chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@objectstack/rest@12.0.0

Major Changes

• 7c09621: feat(security)!: api.requireAuth now defaults to true — anonymous access to the data API is denied by default (ADR-0056 D2 flip)

  BREAKING. The global requireAuth default flipped FROM false TO true
  (RestApiConfigSchema.requireAuth in @objectstack/spec, mirrored by
  RestServer.normalizeConfig in @objectstack/rest). Anonymous requests to
  the /data/* CRUD + batch endpoints are now rejected with HTTP 401 unless the
  deployment explicitly opts out. (Scope note: this gate covers the REST
  /data/* surface — the metadata read/write endpoints and the dispatcher
  GraphQL route have their own pre-existing anonymous posture, tracked
  separately; this flip does not change them.)

  Migration (one line): a deployment that intentionally serves data publicly
  (demo / playground / kiosk) sets the flag on the stack config — now a declared
  ObjectStackDefinitionSchema.api field, so it survives defineStack strict
  parsing (previously an undeclared top-level api key was silently stripped):

  export default defineStack({
    // …
    api: { requireAuth: false },
  });

  The REST plugin logs a boot warning for the explicit opt-out so a fail-open
  posture is always visible. A misplaced api.requireAuth at the plugin level
  (one nesting short) is now also called out with a boot warning instead of
  being silently ignored.

  What keeps working with no action:

  • Share links — validate their token, then read under a system context.
  • Public forms — self-authorizing via the declaration-derived
    publicFormGrant (create + read-back on the declared target object only);
    no guest_portal profile needed.
  • Control plane — /auth, /health, /discovery are exempt.
  • objectstack serve with an auth-less stack — the CLI passes an explicit
    requireAuth: false for stacks whose tier set has no auth (nothing could
    authenticate against them), with the boot warning.

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/service-package@12.0.0

@objectstack/spec@12.0.0

Major Changes

• 7c09621: feat(security)!: api.requireAuth now defaults to true — anonymous access to the data API is denied by default (ADR-0056 D2 flip)

  BREAKING. The global requireAuth default flipped FROM false TO true
  (RestApiConfigSchema.requireAuth in @objectstack/spec, mirrored by
  RestServer.normalizeConfig in @objectstack/rest). Anonymous requests to
  the /data/* CRUD + batch endpoints are now rejected with HTTP 401 unless the
  deployment explicitly opts out. (Scope note: this gate covers the REST
  /data/* surface — the metadata read/write endpoints and the dispatcher
  GraphQL route have their own pre-existing anonymous posture, tracked
  separately; this flip does not change them.)

  Migration (one line): a deployment that intentionally serves data publicly
  (demo / playground / kiosk) sets the flag on the stack config — now a declared
  ObjectStackDefinitionSchema.api field, so it survives defineStack strict
  parsing (previously an undeclared top-level api key was silently stripped):

  export default defineStack({
    // …
    api: { requireAuth: false },
  });

  The REST plugin logs a boot warning for the explicit opt-out so a fail-open
  posture is always visible. A misplaced api.requireAuth at the plugin level
  (one nesting short) is now also called out with a boot warning instead of
  being silently ignored.

  What keeps working with no action:

  • Share links — validate their token, then read under a system context.
  • Public forms — self-authorizing via the declaration-derived
    publicFormGrant (create + read-back on the declared target object only);
    no guest_portal profile needed.
  • Control plane — /auth, /health, /discovery are exempt.
  • objectstack serve with an auth-less stack — the CLI passes an explicit
    requireAuth: false for stacks whose tier set has no auth (nothing could
    authenticate against them), with the boot warning.

Minor Changes

• 7709db4: feat(security): permission-set package provenance + declared-permission seeding (ADR-0086 P1)

  Packages now ship working default access for their own objects, with a
  machine-checkable metadata↔config boundary:

  • Spec (ADR-0086 D3): PermissionSetSchema.packageId (owning package for
    a package-shipped set; absent = env-authored) and per-record provenance
    managedBy: 'package' | 'platform' | 'user' on the existing
    metadata-persistence axis. Persisted on sys_permission_set as
    package_id / managed_by (new columns + package_id index).
  • Seeding (ADR-0086 D5): new bootstrapDeclaredPermissions — the sibling
    of bootstrapDeclaredRoles — materializes stack.permissions into
    sys_permission_set at boot with managed_by:'package' + package_id.
    Idempotent and upgrade-aware: rows the seeder owns are re-seeded to the
    shipped declaration on every boot; rows owned by a different package are
    refused loudly; env-authored platform/user/legacy rows are never
    clobbered. Closes the ADR-0078 inert-metadata violation for
    stack.permissions (declared sets were runtime-enforced but never
    materialized — invisible to the admin surface, uninstall undefined).
  • Conformance matrix row declarative-permission-seeding (ADR-0056 D10) +
    dogfood proof pin the behavior so it cannot regress to inert.

Patch Changes

• 7c09621: feat(security): pre-map transfer/restore/purge to their RBAC bits ([P0][security] Permission lifecycle ops ungated (allowTransfer/allowRestore/allowPurge) #1883)

  The permission evaluator now maps the destructive record-lifecycle operations
  to their spec permission bits (transfer → allowTransfer, restore →
  allowRestore, purge → allowPurge) and extends the modifyAllRecords
  super-user bypass to cover them. The ObjectQL operations themselves are still
  roadmap M2 — but the gate now exists ahead of them: the moment such an
  operation is dispatched through the security middleware it is denied unless a
  resolved permission set grants the matching bit. Unmapped destructive
  operations continue to fail closed (ADR-0049). Spec descriptions updated from
  [EXPERIMENTAL — not enforced] to [RBAC-gated; operation pending M2].

• 9860de4: Surface view-key collisions during view container expansion instead of renaming silently.

  expandViewContainer keeps its backward-compatible rename behaviour (<object>.<key> →
  <object>.<key>_2 on collision) but now stamps a machine-readable
  _diagnostics.warnings entry on the renamed ExpandedViewItem, explaining that
  references targeting the requested name (form action targets, navigation viewNames)
  will resolve to the other view. Both flattening loaders — the ObjectQL engine and the
  MetadataPlugin — log these warnings at boot so the collision is visible instead of
  manifesting as a form action opening a list view (expandViewContainer silently renames colliding form view keys (formViews.default → default_2) — form action targets break #2554).

@objectstack/metadata-protocol@12.0.0

Minor Changes

• 9796e7c: feat(security): two-doors separation for permission sets (ADR-0086 P2)

  Splits who may change a permission set into two non-overlapping doors, enforced
  at the data layer instead of by convention:

  块 1 — the package door (publish-time materialization).
  ObjectStackProtocolImplementation gains a generic publish-time materializer
  registry (registerPublishMaterializer(type, fn)). When a draft of a registered
  type is published, its body is projected into a data-plane row and the result is
  surfaced on the publish response as materializeApplied (best-effort, never
  thrown — same contract as seedApplied). promoteDraft now returns the draft's
  packageId so the materializer can stamp the owning package. plugin-security
  registers a permission materializer that upserts the published set into
  sys_permission_set with managed_by:'package' + package_id — so a set
  authored through the studio package door (saved as a permission draft, then
  published) lands in the admin surface with the exact provenance the boot seeder
  already stamps, now on the runtime publish path too. The single-set upsert is
  shared with bootstrapDeclaredPermissions (upsertPackagePermissionSet), so
  both paths apply the same own-row / foreign-package / env-authored rules.

  块 2 — the admin door (data-layer write gate).
  The security middleware now refuses any admin-door write
  (update/delete/transfer/restore/purge) to a sys_permission_set row
  with managed_by:'package', and refuses an insert that forges
  managed_by:'package'. The gate fails closed regardless of the caller's grants
  (a platform admin with modifyAllRecords is blocked just the same), so it is a
  real data-layer boundary rather than a UI hint. System/boot writes carry
  isSystem and bypass the whole middleware, so the boot seeder and the publish
  materializer are unaffected. Env-authored sets (managed_by user/platform
  or absent) stay freely editable through the admin door — the two doors never
  overwrite each other.

Patch Changes

• b5be479: fix(protocol): versionless package installs now persist to sys_packages (DB-created base packages vanish from GET /packages after server restart #2532)

  installPackage writes both package stores, but its durable half was guarded by
  pkgSvc?.publish && manifest.version — silently skipping every versionless
  runtime-created base ({id, name} from the builder / Setup). Those packages
  lived only in the in-memory registry and vanished on restart, while their
  metadata and tables survived. The version is now defaulted (0.1.0) instead of
  skipping, a failed persist logs loudly instead of silently, and deletePackage
  drops the sys_packages record so an uninstalled package no longer resurrects
  at the next boot (service-package hydrates that table into the registry).

• 806a40a: Stop runtime view personalization from permanently removing views from the switcher.

  A console personalization PUT (grid column sort, inline edit, …) sends only the raw
  view config — no top-level viewKind/object. Persisted verbatim, the overlay row
  replaced the flattened package entry wholesale on read, stripping the identity fields
  every switcher-style consumer filters on (viewKind && object) — one sort click and
  the view vanished until the DB row was deleted (Runtime view overlay drops viewKind/object — one grid sort permanently removes the view from the switcher #2555).

  Two independent guards: saveMetaItem now inherits the missing viewKind/object/
  label from the registry entry the overlay shadows before persisting, and
  getMetaItems heals identity-less rows already in the DB the same way on read. The
  overlay's own fields always win; defineView container bodies are untouched.

• Updated dependencies [7c09621]

• Updated dependencies [7709db4]

• Updated dependencies [7c09621]

• Updated dependencies [9860de4]

  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0
  • @objectstack/metadata-core@12.0.0
  • @objectstack/types@12.0.0

@objectstack/platform-objects@12.0.0

Minor Changes

• 07f055c: feat(auth): last-login audit fields — sys_user.last_login_at / last_login_ip (ADR-0069 D7)

  Completes the ADR-0069 D7 identity-field set: sys_user.last_login_at and
  sys_user.last_login_ip are stamped on every successful /sign-in/email by
  AuthManager.stampLastLogin (a best-effort after-hook, independent of the
  lockout-accounting path so it runs even when lockout is disabled). The IP is
  taken from the trusted forwarded headers (x-forwarded-for →
  cf-connecting-ip → x-real-ip), the same precedence as the D5 IP allow-list
  middleware, and capped to the 45-char column width. Both fields are
  system-managed, read-only, and land in the Admin group of sys_user.

  The rest of ADR-0069 P1 (password complexity/history/expiry, HIBP, account
  lockout, enforced MFA) was already implemented; this fills the one missing D7
  field pair. ADR-0069 status updated Proposed → Accepted (P1/P2 implemented)
  with an implementation-status matrix reflecting what is landed vs the remaining
  P2 gaps (per-org IP ranges, shared-store rate limiting).

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/metadata-core@12.0.0

@objectstack/plugin-auth@12.0.0

Minor Changes

• 07f055c: feat(auth): last-login audit fields — sys_user.last_login_at / last_login_ip (ADR-0069 D7)

  Completes the ADR-0069 D7 identity-field set: sys_user.last_login_at and
  sys_user.last_login_ip are stamped on every successful /sign-in/email by
  AuthManager.stampLastLogin (a best-effort after-hook, independent of the
  lockout-accounting path so it runs even when lockout is disabled). The IP is
  taken from the trusted forwarded headers (x-forwarded-for →
  cf-connecting-ip → x-real-ip), the same precedence as the D5 IP allow-list
  middleware, and capped to the 45-char column width. Both fields are
  system-managed, read-only, and land in the Admin group of sys_user.

  The rest of ADR-0069 P1 (password complexity/history/expiry, HIBP, account
  lockout, enforced MFA) was already implemented; this fills the one missing D7
  field pair. ADR-0069 status updated Proposed → Accepted (P1/P2 implemented)
  with an implementation-status matrix reflecting what is landed vs the remaining
  P2 gaps (per-org IP ranges, shared-store rate limiting).

• 1b1b34e: feat(auth): shared cross-node rate-limit + session store via the cache service (ADR-0069 D2)

  Multi-node deployments previously rate-limited per process — better-auth's
  default rateLimit store is in-memory, so each node counted independently and
  an attacker could rotate nodes to bypass the limit. AuthPlugin now wires the
  kernel cache service as better-auth's secondaryStorage and flips
  rateLimit.storage to 'secondary-storage', so rate-limit counters (and the
  session cache) are enforced against one shared store across every node —
  shared iff the cache service is (Redis adapter in a cluster; memory single-node,
  where behavior is unchanged). When no cache service is registered the plugin
  logs a warning that a multi-node deployment needs a shared cache (ADR-0069
  honesty — no silent per-process limiting presented as global).

  New cacheSecondaryStorage(cache) adapter (ICacheService → better-auth
  SecondaryStorage). Note: the cache has no atomic increment, so under high
  concurrency the get→set counter path can slightly over-count — acceptable for a
  rate limiter and strictly better than independent per-node counters; a future
  cache adapter exposing atomic INCR can add an increment method for exact
  counting.

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/types@12.0.0

@objectstack/plugin-security@12.0.0

Minor Changes

• 9796e7c: feat(security): two-doors separation for permission sets (ADR-0086 P2)

  Splits who may change a permission set into two non-overlapping doors, enforced
  at the data layer instead of by convention:

  块 1 — the package door (publish-time materialization).
  ObjectStackProtocolImplementation gains a generic publish-time materializer
  registry (registerPublishMaterializer(type, fn)). When a draft of a registered
  type is published, its body is projected into a data-plane row and the result is
  surfaced on the publish response as materializeApplied (best-effort, never
  thrown — same contract as seedApplied). promoteDraft now returns the draft's
  packageId so the materializer can stamp the owning package. plugin-security
  registers a permission materializer that upserts the published set into
  sys_permission_set with managed_by:'package' + package_id — so a set
  authored through the studio package door (saved as a permission draft, then
  published) lands in the admin surface with the exact provenance the boot seeder
  already stamps, now on the runtime publish path too. The single-set upsert is
  shared with bootstrapDeclaredPermissions (upsertPackagePermissionSet), so
  both paths apply the same own-row / foreign-package / env-authored rules.

  块 2 — the admin door (data-layer write gate).
  The security middleware now refuses any admin-door write
  (update/delete/transfer/restore/purge) to a sys_permission_set row
  with managed_by:'package', and refuses an insert that forges
  managed_by:'package'. The gate fails closed regardless of the caller's grants
  (a platform admin with modifyAllRecords is blocked just the same), so it is a
  real data-layer boundary rather than a UI hint. System/boot writes carry
  isSystem and bypass the whole middleware, so the boot seeder and the publish
  materializer are unaffected. Env-authored sets (managed_by user/platform
  or absent) stay freely editable through the admin door — the two doors never
  overwrite each other.

• 7c09621: feat(security): pre-map transfer/restore/purge to their RBAC bits ([P0][security] Permission lifecycle ops ungated (allowTransfer/allowRestore/allowPurge) #1883)

  The permission evaluator now maps the destructive record-lifecycle operations
  to their spec permission bits (transfer → allowTransfer, restore →
  allowRestore, purge → allowPurge) and extends the modifyAllRecords
  super-user bypass to cover them. The ObjectQL operations themselves are still
  roadmap M2 — but the gate now exists ahead of them: the moment such an
  operation is dispatched through the security middleware it is denied unless a
  resolved permission set grants the matching bit. Unmapped destructive
  operations continue to fail closed (ADR-0049). Spec descriptions updated from
  [EXPERIMENTAL — not enforced] to [RBAC-gated; operation pending M2].

• 7709db4: feat(security): permission-set package provenance + declared-permission seeding (ADR-0086 P1)

  Packages now ship working default access for their own objects, with a
  machine-checkable metadata↔config boundary:

  • Spec (ADR-0086 D3): PermissionSetSchema.packageId (owning package for
    a package-shipped set; absent = env-authored) and per-record provenance
    managedBy: 'package' | 'platform' | 'user' on the existing
    metadata-persistence axis. Persisted on sys_permission_set as
    package_id / managed_by (new columns + package_id index).
  • Seeding (ADR-0086 D5): new bootstrapDeclaredPermissions — the sibling
    of bootstrapDeclaredRoles — materializes stack.permissions into
    sys_permission_set at boot with managed_by:'package' + package_id.
    Idempotent and upgrade-aware: rows the seeder owns are re-seeded to the
    shipped declaration on every boot; rows owned by a different package are
    refused loudly; env-authored platform/user/legacy rows are never
    clobbered. Closes the ADR-0078 inert-metadata violation for
    stack.permissions (declared sets were runtime-enforced but never
    materialized — invisible to the admin surface, uninstall undefined).
  • Conformance matrix row declarative-permission-seeding (ADR-0056 D10) +
    dogfood proof pin the behavior so it cannot regress to inert.

Patch Changes

• 48ad533: fix(security): surface swallowed permission-set resolution failures ([security][observability] resolvePermissionSets swallows dbLoader failures silently — custom permission sets vanish with no log #2565)

  PermissionEvaluator.resolvePermissionSets swallowed metadata list() and
  sys_permission_set dbLoader failures silently — fail-closed (unresolvable
  sets grant nothing), but a transient DB error made custom permission sets
  vanish with no trace, leaving the resulting 403s undiagnosable. The evaluator
  now accepts an optional { logger } and emits one warn per failed source,
  naming the unresolved permission sets and the error. SecurityPlugin wires its
  plugin logger into both call sites. Resolution behavior is byte-identical.

• Updated dependencies [07f055c]

• Updated dependencies [7c09621]

• Updated dependencies [7709db4]

• Updated dependencies [7c09621]

• Updated dependencies [9860de4]

  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0

@objectstack/service-automation@12.0.0

Minor Changes

• ffafb30: feat(automation): durable run history — every terminal run leaves a queryable record with its failure reason

  Automation runs were observable only in memory: the engine kept the last N
  ExecutionLogEntry records in a ring buffer, so "did this flow run, and why did
  it fail?" could not be answered after a process restart (or once the buffer
  evicted the entry), and a failed run surfaced no reason at all. This was the
  biggest silent-trust gap for anyone authoring automations — a flow could stop
  firing or start failing with nothing durable to inspect.

  sys_automation_run — previously the ADR-0019 store for live suspended runs
  only — becomes a durable run-history table. On every terminal run the engine
  mirrors a row through the SuspendedRunStore (recordTerminal): status
  (completed / failed), finished_at, duration_ms, and, for a failure, the
  error message a designer needs to fix it. listRuns() merges this durable
  history with the in-memory buffer (in-memory wins on id, newest-first) so the
  Studio "Runs" surface shows runs that predate the current process.

  The design is safe and additive. Terminal history rows use a run_-prefixed
  id, disjoint from live suspended runs (which key on the raw runId with
  status: 'paused'), so the suspend save/load/delete/list path is untouched and
  resume sweeps (list() filters status: 'paused') never see history rows.
  Persisting is best-effort and fire-and-forget — a history-write failure is
  logged and swallowed, never breaking the run that produced it. New object fields
  (finished_at, duration_ms, error) are all optional and the status enum
  gains running / completed / failed alongside the existing paused.

  Verified end-to-end on a clean showcase instance: a schedule-triggered flow and
  seven task-completion flows each left durable completed rows; a genuinely
  failing flow (showcase_resilient_sync) left a failed row carrying its
  try_catch failure reason; a live paused suspended run coexisted without
  collision; and after a full process restart the failed row — reason intact —
  was still queryable via /api/v1/data/sys_automation_run. New run-history.test.ts
  covers completed/failed persistence, read-across-restart, and best-effort isolation.

Patch Changes

• f84f8d5: fix(automation): bind flow triggers on a cold boot, not just after an HMR reload

  Record-triggered (and other trigger-typed) flows silently never fired on a
  fresh process start — in dev and in production. The automation service's
  boot-time flow pull reads ql.registry.listItems('flow'), which is empty for
  flows defined inline in an app manifest — registry.registerApp() stores the
  app under type 'app' and never promotes its inline flows to standalone
  registry 'flow' items. The re-sync that could see them only ran on the
  metadata:reloaded hook, which never fires on a cold boot (os dev restarts
  the process on recompile rather than firing it, and production never reloads).

  Net effect: after any real restart, no flow bound its trigger, so
  record-change automations did not fire at all.

  Fix: bind flows at kernel:ready from protocol.getMetaItems({ type: 'flow' })
  — the canonical flattened flow view that GET /meta/flow serves and that does
  surface inline app flows — once every plugin has finished init()/start()
  (so the app, hence its flows, is registered). registerFlow is idempotent, so
  re-binding a flow the boot pull already registered is harmless.

  Verified end-to-end on a clean instance: before the fix, updating a record
  fired 0 flows (0 bound at boot); after, a cold boot binds all flows and a
  single record update fires every matching record-triggered flow. Regression
  test boots a kernel with an inline-app record-triggered flow served only via
  protocol.getMetaItems and asserts it is bound after bootstrap() alone with
  no metadata:reloaded fired — it fails on the pre-fix code.

• 9693a36: fix(automation): bind a flow published while the server runs, without a restart

  Follow-up to fix(automation): bind flow triggers on cold boot, not just after HMR reload #2560 (cold-boot flow binding). A flow published while the server
  is running — the Studio online-authoring journey: author a record-triggered
  automation, publish it, immediately update a matching record — did not fire.
  Its trigger only bound on the next process restart.

  Two gaps, both fixed:

  1. The publish path fired no rebind signal. POST /packages/:id/publish-drafts
     → protocol.publishPackageDrafts promotes the drafts to active but emitted no
     event the automation service listens to. The runtime dispatcher now announces
     metadata:reloaded after a successful publish — the same signal a dev artifact
     reload fires (MetadataPlugin._reloadAndAnnounce) — so boot-cached consumers
     re-sync without a restart.

  2. The runtime re-sync read the wrong source. The automation service's
     metadata:reloaded re-sync pulled metadata.list('flow'), which returns 0 in a
     real running server (it does not surface inline app flows), so even when the
     hook fired it bound nothing. It now reads protocol.getMetaItems({ type: 'flow' })
     — the same flattened flow view fix(automation): bind flow triggers on cold boot, not just after HMR reload #2560's cold-boot bind and GET /meta/flow use —
     while keeping the teardown of flows removed from the artifact. A failed or
     unavailable protocol read is a no-op and never tears down live flows.

  Production is largely unaffected (a deploy reboots the process, so fix(automation): bind flow triggers on cold boot, not just after HMR reload #2560's
  cold-boot bind covers it); this closes the gap for dev and single-instance
  Studio authoring.

  Verified end-to-end on a clean instance: authored a record-triggered flow in a
  package, published it via POST /packages/:id/publish-drafts without
  restarting, then updated a matching record and observed the flow fire (before
  the fix it did not). New regression tests boot a kernel whose protocol serves a
  flow only after boot and assert metadata:reloaded binds it — and that the
  re-sync reads the protocol, not metadata.list — both failing on the pre-fix code.

• Updated dependencies [7c09621]

• Updated dependencies [7709db4]

• Updated dependencies [7c09621]

• Updated dependencies [9860de4]

  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0

@objectstack/hono@12.0.0

Patch Changes

• Updated dependencies [9693a36]
  • @objectstack/runtime@12.0.0
  • @objectstack/plugin-hono-server@12.0.0
  • @objectstack/types@12.0.0

@objectstack/account@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0

@objectstack/setup@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0

@objectstack/studio@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0

@objectstack/cli@12.0.0

Patch Changes

• 7c09621: feat(security)!: api.requireAuth now defaults to true — anonymous access to the data API is denied by default (ADR-0056 D2 flip)

  BREAKING. The global requireAuth default flipped FROM false TO true
  (RestApiConfigSchema.requireAuth in @objectstack/spec, mirrored by
  RestServer.normalizeConfig in @objectstack/rest). Anonymous requests to
  the /data/* CRUD + batch endpoints are now rejected with HTTP 401 unless the
  deployment explicitly opts out. (Scope note: this gate covers the REST
  /data/* surface — the metadata read/write endpoints and the dispatcher
  GraphQL route have their own pre-existing anonymous posture, tracked
  separately; this flip does not change them.)

  Migration (one line): a deployment that intentionally serves data publicly
  (demo / playground / kiosk) sets the flag on the stack config — now a declared
  ObjectStackDefinitionSchema.api field, so it survives defineStack strict
  parsing (previously an undeclared top-level api key was silently stripped):

  export default defineStack({
    // …
    api: { requireAuth: false },
  });

  The REST plugin logs a boot warning for the explicit opt-out so a fail-open
  posture is always visible. A misplaced api.requireAuth at the plugin level
  (one nesting short) is now also called out with a boot warning instead of
  being silently ignored.

  What keeps working with no action:

  • Share links — validate their token, then read under a system context.
  • Public forms — self-authorizing via the declaration-derived
    publicFormGrant (create + read-back on the declared target object only);
    no guest_portal profile needed.
  • Control plane — /auth, /health, /discovery are exempt.
  • objectstack serve with an auth-less stack — the CLI passes an explicit
    requireAuth: false for stacks whose tier set has no auth (nothing could
    authenticate against them), with the boot warning.

• Updated dependencies [07f055c]

• Updated dependencies [1b1b34e]

• Updated dependencies [9796e7c]

• Updated dependencies [f84f8d5]

• Updated dependencies [9693a36]

• Updated dependencies [ffafb30]

• Updated dependencies [7c09621]

• Updated dependencies [24b62ee]

• Updated dependencies [7709db4]

• Updated dependencies [48ad533]

• Updated dependencies [7c09621]

• Updated dependencies [c2fdbf9]

• Updated dependencies [9860de4]

  • @objectstack/platform-objects@12.0.0
  • @objectstack/plugin-auth@12.0.0
  • @objectstack/plugin-security@12.0.0
  • @objectstack/service-automation@12.0.0
  • @objectstack/runtime@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/rest@12.0.0
  • @objectstack/verify@12.0.0
  • @objectstack/account@12.0.0
  • @objectstack/setup@12.0.0
  • @objectstack/studio@12.0.0
  • @objectstack/plugin-approvals@12.0.0
  • @objectstack/plugin-audit@12.0.0
  • @objectstack/plugin-email@12.0.0
  • @objectstack/plugin-org-scoping@12.0.0
  • @objectstack/plugin-reports@12.0.0
  • @objectstack/plugin-sharing@12.0.0
  • @objectstack/service-job@12.0.0
  • @objectstack/service-queue@12.0.0
  • @objectstack/service-realtime@12.0.0
  • @objectstack/service-settings@12.0.0
  • @objectstack/service-storage@12.0.0
  • @objectstack/trigger-record-change@12.0.0
  • @objectstack/trigger-schedule@12.0.0
  • @objectstack/client@12.0.0
  • @objectstack/cloud-connection@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0
  • @objectstack/lint@12.0.0
  • @objectstack/mcp@12.0.0
  • @objectstack/observability@12.0.0
  • @objectstack/driver-memory@12.0.0
  • @objectstack/driver-mongodb@12.0.0
  • @objectstack/driver-sql@12.0.0
  • @objectstack/driver-sqlite-wasm@12.0.0
  • @objectstack/plugin-hono-server@12.0.0
  • @objectstack/plugin-webhooks@12.0.0
  • @objectstack/service-analytics@12.0.0
  • @objectstack/service-cache@12.0.0
  • @objectstack/service-datasource@12.0.0
  • @objectstack/service-messaging@12.0.0
  • @objectstack/service-package@12.0.0
  • @objectstack/trigger-api@12.0.0
  • @objectstack/types@12.0.0
  • @objectstack/console@12.0.0

@objectstack/client@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/client-react@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/client@12.0.0
  • @objectstack/core@12.0.0

@objectstack/cloud-connection@12.0.0

Patch Changes

• Updated dependencies [9693a36]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/runtime@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/types@12.0.0

@objectstack/connector-mcp@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/connector-openapi@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/connector-rest@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/connector-slack@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/core@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0

@objectstack/formula@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0

@objectstack/lint@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/formula@12.0.0
  • @objectstack/sdui-parser@12.0.0

@objectstack/mcp@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/types@12.0.0

@objectstack/metadata@12.0.0

Patch Changes

• 9860de4: Surface view-key collisions during view container expansion instead of renaming silently.

  expandViewContainer keeps its backward-compatible rename behaviour (<object>.<key> →
  <object>.<key>_2 on collision) but now stamps a machine-readable
  _diagnostics.warnings entry on the renamed ExpandedViewItem, explaining that
  references targeting the requested name (form action targets, navigation viewNames)
  will resolve to the other view. Both flattening loaders — the ObjectQL engine and the
  MetadataPlugin — log these warnings at boot so the collision is visible instead of
  manifesting as a form action opening a list view (expandViewContainer silently renames colliding form view keys (formViews.default → default_2) — form action targets break #2554).

• Updated dependencies [07f055c]

• Updated dependencies [7c09621]

• Updated dependencies [7709db4]

• Updated dependencies [7c09621]

• Updated dependencies [9860de4]

  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/metadata-core@12.0.0
  • @objectstack/types@12.0.0
  • @objectstack/metadata-fs@12.0.0

@objectstack/metadata-core@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0

@objectstack/metadata-fs@12.0.0

Patch Changes

• @objectstack/metadata-core@12.0.0

@objectstack/objectql@12.0.0

Patch Changes

• 24b62ee: Enforce array shape for multi-value fields in the write pipeline (objectql: write pipeline accepts scalar values for multi-value fields (multiselect/tags/select+multiple/lookup+multiple), corrupting stored shape #2552). Lone scalars sent at a multiselect / checkboxes / tags field — or at a select / radio / lookup / user / file / image field flagged multiple: true — are now normalized into single-element arrays before validation instead of being stored verbatim (which silently corrupted the column shape), un-wrappable shapes are rejected with a new invalid_type validation code, and a legal array at a select+multiple field is no longer mis-rejected as invalid_option.

• c2fdbf9: fix(objectql): surface the human validation message in ValidationError.message, not a field (code) digest

  When an object-level validation rule (ADR-0020 validations[]) rejected a
  save, the console toast showed the generic English string
  Validation failed for 1 field(s): _record (rule_violation) instead of the
  rule author's own message (often localized, e.g. 最小水深不能大于最大水深。).

  The author's message was always transported in ValidationError.fields[].message
  through the whole chain (rule-validator → REST envelope fields[] → client SDK
  error.details), but every generic UI surface displays the top-level
  Error.message, which only contained the field (code) pairs.

  Fix at the single choke point — the ValidationError constructor now builds its
  top-level message from the per-field human messages (joined with ; ), falling
  back to field (code) only when a field error has no message. Machine-readable
  code and fields[] are unchanged, so programmatic consumers and the REST
  envelope shape are unaffected; every client (console toast, CLI, SDK callers)
  now sees the author-written message with no client-side change needed.

• 9860de4: Surface view-key collisions during view container expansion instead of renaming silently.

  expandViewContainer keeps its backward-compatible rename behaviour (<object>.<key> →
  <object>.<key>_2 on collision) but now stamps a machine-readable
  _diagnostics.warnings entry on the renamed ExpandedViewItem, explaining that
  references targeting the requested name (form action targets, navigation viewNames)
  will resolve to the other view. Both flattening loaders — the ObjectQL engine and the
  MetadataPlugin — log these warnings at boot so the collision is visible instead of
  manifesting as a form action opening a list view (expandViewContainer silently renames colliding form view keys (formViews.default → default_2) — form action targets break #2554).

• Updated dependencies [9796e7c]

• Updated dependencies [7c09621]

• Updated dependencies [b5be479]

• Updated dependencies [7709db4]

• Updated dependencies [7c09621]

• Updated dependencies [9860de4]

• Updated dependencies [806a40a]

  • @objectstack/metadata-protocol@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0
  • @objectstack/metadata-core@12.0.0
  • @objectstack/types@12.0.0

@objectstack/observability@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0

@objectstack/driver-memory@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/driver-mongodb@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/driver-sql@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/types@12.0.0

@objectstack/driver-sqlite-wasm@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/driver-sql@12.0.0

@objectstack/embedder-openai@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0

@objectstack/knowledge-memory@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/service-knowledge@12.0.0

@objectstack/knowledge-ragflow@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/service-knowledge@12.0.0

@objectstack/plugin-approvals@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0
  • @objectstack/metadata-core@12.0.0

@objectstack/plugin-audit@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/plugin-dev@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [1b1b34e]
• Updated dependencies [9796e7c]
• Updated dependencies [9693a36]
• Updated dependencies [7c09621]
• Updated dependencies [24b62ee]
• Updated dependencies [7709db4]
• Updated dependencies [48ad533]
• Updated dependencies [7c09621]
• Updated dependencies [c2fdbf9]
• Updated dependencies [9860de4]
  • @objectstack/plugin-auth@12.0.0
  • @objectstack/plugin-security@12.0.0
  • @objectstack/runtime@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/rest@12.0.0
  • @objectstack/account@12.0.0
  • @objectstack/setup@12.0.0
  • @objectstack/studio@12.0.0
  • @objectstack/plugin-org-scoping@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/driver-memory@12.0.0
  • @objectstack/plugin-hono-server@12.0.0
  • @objectstack/service-i18n@12.0.0
  • @objectstack/types@12.0.0

@objectstack/plugin-email@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0

@objectstack/plugin-hono-server@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/observability@12.0.0
  • @objectstack/types@12.0.0

@objectstack/plugin-org-scoping@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/plugin-reports@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/plugin-sharing@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [24b62ee]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [c2fdbf9]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0

@objectstack/plugin-webhooks@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/service-messaging@12.0.0

@objectstack/runtime@12.0.0

Patch Changes

• 9693a36: fix(automation): bind a flow published while the server runs, without a restart

  Follow-up to fix(automation): bind flow triggers on cold boot, not just after HMR reload #2560 (cold-boot flow binding). A flow published while the server
  is running — the Studio online-authoring journey: author a record-triggered
  automation, publish it, immediately update a matching record — did not fire.
  Its trigger only bound on the next process restart.

  Two gaps, both fixed:

  1. The publish path fired no rebind signal. POST /packages/:id/publish-drafts
     → protocol.publishPackageDrafts promotes the drafts to active but emitted no
     event the automation service listens to. The runtime dispatcher now announces
     metadata:reloaded after a successful publish — the same signal a dev artifact
     reload fires (MetadataPlugin._reloadAndAnnounce) — so boot-cached consumers
     re-sync without a restart.

  2. The runtime re-sync read the wrong source. The automation service's
     metadata:reloaded re-sync pulled metadata.list('flow'), which returns 0 in a
     real running server (it does not surface inline app flows), so even when the
     hook fired it bound nothing. It now reads protocol.getMetaItems({ type: 'flow' })
     — the same flattened flow view fix(automation): bind flow triggers on cold boot, not just after HMR reload #2560's cold-boot bind and GET /meta/flow use —
     while keeping the teardown of flows removed from the artifact. A failed or
     unavailable protocol read is a no-op and never tears down live flows.

  Production is largely unaffected (a deploy reboots the process, so fix(automation): bind flow triggers on cold boot, not just after HMR reload #2560's
  cold-boot bind covers it); this closes the gap for dev and single-instance
  Studio authoring.

  Verified end-to-end on a clean instance: authored a record-triggered flow in a
  package, published it via POST /packages/:id/publish-drafts without
  restarting, then updated a matching record and observed the flow fire (before
  the fix it did not). New regression tests boot a kernel whose protocol serves a
  flow only after boot and assert metadata:reloaded binds it — and that the
  re-sync reads the protocol, not metadata.list — both failing on the pre-fix code.

• Updated dependencies [07f055c]

• Updated dependencies [1b1b34e]

• Updated dependencies [9796e7c]

• Updated dependencies [7c09621]

• Updated dependencies [24b62ee]

• Updated dependencies [7709db4]

• Updated dependencies [48ad533]

• Updated dependencies [7c09621]

• Updated dependencies [c2fdbf9]

• Updated dependencies [9860de4]

  • @objectstack/plugin-auth@12.0.0
  • @objectstack/plugin-security@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/rest@12.0.0
  • @objectstack/metadata@12.0.0
  • @objectstack/plugin-org-scoping@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/formula@12.0.0
  • @objectstack/observability@12.0.0
  • @objectstack/driver-memory@12.0.0
  • @objectstack/driver-sql@12.0.0
  • @objectstack/driver-sqlite-wasm@12.0.0
  • @objectstack/service-cluster@12.0.0
  • @objectstack/service-datasource@12.0.0
  • @objectstack/service-i18n@12.0.0
  • @objectstack/types@12.0.0

@objectstack/service-analytics@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-cache@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/observability@12.0.0

@objectstack/service-cluster@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-cluster-redis@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/service-cluster@12.0.0

@objectstack/service-datasource@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-i18n@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-job@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-knowledge@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-messaging@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-package@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-queue@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-realtime@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/service-settings@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/types@12.0.0

@objectstack/service-storage@12.0.0

Patch Changes

• Updated dependencies [07f055c]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/platform-objects@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/observability@12.0.0

@objectstack/trigger-api@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/trigger-record-change@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/trigger-schedule@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/core@12.0.0

@objectstack/types@12.0.0

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0

@objectstack/verify@12.0.0

Patch Changes

• 7c09621: feat(security)!: api.requireAuth now defaults to true — anonymous access to the data API is denied by default (ADR-0056 D2 flip)

  BREAKING. The global requireAuth default flipped FROM false TO true
  (RestApiConfigSchema.requireAuth in @objectstack/spec, mirrored by
  RestServer.normalizeConfig in @objectstack/rest). Anonymous requests to
  the /data/* CRUD + batch endpoints are now rejected with HTTP 401 unless the
  deployment explicitly opts out. (Scope note: this gate covers the REST
  /data/* surface — the metadata read/write endpoints and the dispatcher
  GraphQL route have their own pre-existing anonymous posture, tracked
  separately; this flip does not change them.)

  Migration (one line): a deployment that intentionally serves data publicly
  (demo / playground / kiosk) sets the flag on the stack config — now a declared
  ObjectStackDefinitionSchema.api field, so it survives defineStack strict
  parsing (previously an undeclared top-level api key was silently stripped):

  export default defineStack({
    // …
    api: { requireAuth: false },
  });

  The REST plugin logs a boot warning for the explicit opt-out so a fail-open
  posture is always visible. A misplaced api.requireAuth at the plugin level
  (one nesting short) is now also called out with a boot warning instead of
  being silently ignored.

  What keeps working with no action:

  • Share links — validate their token, then read under a system context.
  • Public forms — self-authorizing via the declaration-derived
    publicFormGrant (create + read-back on the declared target object only);
    no guest_portal profile needed.
  • Control plane — /auth, /health, /discovery are exempt.
  • objectstack serve with an auth-less stack — the CLI passes an explicit
    requireAuth: false for stacks whose tier set has no auth (nothing could
    authenticate against them), with the boot warning.

• Updated dependencies [07f055c]

• Updated dependencies [1b1b34e]

• Updated dependencies [9796e7c]

• Updated dependencies [f84f8d5]

• Updated dependencies [9693a36]

• Updated dependencies [ffafb30]

• Updated dependencies [7c09621]

• Updated dependencies [24b62ee]

• Updated dependencies [7709db4]

• Updated dependencies [48ad533]

• Updated dependencies [7c09621]

• Updated dependencies [c2fdbf9]

• Updated dependencies [9860de4]

  • @objectstack/plugin-auth@12.0.0
  • @objectstack/plugin-security@12.0.0
  • @objectstack/service-automation@12.0.0
  • @objectstack/runtime@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/rest@12.0.0
  • @objectstack/plugin-org-scoping@12.0.0
  • @objectstack/plugin-sharing@12.0.0
  • @objectstack/service-settings@12.0.0
  • @objectstack/core@12.0.0
  • @objectstack/driver-sqlite-wasm@12.0.0
  • @objectstack/plugin-hono-server@12.0.0
  • @objectstack/service-analytics@12.0.0
  • @objectstack/service-datasource@12.0.0

@objectstack/console@12.0.0

create-objectstack@12.0.0

@objectstack/sdui-parser@12.0.0

objectstack-vscode@12.0.0

@objectstack/example-crm@4.0.70

Patch Changes

• Updated dependencies [9693a36]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/runtime@12.0.0
  • @objectstack/spec@12.0.0

@objectstack/example-showcase@0.2.16

Patch Changes

• Updated dependencies [9693a36]
• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/runtime@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/connector-rest@12.0.0
  • @objectstack/connector-slack@12.0.0
  • @objectstack/cloud-connection@12.0.0
  • @objectstack/driver-sql@12.0.0

@objectstack/example-todo@4.0.70

Patch Changes

• Updated dependencies [9693a36]
• Updated dependencies [7c09621]
• Updated dependencies [24b62ee]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [c2fdbf9]
• Updated dependencies [9860de4]
  • @objectstack/runtime@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/metadata@12.0.0
  • @objectstack/client@12.0.0
  • @objectstack/mcp@12.0.0
  • @objectstack/driver-sqlite-wasm@12.0.0
  • @objectstack/knowledge-memory@12.0.0
  • @objectstack/service-knowledge@12.0.0

@objectstack/example-embed-objectql@0.0.10

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [24b62ee]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [c2fdbf9]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/driver-memory@12.0.0

@objectstack/dogfood@0.0.18

Patch Changes

• Updated dependencies [9796e7c]
• Updated dependencies [7c09621]
• Updated dependencies [24b62ee]
• Updated dependencies [7709db4]
• Updated dependencies [48ad533]
• Updated dependencies [7c09621]
• Updated dependencies [c2fdbf9]
• Updated dependencies [9860de4]
  • @objectstack/plugin-security@12.0.0
  • @objectstack/spec@12.0.0
  • @objectstack/objectql@12.0.0
  • @objectstack/verify@12.0.0
  • @objectstack/example-crm@4.0.70
  • @objectstack/example-showcase@0.2.16

@objectstack/downstream-contract@0.0.16

Patch Changes

• Updated dependencies [7c09621]
• Updated dependencies [7709db4]
• Updated dependencies [7c09621]
• Updated dependencies [9860de4]
  • @objectstack/spec@12.0.0

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 4, 2026 3:12pm