch release for maintenance and stability improvements
• Updated dependencies
  • @objectstack/spec@2.0.1

2.0.0

Patch Changes

• Updated dependencies [38e5dd5]
• Updated dependencies [38e5dd5]
  • @objectstack/spec@2.0.0

1.0.12

Patch Changes

• chore: add Vercel deployment configs, simplify console runtime configuration
• Updated dependencies
  • @objectstack/spec@1.0.12

1.0.11

Patch Changes

• @objectstack/spec@1.0.11

1.0.10

Patch Changes

• 10f52e1: fix: silence unhandled promise rejections when checking for async services in kernel
  • @objectstack/spec@1.0.10

1.0.9

Patch Changes

• @objectstack/spec@1.0.9

1.0.8

Patch Changes

• @objectstack/spec@1.0.8

1.0.7

Patch Changes

• @objectstack/spec@1.0.7

1.0.6

Patch Changes

• Updated dependencies [a7f7b9d]
  • @objectstack/spec@1.0.6

1.0.5

Patch Changes

• b1d24bd: refactor: migrate build system from tsc to tsup for faster builds
  • Replaced tsc with tsup (using esbuild) across all packages
  • Added shared tsup.config.ts in workspace root
  • Added tsup as workspace dev dependency
  • significantly improved build performance
• Updated dependencies [b1d24bd]
  • @objectstack/spec@1.0.5

1.0.4

Patch Changes

• @objectstack/spec@1.0.4

1.0.3

Patch Changes

• fb2eabd: fix: resolve "process is not defined" runtime error in browser environments by adding safe environment detection and polyfills
  • @objectstack/spec@1.0.3

1.0.2

Patch Changes

• a0a6c85: Infrastructure and development tooling improvements

  • Add changeset configuration for automated version management
  • Add comprehensive GitHub Actions workflows (CI, CodeQL, linting, releases)
  • Add development configuration files (.cursorrules, .github/prompts)
  • Add documentation files (ARCHITECTURE.md, CONTRIBUTING.md, workflows docs)
  • Update test script configuration in package.json
  • Add @objectstack/cli to devDependencies for better development experience

• 109fc5b: Unified patch release to align all package versions.

• Updated dependencies [a0a6c85]

• Updated dependencies [109fc5b]

  • @objectstack/spec@1.0.2

1.0.1

Patch Changes

• @objectstack/spec@1.0.1

1.0.0

Major Changes

• Major version release for ObjectStack Protocol v1.0.
  • Stabilized Protocol Definitions
  • Enhanced Runtime Plugin Support
  • Fixed Type Compliance across Monorepo

Patch Changes

• Updated dependencies
  • @objectstack/spec@1.0.0

0.9.2

Patch Changes

• Updated dependencies
  • @objectstack/spec@0.9.2

0.9.1

Patch Changes

• Patch release for maintenance and stability improvements. All packages updated with unified versioning.
• Updated dependencies
  • @objectstack/spec@0.9.1

0.8.2

Patch Changes

• Updated dependencies [555e6a7]
  • @objectstack/spec@0.8.2

0.8.1

Patch Changes

• @objectstack/spec@0.8.1

1.0.0

Minor Changes

• Upgrade to Zod v4 and Protocol Improvements

  This release includes a major upgrade to the core validation engine (Zod v4) and aligns all protocol definitions with stricter type safety.

Patch Changes

• Updated dependencies
  • @objectstack/spec@1.0.0

0.7.2

Patch Changes

• fb41cc0: Patch release: Updated documentation and JSON schemas
• Updated dependencies [fb41cc0]
  • @objectstack/spec@0.7.2

0.7.1

Patch Changes

• Updated dependencies
  • @objectstack/spec@0.7.1

0.6.1

Patch Changes

• Patch release for maintenance and stability improvements
• Updated dependencies
  • @objectstack/spec@0.6.1

0.6.0

Minor Changes

• b2df5f7: Unified version bump to 0.5.0

  • Standardized all package versions to 0.5.0 across the monorepo
  • Fixed driver-memory package.json paths for proper module resolution
  • Ensured all packages are in sync for the 0.5.0 release

Patch Changes

• Updated dependencies [b2df5f7]
  • @objectstack/spec@0.6.0