Skip to content

CHANGELOG.md

Latest commit

 

History

History
1705 lines (1364 loc) · 66.9 KB

CHANGELOG.md

File metadata and controls

1705 lines (1364 loc) · 66.9 KB
Raw

@objectstack/plugin-approvals

16.1.0

Patch Changes

  • Updated dependencies [212b66a]
  • Updated dependencies [d10c4dc]
  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @objectstack/platform-objects@16.1.0
    • @objectstack/spec@16.1.0
    • @objectstack/core@16.1.0
    • @objectstack/formula@16.1.0
    • @objectstack/metadata-core@16.1.0

16.0.0

Minor Changes

  • e412fb6: feat(approvals): declare file attachments on approve/reject decisions

    The declared approval_approve / approval_reject actions on sys_approval_request gain an optional multi-file attachments param (type: 'file', multiple). The console renders type:'file' action params through the shared upload widget (objectui ADR-0059) and POSTs the resolved attachments: string[], so a reviewer can attach supporting files to a decision through the generic declared-action dialog — letting the approvals inbox retire its hand-wired attachment composer (objectui#2698).

    Purely additive metadata: the decision route already forwards body.attachments to ApprovalService.decide, and the sys_approval_action.attachments column (file, multiple) already persists them (#3266/#3274). No service or route change.

  • 8efa395: feat(approvals): server-computed viewer capability for precise decision-action gating

    getRequest / listRequests now attach a per-viewer block — viewer: { can_act, is_submitter } — computed from the caller's context (ApprovalRequestRow.viewer):

    • can_act — the caller is a current pending approver (their user id is in the request's resolved pending_approvers while it is still pending). This is the same check the decision methods authorize with, so it already reflects position/team/manager resolution — strictly more accurate than a client-side identity guess.
    • is_submitter — the caller submitted the request.

    The declared decision actions on sys_approval_request now gate on it: approver actions (approve/reject/reassign/send-back/request-info) use record.viewer.can_act; submitter levers (remind/recall/resubmit) use record.viewer.is_submitter. Previously approver actions only trimmed the non-pending case, so a submitter viewing their own pending request saw buttons they couldn't use (the backend 403'd); a position-addressed approver could be wrongly hidden by the old client heuristic. Where viewer is absent (a row surfaced outside a service read with a user context), the predicate fails closed.

  • 3a18b60: feat(approvals): rename the role approver type to org_membership_level (#3133)

    ApproverType.role was the last platform surface projecting the reserved word "role" (ADR-0090 D3). It is not covered by D3's better-auth exception: that exception protects better-auth's own sys_member.role column, which we do not own — ApproverType is our own enum, an authoring surface, and D3 mandates that the projection of that concept is spelled org_membership_level and labelled "organization membership", never "role".

    The sentence licensing the leak was also false: ADR-0090 D3 claims sys_member.role is "already relabelled org_membership_level in the platform projection", but org_membership_level existed nowhere in the codebase and ADR-0057 D7 lists that relabel under "Deferred (evidence-gated, P4)". The projection never landed, so the word reached authors.

    The name manufactured a real, silent failure — "hotcrm class": every other surface renamed to position (sys_role, ShareRecipientType.role, ctx.roles[]), so { type: 'role', value: 'sales_manager' } reads as the legacy spelling of a position. It resolves against the membership tier, finds no member row, falls back to an inert role:sales_manager literal, and the request waits forever on an approver that cannot exist.

    • spec: ApproverType gains org_membership_level; role stays as a deprecated alias for one window (a published 15.x flow keeps loading) with DEPRECATED_APPROVER_TYPES + canonicalApproverType() as the single source for the mapping. Removed in the next major.
    • plugin-approvals: resolves on the canonical type and warns on the deprecated spelling. The type:value fallback literal keeps the authored spelling — stored sys_approval_approver rows and pending_approvers slots from 15.x carry role:<v>, and rewriting it would orphan them.
    • lint: approval-role-not-membership-tier → approval-approver-not-membership-tier (the rule id carried the reserved word too), plus a new approval-approver-type-deprecated. The two are mutually exclusive: a bad value wins, because prescribing org_membership_level for a position name would be wrong advice — the fix there is position.

    Authoring type: 'role' keeps working and now says so out loud. Rewrite it as org_membership_level; if the value is an org position, the fix is position.

Patch Changes

  • 22013aa: Split the overloaded managedBy: 'system' bucket into engine-owned vs. admin-writable, and enforce engine-owned writes (ADR-0103, #3220). The system bucket conflated two incompatible write policies: rows a platform service owns end to end (never user-written), and platform-defined schema whose rows are legitimately admin/user-writable. It carried the same all-false affordance row as better-auth/append-only but, unlike better-auth, had no engine enforcement — a wildcard admin could raw-write these rows through the generic data API (ADR-0049 gap).

    Rather than add a new managedBy enum value (which would fall through to fully-editable platform defaults on already-deployed Console clients), the write policy is now the resolved affordance (resolveCrudAffordances = bucket default + userActions), and engine-owned is defined as a system/append-only object that grants no write:

    • Writable set declares userActions — the RBAC link tables (sys_user_position, sys_user_permission_set, sys_position_permission_set), sys_user_preference, sys_approval_delegation, and the messaging config grids (sys_notification_preference / …_subscription / …_template) now declare userActions: { create, edit, delete: true }. The affordance is a declaration only — the DelegatedAdminGate / RLS / permission sets remain the authz.
    • Engine-owned objects locked to reads — apiMethods: ['get','list'] added where absent (jobs, notifications, approval request/approver/token/action, sys_record_share, sys_automation_run, mail/settings/secret audit, the messaging delivery pipeline). sys_secret is explicitly read-locked (an empty apiMethods array fails open).
    • sys_import_job stays engine-owned: the REST import route now writes its job rows isSystem-elevated (attribution preserved via the explicit created_by stamp) and the object is locked to ['get','list'].
    • New engine write guard (assertEngineOwnedWriteAllowed, plugin-security) fail-closed rejects user-context generic writes to engine-owned system/append-only objects, keyed off the resolved affordance; isSystem and context-less engine/service writes bypass by construction. Wired into the security middleware alongside the other data-layer gates.
    • reconcileManagedApiMethods (objectql registry) now runs for every managed bucket, not just better-auth: any advertised write verb an object's resolved affordances forbid is stripped at registration with a warning (the drift backstop, ADR-0049).
    • /me/permissions clamp (plugin-hono-server) now clamps system/append-only as well as better-auth, so the client hint reflects permission ∩ guard.

    Potentially breaking: a downstream/third-party system object that advertised generic write verbs relying on today's fail-open behaviour will have those verbs stripped (with a warning) and user-context generic writes to it rejected. Declare userActions opening the verbs the object legitimately takes from a user context. better-auth keeps plugin-auth's identity write guard unchanged; the row-level managed_by provenance vocabulary (ADR-0066) is a different axis and is untouched.

  • 62a2117: Split the overloaded managedBy: 'system' bucket with an explicit engine-owned value (ADR-0103 addendum, #3343). ADR-0103 deferred the enum split ("revisitable later as a rename") because a new managedBy value would fall through to the fully-editable platform default on deployed Console clients. Both reasons against it are now retired — the server-side write guard / apiMethods reconciliation / /me/permissions clamp make that fallthrough cosmetic (the write is rejected regardless of what the client renders), and objectui#2712 closed the UI union — so v16 lands it, additively.

    • New enum value engine-owned with the same all-locked default affordance row as system (create/import/edit/delete: false, exportCsv: true). It joins ENGINE_OWNED_BUCKETS (the engine write guard) and GUARDED_WRITE_BUCKETS (the /me/permissions clamp); the guard, reconcileManagedApiMethods, and the clamp mechanisms are unchanged — engine-owned is an explicit member of the set they already covered by resolved affordance.
    • 20 objects relabelled system → engine-owned — the ones the engine owns end to end and that declared no write-opening userActions (the metadata store, jobs, approval runtime rows, sharing rows, sys_automation_run, the messaging delivery/receipt pipeline, sys_secret, settings). One-line, behaviour-identical per object.
    • 8 admin/user-writable objects keep managedBy: 'system' (the RBAC link tables, sys_user_preference, sys_approval_delegation, the messaging config grids) — system now reads as "engine-managed schema, writable via userActions".

    Behaviour-, enforcement- and wire-identical: resolved affordances, the guard verdict, the 405 apiMethods reconciliation, and the permissions clamp are the same before and after — this is a self-documenting relabel, not a policy change. No data migration (managedBy is schema metadata) and no code branches on the 'system' literal. Retiring the overloaded system entirely (moving the 8 writable objects to a dedicated bucket) is a breaking rename deferred to v17.

  • Updated dependencies [f972574]

  • Updated dependencies [6289ec3]

  • Updated dependencies [22013aa]

  • Updated dependencies [3ad3dd5]

  • Updated dependencies [8efa395]

  • Updated dependencies [3a18b60]

  • Updated dependencies [a8aa34c]

  • Updated dependencies [e057f42]

  • Updated dependencies [a3823b2]

  • Updated dependencies [bc65105]

  • Updated dependencies [43a3efb]

  • Updated dependencies [524696a]

  • Updated dependencies [6b51346]

  • Updated dependencies [80273c8]

  • Updated dependencies [bfa3c3f]

  • Updated dependencies [5e3301d]

  • Updated dependencies [dd9f223]

  • Updated dependencies [46e876c]

  • Updated dependencies [7125007]

  • Updated dependencies [5f05de2]

  • Updated dependencies [021ba4c]

  • Updated dependencies [158aa14]

  • Updated dependencies [62a2117]

  • Updated dependencies [d2723e2]

  • Updated dependencies [fefcd54]

  • Updated dependencies [beaf2de]

  • Updated dependencies [06cb319]

  • Updated dependencies [369eb6e]

  • Updated dependencies [06ff734]

  • Updated dependencies [b659111]

  • Updated dependencies [5754a23]

  • Updated dependencies [6c270a6]

  • Updated dependencies [290e2f0]

  • Updated dependencies [668dd17]

  • Updated dependencies [8abf133]

  • Updated dependencies [e0859b1]

  • Updated dependencies [04ecd4e]

  • Updated dependencies [4d5a892]

  • Updated dependencies [16cebeb]

  • Updated dependencies [86d30af]

  • Updated dependencies [8923843]

  • Updated dependencies [ea32ec7]

  • Updated dependencies [a2795f6]

  • Updated dependencies [f16b492]

  • Updated dependencies [4b6fde8]

  • Updated dependencies [2018df9]

  • Updated dependencies [fc5a3a2]

  • Updated dependencies [8ff9210]

    • @objectstack/spec@16.0.0
    • @objectstack/platform-objects@16.0.0
    • @objectstack/core@16.0.0
    • @objectstack/formula@16.0.0
    • @objectstack/metadata-core@16.0.0

16.0.0-rc.1

Minor Changes

  • e412fb6: feat(approvals): declare file attachments on approve/reject decisions

    The declared approval_approve / approval_reject actions on sys_approval_request gain an optional multi-file attachments param (type: 'file', multiple). The console renders type:'file' action params through the shared upload widget (objectui ADR-0059) and POSTs the resolved attachments: string[], so a reviewer can attach supporting files to a decision through the generic declared-action dialog — letting the approvals inbox retire its hand-wired attachment composer (objectui#2698).

    Purely additive metadata: the decision route already forwards body.attachments to ApprovalService.decide, and the sys_approval_action.attachments column (file, multiple) already persists them (#3266/#3274). No service or route change.

  • 8efa395: feat(approvals): server-computed viewer capability for precise decision-action gating

    getRequest / listRequests now attach a per-viewer block — viewer: { can_act, is_submitter } — computed from the caller's context (ApprovalRequestRow.viewer):

    • can_act — the caller is a current pending approver (their user id is in the request's resolved pending_approvers while it is still pending). This is the same check the decision methods authorize with, so it already reflects position/team/manager resolution — strictly more accurate than a client-side identity guess.
    • is_submitter — the caller submitted the request.

    The declared decision actions on sys_approval_request now gate on it: approver actions (approve/reject/reassign/send-back/request-info) use record.viewer.can_act; submitter levers (remind/recall/resubmit) use record.viewer.is_submitter. Previously approver actions only trimmed the non-pending case, so a submitter viewing their own pending request saw buttons they couldn't use (the backend 403'd); a position-addressed approver could be wrongly hidden by the old client heuristic. Where viewer is absent (a row surfaced outside a service read with a user context), the predicate fails closed.

Patch Changes

  • 62a2117: Split the overloaded managedBy: 'system' bucket with an explicit engine-owned value (ADR-0103 addendum, #3343). ADR-0103 deferred the enum split ("revisitable later as a rename") because a new managedBy value would fall through to the fully-editable platform default on deployed Console clients. Both reasons against it are now retired — the server-side write guard / apiMethods reconciliation / /me/permissions clamp make that fallthrough cosmetic (the write is rejected regardless of what the client renders), and objectui#2712 closed the UI union — so v16 lands it, additively.

    • New enum value engine-owned with the same all-locked default affordance row as system (create/import/edit/delete: false, exportCsv: true). It joins ENGINE_OWNED_BUCKETS (the engine write guard) and GUARDED_WRITE_BUCKETS (the /me/permissions clamp); the guard, reconcileManagedApiMethods, and the clamp mechanisms are unchanged — engine-owned is an explicit member of the set they already covered by resolved affordance.
    • 20 objects relabelled system → engine-owned — the ones the engine owns end to end and that declared no write-opening userActions (the metadata store, jobs, approval runtime rows, sharing rows, sys_automation_run, the messaging delivery/receipt pipeline, sys_secret, settings). One-line, behaviour-identical per object.
    • 8 admin/user-writable objects keep managedBy: 'system' (the RBAC link tables, sys_user_preference, sys_approval_delegation, the messaging config grids) — system now reads as "engine-managed schema, writable via userActions".

    Behaviour-, enforcement- and wire-identical: resolved affordances, the guard verdict, the 405 apiMethods reconciliation, and the permissions clamp are the same before and after — this is a self-documenting relabel, not a policy change. No data migration (managedBy is schema metadata) and no code branches on the 'system' literal. Retiring the overloaded system entirely (moving the 8 writable objects to a dedicated bucket) is a breaking rename deferred to v17.

  • Updated dependencies [6289ec3]

  • Updated dependencies [8efa395]

  • Updated dependencies [bfa3c3f]

  • Updated dependencies [7125007]

  • Updated dependencies [62a2117]

  • Updated dependencies [06ff734]

    • @objectstack/spec@16.0.0-rc.1
    • @objectstack/platform-objects@16.0.0-rc.1
    • @objectstack/formula@16.0.0-rc.1
    • @objectstack/metadata-core@16.0.0-rc.1
    • @objectstack/core@16.0.0-rc.1

16.0.0-rc.0

Minor Changes

  • 3a18b60: feat(approvals): rename the role approver type to org_membership_level (#3133)

    ApproverType.role was the last platform surface projecting the reserved word "role" (ADR-0090 D3). It is not covered by D3's better-auth exception: that exception protects better-auth's own sys_member.role column, which we do not own — ApproverType is our own enum, an authoring surface, and D3 mandates that the projection of that concept is spelled org_membership_level and labelled "organization membership", never "role".

    The sentence licensing the leak was also false: ADR-0090 D3 claims sys_member.role is "already relabelled org_membership_level in the platform projection", but org_membership_level existed nowhere in the codebase and ADR-0057 D7 lists that relabel under "Deferred (evidence-gated, P4)". The projection never landed, so the word reached authors.

    The name manufactured a real, silent failure — "hotcrm class": every other surface renamed to position (sys_role, ShareRecipientType.role, ctx.roles[]), so { type: 'role', value: 'sales_manager' } reads as the legacy spelling of a position. It resolves against the membership tier, finds no member row, falls back to an inert role:sales_manager literal, and the request waits forever on an approver that cannot exist.

    • spec: ApproverType gains org_membership_level; role stays as a deprecated alias for one window (a published 15.x flow keeps loading) with DEPRECATED_APPROVER_TYPES + canonicalApproverType() as the single source for the mapping. Removed in the next major.
    • plugin-approvals: resolves on the canonical type and warns on the deprecated spelling. The type:value fallback literal keeps the authored spelling — stored sys_approval_approver rows and pending_approvers slots from 15.x carry role:<v>, and rewriting it would orphan them.
    • lint: approval-role-not-membership-tier → approval-approver-not-membership-tier (the rule id carried the reserved word too), plus a new approval-approver-type-deprecated. The two are mutually exclusive: a bad value wins, because prescribing org_membership_level for a position name would be wrong advice — the fix there is position.

    Authoring type: 'role' keeps working and now says so out loud. Rewrite it as org_membership_level; if the value is an org position, the fix is position.

Patch Changes

  • 22013aa: Split the overloaded managedBy: 'system' bucket into engine-owned vs. admin-writable, and enforce engine-owned writes (ADR-0103, #3220). The system bucket conflated two incompatible write policies: rows a platform service owns end to end (never user-written), and platform-defined schema whose rows are legitimately admin/user-writable. It carried the same all-false affordance row as better-auth/append-only but, unlike better-auth, had no engine enforcement — a wildcard admin could raw-write these rows through the generic data API (ADR-0049 gap).

    Rather than add a new managedBy enum value (which would fall through to fully-editable platform defaults on already-deployed Console clients), the write policy is now the resolved affordance (resolveCrudAffordances = bucket default + userActions), and engine-owned is defined as a system/append-only object that grants no write:

    • Writable set declares userActions — the RBAC link tables (sys_user_position, sys_user_permission_set, sys_position_permission_set), sys_user_preference, sys_approval_delegation, and the messaging config grids (sys_notification_preference / …_subscription / …_template) now declare userActions: { create, edit, delete: true }. The affordance is a declaration only — the DelegatedAdminGate / RLS / permission sets remain the authz.
    • Engine-owned objects locked to reads — apiMethods: ['get','list'] added where absent (jobs, notifications, approval request/approver/token/action, sys_record_share, sys_automation_run, mail/settings/secret audit, the messaging delivery pipeline). sys_secret is explicitly read-locked (an empty apiMethods array fails open).
    • sys_import_job stays engine-owned: the REST import route now writes its job rows isSystem-elevated (attribution preserved via the explicit created_by stamp) and the object is locked to ['get','list'].
    • New engine write guard (assertEngineOwnedWriteAllowed, plugin-security) fail-closed rejects user-context generic writes to engine-owned system/append-only objects, keyed off the resolved affordance; isSystem and context-less engine/service writes bypass by construction. Wired into the security middleware alongside the other data-layer gates.
    • reconcileManagedApiMethods (objectql registry) now runs for every managed bucket, not just better-auth: any advertised write verb an object's resolved affordances forbid is stripped at registration with a warning (the drift backstop, ADR-0049).
    • /me/permissions clamp (plugin-hono-server) now clamps system/append-only as well as better-auth, so the client hint reflects permission ∩ guard.

    Potentially breaking: a downstream/third-party system object that advertised generic write verbs relying on today's fail-open behaviour will have those verbs stripped (with a warning) and user-context generic writes to it rejected. Declare userActions opening the verbs the object legitimately takes from a user context. better-auth keeps plugin-auth's identity write guard unchanged; the row-level managed_by provenance vocabulary (ADR-0066) is a different axis and is untouched.

  • Updated dependencies [f972574]

  • Updated dependencies [22013aa]

  • Updated dependencies [3ad3dd5]

  • Updated dependencies [3a18b60]

  • Updated dependencies [a8aa34c]

  • Updated dependencies [e057f42]

  • Updated dependencies [a3823b2]

  • Updated dependencies [bc65105]

  • Updated dependencies [43a3efb]

  • Updated dependencies [524696a]

  • Updated dependencies [6b51346]

  • Updated dependencies [80273c8]

  • Updated dependencies [5e3301d]

  • Updated dependencies [dd9f223]

  • Updated dependencies [46e876c]

  • Updated dependencies [5f05de2]

  • Updated dependencies [021ba4c]

  • Updated dependencies [158aa14]

  • Updated dependencies [d2723e2]

  • Updated dependencies [fefcd54]

  • Updated dependencies [beaf2de]

  • Updated dependencies [06cb319]

  • Updated dependencies [369eb6e]

  • Updated dependencies [b659111]

  • Updated dependencies [5754a23]

  • Updated dependencies [6c270a6]

  • Updated dependencies [290e2f0]

  • Updated dependencies [668dd17]

  • Updated dependencies [8abf133]

  • Updated dependencies [e0859b1]

  • Updated dependencies [04ecd4e]

  • Updated dependencies [4d5a892]

  • Updated dependencies [16cebeb]

  • Updated dependencies [86d30af]

  • Updated dependencies [8923843]

  • Updated dependencies [ea32ec7]

  • Updated dependencies [a2795f6]

  • Updated dependencies [f16b492]

  • Updated dependencies [4b6fde8]

  • Updated dependencies [2018df9]

  • Updated dependencies [fc5a3a2]

    • @objectstack/spec@16.0.0-rc.0
    • @objectstack/platform-objects@16.0.0-rc.0
    • @objectstack/core@16.0.0-rc.0
    • @objectstack/formula@16.0.0-rc.0
    • @objectstack/metadata-core@16.0.0-rc.0

15.1.1

Patch Changes

  • @objectstack/spec@15.1.1
  • @objectstack/core@15.1.1
  • @objectstack/metadata-core@15.1.1
  • @objectstack/formula@15.1.1
  • @objectstack/platform-objects@15.1.1

15.1.0

Patch Changes

  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [3fe9df1]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [4109153]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [627f225]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
  • Updated dependencies [f531a26]
    • @objectstack/spec@15.1.0
    • @objectstack/platform-objects@15.1.0
    • @objectstack/core@15.1.0
    • @objectstack/formula@15.1.0
    • @objectstack/metadata-core@15.1.0

15.0.0

Patch Changes

  • Updated dependencies [02a014b]
  • Updated dependencies [28b7c28]
  • Updated dependencies [13749ec]
  • Updated dependencies [e62c233]
  • Updated dependencies [ed61c9b]
  • Updated dependencies [31d04d4]
    • @objectstack/platform-objects@15.0.0
    • @objectstack/spec@15.0.0
    • @objectstack/core@15.0.0
    • @objectstack/formula@15.0.0
    • @objectstack/metadata-core@15.0.0

14.8.0

Patch Changes

  • Updated dependencies [16b4bf6]
  • Updated dependencies [16b4bf6]
  • Updated dependencies [10e8983]
  • Updated dependencies [607aaf4]
  • Updated dependencies [bb71321]
    • @objectstack/spec@14.8.0
    • @objectstack/platform-objects@14.8.0
    • @objectstack/core@14.8.0
    • @objectstack/formula@14.8.0
    • @objectstack/metadata-core@14.8.0

14.7.0

Patch Changes

  • Updated dependencies [d6a72eb]
    • @objectstack/spec@14.7.0
    • @objectstack/core@14.7.0
    • @objectstack/formula@14.7.0
    • @objectstack/metadata-core@14.7.0
    • @objectstack/platform-objects@14.7.0

14.6.0

Patch Changes

  • Updated dependencies [609cb13]
  • Updated dependencies [ce6d151]
    • @objectstack/spec@14.6.0
    • @objectstack/platform-objects@14.6.0
    • @objectstack/core@14.6.0
    • @objectstack/formula@14.6.0
    • @objectstack/metadata-core@14.6.0

14.5.0

Patch Changes

  • Updated dependencies [526805e]
  • Updated dependencies [d79ca07]
  • Updated dependencies [33ebd34]
  • Updated dependencies [c044f08]
  • Updated dependencies [01274eb]
  • Updated dependencies [8f23746]
  • Updated dependencies [b97af7e]
  • Updated dependencies [6da03ee]
    • @objectstack/spec@14.5.0
    • @objectstack/platform-objects@14.5.0
    • @objectstack/core@14.5.0
    • @objectstack/formula@14.5.0
    • @objectstack/metadata-core@14.5.0

14.4.0

Patch Changes

  • Updated dependencies [7953832]
  • Updated dependencies [82e745e]
  • Updated dependencies [f3035bd]
  • Updated dependencies [82c0d94]
  • Updated dependencies [7449476]
    • @objectstack/spec@14.4.0
    • @objectstack/platform-objects@14.4.0
    • @objectstack/metadata-core@14.4.0
    • @objectstack/core@14.4.0
    • @objectstack/formula@14.4.0

14.3.0

Patch Changes

  • Updated dependencies [2a71f48]
  • Updated dependencies [02f6af4]
  • Updated dependencies [c1064f1]
    • @objectstack/platform-objects@14.3.0
    • @objectstack/spec@14.3.0
    • @objectstack/core@14.3.0
    • @objectstack/formula@14.3.0
    • @objectstack/metadata-core@14.3.0

14.2.0

Patch Changes

  • Updated dependencies [ac8f029]
  • Updated dependencies [4ab9958]
    • @objectstack/spec@14.2.0
    • @objectstack/platform-objects@14.2.0
    • @objectstack/core@14.2.0
    • @objectstack/formula@14.2.0
    • @objectstack/metadata-core@14.2.0

14.1.0

Minor Changes

  • 5a8465f: SLA escalation escalateTo is position-first (ADR-0090 D3 follow-up to the position approver type).

    • spec: ApprovalEscalationSchema.escalateTo is documented as a position machine name or a specific user id (was "User id, role, or manager level" — the same pre-D3 'role' trap the position approver type fixed); the Studio xRef picker kind moves role → position.
    • plugin-approvals: on escalation, escalateTo now expands position holders via sys_user_position ∪ the sys_member.role transition source (ADR-0057 D4) for both the reassign approver hand-off and the notify audience. An empty expansion falls back to treating the value as a literal user id, so configs naming a specific user keep working unchanged. The audit trail keeps the authored target.
    • lint: new approval-escalation-reassign-no-target warning — escalation.action: 'reassign' with no escalateTo silently degrades to a notify at runtime; the fix-it prescribes a position or user id target (or action: 'notify').

Patch Changes

  • Updated dependencies [5a8465f]
  • Updated dependencies [7f8620b]
  • Updated dependencies [82ba3a6]
    • @objectstack/spec@14.1.0
    • @objectstack/core@14.1.0
    • @objectstack/formula@14.1.0
    • @objectstack/metadata-core@14.1.0
    • @objectstack/platform-objects@14.1.0

14.0.0

Minor Changes

  • 216fa9a: Add a position approver type so approvals can route to org positions (ADR-0090 D3 fallout).

    Post ADR-0090 D3 the role approver type resolves against the better-auth org-membership tier (sys_member.role: owner/admin/member) — it was never a position. Downstream apps that authored { type: 'role', value: 'sales_manager' } silently routed approvals to nobody. Now:

    • spec: ApproverType gains 'position' — value is the position machine name; the approver expands to its holders via sys_user_position. Authoring guidance: keep type: 'role' ONLY for membership tiers; for org positions use { type: 'position', value: '<position_name>' } (one-line fix for the mismatch above).
    • plugin-approvals: the engine resolves position approvers via sys_user_position ∪ the sys_member.role transition source (same semantics as PositionGraphService in plugin-sharing). The department approver type is now honored by its spec spelling (previously only the off-spec business_unit/bu dialect matched).
    • lint: new validateApprovalApprovers rule — approval-role-not-membership-tier warns when a role approver's value is not a membership tier and prescribes the position rewrite; approval-approver-type-unknown flags off-spec approver types (with a business_unit → department fix-it). Wired into os lint.

Patch Changes

  • Updated dependencies [0a8e685]
  • Updated dependencies [afa8115]
  • Updated dependencies [80f12ca]
  • Updated dependencies [332b711]
  • Updated dependencies [e2fa074]
  • Updated dependencies [23c8668]
  • Updated dependencies [29f017d]
  • Updated dependencies [216fa9a]
  • Updated dependencies [6c22b12]
  • Updated dependencies [d0531c4]
  • Updated dependencies [cff5aac]
    • @objectstack/spec@14.0.0
    • @objectstack/platform-objects@14.0.0
    • @objectstack/core@14.0.0
    • @objectstack/formula@14.0.0
    • @objectstack/metadata-core@14.0.0

13.0.0

Patch Changes

  • Updated dependencies [6d83431]
  • Updated dependencies [01917c2]
  • Updated dependencies [b271691]
  • Updated dependencies [a5a1e41]
  • Updated dependencies [466adf6]
  • Updated dependencies [5be00c3]
  • Updated dependencies [466adf6]
  • Updated dependencies [2bee609]
  • Updated dependencies [9fa84f9]
  • Updated dependencies [fc7e7f7]
    • @objectstack/spec@13.0.0
    • @objectstack/core@13.0.0
    • @objectstack/formula@13.0.0
    • @objectstack/platform-objects@13.0.0
    • @objectstack/metadata-core@13.0.0

12.6.0

Patch Changes

  • Updated dependencies [6cebf22]
  • Updated dependencies [21420d9]
    • @objectstack/spec@12.6.0
    • @objectstack/core@12.6.0
    • @objectstack/formula@12.6.0
    • @objectstack/metadata-core@12.6.0
    • @objectstack/platform-objects@12.6.0

12.5.0

Patch Changes

  • Updated dependencies [8b3d363]
    • @objectstack/spec@12.5.0
    • @objectstack/core@12.5.0
    • @objectstack/formula@12.5.0
    • @objectstack/metadata-core@12.5.0
    • @objectstack/platform-objects@12.5.0

12.4.0

Patch Changes

  • Updated dependencies [60dc3ba]
    • @objectstack/spec@12.4.0
    • @objectstack/metadata-core@12.4.0
    • @objectstack/core@12.4.0
    • @objectstack/formula@12.4.0
    • @objectstack/platform-objects@12.4.0

12.3.0

Patch Changes

  • Updated dependencies [e7eceec]
    • @objectstack/spec@12.3.0
    • @objectstack/core@12.3.0
    • @objectstack/formula@12.3.0
    • @objectstack/metadata-core@12.3.0
    • @objectstack/platform-objects@12.3.0

12.2.0

Patch Changes

  • Updated dependencies [fce8ff4]
  • Updated dependencies [3962023]
  • Updated dependencies [2bb193d]
  • Updated dependencies [0426d27]
  • Updated dependencies [da807f7]
  • Updated dependencies [4f5b791]
    • @objectstack/spec@12.2.0
    • @objectstack/metadata-core@12.2.0
    • @objectstack/core@12.2.0
    • @objectstack/formula@12.2.0
    • @objectstack/platform-objects@12.2.0

12.1.0

Patch Changes

  • Updated dependencies [93e6d02]
    • @objectstack/spec@12.1.0
    • @objectstack/core@12.1.0
    • @objectstack/formula@12.1.0
    • @objectstack/metadata-core@12.1.0
    • @objectstack/platform-objects@12.1.0

12.0.0

Patch Changes

  • Updated dependencies [a8df396]
  • Updated dependencies [e695fe0]
  • Updated dependencies [07f055c]
  • Updated dependencies [7c09621]
  • Updated dependencies [7709db4]
  • Updated dependencies [2082109]
  • Updated dependencies [7c09621]
  • Updated dependencies [9860de4]
  • Updated dependencies [069c205]
    • @objectstack/spec@12.0.0
    • @objectstack/platform-objects@12.0.0
    • @objectstack/core@12.0.0
    • @objectstack/formula@12.0.0
    • @objectstack/metadata-core@12.0.0

11.10.0

Patch Changes

  • 6a9397e: Retire the deprecated compactLayout alias for highlightFields (framework#2536, closes the ADR-0085 deprecation window).

    • ObjectSchema no longer declares compactLayout: create() rejects it like any unknown key; lenient parse() strips it (no silent aliasing).
    • The parse-time alias AND the highlightFields → compactLayout back-fill transition mirror are removed from normalizeSemanticRoleAliases. Served metadata now carries the canonical key only.
    • All remaining first-party authors (27 system objects across plugin-audit / approvals / security / sharing / webhooks / service-storage / automation / messaging / realtime — missed by the #2521 sweep, caught by the type gate) renamed to highlightFields.
    • The downstream smoke pin moves to hotcrm v1.2.2 (hotcrm#424: same rename + deps ^11.7.0).
    • Consumers were switched in objectui#2168 and shipped via the console pin bump (#2526); this closes the window scheduled there. The dogfood mirror assertion (#2528) flips to compactLayout: undefined in this same change, per the plan it carried.

    Version note: minor, not major — the key was deprecated-with-alias for a full release window, all first-party consumers/authors are migrated, and the spec api-surface gate reports no export changes (same documented-exception path as the ADR-0085 removals in 11.7.0). External metadata still authoring compactLayout will now fail create() loudly with the standard unknown-key error naming the key.

  • Updated dependencies [6a9397e]

  • Updated dependencies [c0efe5d]

    • @objectstack/spec@11.10.0
    • @objectstack/core@11.10.0
    • @objectstack/formula@11.10.0
    • @objectstack/metadata-core@11.10.0
    • @objectstack/platform-objects@11.10.0

11.9.0

Patch Changes

  • Updated dependencies [d3595d9]
    • @objectstack/spec@11.9.0
    • @objectstack/core@11.9.0
    • @objectstack/formula@11.9.0
    • @objectstack/metadata-core@11.9.0
    • @objectstack/platform-objects@11.9.0

11.8.0

Patch Changes

  • Updated dependencies [53d491a]
  • Updated dependencies [b84726b]
    • @objectstack/platform-objects@11.8.0
    • @objectstack/spec@11.8.0
    • @objectstack/core@11.8.0
    • @objectstack/metadata-core@11.8.0
    • @objectstack/formula@11.8.0

11.7.0

Patch Changes

  • Updated dependencies [5178906]
    • @objectstack/spec@11.7.0
    • @objectstack/platform-objects@11.7.0
    • @objectstack/core@11.7.0
    • @objectstack/formula@11.7.0
    • @objectstack/metadata-core@11.7.0

11.6.0

Patch Changes

  • @objectstack/spec@11.6.0
  • @objectstack/core@11.6.0
  • @objectstack/metadata-core@11.6.0
  • @objectstack/formula@11.6.0
  • @objectstack/platform-objects@11.6.0

11.5.0

Patch Changes

  • Updated dependencies [6ee4f04]
  • Updated dependencies [c1e3a65]
    • @objectstack/spec@11.5.0
    • @objectstack/core@11.5.0
    • @objectstack/formula@11.5.0
    • @objectstack/metadata-core@11.5.0
    • @objectstack/platform-objects@11.5.0

11.4.0

Patch Changes

  • Updated dependencies [5821c51]
  • Updated dependencies [a0fce3f]
    • @objectstack/spec@11.4.0
    • @objectstack/core@11.4.0
    • @objectstack/formula@11.4.0
    • @objectstack/metadata-core@11.4.0
    • @objectstack/platform-objects@11.4.0

11.3.0

Patch Changes

  • Updated dependencies [58e8e31]
  • Updated dependencies [b4a5df0]
    • @objectstack/spec@11.3.0
    • @objectstack/core@11.3.0
    • @objectstack/formula@11.3.0
    • @objectstack/metadata-core@11.3.0
    • @objectstack/platform-objects@11.3.0

11.2.0

Patch Changes

  • Updated dependencies [d0f4b13]
  • Updated dependencies [302bdab]
    • @objectstack/spec@11.2.0
    • @objectstack/core@11.2.0
    • @objectstack/formula@11.2.0
    • @objectstack/metadata-core@11.2.0
    • @objectstack/platform-objects@11.2.0

11.1.0

Patch Changes

  • Updated dependencies [cbc8c02]
  • Updated dependencies [07c2773]
  • Updated dependencies [d7a88df]
  • Updated dependencies [4f8f108]
  • Updated dependencies [ce0b4f6]
  • Updated dependencies [90bce88]
  • Updated dependencies [3209ec6]
  • Updated dependencies [e011d42]
  • Updated dependencies [6e5bdd5]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
    • @objectstack/platform-objects@11.1.0
    • @objectstack/core@11.1.0
    • @objectstack/spec@11.1.0
    • @objectstack/formula@11.1.0
    • @objectstack/metadata-core@11.1.0

11.0.0

Patch Changes

  • d980f0d: feat: add a first-class user field type (person picker)

    A new user field type — the equivalent of Airtable's Collaborator / Notion's Person / Salesforce's Lookup(User). Authored as Field.user({ ... }); use { multiple: true } for collaborators/watchers and { defaultValue: 'current_user' } to auto-fill the acting user on create.

    Why a distinct type rather than telling authors to Field.lookup('sys_user'): selecting a person is table-stakes, but the value is in modelling discoverability — a "User" entry in the Studio/AI field palette instead of requiring authors (and AI) to know to reference the internal sys_user system object — plus current_user defaults and a user-search picker. Storage and runtime are unchanged.

    Deliberately NOT a new storage primitive. user is a semantic specialization of lookup with the target fixed to sys_user: it shares the exact lookup code path — same FK string column (multiple ⇒ JSON), same $expand resolution, same indexing — so referential integrity and fresh display names come for free, and nothing is re-implemented. An existing Field.lookup('sys_user') is therefore equivalent at the storage layer (zero data migration to adopt Field.user).

    Ownership semantics are unchanged: the existing owner_id convention + plugin-security auto-stamp/RLS still apply. A declarative owner flag is a possible future follow-up; intentionally not added here to avoid a second field type for what is a system role (rationale: keep the FieldType surface lean — see related ADR-0059 freeze discipline).

    Changes: FieldType gains 'user' + Field.user() builder; the SQL/Mongo drivers treat user exactly like lookup; the engine resolves $expand for user fields and honours a new defaultValue: 'current_user' token (resolved app-side from the execution context, mirroring the NOW() convention); kanban group-by and symbolic seed references accept user; approvals enrich user references. The public API surface is unchanged (additive enum member).

  • Updated dependencies [4d99a5c]

  • Updated dependencies [9b5bf3d]

  • Updated dependencies [cb5b393]

  • Updated dependencies [ab5718a]

  • Updated dependencies [4845c12]

  • Updated dependencies [c1a754a]

  • Updated dependencies [6fbe91f]

  • Updated dependencies [715d667]

  • Updated dependencies [5eef4cf]

  • Updated dependencies [72759e1]

  • Updated dependencies [6c4fbd9]

  • Updated dependencies [ef3ed67]

  • Updated dependencies [cd51229]

  • Updated dependencies [7697a0e]

  • Updated dependencies [e7e04f1]

  • Updated dependencies [cfd5ac4]

  • Updated dependencies [2be5c1f]

  • Updated dependencies [ad143ce]

  • Updated dependencies [5c4a8c8]

  • Updated dependencies [3afaeed]

  • Updated dependencies [5737261]

  • Updated dependencies [a619a3a]

  • Updated dependencies [f44c1bd]

  • Updated dependencies [8801c02]

  • Updated dependencies [3d04e06]

  • Updated dependencies [4a84c98]

  • Updated dependencies [c715d25]

  • Updated dependencies [aa33b02]

  • Updated dependencies [d980f0d]

  • Updated dependencies [a658523]

  • Updated dependencies [82ff91c]

  • Updated dependencies [638f472]

    • @objectstack/metadata-core@11.0.0
    • @objectstack/platform-objects@11.0.0
    • @objectstack/spec@11.0.0
    • @objectstack/formula@11.0.0
    • @objectstack/core@11.0.0

10.3.0

Patch Changes

  • @objectstack/spec@10.3.0
  • @objectstack/core@10.3.0
  • @objectstack/metadata-core@10.3.0
  • @objectstack/formula@10.3.0
  • @objectstack/platform-objects@10.3.0

10.2.0

Patch Changes

  • Updated dependencies [b496498]
    • @objectstack/spec@10.2.0
    • @objectstack/core@10.2.0
    • @objectstack/formula@10.2.0
    • @objectstack/metadata-core@10.2.0
    • @objectstack/platform-objects@10.2.0

10.1.0

Patch Changes

  • Updated dependencies [49da36e]
  • Updated dependencies [ac79f16]
    • @objectstack/spec@10.1.0
    • @objectstack/core@10.1.0
    • @objectstack/formula@10.1.0
    • @objectstack/metadata-core@10.1.0
    • @objectstack/platform-objects@10.1.0

10.0.0

Patch Changes

  • e16f2a8: BREAKING: the system object sys_department is renamed to sys_business_unit — object + member table (sys_department_member → sys_business_unit_member), fields, and i18n — with no compatibility alias. Any deployment holding sys_department rows, or metadata that references the object by name (lookups, list views, queries, sharing/approval scopes), must migrate to sys_business_unit. A renamed shipped system object is a breaking change to the platform's public data surface, so this lands as a major. Verified per ADR-0059's pre-publish hotcrm gate: no published downstream consumer references the old name.

    ADR-0057 — ERP authorization core. Adds permission-grant access DEPTH (own/own_and_reports/unit/unit_and_below/org), renames sys_department → sys_business_unit (no aliases — see BREAKING above), introduces the platform-owned sys_user_position assignment, and seeds stack-declared roles/sharingRules into sys_position/sys_sharing_rule at boot (closes #2077). Hierarchy-relative scopes are delegated to a pluggable IHierarchyScopeResolver (open edition fails closed to owner-only; defineStack errors without requires: ['hierarchy-security']). Also fixes a latent over-grant where engine.find({ filter }) was ignored (driver reads where) — normalized filter→where in the engine.

  • Updated dependencies [d7ff626]

  • Updated dependencies [2a1b16b]

  • Updated dependencies [2256e93]

  • Updated dependencies [7108ff3]

  • Updated dependencies [30c0313]

  • Updated dependencies [e16f2a8]

  • Updated dependencies [cfd86ce]

  • Updated dependencies [e411a82]

  • Updated dependencies [ae271d0]

  • Updated dependencies [61ed5c7]

  • Updated dependencies [a581385]

  • Updated dependencies [d5f6d29]

  • Updated dependencies [220ce5b]

  • Updated dependencies [3efe334]

  • Updated dependencies [0df063e]

  • Updated dependencies [ce13bb8]

  • Updated dependencies [feead7e]

  • Updated dependencies [6ca20b3]

  • Updated dependencies [5f875fe]

  • Updated dependencies [b469950]

  • Updated dependencies [47d978a]

  • Updated dependencies [48a307a]

  • Updated dependencies [25fc0e4]

    • @objectstack/spec@10.0.0
    • @objectstack/platform-objects@10.0.0
    • @objectstack/formula@10.0.0
    • @objectstack/core@10.0.0
    • @objectstack/metadata-core@10.0.0

9.11.0

Patch Changes

  • Updated dependencies [e7f6539]
  • Updated dependencies [2365d07]
  • Updated dependencies [6595b53]
  • Updated dependencies [fa8964d]
  • Updated dependencies [36138c7]
  • Updated dependencies [a8e4f3b]
  • Updated dependencies [4c213c2]
  • Updated dependencies [2afb612]
    • @objectstack/spec@9.11.0
    • @objectstack/core@9.11.0
    • @objectstack/formula@9.11.0
    • @objectstack/metadata-core@9.11.0
    • @objectstack/platform-objects@9.11.0

9.10.0

Patch Changes

  • Updated dependencies [db02bd5]
  • Updated dependencies [641675d]
  • Updated dependencies [1f88fd9]
  • Updated dependencies [94e9040]
  • Updated dependencies [4331adb]
  • Updated dependencies [1f88fd9]
  • Updated dependencies [1f88fd9]
    • @objectstack/spec@9.10.0
    • @objectstack/formula@9.10.0
    • @objectstack/platform-objects@9.10.0
    • @objectstack/core@9.10.0
    • @objectstack/metadata-core@9.10.0

9.9.1

Patch Changes

  • @objectstack/spec@9.9.1
  • @objectstack/core@9.9.1
  • @objectstack/metadata-core@9.9.1
  • @objectstack/formula@9.9.1
  • @objectstack/platform-objects@9.9.1

9.9.0

Patch Changes

  • Updated dependencies [84249a4]
  • Updated dependencies [11af299]
  • Updated dependencies [d5774b5]
  • Updated dependencies [134043a]
  • Updated dependencies [90108e0]
  • Updated dependencies [9afeb2d]
  • Updated dependencies [6bec07e]
  • Updated dependencies [601cc11]
  • Updated dependencies [d99a75a]
  • Updated dependencies [575448d]
    • @objectstack/spec@9.9.0
    • @objectstack/core@9.9.0
    • @objectstack/formula@9.9.0
    • @objectstack/metadata-core@9.9.0
    • @objectstack/platform-objects@9.9.0

9.8.0

Patch Changes

  • Updated dependencies [c17d2c8]
  • Updated dependencies [97c55b3]
  • Updated dependencies [1b1f490]
    • @objectstack/formula@9.8.0
    • @objectstack/spec@9.8.0
    • @objectstack/core@9.8.0
    • @objectstack/metadata-core@9.8.0
    • @objectstack/platform-objects@9.8.0

9.7.0

Patch Changes

  • Updated dependencies [82c7438]
  • Updated dependencies [417b6ac]
  • Updated dependencies [ff0a87a]
    • @objectstack/formula@9.7.0
    • @objectstack/spec@9.7.0
    • @objectstack/core@9.7.0
    • @objectstack/metadata-core@9.7.0
    • @objectstack/platform-objects@9.7.0

9.6.0

Patch Changes

  • Updated dependencies [d1e930a]
  • Updated dependencies [71578f2]
  • Updated dependencies [bb00a50]
  • Updated dependencies [5e3a301]
  • Updated dependencies [5db2742]
    • @objectstack/spec@9.6.0
    • @objectstack/formula@9.6.0
    • @objectstack/core@9.6.0
    • @objectstack/metadata-core@9.6.0
    • @objectstack/platform-objects@9.6.0

9.5.1

Patch Changes

  • Updated dependencies [ee72aae]
    • @objectstack/spec@9.5.1
    • @objectstack/core@9.5.1
    • @objectstack/formula@9.5.1
    • @objectstack/metadata-core@9.5.1
    • @objectstack/platform-objects@9.5.1

9.5.0

Patch Changes

  • Updated dependencies [d08551c]
  • Updated dependencies [5be7102]
  • Updated dependencies [707aeed]
  • Updated dependencies [7a103d4]
  • Updated dependencies [4b01250]
    • @objectstack/spec@9.5.0
    • @objectstack/platform-objects@9.5.0
    • @objectstack/core@9.5.0
    • @objectstack/formula@9.5.0
    • @objectstack/metadata-core@9.5.0

9.4.0

Patch Changes

  • Updated dependencies [060467a]
  • Updated dependencies [0856476]
  • Updated dependencies [fef38ec]
  • Updated dependencies [b678d8c]
  • Updated dependencies [b678d8c]
  • Updated dependencies [b678d8c]
    • @objectstack/spec@9.4.0
    • @objectstack/metadata-core@9.4.0
    • @objectstack/core@9.4.0
    • @objectstack/formula@9.4.0
    • @objectstack/platform-objects@9.4.0

9.3.0

Minor Changes

  • 3219191: ADR-0043 actionable approval links (#1743). remind() now fans out per approver: every concrete identity gets its own single-use approve/reject links in the notification payload. Tokens are 256-bit, stored as SHA-256 hashes only (sys_approval_token), scoped to one request + action + approver, 72h TTL, consumed-before-decide (replay burns), and re-validated at redemption against the live request (decided/recalled/reassigned ⇒ dead link). The plugin mounts a session-less bilingual confirm page at GET /api/v1/approvals/act (renders only — mail-gateway prefetch safe) and redeems exclusively on the POST, auditing the decision as the bound approver.
  • f3c1735: Approver join table — the #1745 follow-up that makes approver-filtered pagination exact. New sys_approval_approver object holds one row per (pending request, approver identity); the service mirrors every pending_approvers change into it (open / decide / recall / send-back / reassign / SLA-escalate) and clears the rows when a request leaves pending, so the table tracks the live work queue, not the append-only history. listRequests / countRequests now resolve approver filters through this index ($in on indexed equality instead of a per-row CSV scan) and push status arrays down as $in — every filter is engine-side, so the page window and totals are correct at any table size; the old 500-row bounded-scan residual is gone. rebuildApproverIndex() rebuilds the index from the CSV source of truth, and runs idempotently at plugin start to backfill rows written before the index existed.
  • 290f631: ADR-0044 flow-level send-back-for-revision (#1744). The approval node gains a third flow movement beyond approve/reject: sendBack() finalizes the pending request as returned (new ApprovalStatus), resumes the run down its revise edge to a wait point where the record lock releases, and the submitter's resubmit() re-enters the approval node over a declared back-edge, opening the next round's request (fresh approver slate, re-locked, round stamped via the config snapshot). Engine: FlowEdgeSchema.type gains 'back' — cycle validation now requires the graph minus back-edges to be a DAG (unmarked cycles still rejected), node re-entry overwrites outputs/appends steps, a 100-re-entry runaway guard backstops misauthored loops, and cancelRun(runId, reason) lands as the first run-cancel primitive (recall crossing a revise window cancels the parked run). maxRevisions (default 3) on the approval node config auto-rejects send-backs past the budget. REST: POST /approvals/requests/:id/revise and /resubmit. Audit kinds revise/resubmit join ApprovalActionKind and the sys_approval_action enum.
  • 50b7b47: Approvals server-side pagination + search pushdown (#1745). listRequests accepts q / limit / offset — free-text search pushes into the engine query as an $or of $contains terms (the payload_json snapshot carries record titles, so titles match without a join), and the page window pushes down whenever the filter is fully pushable; approver/status-array filters still post-filter their bounded scan and window in memory (the documented residual until the approver join-table follow-up). New countRequests returns the unwindowed total (engine count when pushable). REST: GET /approvals/requests gains q/limit/offset and returns {data, total} when paging.
  • f15d6f6: ADR-0042 SLA auto-escalation + ADR-0041 mechanical landing. plugin-approvals now owns a jobs-backed escalation scanner (runEscalations, interval job approvals-sla-escalation + boot catch-up): overdue pending requests escalate at most once (the escalate audit row is the idempotency marker, written audit-first) executing the node's escalation.action — notify / reassign-to-escalateTo / auto_approve / auto_reject as the reserved actor system:sla. The trigger packages drop their plugin- prefix (@objectstack/trigger-record-change, @objectstack/trigger-schedule) per ADR-0041, and ActionDescriptor gains an optional maturity: 'ga' | 'beta' | 'reserved' field so designers can grey out contract-ahead-of-runtime surfaces.
  • f8684ea: Approvals thread interactions — the collaboration layer between submit and decide. reassign() hands a pending-approver slot to someone else (audit-first ordering, new approver notified via the optional messaging service), remind() nudges every pending approver with a 4h per-request throttle (THROTTLED → HTTP 429), requestInfo() sends a request back to the submitter for more material while it stays pending, and comment() adds free-form thread replies. Rows expose sla_due_at (created_at + escalation.timeoutHours, display-only) and single reads attach flow_steps (the owning flow's approval trunk with done/current/upcoming states). REST grows the four matching POST routes; the sys_approval_action.action enum gains the new kinds.

Patch Changes

  • Updated dependencies [1ada658]
  • Updated dependencies [3219191]
  • Updated dependencies [290f631]
  • Updated dependencies [50b7b47]
  • Updated dependencies [f15d6f6]
  • Updated dependencies [f8684ea]
  • Updated dependencies [c802327]
  • Updated dependencies [b4765be]
    • @objectstack/spec@9.3.0
    • @objectstack/platform-objects@9.3.0
    • @objectstack/core@9.3.0
    • @objectstack/formula@9.3.0
    • @objectstack/metadata-core@9.3.0

9.2.0

Patch Changes

  • Updated dependencies [2f57b75]
  • Updated dependencies [2f57b75]
    • @objectstack/spec@9.2.0
    • @objectstack/core@9.2.0
    • @objectstack/formula@9.2.0
    • @objectstack/metadata-core@9.2.0
    • @objectstack/platform-objects@9.2.0

9.1.0

Patch Changes

  • Updated dependencies [b9062c9]
    • @objectstack/spec@9.1.0
    • @objectstack/core@9.1.0
    • @objectstack/formula@9.1.0
    • @objectstack/metadata-core@9.1.0
    • @objectstack/platform-objects@9.1.0

9.0.1

Patch Changes

  • Updated dependencies [1817845]
    • @objectstack/spec@9.0.1
    • @objectstack/core@9.0.1
    • @objectstack/formula@9.0.1
    • @objectstack/metadata-core@9.0.1
    • @objectstack/platform-objects@9.0.1

9.0.0

Patch Changes

  • Updated dependencies [4c3f693]
  • Updated dependencies [0bf39f1]
  • Updated dependencies [f533f42]
  • Updated dependencies [1c83ee8]
    • @objectstack/spec@9.0.0
    • @objectstack/core@9.0.0
    • @objectstack/formula@9.0.0
    • @objectstack/metadata-core@9.0.0
    • @objectstack/platform-objects@9.0.0

8.0.1

Patch Changes

  • @objectstack/spec@8.0.1
  • @objectstack/core@8.0.1
  • @objectstack/metadata-core@8.0.1
  • @objectstack/formula@8.0.1
  • @objectstack/platform-objects@8.0.1

8.0.0

Patch Changes

  • Updated dependencies [a46c017]
  • Updated dependencies [b990b89]
  • Updated dependencies [99111ec]
  • Updated dependencies [d5a8161]
  • Updated dependencies [5cf1f1b]
  • Updated dependencies [9ef89d4]
  • Updated dependencies [3306d2f]
  • Updated dependencies [c262301]
  • Updated dependencies [bc44195]
  • Updated dependencies [9e2e229]
    • @objectstack/spec@8.0.0
    • @objectstack/core@8.0.0
    • @objectstack/formula@8.0.0
    • @objectstack/metadata-core@8.0.0
    • @objectstack/platform-objects@8.0.0

7.9.0

Patch Changes

  • @objectstack/spec@7.9.0
  • @objectstack/core@7.9.0
  • @objectstack/metadata-core@7.9.0
  • @objectstack/formula@7.9.0
  • @objectstack/platform-objects@7.9.0

7.8.0

Patch Changes

  • Updated dependencies [06f2bbb]
  • Updated dependencies [f01f9fa]
  • Updated dependencies [36719db]
  • Updated dependencies [424ab26]
    • @objectstack/spec@7.8.0
    • @objectstack/formula@7.8.0
    • @objectstack/core@7.8.0
    • @objectstack/metadata-core@7.8.0
    • @objectstack/platform-objects@7.8.0

7.7.0

Patch Changes

  • Updated dependencies [b391955]
  • Updated dependencies [f06b64e]
  • Updated dependencies [825ab06]
  • Updated dependencies [023bf93]
  • Updated dependencies [764c747]
    • @objectstack/spec@7.7.0
    • @objectstack/formula@7.7.0
    • @objectstack/platform-objects@7.7.0
    • @objectstack/metadata-core@7.7.0
    • @objectstack/core@7.7.0

7.6.0

Patch Changes

  • Updated dependencies [955d4c8]
  • Updated dependencies [c4a4cbd]
  • Updated dependencies [b046ec2]
  • Updated dependencies [2170ad9]
  • Updated dependencies [02d6359]
  • Updated dependencies [7648242]
  • Updated dependencies [8fa1e7f]
  • Updated dependencies [7ae6abc]
  • Updated dependencies [55866f5]
  • Updated dependencies [60f9c45]
    • @objectstack/spec@7.6.0
    • @objectstack/formula@7.6.0
    • @objectstack/platform-objects@7.6.0
    • @objectstack/core@7.6.0
    • @objectstack/metadata-core@7.6.0

7.5.0

Patch Changes

  • @objectstack/spec@7.5.0
  • @objectstack/core@7.5.0
  • @objectstack/metadata-core@7.5.0
  • @objectstack/formula@7.5.0
  • @objectstack/platform-objects@7.5.0

7.4.1

Patch Changes

  • @objectstack/spec@7.4.1
  • @objectstack/core@7.4.1
  • @objectstack/metadata-core@7.4.1
  • @objectstack/formula@7.4.1
  • @objectstack/platform-objects@7.4.1

7.4.0

Minor Changes

  • 4cc2ced: ADR-0029 K2.b — approvals domain ownership + Setup nav contribution.

    Moves sys_approval_request / sys_approval_action out of the @objectstack/platform-objects monolith into @objectstack/plugin-approvals, which already registers and operates them — so the plugin now owns its data model, behavior, and admin menu as one unit.

    • The object definitions move to plugin-approvals; platform-objects no longer exports them from /audit. Runtime is unchanged (the plugin already registered them at runtime).
    • D7 navigation — the Setup app's group_approvals entries (Requests, Action History) move out of platform-objects' SETUP_NAV_CONTRIBUTIONS into plugin-approvals' navigationContributions. The plugin fills the slot it owns; when the plugin is absent the slot stays empty.
    • i18n (D8) — the objects are removed from the platform-objects i18n extract config; their existing generated translation bundles keep working at runtime (object-name keyed). Migrating the i18n extraction/bundles to the plugin remains the tracked cross-cutting follow-up (best done with the os i18n extract tooling, not hand-edited generated files).

Patch Changes

  • 4404572: ADR-0029 D8 — migrate i18n ownership for the moved domains to their plugins.

    The object translations for the domains decomposed in K2.a/K2.b/K2 previously lived in the @objectstack/platform-objects generated bundles even though the objects now live in their capability plugins. This moves each domain's i18n extraction + bundles to the owning plugin, preserving every hand-translated string (zh-CN / ja-JP / es-ES):

    • Each plugin gains a build-time scripts/i18n-extract.config.ts and a src/translations/ bundle ({locale}.objects.generated.ts + an index.ts barrel), generated with os i18n extract and self-baselined so re-runs preserve translations.
    • Each plugin loads its bundle at runtime on kernel:ready via i18n.loadTranslations (the i18n service is optional — load is best-effort).
      • plugin-webhooks ← sys_webhook, sys_webhook_delivery
      • plugin-approvals ← sys_approval_request, sys_approval_action
      • plugin-security ← sys_position, sys_permission_set, sys_user_permission_set, sys_position_permission_set
      • plugin-sharing ← sys_record_share, sys_sharing_rule, sys_share_link
    • @objectstack/platform-objects translation bundles are regenerated to drop those objects' keys (its extract config already excluded them); all other objects' translations and the metadata-form bundles are preserved.

    Net runtime effect is unchanged (same translations load, now contributed by the package that owns each object) — closing the D8 follow-up tracked since K2.a.

  • Updated dependencies [23c7107]

  • Updated dependencies [c72daad]

  • Updated dependencies [4404572]

  • Updated dependencies [eea3f1b]

  • Updated dependencies [e478e0c]

  • Updated dependencies [4cc2ced]

  • Updated dependencies [13632b1]

  • Updated dependencies [f115182]

  • Updated dependencies [2faf9f2]

  • Updated dependencies [2faf9f2]

  • Updated dependencies [2faf9f2]

  • Updated dependencies [58b450b]

  • Updated dependencies [82eb6cf]

  • Updated dependencies [c381977]

  • Updated dependencies [13d8653]

  • Updated dependencies [ff3d006]

  • Updated dependencies [5e831de]

    • @objectstack/spec@7.4.0
    • @objectstack/platform-objects@7.4.0
    • @objectstack/core@7.4.0
    • @objectstack/formula@7.4.0
    • @objectstack/metadata-core@7.4.0

7.3.0

Patch Changes

  • Updated dependencies [5e7c554]
    • @objectstack/spec@7.3.0
    • @objectstack/core@7.3.0
    • @objectstack/formula@7.3.0
    • @objectstack/platform-objects@7.3.0
    • @objectstack/metadata-core@7.3.0

7.2.1

Patch Changes

  • @objectstack/spec@7.2.1
  • @objectstack/core@7.2.1
  • @objectstack/metadata-core@7.2.1
  • @objectstack/formula@7.2.1
  • @objectstack/platform-objects@7.2.1

7.2.0

Patch Changes

  • @objectstack/spec@7.2.0
  • @objectstack/core@7.2.0
  • @objectstack/metadata-core@7.2.0
  • @objectstack/formula@7.2.0
  • @objectstack/platform-objects@7.2.0

7.1.0

Patch Changes

  • Updated dependencies [6228609]
  • Updated dependencies [47a92f4]
    • @objectstack/platform-objects@7.1.0
    • @objectstack/spec@7.1.0
    • @objectstack/core@7.1.0
    • @objectstack/formula@7.1.0
    • @objectstack/metadata-core@7.1.0

7.0.0

Patch Changes

  • Updated dependencies [74470ad]
  • Updated dependencies [d29617e]
  • Updated dependencies [dc72172]
  • Updated dependencies [d29617e]
  • Updated dependencies [010757b]
  • Updated dependencies [257954d]
    • @objectstack/spec@7.0.0
    • @objectstack/platform-objects@7.0.0
    • @objectstack/core@7.0.0
    • @objectstack/formula@7.0.0
    • @objectstack/metadata-core@7.0.0

6.9.0

Patch Changes

  • @objectstack/spec@6.9.0
  • @objectstack/core@6.9.0
  • @objectstack/metadata-core@6.9.0
  • @objectstack/formula@6.9.0
  • @objectstack/platform-objects@6.9.0

6.8.1

Patch Changes

  • @objectstack/spec@6.8.1
  • @objectstack/core@6.8.1
  • @objectstack/metadata-core@6.8.1
  • @objectstack/formula@6.8.1
  • @objectstack/platform-objects@6.8.1

6.8.0

Patch Changes

  • Updated dependencies [6e88f77]
  • Updated dependencies [c8b9f57]
  • Updated dependencies [45d27c5]
    • @objectstack/spec@6.8.0
    • @objectstack/platform-objects@6.8.0
    • @objectstack/core@6.8.0
    • @objectstack/formula@6.8.0
    • @objectstack/metadata-core@6.8.0

6.7.1

Patch Changes

  • @objectstack/spec@6.7.1
  • @objectstack/core@6.7.1
  • @objectstack/metadata-core@6.7.1
  • @objectstack/formula@6.7.1
  • @objectstack/platform-objects@6.7.1

6.7.0

Patch Changes

  • Updated dependencies [430067b]
  • Updated dependencies [4f9e9d4]
  • Updated dependencies [4f9e9d4]
    • @objectstack/spec@6.7.0
    • @objectstack/platform-objects@6.7.0
    • @objectstack/core@6.7.0
    • @objectstack/formula@6.7.0
    • @objectstack/metadata-core@6.7.0

6.6.0

Patch Changes

  • Updated dependencies [a49cfc2]
    • @objectstack/spec@6.6.0
    • @objectstack/core@6.6.0
    • @objectstack/formula@6.6.0
    • @objectstack/platform-objects@6.6.0
    • @objectstack/metadata-core@6.6.0

6.5.1

Patch Changes

  • @objectstack/spec@6.5.1
  • @objectstack/core@6.5.1
  • @objectstack/metadata-core@6.5.1
  • @objectstack/formula@6.5.1
  • @objectstack/platform-objects@6.5.1

6.5.0

Patch Changes

  • @objectstack/spec@6.5.0
  • @objectstack/core@6.5.0
  • @objectstack/metadata-core@6.5.0
  • @objectstack/formula@6.5.0
  • @objectstack/platform-objects@6.5.0

6.4.0

Patch Changes

  • Updated dependencies [f8651cc]
  • Updated dependencies [f8651cc]
  • Updated dependencies [0bf6f9a]
    • @objectstack/spec@6.4.0
    • @objectstack/core@6.4.0
    • @objectstack/formula@6.4.0
    • @objectstack/platform-objects@6.4.0
    • @objectstack/metadata-core@6.4.0

6.3.0

Patch Changes

  • @objectstack/spec@6.3.0
  • @objectstack/core@6.3.0
  • @objectstack/metadata-core@6.3.0
  • @objectstack/formula@6.3.0
  • @objectstack/platform-objects@6.3.0

6.2.0

Patch Changes

  • Updated dependencies [b4c74a9]
    • @objectstack/spec@6.2.0
    • @objectstack/core@6.2.0
    • @objectstack/formula@6.2.0
    • @objectstack/platform-objects@6.2.0
    • @objectstack/metadata-core@6.2.0

6.1.1

Patch Changes

  • @objectstack/spec@6.1.1
  • @objectstack/core@6.1.1
  • @objectstack/metadata-core@6.1.1
  • @objectstack/formula@6.1.1
  • @objectstack/platform-objects@6.1.1

6.1.0

Patch Changes

  • Updated dependencies [93c0589]
    • @objectstack/spec@6.1.0
    • @objectstack/core@6.1.0
    • @objectstack/formula@6.1.0
    • @objectstack/platform-objects@6.1.0
    • @objectstack/metadata-core@6.1.0

6.0.0

Patch Changes

  • Updated dependencies [629a716]
  • Updated dependencies [dbc4f7d]
  • Updated dependencies [944f187]
    • @objectstack/spec@6.0.0
    • @objectstack/platform-objects@6.0.0
    • @objectstack/core@6.0.0
    • @objectstack/formula@6.0.0
    • @objectstack/metadata-core@6.0.0

5.2.0

Minor Changes

  • bab2b20: feat(approvals): execution-pinned approval processes (ADR-0009)

    When an approval request is submitted, the engine now records a process_hash on sys_approval_request — the sha256 of the approval process body resolved through MetadataRepository. While the request is in flight, approve / reject / recall resolve the pinned process body via MetadataRepository.getByHash. Upgrading the approval process definition mid-flight therefore no longer affects requests that already started against the previous version.

    Behavior:

    • sys_approval_request gains a process_hash column (text, nullable, read-only). Existing rows keep working — the engine falls back to the current sys_approval_process projection when the column is empty.
    • ApprovalServiceOptions accepts an optional metadataRepo. When omitted (e.g. defining processes purely through the runtime API or in unit tests), pinning is silently disabled and the service behaves as before.
    • ApprovalsServicePlugin looks up the metadata service from the kernel and wires its repository automatically.
    • The metadata-core local MetadataTypeSchema enum was realigned with the canonical @objectstack/spec/kernel enum (drift fix: approval, field, function, service, …).

    This is the first user-visible consumer of the executionPinned capability introduced in ADR-0009.

Patch Changes

  • Updated dependencies [bab2b20]
  • Updated dependencies [fa011d8]
  • Updated dependencies [f0f7c27]
  • Updated dependencies [b806f58]
    • @objectstack/platform-objects@5.2.0
    • @objectstack/spec@5.2.0
    • @objectstack/metadata-core@5.2.0
    • @objectstack/core@5.2.0
    • @objectstack/formula@5.2.0

5.1.0

Patch Changes

  • Updated dependencies [75f4ee6]
  • Updated dependencies [823d559]
    • @objectstack/spec@5.1.0
    • @objectstack/platform-objects@5.1.0
    • @objectstack/core@5.1.0
    • @objectstack/formula@5.1.0

5.0.0

Patch Changes

  • Updated dependencies [888a5c1]
  • Updated dependencies [2f9073a]
    • @objectstack/platform-objects@5.0.0
    • @objectstack/spec@5.0.0
    • @objectstack/core@5.0.0
    • @objectstack/formula@5.0.0

4.2.0

Patch Changes

  • Updated dependencies [2869891]
    • @objectstack/spec@4.2.0
    • @objectstack/core@4.2.0
    • @objectstack/formula@4.2.0
    • @objectstack/platform-objects@4.2.0

4.1.1

Patch Changes

  • @objectstack/spec@4.1.1
  • @objectstack/core@4.1.1
  • @objectstack/formula@4.1.1
  • @objectstack/platform-objects@4.1.1

4.0.1

Patch Changes

  • Updated dependencies [2108c30]
  • Updated dependencies [23db640]
    • @objectstack/spec@4.1.0
    • @objectstack/core@4.1.0
    • @objectstack/formula@4.1.0
    • @objectstack/platform-objects@4.1.0