diff --git a/.changeset/a3-user-assignment-tabs.md b/.changeset/a3-user-assignment-tabs.md deleted file mode 100644 index 9e030f196b..0000000000 --- a/.changeset/a3-user-assignment-tabs.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -'@objectstack/platform-objects': minor ---- - -feat(platform-objects): sys_user 记录页新增 Permission Sets 与 Business Units 两个一站式分配 tab (A3, #2920) - -管理员现在可在单个用户记录页完成三类分配:岗位(Positions,已有)、直接权限集授权(Permission Sets)、业务单元归属(Business Units)。两个新 tab 均为纯 SDUI 的 `record:related_list` + Add picker: - -- **Permission Sets** — junction `sys_user_permission_set`(id-keyed,`relationshipField: 'user_id'`),Add picker 绑定 `sys_permission_set`(`linkField: 'permission_set_id'`)。服务端 audience-anchor(D5/D9)与 delegated-admin(D12)门禁的拒绝原因会显示在 Add 对话框。 -- **Business Units** — junction `sys_business_unit_member`(id-keyed,`relationshipField: 'user_id'`),Add picker 绑定 `sys_business_unit`(`linkField: 'business_unit_id'`,按显示字段 `name` 标注)。 - -tab 顺序为 Positions → Permission Sets → Business Units,四语言标签齐全。 diff --git a/.changeset/adr-0089-d3a-strict-visibility-schemas.md b/.changeset/adr-0089-d3a-strict-visibility-schemas.md deleted file mode 100644 index 03470bb8f6..0000000000 --- a/.changeset/adr-0089-d3a-strict-visibility-schemas.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@objectstack/spec": major ---- - -ADR-0089 D3a: flip `.strict()` on the view form + page component schemas so a mis-layered or stale conditional-visibility key is a **loud parse error** instead of a silent strip. - -`FormFieldSchema`, `FormSectionSchema` (`view.zod.ts`) and `PageComponentSchema` (`page.zod.ts`) now reject unknown keys. Previously zod's default strip mode discarded any key these schemas did not declare — including a `visibleWhen` typo, a page-only `visibility` pasted onto a view field (or vice-versa), or a key surviving past its deprecation window — with no diagnostic, shipping inert metadata (ADR-0049 enforce-or-remove, ADR-0078 no-silently-inert). - -- **Breaking:** metadata carrying a key not declared by these three schemas now fails validation at parse. A monorepo + examples sweep found a single offender (a test fixture using `id`/`title` on a form section instead of the canonical `name`/`label`); all first-party apps and platform metadata parse clean. -- The deprecated `visibleOn` (view form) / `visibility` (page component) aliases are **declared** keys, so they keep parsing and normalizing to `visibleWhen` — unchanged. -- Rejection messages name the offending key(s) and, when a key looks like the visibility predicate, point the author at the canonical `visibleWhen` (new `strictVisibilityError` zod error map, exported from `shared/visibility`). diff --git a/.changeset/adr-0089-d3b-bidirectional-visibility-root.md b/.changeset/adr-0089-d3b-bidirectional-visibility-root.md deleted file mode 100644 index e3dc2f5c78..0000000000 --- a/.changeset/adr-0089-d3b-bidirectional-visibility-root.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"@objectstack/lint": minor ---- - -ADR-0089 D3b: make the `visibility-root-mislayered` lint check bidirectional. `validateVisibilityPredicates` now accepts an optional `{ layer }` option — `'runtime'` (default, unchanged) flags a `data.`-rooted predicate on a `*.view.ts` / `*.page.ts` surface, and `'metadata'` flags a `record.`-rooted predicate on a `*.form.ts` metadata-editing form. Both directions of the ADR's binding-root rule are now covered. Adds the `VisibilityLayer` / `VisibilityOptions` exported types. Fully back-compat: existing single-argument callers keep the runtime behavior. diff --git a/.changeset/adr-0095-d1-tenant-layer-0.md b/.changeset/adr-0095-d1-tenant-layer-0.md deleted file mode 100644 index 8b4465a836..0000000000 --- a/.changeset/adr-0095-d1-tenant-layer-0.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -"@objectstack/plugin-security": major ---- - -ADR-0095 D1: tenant isolation is now **Layer 0** — an independent, always-first, -AND-composed filter (`tenant-layer.ts`), no longer a wildcard `tenant_isolation` -RLS policy OR-merged with business RLS. The effective row filter is -`Layer0(tenant) AND Layer1(business RLS)`; the two share no compiler, merge step, -or bypass bit. The superuser bypass now exempts the tenant wall only as a Layer 0 -rule (platform-admin posture + object posture permits: private / platform-global -/ better-auth-managed), never via a business-RLS short-circuit. - -**BREAKING (multi-org `tenancy.mode = 'multi'` deployments only; `single` mode is -inert and unchanged).** Retiring the OR-merged tenant policy resolves four -behavior deltas, all toward stronger/correcter isolation: - -- **(a) Cross-tenant read leak closed.** A permissive business RLS policy (e.g. - `status == 'public'`) no longer OR-widens tenant scope; a foreign-org row it - matched is now invisible. -- **(b) Member by-id writes narrow to owner-only.** The OR-merge silently widened - `owner_only_writes` (`created_by == me`) back to org-wide, so a member could - by-id update/delete *any* record in their org. Writes are now owner-scoped as - authored. **Migration:** if your deployment intentionally relied on members - editing each other's records org-wide, grant an explicit per-object edit - permission set (position-distributed) where that is wanted — the baseline - `member_default` no longer permits it. -- **(c) Global-catalog objects visible to members.** On a `tenancy.enabled:false` - object, members were scoped by a phantom `organization_id` filter (a column - such objects lack); Layer 0 correctly treats them as non-tenant, so the global - catalog is visible. -- **(e) No-active-org writes fail closed.** A write by a principal with no active - organization on a tenant object is now denied (was owner-scoped only). - -`tenant_isolation` is retired from the seeded `organization_admin` / -`member_default` / `viewer_readonly` sets; the `_self` / `_org` identity-table -carve-outs and `owner_only_writes/deletes` are unchanged. Customized seeded sets -keep their overlays (ADR-0094). The driver-level `applyTenantScope` seam is -untouched. See ADR-0095 and framework#2936 (the `extractTargetField` `==` blind -spot this exposes, tracked separately). diff --git a/.changeset/adr-0095-d2-d3-posture-ladder.md b/.changeset/adr-0095-d2-d3-posture-ladder.md deleted file mode 100644 index ea6e6a7e03..0000000000 --- a/.changeset/adr-0095-d2-d3-posture-ladder.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -"@objectstack/core": minor -"@objectstack/spec": minor ---- - -ADR-0095 D2/D3: the authorization kernel now resolves an explicit **posture -ladder** — a monotonic principal tier `PLATFORM_ADMIN > TENANT_ADMIN > MEMBER > -EXTERNAL` — once, in `resolveAuthzContext`, and carries it on -`ResolvedAuthzContext.posture`. - -- **D2 — the ladder.** New `@objectstack/core/security` module `posture-ladder.ts` - reuses the spec `AuthzPosture` enum and pins the rung → row-visibility - injection-rule mapping (exactly one rule per rung) plus its two ADR-required - invariants as unit-tested properties: strict nesting (rung *n*'s visible set ⊇ - rung *n−1*'s) and the `EXTERNAL` deny-by-default semantics (explicitly shared - rows only — OWD baselines and sharing rules never widen it). `EXTERNAL` is - defined and test-locked now but never resolved: no external principal type - exists yet (portal/ADR-0093), so the resolver's floor is `MEMBER`. -- **D3 — capability-derived, single track.** The rung derives from held - **capability grants**, never a better-auth role: `PLATFORM_ADMIN` from the - unscoped `admin_full_access` grant (the same `viewAllRecords`/`modifyAllRecords` - evidence the superuser bypass trusts), `TENANT_ADMIN` from the - `organization_admin` grant. The better-auth `role='admin'` remains only a - *provisioning source* of those grants (`auto-org-admin-grant.ts`, - `mapMembershipRole`); no enforcement path reads the raw role, closing the - #2836 dual-track adjudication class by construction. -- New spec export `ORGANIZATION_ADMIN` (the org-admin capability-grant name), - alongside the existing `ADMIN_FULL_ACCESS`. - -**Behavior-preserving.** Enforcement is unchanged — the per-object Layer 0 -exemption and per-side superuser bypass still gate access exactly as before; -`posture` is an additive, derived, explainable field. The `authz-matrix-gate` -unit snapshot and the dogfood authz-conformance matrix stay green. No migration -required. diff --git a/.changeset/authz-2936-rls-eq-recognition.md b/.changeset/authz-2936-rls-eq-recognition.md deleted file mode 100644 index 217407bb8c..0000000000 --- a/.changeset/authz-2936-rls-eq-recognition.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -"@objectstack/plugin-security": patch ---- - -fix(plugin-security): #2936 — RLS field-existence / tenancy-disabled safety nets now recognize canonical `==` - -`extractTargetField` (the lightweight left-hand-field parser feeding the Layer 1 -**field-existence** net and the **tenancy-disabled** skip net in -`computeLayeredRlsFilter`) only matched the legacy single-`=` / `IN` shape. It -returned `null` for canonical CEL `==` (`field == …`), which is how real seeds -and business policies author equality. A `null` target field means "keep the -policy", so both safety nets were **inert** for every `==` policy: a wildcard -policy targeting a column the object lacks was NOT failed closed, and a -`==`-form `organization_id` policy on a `tenancy.enabled:false` object was NOT -skipped. The regex now recognizes `==` (listed before `=` so the ordered -alternation does not mis-match the first `=`), alongside the existing `=`/`IN`. -Recognition is only **extended** — the net semantics are unchanged, and -`!=`/`>`/`<`/`>=`/`<=` still return `null` (conservative keep), matching prior -behavior for any unmatched shape. - -Behavior delta (fail-closed strengthening, same effective visibility): the -wildcard `owner_only_writes` / `owner_only_deletes` seed policies -(`created_by == current_user.id`) now correctly fail closed on an object that -lacks a `created_by` column (platform-global / system tables). Previously they -slipped the net and compiled to a phantom `{ created_by: … }` filter against a -missing column — a driver-dependent, effectively-deny result; now the net drops -the sole applicable write policy and yields the deny sentinel. A member could not -by-id write such a column-less object either way, so the visible/writable row set -is unchanged; only the mechanism is now an explicit fail-closed deny. All ordinary -tenant/business objects carry `created_by`, so they are unaffected (proven green by -the dogfood authz-conformance + RLS matrices). The tenancy-disabled skip net has no -effect on any current seed (no `==` seed policy targets `organization_id` on a -tenancy-disabled object). The tenant wall itself is Layer 0 (`tenant-layer.ts`), -which never used this parser, so tenant isolation is unaffected (ADR-0095 D1). diff --git a/.changeset/authz-2937-insert-tenant-guard.md b/.changeset/authz-2937-insert-tenant-guard.md deleted file mode 100644 index 7a732917e2..0000000000 --- a/.changeset/authz-2937-insert-tenant-guard.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -'@objectstack/plugin-security': major ---- - -fix(plugin-security): #2937 — Layer 0 insert post-image 租户检查（伪造 organization_id 的用户 insert 现被拒） - -**安全修复 + 行为变更（release-notes callout）。** 多组织模式(`tenancy.mode='multi'` + -`@objectstack/organizations`)下，一个普通用户此前可以 `insert` 一条**伪造 `organization_id`** -(指向别的租户)的业务记录并使其落进受害租户 —— Layer 0 的租户墙 AND-composed 到读 + -update/delete 的 pre-image，但 insert 没有 pre-image、也不带 AST，从未被门控(ADR-0095 D1 -读侧 W1 的写侧未竟部分)。 - -新增 SecurityPlugin 中间件步骤 3.7:对 insert 的 **post-image** 复用读侧同一套 Layer 0 决策 -(`computeInsertTenantCheckFilter` → `computeLayeredRlsFilter` 的 `layer0`)做校验 —— -一个**显式提供**的 `organization_id` 必须等于调用者的活动组织,否则 fail-closed 拒绝。规则与 -读侧完全一致:单组织/隔离未激活、非租户对象(无 `organization_id` 列或 `tenancy.enabled:false`)、 -platform-admin 姿态豁免的对象均不适用;无活动组织的用户提供任意 org_id → 拒(deny sentinel)。 - -**行为 delta(需注意):** 此前能成功的「带跨租户 `organization_id` 的用户级 insert」现被拒绝。 -**缺省(不提供 `organization_id`)的 insert 不受影响** —— 补全仍由 `@objectstack/organizations` -的 auto-stamp 负责(职责分离,因此本检查与 auto-stamp 中间件的注册顺序无关)。系统上下文 -(`isSystem`,含 import 引擎 / 迁移 / 每-org seed replay·clone·orphan-claim 的 `SYSTEM_CTX`) -在中间件入口即短路,合法的「代客设置 org_id」写路径**完全不受影响**。 - -矩阵门:`authz-matrix-gate.test.ts` 新增 `[#2937] Layer 0 insert post-image tenant guard` -八格(伪造异租户→拒、同租户→通过、缺省→放行、无活动组织→拒、platform-admin 私有对象豁免、 -public 业务对象不豁免、tenancy-disabled 对象不适用、单组织模式不检查)。授权一致性 ledger -新增 `multi-tenant-insert-postimage` 行。配套 cloud `@objectstack/organizations` 的 auto-stamp -权威覆盖(纵深防御)。Closes objectstack-ai/framework#2937。 diff --git a/.changeset/authz-a4-managed-by-tristate.md b/.changeset/authz-a4-managed-by-tristate.md deleted file mode 100644 index 4530f9c91f..0000000000 --- a/.changeset/authz-a4-managed-by-tristate.md +++ /dev/null @@ -1,35 +0,0 @@ ---- -"@objectstack/plugin-security": minor ---- - -feat(plugin-security): A4 — managed_by tri-state unification + listView exposure (#2920) - -Unifies the record-level provenance vocabulary across the three RBAC catalogs -(`sys_capability`, `sys_permission_set`, `sys_position`) onto a single tri-state -— **platform / package / admin** — so an administrator reads one vocabulary for -"who owns this" everywhere. - -- **`sys_permission_set.managed_by`** and **`sys_position.managed_by`** converted - from free `text` to a constrained `select` matching `sys_capability` (options - `platform` / `package` / `admin`, `defaultValue: 'admin'`, `readonly`). -- **Writers re-stamped to canonical vocab:** built-in identity/anchor positions - now seed `managed_by: 'platform'` (was `'system'`); env/Studio-authored - permission sets project as `managed_by: 'admin'` (was `'user'`). Declared - package sets (`'package'`) and platform capabilities (`'platform'`) were - already canonical. -- **`sys_position` list views** (`active` / `default_positions` / `custom` / - `all_positions`) now surface the `managed_by` column, matching the capability - and permission-set views. -- **Back-compat, no destructive migration.** No runtime path branches on the - legacy values — every access decision keys on `'package'` / `'platform'` - (both unchanged) — so the rename never changes an authorization outcome. - Built-in positions and declared sets self-heal on their next bootstrap upsert; - a new idempotent `kernel:ready` reconciler (`normalizeManagedByVocab`) rewrites - the residual legacy values (`system`→`platform`, `config`→`package`, - `user`→`admin`) on existing `sys_position` / `sys_permission_set` rows. -- **i18n:** `managed_by` field + option labels (`platform` / `package` / `admin`) - added for `sys_capability` / `sys_permission_set` / `sys_position` across - en / zh-CN / ja-JP / es-ES. - -Pairs with objectui `feat(app-shell): A4 — provenance tri-state badge` -(framework#2920). diff --git a/.changeset/authz-a5-capability-declaration.md b/.changeset/authz-a5-capability-declaration.md deleted file mode 100644 index 52c450653b..0000000000 --- a/.changeset/authz-a5-capability-declaration.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -"@objectstack/spec": minor -"@objectstack/plugin-security": minor -"@objectstack/runtime": minor -"@objectstack/lint": minor ---- - -feat(spec,plugin-security): package-level capability declaration API (ADR-0066 D1) - -Packages can now DEFINE their own authorization capabilities explicitly via the -new `defineCapability` factory and a stack's `capabilities` array, instead of -relying on the implicit "derive an untitled capability from whatever a permission -set references in `systemPermissions[]`" back-door. - -- `@objectstack/spec`: new `defineCapability` / `CapabilityDeclarationSchema` - (`{ name, label?, description?, scope, packageId? }`) and a `capabilities` - field on the stack definition. -- `@objectstack/plugin-security`: new `bootstrapDeclaredCapabilities` seeds - declared capabilities into `sys_capability` with `managed_by:'package'` + - `package_id` provenance (new `package_id` field on the object). Idempotent, - upgrade-aware; refuses to hijack curated platform capabilities or another - package's rows, never clobbers admin-authored rows, and CLAIMS a pre-existing - derived placeholder (upgrading it to package provenance). The implicit - derive-from-`systemPermissions` path still runs for back-compat but now skips - any explicitly-declared name so it can't clobber authored metadata. -- `@objectstack/runtime`: stack-declared `capabilities` are registered into the - metadata registry (type `capability`) so the boot seeder can read them. -- `@objectstack/lint`: `validateCapabilityReferences` treats - `stack.capabilities` names as a known capability source. - -A capability is not a contract: DEFINE it (`defineCapability`), GRANT it -(`systemPermissions`), REQUIRE it (`requiredPermissions`) — no `inputs`. -Aligns with ADR-0094 D5 (retire implicit `managed_by`-guessing back-doors). diff --git a/.changeset/authz-c2-explain-record-contract.md b/.changeset/authz-c2-explain-record-contract.md deleted file mode 100644 index e7fe33ac38..0000000000 --- a/.changeset/authz-c2-explain-record-contract.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -"@objectstack/spec": minor ---- - -feat(spec): C2-α — extend the `explain` contract to record granularity (#2920) - -The access-explanation contract (ADR-0090 D6) now carries the schema for -record-level authorization explanations, so the β-phase engine -(`plugin-security` + `plugin-sharing`) and the Studio/Setup "view as" UI can be -built against a stable wire shape. Contract-only: no engine or UI changes ship -here. - -Request side: -- `ExplainRequest.recordId` (optional) — explain one concrete record at row - granularity. Omitted = the pre-C2 object-level question, answered identically - (backward compatible). - -Response side (row-level attribution, present only for record-grained requests): -- New `ExplainMatchedRule` — a concrete share / sharing rule / ownership fact / - team / territory / RLS policy / Layer 0 tenant filter that admitted or - excluded the record at a layer, with its access level (`grants`), how it - reached the principal (`via`), the row predicate (`predicate`), and its - `effect` on the record. -- New `ExplainRecordAttribution` — a layer's per-record determination - (`outcome`, effective `rowFilter`, `matchesRecord`, matched `rules`), attached - as the optional `ExplainLayer.record`. -- New top-level `ExplainDecision.record` — the row-level bottom line - (`recordId`, `visible`, `decidedBy`). - -Reserved for the ADR-0095 kernel chain (β fills these; optional, backward -compatible): -- New `tenant_isolation` layer id (Layer 0, the always-first tenant wall). -- New `ExplainLayer.kernelTier` (`layer_0_tenant` | `layer_1_business`) so a - consumer can tell the tenant wall from business RLS without hard-coding ids. -- New `AuthzPosture` enum (`PLATFORM_ADMIN` > `TENANT_ADMIN` > `MEMBER` > - `EXTERNAL`) exposed as the optional `ExplainDecision.principal.posture`. - -Backward compatibility: every new field is optional or additive; existing -object-level requests and reports parse unchanged. The contract test locks the -new field shapes alongside the existing ones. diff --git a/.changeset/authz-secfix-self-deleg-anchor.md b/.changeset/authz-secfix-self-deleg-anchor.md deleted file mode 100644 index 98f008a062..0000000000 --- a/.changeset/authz-secfix-self-deleg-anchor.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -'@objectstack/plugin-security': patch ---- - -Security fix: constrain self-delegation (D3) position anchor to prevent lateral -visibility escalation (cloud#830 follow-up). - -cloud#830 (C1 position-anchor) made `sys_user_position.business_unit_id` -visibility **load-bearing** — it is the readScope depth anchor, so a -`unit`/`unit_and_below` holder sees the owner set rooted at that BU (and, for -`unit_and_below`, its whole subtree). The delegated-admin gate's self-service -delegation path (`assertSelfDelegation`) stamped this anchor with **no -subtree/source constraint**: a holder of a delegatable, non-admin-scope position -anchored at a LOW business unit could delegate it to a co-conspirator with an -**ancestor / arbitrary-high** anchor, leaking that BU's whole subtree of member -records — visibility beyond the delegator's own range. Mutual delegation could -grant it both ways. - -The gate now requires a self-delegated `business_unit_id` to fall inside the -delegator's **own effective anchor** for that position (the subtree of their own -direct holding's anchor, or of their member BU when the holding is unanchored) — -the same "assignments must target your subtree" spirit as the D12 -delegated-admin boundary. Fail-closed: an anchor that cannot be proven inside the -delegator's range is rejected. Unanchored delegation rows keep prior behavior -(the delegate resolves to their own member BU — not a widening). The -"anchoring only narrows, never widens" invariant now holds on the D3 path too. diff --git a/.changeset/authz-secfollowup-explain-posture.md b/.changeset/authz-secfollowup-explain-posture.md deleted file mode 100644 index 29d78029d5..0000000000 --- a/.changeset/authz-secfollowup-explain-posture.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -'@objectstack/plugin-security': patch ---- - -fix(plugin-security): explain posture 证据对齐 enforcement 派生（消除标签漂移） - -Security review 低危项。explain-engine 的 `derivePosture(context)` 之前用**松名字匹配**作 -posture 证据——`permissions.includes(ADMIN_FULL_ACCESS)`（不校验非作用域）+ `positions.includes( -'org_owner'/'org_admin')`（读 better-auth 角色），比 enforcement（`resolve-authz-context.ts` 的 -`hasPlatformAdminGrant`：要求**非作用域 admin_full_access user grant**；TENANT_ADMIN 用 -`organization_admin` **能力**而非角色）更松，可能让 explain 面板给运维显示**偏高**的 posture 标签 -（作用域 org-admin grant 被误标 PLATFORM/TENANT_ADMIN）。 - -修法——让 explain 的 posture 走 enforcement 已用的同一份证据： - -- **优先直接消费 `ctx.posture`**：principal 经完整 `resolveAuthzContext` 时已带 enforcement 派生的 - rung，逐字返回 → 结构上不可能漂移。 -- **回退（explain 用 `buildContextForUser` 自建 context，不经完整 resolveAuthzContext）**：复制 - enforcement 的非作用域 grant 判定——`buildContextForUser` 现按与 `hasPlatformAdminGrant` 逐字节 - 一致的规则（`admin_full_access` 且 `organization_id == null` 的 active user grant）计算并挂出 - `hasPlatformAdminGrant`；`derivePosture` 以此 + 投影出的 `platform_admin` 内建岗位判 PLATFORM_ADMIN， - 以 `organization_admin` **能力**判 TENANT_ADMIN，**不再**读 `org_owner`/`org_admin` 角色岗位 - （ADR-0095 D3：角色只是 provisioning 来源，非裁决输入 — explain 侧同样闭合 #2836 dual-track）。 -- 保留 explain 特有的 **guest → EXTERNAL** 底（enforcement floor 是 MEMBER），且置于最前。 - -只改 explain 的 **posture 标签**证据，不改 explain 的 allow/deny verdict（来自复用的 enforcement -filter），不改 enforcement。#2947 跟踪的「posture 未 plumb 进 enforcement context」更广缺口不在本 -任务范围。关联 #2920。 diff --git a/.changeset/authz-tenant-write-wall-fix.md b/.changeset/authz-tenant-write-wall-fix.md deleted file mode 100644 index 9aff4f054e..0000000000 --- a/.changeset/authz-tenant-write-wall-fix.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/plugin-security': major ---- - -fix(plugin-security): 堵跨租户 UPDATE 写 + org_admin 越 private 租户对象墙（security） - -**安全修复 + 行为变更（release-notes callout）。** 修复 security review 确认的两个租户墙授权漏洞，两者同在 `security-plugin.ts` / `tenant-layer.ts` 的写侧热路径。多组织模式（`tenancy.mode='multi'` + `@objectstack/organizations`）下生效。 - -**Finding 1 [BLOCKER] — 经 UPDATE 重指 `organization_id` 的跨租户写。** #2937 的 Layer 0 insert post-image 检查（中间件 step 3.7）只管 insert。对称的 update 路径无人管：成员拥有 org A 的记录 R，对 R 发 by-id 或 bulk `update` 带 `{organization_id: 受害者 org B}`，即可把行**移动进任意租户**——auto-stamp（insert-only）、FLS、服务端未强制的 `readonly`、Layer 0 pre-image（只校验旧 org）、显式 RLS check 全部漏过。修法（Option B，最小面 + 与 insert 对称）：把 step 3.7 的 Layer 0 post-image 检查扩到 update，复用**同一套** Layer 0 决策（`computeWriteTenantCheckFilter` → `computeLayeredRlsFilter` 的 `layer0`）。一个**显式提供**的 `organization_id` 必须过 Layer 0（== 调用者活动组织），否则 fail-closed 拒绝——这令非平台用户上下文里 `organization_id` **事实不可变**（只有活动组织值能过，而 pre-image 已把目标锁在活动组织内，故重指到任何**其他**租户被拒）。缺省（不碰 org_id）的 update 不受影响；bulk update 的跨租户 change-set 也被堵。 - -**Finding 2 [HIGH] — org_admin 在 private 租户对象上越租户墙。** Layer 0 跨租户豁免门此前用「持有 `viewAllRecords`/`modifyAllRecords`」判定。`organization_admin`（自动授给每个 org owner/admin）经其 `'*'` 通配持有这两个超级位，于是在 `access.default:'private'` 的**租户业务对象**上触发豁免 → 零过滤 → 读写所有租户的行。修法：把 Layer 0 豁免门从「超级位」收窄为**真正的平台管理员判定**（`hasPlatformAdminPosture`：持有平台专属能力 `manage_metadata`/`manage_platform_settings`/`studio.access`/`manage_users`，即 `admin_full_access` 携带而 `organization_admin` 刻意不给的那组）。超级位继续只驱动 Layer 1 业务 RLS 短路（TENANT_ADMIN 组织内见全行、无所有权收窄）。因新豁免是旧门的严格子集，只会**收窄**、绝不放宽（fail-safe）。 - -**行为收窄（预期的安全收窄，需注意）：** org admin 不再在 private/platform-global/better-auth 的**租户**对象上越租户墙——它现在被 Layer 0 墙到自己的 org。真·平台管理员（`admin_full_access` + 平台 systemPermissions）仍豁免；better-auth 托管身份表 carve-out 不受影响（无 `organization_id` 列，Layer 0 本就 inert）。系统上下文（`isSystem`，含 import/迁移/seed 的合法跨组织移动）在中间件入口即短路，完全不受影响。 - -**为何不用 `ctx.posture` 作豁免门：** B2 已把 `PLATFORM_ADMIN` posture 落进 `resolve-authz-context.ts` 的 `ctx.posture`，但该字段**未被 plumb 进** enforcement 中间件收到的 ExecutionContext（rest-server 与 runtime dispatcher 都丢弃了它），直接消费会静默 no-op。改用平台专属能力探针，读的是 enforcement 已用的同一套 permission sets，覆盖所有入口，且天然 fail-safe。 - -矩阵门：`authz-matrix-gate.test.ts` 更新 `private_obj.org_admin` 格（read `null` → `{organization_id:'org-1'}`）并新增 `[Finding 1 …]`（8 格：成员重指异租户→拒、同租户→通过、不碰 org_id→放行、无活动组织→拒、org_admin 重指→拒、platform-admin private 对象→放行、public 对象→拒、单组织→不检查）与 `[Finding 2 …]`（5 格：org_admin private 对象读/写墙到本租户、真平台管理员仍豁免、org_admin public 对象回归、better-auth carve-out 不受影响）。授权一致性 ledger 更新 `multi-tenant-write-postimage`（覆盖 insert+update）并新增 `multi-tenant-exemption-posture`。关联 objectstack-ai/framework#2920。 diff --git a/.changeset/c2-beta-explain-record-grained.md b/.changeset/c2-beta-explain-record-grained.md deleted file mode 100644 index c0c831242f..0000000000 --- a/.changeset/c2-beta-explain-record-grained.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/plugin-security': minor -'@objectstack/rest': patch ---- - -feat(plugin-security): C2-β — explain 引擎 record 粒度行级归因 (#2920) - -`explain(principal, object, operation, recordId?)` 现支持记录级解释。透传 `recordId` 时，引擎在对象级流水线之上叠加**行级归因**，全部复用 enforcement 同一批函数（explained-by-construction）： - -- **`tenant_isolation` Layer 0**：作为永远最先的层被 prepend；每层打上 `kernelTier`（`layer_0_tenant` vs `layer_1_business`），可区分「租户墙挡的」还是「业务 RLS 挡的」。 -- **每层 `record` 归因**（tenant / owd_baseline / sharing / rls）：`outcome`（admitted/excluded/not_evaluated）、有效 `rowFilter`、`matchesRecord`（用 `@objectstack/formula` 的 `matchesFilterCondition` 对同一条 FilterCondition 求值)、命中的 `rules[]`（tenant_filter/owd_baseline/ownership/record_share/sharing_rule/team/rls_policy，含 grants/via/effect）。 -- **顶层 `record` 判定**：`visible` + `decidedBy` 决定性层。读走复合行过滤匹配，写走 sharing service 的 `canEdit`（均为 enforcement 原语）。 -- **`principal.posture`**：ADR-0095 D2 档位（PLATFORM_ADMIN/TENANT_ADMIN/MEMBER/EXTERNAL）的 B2 stand-in 派生（复用 `resolveAuthzContext` 已投影的 platform_admin / org 角色证据），待 B2 合并后替换。 -- `computeRlsFilter` 重构为 `computeLayeredRlsFilter`（暴露 `{ layer0, layer1 }` 拆分）+ 薄 andCompose 包装，单一代码路径，行级归因不会与执行漂移。 -- REST `security.explain`（GET/POST）接受可选 `recordId`。 - -**向后兼容**:无 `recordId` 的对象级请求输出 **byte-identical**——无 `tenant_isolation` 层、无 `kernelTier`、无 `posture`、无 `record`。 diff --git a/.changeset/import-automation-hooks-2922.md b/.changeset/import-automation-hooks-2922.md deleted file mode 100644 index 08a52ff7ba..0000000000 --- a/.changeset/import-automation-hooks-2922.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/spec': patch -'@objectstack/objectql': patch -'@objectstack/rest': patch ---- - -Fix the data-import automation chain (#2922). Batch `engine.insert` now fires -`beforeInsert`/`afterInsert` once **per row** with single-record hook contexts, -so flat-input proxies, declarative hook conditions, audit writers, and -record-change triggers see real records instead of arrays. A new -`ExecutionContext.skipAutomations` flag (mirrored into `HookContext.session`) -lets callers suppress metadata-bound automation hooks and flow dispatch while -code-registered system hooks (audit, security, sharing) still run — making the -import wizard's "run automations & triggers" checkbox and import undo actually -effective. The REST import default flips to running automations unless the -request explicitly opts out (`runAutomations: false`), matching historical -behavior. diff --git a/.changeset/system-row-write-guardrail.md b/.changeset/system-row-write-guardrail.md deleted file mode 100644 index 48bf35b197..0000000000 --- a/.changeset/system-row-write-guardrail.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -'@objectstack/plugin-security': patch ---- - -内置行写护栏：`sys_position` / `sys_capability` 的平台/应用托管行不再可被客户管理员删改。 - -`sys_permission_set` 早有两道门写护栏（`assertPackageManagedWriteGate`）拦截对 package 托管行的写入，但 `sys_position` / `sys_capability` 缺失对应保护——平台/应用发布的系统岗位与能力（provenance 记录在 `managed_by`）可被管理员直接 delete / update 直达驱动，静默破坏应用的授权基线（ADR-0049：provenance 字段存在却无强制 = 正是要补的 enforcement gap）。 - -新增 **`assertSystemRowWriteGate`**（`packages/plugins/plugin-security/src/security-plugin.ts`，data-write hook 接线与 package 门同处），对这两个对象的托管行施加一道无条件的数据层边界： - -- **禁止伪造托管来源**：管理员门的 insert / update 载荷（单对象或数组）不得把 `managed_by` 盖成平台/应用值——只有携带 `isSystem` 的平台 seeder / 包发布路径可写；同时封堵 update-to-forge（把自建行改badge成托管行）。 -- **拒绝改删托管行**：对 `managed_by` 已是平台/应用值的行，`delete` / `update` / `transfer` / `restore` / `purge` 一律拒绝。与 `sys_permission_set` 不同，这两个对象没有 ADR-0094 overlay write-through，故写护栏必须在此层直接拒绝，而非下放给下游翻译。 -- **管理员自建行不受限**：`managed_by` 为 `user`/∅（sys_position）或 `admin`（sys_capability）的行完全归管理员所有（含委派管理员在自己 subtree 内的自建行）。 - -护栏 fail-closed 且不依赖调用方授权——持 `modifyAllRecords` 的超管也无法删除平台岗位。两对象的 `managed_by` 词表不同（sys_position：`system`/`config` 托管，`user`/∅ 自建；sys_capability：`platform`/`package` 托管，`admin` 自建），网关按对象分别判定。错误信息仅含业务文案（"此岗位/能力由 平台|应用包 提供，不可删除/修改"）。 - -与 delegated-admin 边界不冲突：`GOVERNED_OBJECTS` 本就不含这两个对象，委派管理仍治理 RBAC 链接表而非定义对象。 diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md index 5f4e894df6..d752685fa3 100644 --- a/examples/app-crm/CHANGELOG.md +++ b/examples/app-crm/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/example-crm +## 4.0.87 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/runtime@15.0.0 + ## 4.0.86 ### Patch Changes diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json index 0ecf8dac3c..581dd23289 100644 --- a/examples/app-crm/package.json +++ b/examples/app-crm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-crm", - "version": "4.0.86", + "version": "4.0.87", "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md index 83f58c0cad..fe2d5c6c5c 100644 --- a/examples/app-showcase/CHANGELOG.md +++ b/examples/app-showcase/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/example-showcase +## 0.3.9 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/runtime@15.0.0 + - @objectstack/cloud-connection@15.0.0 + - @objectstack/connector-rest@15.0.0 + - @objectstack/connector-slack@15.0.0 + - @objectstack/driver-sql@15.0.0 + - @objectstack/service-datasource@15.0.0 + ## 0.3.8 ### Patch Changes diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json index 1901d4ce14..82efed03f6 100644 --- a/examples/app-showcase/package.json +++ b/examples/app-showcase/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-showcase", - "version": "0.3.8", + "version": "0.3.9", "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, analytics). Built for demonstration, debugging, and coverage-driven verification.", "license": "Apache-2.0", "private": true, diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md index e67b169d6a..9c469b1779 100644 --- a/examples/app-todo/CHANGELOG.md +++ b/examples/app-todo/CHANGELOG.md @@ -1,5 +1,24 @@ # @objectstack/example-todo +## 4.0.87 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/runtime@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/metadata@15.0.0 + - @objectstack/client@15.0.0 + - @objectstack/mcp@15.0.0 + - @objectstack/driver-sqlite-wasm@15.0.0 + - @objectstack/knowledge-memory@15.0.0 + - @objectstack/service-knowledge@15.0.0 + ## 4.0.86 ### Patch Changes diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json index 237ed92367..cc3f09bad7 100644 --- a/examples/app-todo/package.json +++ b/examples/app-todo/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-todo", - "version": "4.0.86", + "version": "4.0.87", "description": "Example Todo App using ObjectStack Protocol", "license": "Apache-2.0", "private": true, diff --git a/examples/embed-objectql/CHANGELOG.md b/examples/embed-objectql/CHANGELOG.md index 922ad7db26..987edbf401 100644 --- a/examples/embed-objectql/CHANGELOG.md +++ b/examples/embed-objectql/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/example-embed-objectql +## 0.0.27 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/driver-memory@15.0.0 + ## 0.0.26 ### Patch Changes diff --git a/examples/embed-objectql/package.json b/examples/embed-objectql/package.json index 6f1364e88f..519c0ebbbe 100644 --- a/examples/embed-objectql/package.json +++ b/examples/embed-objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/example-embed-objectql", - "version": "0.0.26", + "version": "0.0.27", "private": true, "description": "Embed the ObjectQL engine as a plain library via @objectstack/objectql/core — no kernel, no plugins, no metadata protocol (ADR-0076).", "type": "module", diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md index 32351f0d14..3022cd0762 100644 --- a/packages/adapters/hono/CHANGELOG.md +++ b/packages/adapters/hono/CHANGELOG.md @@ -1,5 +1,14 @@ # @objectstack/hono +## 15.0.0 + +### Patch Changes + +- Updated dependencies [e62c233] + - @objectstack/runtime@15.0.0 + - @objectstack/plugin-hono-server@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json index 1e22e3c203..39a5f52008 100644 --- a/packages/adapters/hono/package.json +++ b/packages/adapters/hono/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/hono", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md index efa0404140..4bdca27da2 100644 --- a/packages/apps/account/CHANGELOG.md +++ b/packages/apps/account/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/account +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json index a038b4b759..c30643ab39 100644 --- a/packages/apps/account/package.json +++ b/packages/apps/account/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/account", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md index 70dc872e06..f83dc5e33b 100644 --- a/packages/apps/setup/CHANGELOG.md +++ b/packages/apps/setup/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/setup +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json index f2b7a0ef48..e3ae76fa79 100644 --- a/packages/apps/setup/package.json +++ b/packages/apps/setup/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/setup", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md index acf5453e50..e6765feb5f 100644 --- a/packages/apps/studio/CHANGELOG.md +++ b/packages/apps/studio/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/studio +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json index f224ec5d7f..003560d66d 100644 --- a/packages/apps/studio/package.json +++ b/packages/apps/studio/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/studio", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).", "main": "dist/index.js", diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md index 7cef17a9a7..b5c70032ec 100644 --- a/packages/cli/CHANGELOG.md +++ b/packages/cli/CHANGELOG.md @@ -1,5 +1,72 @@ # @objectstack/cli +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [891ea81] +- Updated dependencies [0fcef9b] +- Updated dependencies [13749ec] +- Updated dependencies [ca2b2f6] +- Updated dependencies [2ae78c6] +- Updated dependencies [5febe3f] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [698454e] +- Updated dependencies [29a4c90] +- Updated dependencies [ef70521] +- Updated dependencies [a581a65] +- Updated dependencies [31d04d4] +- Updated dependencies [5774a75] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/lint@15.0.0 + - @objectstack/plugin-security@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/runtime@15.0.0 + - @objectstack/rest@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/account@15.0.0 + - @objectstack/setup@15.0.0 + - @objectstack/metadata@15.0.0 + - @objectstack/plugin-approvals@15.0.0 + - @objectstack/plugin-audit@15.0.0 + - @objectstack/plugin-auth@15.0.0 + - @objectstack/plugin-email@15.0.0 + - @objectstack/plugin-reports@15.0.0 + - @objectstack/plugin-sharing@15.0.0 + - @objectstack/service-job@15.0.0 + - @objectstack/service-queue@15.0.0 + - @objectstack/service-realtime@15.0.0 + - @objectstack/service-settings@15.0.0 + - @objectstack/service-storage@15.0.0 + - @objectstack/client@15.0.0 + - @objectstack/cloud-connection@15.0.0 + - @objectstack/formula@15.0.0 + - @objectstack/mcp@15.0.0 + - @objectstack/observability@15.0.0 + - @objectstack/driver-memory@15.0.0 + - @objectstack/driver-mongodb@15.0.0 + - @objectstack/driver-sql@15.0.0 + - @objectstack/driver-sqlite-wasm@15.0.0 + - @objectstack/plugin-hono-server@15.0.0 + - @objectstack/plugin-webhooks@15.0.0 + - @objectstack/service-analytics@15.0.0 + - @objectstack/service-automation@15.0.0 + - @objectstack/service-cache@15.0.0 + - @objectstack/service-datasource@15.0.0 + - @objectstack/service-messaging@15.0.0 + - @objectstack/service-package@15.0.0 + - @objectstack/service-sms@15.0.0 + - @objectstack/trigger-api@15.0.0 + - @objectstack/trigger-record-change@15.0.0 + - @objectstack/trigger-schedule@15.0.0 + - @objectstack/types@15.0.0 + - @objectstack/verify@15.0.0 + - @objectstack/console@15.0.0 + ## 14.8.0 ### Minor Changes diff --git a/packages/cli/package.json b/packages/cli/package.json index 235874bf9c..fb3740e4bf 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cli", - "version": "14.8.0", + "version": "15.0.0", "description": "Command Line Interface for ObjectStack Protocol", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md index 639d6206dd..759133f5af 100644 --- a/packages/client-react/CHANGELOG.md +++ b/packages/client-react/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/client-react +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/client@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/client-react/package.json b/packages/client-react/package.json index 07af98c792..e7cf246f35 100644 --- a/packages/client-react/package.json +++ b/packages/client-react/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client-react", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "React hooks for ObjectStack Client SDK", "main": "dist/index.js", diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md index 996bfeb682..0d76bc7bba 100644 --- a/packages/client/CHANGELOG.md +++ b/packages/client/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/client +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/client/package.json b/packages/client/package.json index 283694c614..9dd2c390ac 100644 --- a/packages/client/package.json +++ b/packages/client/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/client", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Official Client SDK for ObjectStack Protocol", "main": "dist/index.js", diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md index 0a538d1bdd..f78e62773a 100644 --- a/packages/cloud-connection/CHANGELOG.md +++ b/packages/cloud-connection/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/cloud-connection +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/runtime@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json index e3d22a3c58..45ba983a01 100644 --- a/packages/cloud-connection/package.json +++ b/packages/cloud-connection/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/cloud-connection", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.", "type": "module", diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md index 79fb34dc09..4fe75d8310 100644 --- a/packages/connectors/connector-mcp/CHANGELOG.md +++ b/packages/connectors/connector-mcp/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/connector-mcp +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json index 9b73bfe9bd..686fe03af9 100644 --- a/packages/connectors/connector-mcp/package.json +++ b/packages/connectors/connector-mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-mcp", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).", "main": "dist/index.js", diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md index 16e35d0985..44df932c4c 100644 --- a/packages/connectors/connector-openapi/CHANGELOG.md +++ b/packages/connectors/connector-openapi/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/connector-openapi +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json index 878c6b9618..38490006ff 100644 --- a/packages/connectors/connector-openapi/package.json +++ b/packages/connectors/connector-openapi/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-openapi", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).", "main": "dist/index.js", diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md index ba39f64b39..f5dd04e4bb 100644 --- a/packages/connectors/connector-rest/CHANGELOG.md +++ b/packages/connectors/connector-rest/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/connector-rest +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json index d7b75fb660..3961c20b95 100644 --- a/packages/connectors/connector-rest/package.json +++ b/packages/connectors/connector-rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-rest", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).", "main": "dist/index.js", diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md index 1f49bae47f..dda96076da 100644 --- a/packages/connectors/connector-slack/CHANGELOG.md +++ b/packages/connectors/connector-slack/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/connector-slack +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json index 1b09f27818..534e11c711 100644 --- a/packages/connectors/connector-slack/package.json +++ b/packages/connectors/connector-slack/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/connector-slack", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).", "main": "dist/index.js", diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md index 51887e61fa..1526f4158e 100644 --- a/packages/console/CHANGELOG.md +++ b/packages/console/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/console +## 15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/console/package.json b/packages/console/package.json index 613abc2969..0087d5b4e6 100644 --- a/packages/console/package.json +++ b/packages/console/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/console", - "version": "14.8.0", + "version": "15.0.0", "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).", "license": "Apache-2.0", "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console", diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 7542f928be..47294cbac5 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -1,5 +1,48 @@ # @objectstack/core +## 15.0.0 + +### Minor Changes + +- 13749ec: ADR-0095 D2/D3: the authorization kernel now resolves an explicit **posture + ladder** — a monotonic principal tier `PLATFORM_ADMIN > TENANT_ADMIN > MEMBER > +EXTERNAL` — once, in `resolveAuthzContext`, and carries it on + `ResolvedAuthzContext.posture`. + + - **D2 — the ladder.** New `@objectstack/core/security` module `posture-ladder.ts` + reuses the spec `AuthzPosture` enum and pins the rung → row-visibility + injection-rule mapping (exactly one rule per rung) plus its two ADR-required + invariants as unit-tested properties: strict nesting (rung _n_'s visible set ⊇ + rung _n−1_'s) and the `EXTERNAL` deny-by-default semantics (explicitly shared + rows only — OWD baselines and sharing rules never widen it). `EXTERNAL` is + defined and test-locked now but never resolved: no external principal type + exists yet (portal/ADR-0093), so the resolver's floor is `MEMBER`. + - **D3 — capability-derived, single track.** The rung derives from held + **capability grants**, never a better-auth role: `PLATFORM_ADMIN` from the + unscoped `admin_full_access` grant (the same `viewAllRecords`/`modifyAllRecords` + evidence the superuser bypass trusts), `TENANT_ADMIN` from the + `organization_admin` grant. The better-auth `role='admin'` remains only a + _provisioning source_ of those grants (`auto-org-admin-grant.ts`, + `mapMembershipRole`); no enforcement path reads the raw role, closing the + #2836 dual-track adjudication class by construction. + - New spec export `ORGANIZATION_ADMIN` (the org-admin capability-grant name), + alongside the existing `ADMIN_FULL_ACCESS`. + + **Behavior-preserving.** Enforcement is unchanged — the per-object Layer 0 + exemption and per-side superuser bypass still gate access exactly as before; + `posture` is an additive, derived, explainable field. The `authz-matrix-gate` + unit snapshot and the dogfood authz-conformance matrix stay green. No migration + required. + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/core/package.json b/packages/core/package.json index f2457f3d48..db5a467244 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/core", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Microkernel Core for ObjectStack", "type": "module", diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md index f0d0b01439..731cf914f2 100644 --- a/packages/create-objectstack/CHANGELOG.md +++ b/packages/create-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # create-objectstack +## 15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json index b6620e9853..9fd0cdf38a 100644 --- a/packages/create-objectstack/package.json +++ b/packages/create-objectstack/package.json @@ -1,6 +1,6 @@ { "name": "create-objectstack", - "version": "14.8.0", + "version": "15.0.0", "description": "Create a new ObjectStack project — npx create-objectstack", "bin": { "create-objectstack": "./bin/create-objectstack.js" diff --git a/packages/create-objectstack/src/templates/blank/package.json b/packages/create-objectstack/src/templates/blank/package.json index 07be83fd06..564b9efae0 100644 --- a/packages/create-objectstack/src/templates/blank/package.json +++ b/packages/create-objectstack/src/templates/blank/package.json @@ -11,13 +11,13 @@ "typecheck": "tsc --noEmit" }, "dependencies": { - "@objectstack/spec": "^14.0.0", - "@objectstack/runtime": "^14.0.0", - "@objectstack/driver-memory": "^14.0.0", - "@objectstack/plugin-hono-server": "^14.0.0" + "@objectstack/spec": "^15.0.0", + "@objectstack/runtime": "^15.0.0", + "@objectstack/driver-memory": "^15.0.0", + "@objectstack/plugin-hono-server": "^15.0.0" }, "devDependencies": { - "@objectstack/cli": "^14.0.0", + "@objectstack/cli": "^15.0.0", "typescript": "^6.0.0" } } diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md index 2a979c1bb5..7673d11088 100644 --- a/packages/dogfood/CHANGELOG.md +++ b/packages/dogfood/CHANGELOG.md @@ -1,5 +1,31 @@ # @objectstack/dogfood +## 0.0.35 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [0fcef9b] +- Updated dependencies [13749ec] +- Updated dependencies [ca2b2f6] +- Updated dependencies [2ae78c6] +- Updated dependencies [5febe3f] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [698454e] +- Updated dependencies [29a4c90] +- Updated dependencies [ef70521] +- Updated dependencies [a581a65] +- Updated dependencies [31d04d4] +- Updated dependencies [5774a75] + - @objectstack/spec@15.0.0 + - @objectstack/plugin-security@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/plugin-auth@15.0.0 + - @objectstack/example-crm@4.0.87 + - @objectstack/example-showcase@0.3.9 + - @objectstack/verify@15.0.0 + ## 0.0.34 ### Patch Changes diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json index 5cde52eb33..9e0884d80f 100644 --- a/packages/dogfood/package.json +++ b/packages/dogfood/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/dogfood", - "version": "0.0.34", + "version": "0.0.35", "private": true, "license": "Apache-2.0", "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.", diff --git a/packages/downstream-contract/CHANGELOG.md b/packages/downstream-contract/CHANGELOG.md index e74964196e..646cc387ad 100644 --- a/packages/downstream-contract/CHANGELOG.md +++ b/packages/downstream-contract/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/downstream-contract +## 0.0.33 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + ## 0.0.32 ### Patch Changes diff --git a/packages/downstream-contract/package.json b/packages/downstream-contract/package.json index 3a3f1d1186..bac3eb18b4 100644 --- a/packages/downstream-contract/package.json +++ b/packages/downstream-contract/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/downstream-contract", - "version": "0.0.32", + "version": "0.0.33", "description": "Frozen third-party consumer fixture — a backward-compatibility gate for @objectstack/spec. Authored the way an external project on a published release authors metadata; if a spec change breaks it, that change is breaking (#2035).", "license": "Apache-2.0", "private": true, diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md index 048eafa26a..0baa17c9ac 100644 --- a/packages/formula/CHANGELOG.md +++ b/packages/formula/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/formula +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/formula/package.json b/packages/formula/package.json index 4f88e17e7f..382cfe04bd 100644 --- a/packages/formula/package.json +++ b/packages/formula/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/formula", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry", "main": "dist/index.js", diff --git a/packages/lint/CHANGELOG.md b/packages/lint/CHANGELOG.md index d4c880c3b6..9525f12012 100644 --- a/packages/lint/CHANGELOG.md +++ b/packages/lint/CHANGELOG.md @@ -1,5 +1,48 @@ # @objectstack/lint +## 15.0.0 + +### Minor Changes + +- 891ea81: ADR-0089 D3b: make the `visibility-root-mislayered` lint check bidirectional. `validateVisibilityPredicates` now accepts an optional `{ layer }` option — `'runtime'` (default, unchanged) flags a `data.`-rooted predicate on a `*.view.ts` / `*.page.ts` surface, and `'metadata'` flags a `record.`-rooted predicate on a `*.form.ts` metadata-editing form. Both directions of the ADR's binding-root rule are now covered. Adds the `VisibilityLayer` / `VisibilityOptions` exported types. Fully back-compat: existing single-argument callers keep the runtime behavior. +- e62c233: feat(spec,plugin-security): package-level capability declaration API (ADR-0066 D1) + + Packages can now DEFINE their own authorization capabilities explicitly via the + new `defineCapability` factory and a stack's `capabilities` array, instead of + relying on the implicit "derive an untitled capability from whatever a permission + set references in `systemPermissions[]`" back-door. + + - `@objectstack/spec`: new `defineCapability` / `CapabilityDeclarationSchema` + (`{ name, label?, description?, scope, packageId? }`) and a `capabilities` + field on the stack definition. + - `@objectstack/plugin-security`: new `bootstrapDeclaredCapabilities` seeds + declared capabilities into `sys_capability` with `managed_by:'package'` + + `package_id` provenance (new `package_id` field on the object). Idempotent, + upgrade-aware; refuses to hijack curated platform capabilities or another + package's rows, never clobbers admin-authored rows, and CLAIMS a pre-existing + derived placeholder (upgrading it to package provenance). The implicit + derive-from-`systemPermissions` path still runs for back-compat but now skips + any explicitly-declared name so it can't clobber authored metadata. + - `@objectstack/runtime`: stack-declared `capabilities` are registered into the + metadata registry (type `capability`) so the boot seeder can read them. + - `@objectstack/lint`: `validateCapabilityReferences` treats + `stack.capabilities` names as a known capability source. + + A capability is not a contract: DEFINE it (`defineCapability`), GRANT it + (`systemPermissions`), REQUIRE it (`requiredPermissions`) — no `inputs`. + Aligns with ADR-0094 D5 (retire implicit `managed_by`-guessing back-doors). + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/formula@15.0.0 + - @objectstack/sdui-parser@15.0.0 + ## 14.8.0 ### Minor Changes diff --git a/packages/lint/package.json b/packages/lint/package.json index 6d32fe9c31..adf8f01cf5 100644 --- a/packages/lint/package.json +++ b/packages/lint/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/lint", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Static, build-time validation for an ObjectStack metadata graph — dashboard widget bindings, CEL/predicate expressions, and more. Pure (stack) => Issue[] functions shared by the CLI's `os validate` and any other consumer (e.g. AI authoring). Depends on @objectstack/spec; never on a runtime.", "type": "module", diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md index b1bad36e65..8d209dbbba 100644 --- a/packages/mcp/CHANGELOG.md +++ b/packages/mcp/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-mcp-server +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 89bc18c63e..a6513d7478 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/mcp", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)", "type": "module", diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md index a49089b24c..3eb1628f47 100644 --- a/packages/metadata-core/CHANGELOG.md +++ b/packages/metadata-core/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/metadata-core +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json index 045034a287..eb3d78018c 100644 --- a/packages/metadata-core/package.json +++ b/packages/metadata-core/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-core", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).", "type": "module", diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md index c6f51e11af..ec63b2be73 100644 --- a/packages/metadata-fs/CHANGELOG.md +++ b/packages/metadata-fs/CHANGELOG.md @@ -1,5 +1,11 @@ # @objectstack/metadata-fs +## 15.0.0 + +### Patch Changes + +- @objectstack/metadata-core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json index 50c077e586..9deb98f97c 100644 --- a/packages/metadata-fs/package.json +++ b/packages/metadata-fs/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-fs", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).", "type": "module", diff --git a/packages/metadata-protocol/CHANGELOG.md b/packages/metadata-protocol/CHANGELOG.md index 3a5d99fe4d..8858b3c935 100644 --- a/packages/metadata-protocol/CHANGELOG.md +++ b/packages/metadata-protocol/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/metadata-protocol +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/formula@15.0.0 + - @objectstack/metadata-core@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Minor Changes diff --git a/packages/metadata-protocol/package.json b/packages/metadata-protocol/package.json index 6fc9d92fde..b6e1d9278a 100644 --- a/packages/metadata-protocol/package.json +++ b/packages/metadata-protocol/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata-protocol", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack metadata management protocol: sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics (ADR-0076).", "type": "module", diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md index 33883e86d9..fb72d7faaf 100644 --- a/packages/metadata/CHANGELOG.md +++ b/packages/metadata/CHANGELOG.md @@ -1,5 +1,22 @@ # @objectstack/metadata +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/metadata-core@15.0.0 + - @objectstack/types@15.0.0 + - @objectstack/metadata-fs@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/metadata/package.json b/packages/metadata/package.json index 609af947a3..15709684b4 100644 --- a/packages/metadata/package.json +++ b/packages/metadata/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/metadata", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Metadata loading, saving, and persistence for ObjectStack", "type": "module", diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md index 89004b13b3..0aa7917aaa 100644 --- a/packages/objectql/CHANGELOG.md +++ b/packages/objectql/CHANGELOG.md @@ -1,5 +1,32 @@ # @objectstack/objectql +## 15.0.0 + +### Patch Changes + +- 31d04d4: Fix the data-import automation chain (#2922). Batch `engine.insert` now fires + `beforeInsert`/`afterInsert` once **per row** with single-record hook contexts, + so flat-input proxies, declarative hook conditions, audit writers, and + record-change triggers see real records instead of arrays. A new + `ExecutionContext.skipAutomations` flag (mirrored into `HookContext.session`) + lets callers suppress metadata-bound automation hooks and flow dispatch while + code-registered system hooks (audit, security, sharing) still run — making the + import wizard's "run automations & triggers" checkbox and import undo actually + effective. The REST import default flips to running automations unless the + request explicitly opts out (`runAutomations: false`), matching historical + behavior. +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/formula@15.0.0 + - @objectstack/metadata-core@15.0.0 + - @objectstack/metadata-protocol@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/objectql/package.json b/packages/objectql/package.json index 22a30bab01..d778f34d85 100644 --- a/packages/objectql/package.json +++ b/packages/objectql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/objectql", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Isomorphic ObjectQL Engine for ObjectStack", "main": "dist/index.js", diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md index 227469c11c..f54b68b718 100644 --- a/packages/observability/CHANGELOG.md +++ b/packages/observability/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/observability +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/observability/package.json b/packages/observability/package.json index 3800741b9d..837aa3f52d 100644 --- a/packages/observability/package.json +++ b/packages/observability/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/observability", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.", "type": "module", diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md index 9dc5ad97bd..1e7948d251 100644 --- a/packages/platform-objects/CHANGELOG.md +++ b/packages/platform-objects/CHANGELOG.md @@ -1,5 +1,28 @@ # @objectstack/platform-objects +## 15.0.0 + +### Minor Changes + +- 02a014b: feat(platform-objects): sys_user 记录页新增 Permission Sets 与 Business Units 两个一站式分配 tab (A3, #2920) + + 管理员现在可在单个用户记录页完成三类分配:岗位(Positions,已有)、直接权限集授权(Permission Sets)、业务单元归属(Business Units)。两个新 tab 均为纯 SDUI 的 `record:related_list` + Add picker: + + - **Permission Sets** — junction `sys_user_permission_set`(id-keyed,`relationshipField: 'user_id'`),Add picker 绑定 `sys_permission_set`(`linkField: 'permission_set_id'`)。服务端 audience-anchor(D5/D9)与 delegated-admin(D12)门禁的拒绝原因会显示在 Add 对话框。 + - **Business Units** — junction `sys_business_unit_member`(id-keyed,`relationshipField: 'user_id'`),Add picker 绑定 `sys_business_unit`(`linkField: 'business_unit_id'`,按显示字段 `name` 标注)。 + + tab 顺序为 Positions → Permission Sets → Business Units,四语言标签齐全。 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/metadata-core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json index 4be92beb30..2a91270658 100644 --- a/packages/platform-objects/package.json +++ b/packages/platform-objects/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/platform-objects", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects", "main": "dist/index.js", diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md index b51452c0d0..e421844a6d 100644 --- a/packages/plugins/driver-memory/CHANGELOG.md +++ b/packages/plugins/driver-memory/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/driver-memory +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json index 487e91a9b4..61c0856b16 100644 --- a/packages/plugins/driver-memory/package.json +++ b/packages/plugins/driver-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-memory", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "In-Memory Driver for ObjectStack (Reference Implementation)", "main": "dist/index.js", diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md index 3eddca3981..7151cbce07 100644 --- a/packages/plugins/driver-mongodb/CHANGELOG.md +++ b/packages/plugins/driver-mongodb/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/driver-mongodb +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json index 04302f431a..c76d95c94f 100644 --- a/packages/plugins/driver-mongodb/package.json +++ b/packages/plugins/driver-mongodb/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-mongodb", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client", "main": "dist/index.js", diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md index bdeed134ab..be16f988f7 100644 --- a/packages/plugins/driver-sql/CHANGELOG.md +++ b/packages/plugins/driver-sql/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/driver-sql +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json index e40738e8b4..559cafba76 100644 --- a/packages/plugins/driver-sql/package.json +++ b/packages/plugins/driver-sql/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sql", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex", "main": "dist/index.js", diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md index 2b8b1cd8ba..b2a9ef1125 100644 --- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md +++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/driver-sqlite-wasm +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/driver-sql@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json index 3359e7b99a..6da5ad2548 100644 --- a/packages/plugins/driver-sqlite-wasm/package.json +++ b/packages/plugins/driver-sqlite-wasm/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/driver-sqlite-wasm", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings", "keywords": [ diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md index c292fa62a2..b3f30cda7e 100644 --- a/packages/plugins/embedder-openai/CHANGELOG.md +++ b/packages/plugins/embedder-openai/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/embedder-openai +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json index 2acceaef24..f60e9267a0 100644 --- a/packages/plugins/embedder-openai/package.json +++ b/packages/plugins/embedder-openai/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/embedder-openai", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md index df52d0d922..5ebff4080e 100644 --- a/packages/plugins/knowledge-memory/CHANGELOG.md +++ b/packages/plugins/knowledge-memory/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/knowledge-memory +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/service-knowledge@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json index dbc3a4e98e..fd2005fe6f 100644 --- a/packages/plugins/knowledge-memory/package.json +++ b/packages/plugins/knowledge-memory/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-memory", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).", "main": "dist/index.js", diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md index 5cf042f3a0..89882d1a5e 100644 --- a/packages/plugins/knowledge-ragflow/CHANGELOG.md +++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/knowledge-ragflow +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/service-knowledge@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json index 03ba8ed31b..06aded2b32 100644 --- a/packages/plugins/knowledge-ragflow/package.json +++ b/packages/plugins/knowledge-ragflow/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/knowledge-ragflow", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md index 67ba7e51ee..530761bcc0 100644 --- a/packages/plugins/plugin-approvals/CHANGELOG.md +++ b/packages/plugins/plugin-approvals/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-approvals +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/formula@15.0.0 + - @objectstack/metadata-core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json index a8801ec2d3..d689eba28c 100644 --- a/packages/plugins/plugin-approvals/package.json +++ b/packages/plugins/plugin-approvals/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-approvals", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md index 8cb736811f..13ff83d77f 100644 --- a/packages/plugins/plugin-audit/CHANGELOG.md +++ b/packages/plugins/plugin-audit/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-audit +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json index 6447f18541..e90eb72f84 100644 --- a/packages/plugins/plugin-audit/package.json +++ b/packages/plugins/plugin-audit/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-audit", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Audit Plugin for ObjectStack — System audit log object and audit trail", "main": "dist/index.js", diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md index d1da47c216..d273646af2 100644 --- a/packages/plugins/plugin-auth/CHANGELOG.md +++ b/packages/plugins/plugin-auth/CHANGELOG.md @@ -1,5 +1,22 @@ # Changelog +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [a581a65] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/rest@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json index 0aa7fff5e7..0946e1a551 100644 --- a/packages/plugins/plugin-auth/package.json +++ b/packages/plugins/plugin-auth/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-auth", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Authentication & Identity Plugin for ObjectStack", "main": "dist/index.js", diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md index 4d2424001e..c91e817d0d 100644 --- a/packages/plugins/plugin-dev/CHANGELOG.md +++ b/packages/plugins/plugin-dev/CHANGELOG.md @@ -1,5 +1,37 @@ # @objectstack/plugin-dev +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [0fcef9b] +- Updated dependencies [13749ec] +- Updated dependencies [ca2b2f6] +- Updated dependencies [2ae78c6] +- Updated dependencies [5febe3f] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [698454e] +- Updated dependencies [29a4c90] +- Updated dependencies [ef70521] +- Updated dependencies [a581a65] +- Updated dependencies [31d04d4] +- Updated dependencies [5774a75] + - @objectstack/spec@15.0.0 + - @objectstack/plugin-security@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/runtime@15.0.0 + - @objectstack/rest@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/account@15.0.0 + - @objectstack/setup@15.0.0 + - @objectstack/plugin-auth@15.0.0 + - @objectstack/driver-memory@15.0.0 + - @objectstack/plugin-hono-server@15.0.0 + - @objectstack/service-i18n@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json index 69f94daee9..798f793f71 100644 --- a/packages/plugins/plugin-dev/package.json +++ b/packages/plugins/plugin-dev/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-dev", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations", "main": "dist/index.js", diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md index 1740722332..8d25ad3509 100644 --- a/packages/plugins/plugin-email/CHANGELOG.md +++ b/packages/plugins/plugin-email/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/plugin-email +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/formula@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json index 5a17032b99..9d261986f7 100644 --- a/packages/plugins/plugin-email/package.json +++ b/packages/plugins/plugin-email/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-email", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md index f32f7d2854..897954018b 100644 --- a/packages/plugins/plugin-hono-server/CHANGELOG.md +++ b/packages/plugins/plugin-hono-server/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-hono-server +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/observability@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json index 634b10eb42..816e99c701 100644 --- a/packages/plugins/plugin-hono-server/package.json +++ b/packages/plugins/plugin-hono-server/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-hono-server", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Standard Hono Server Adapter for ObjectStack Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md index 0bdb93e249..9a0bfc8745 100644 --- a/packages/plugins/plugin-reports/CHANGELOG.md +++ b/packages/plugins/plugin-reports/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/plugin-reports +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json index 4e972b8705..6e46cd30a1 100644 --- a/packages/plugins/plugin-reports/package.json +++ b/packages/plugins/plugin-reports/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-reports", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md index 5b4f0c440e..2043d90dc7 100644 --- a/packages/plugins/plugin-security/CHANGELOG.md +++ b/packages/plugins/plugin-security/CHANGELOG.md @@ -1,5 +1,265 @@ # @objectstack/plugin-security +## 15.0.0 + +### Major Changes + +- 0fcef9b: ADR-0095 D1: tenant isolation is now **Layer 0** — an independent, always-first, + AND-composed filter (`tenant-layer.ts`), no longer a wildcard `tenant_isolation` + RLS policy OR-merged with business RLS. The effective row filter is + `Layer0(tenant) AND Layer1(business RLS)`; the two share no compiler, merge step, + or bypass bit. The superuser bypass now exempts the tenant wall only as a Layer 0 + rule (platform-admin posture + object posture permits: private / platform-global + / better-auth-managed), never via a business-RLS short-circuit. + + **BREAKING (multi-org `tenancy.mode = 'multi'` deployments only; `single` mode is + inert and unchanged).** Retiring the OR-merged tenant policy resolves four + behavior deltas, all toward stronger/correcter isolation: + + - **(a) Cross-tenant read leak closed.** A permissive business RLS policy (e.g. + `status == 'public'`) no longer OR-widens tenant scope; a foreign-org row it + matched is now invisible. + - **(b) Member by-id writes narrow to owner-only.** The OR-merge silently widened + `owner_only_writes` (`created_by == me`) back to org-wide, so a member could + by-id update/delete _any_ record in their org. Writes are now owner-scoped as + authored. **Migration:** if your deployment intentionally relied on members + editing each other's records org-wide, grant an explicit per-object edit + permission set (position-distributed) where that is wanted — the baseline + `member_default` no longer permits it. + - **(c) Global-catalog objects visible to members.** On a `tenancy.enabled:false` + object, members were scoped by a phantom `organization_id` filter (a column + such objects lack); Layer 0 correctly treats them as non-tenant, so the global + catalog is visible. + - **(e) No-active-org writes fail closed.** A write by a principal with no active + organization on a tenant object is now denied (was owner-scoped only). + + `tenant_isolation` is retired from the seeded `organization_admin` / + `member_default` / `viewer_readonly` sets; the `_self` / `_org` identity-table + carve-outs and `owner_only_writes/deletes` are unchanged. Customized seeded sets + keep their overlays (ADR-0094). The driver-level `applyTenantScope` seam is + untouched. See ADR-0095 and framework#2936 (the `extractTargetField` `==` blind + spot this exposes, tracked separately). + +- 2ae78c6: fix(plugin-security): #2937 — Layer 0 insert post-image 租户检查（伪造 organization_id 的用户 insert 现被拒） + + **安全修复 + 行为变更（release-notes callout）。** 多组织模式(`tenancy.mode='multi'` + + `@objectstack/organizations`)下，一个普通用户此前可以 `insert` 一条**伪造 `organization_id`** + (指向别的租户)的业务记录并使其落进受害租户 —— Layer 0 的租户墙 AND-composed 到读 + + update/delete 的 pre-image，但 insert 没有 pre-image、也不带 AST，从未被门控(ADR-0095 D1 + 读侧 W1 的写侧未竟部分)。 + + 新增 SecurityPlugin 中间件步骤 3.7:对 insert 的 **post-image** 复用读侧同一套 Layer 0 决策 + (`computeInsertTenantCheckFilter` → `computeLayeredRlsFilter` 的 `layer0`)做校验 —— + 一个**显式提供**的 `organization_id` 必须等于调用者的活动组织,否则 fail-closed 拒绝。规则与 + 读侧完全一致:单组织/隔离未激活、非租户对象(无 `organization_id` 列或 `tenancy.enabled:false`)、 + platform-admin 姿态豁免的对象均不适用;无活动组织的用户提供任意 org_id → 拒(deny sentinel)。 + + **行为 delta(需注意):** 此前能成功的「带跨租户 `organization_id` 的用户级 insert」现被拒绝。 + **缺省(不提供 `organization_id`)的 insert 不受影响** —— 补全仍由 `@objectstack/organizations` + 的 auto-stamp 负责(职责分离,因此本检查与 auto-stamp 中间件的注册顺序无关)。系统上下文 + (`isSystem`,含 import 引擎 / 迁移 / 每-org seed replay·clone·orphan-claim 的 `SYSTEM_CTX`) + 在中间件入口即短路,合法的「代客设置 org_id」写路径**完全不受影响**。 + + 矩阵门:`authz-matrix-gate.test.ts` 新增 `[#2937] Layer 0 insert post-image tenant guard` + 八格(伪造异租户 → 拒、同租户 → 通过、缺省 → 放行、无活动组织 → 拒、platform-admin 私有对象豁免、 + public 业务对象不豁免、tenancy-disabled 对象不适用、单组织模式不检查)。授权一致性 ledger + 新增 `multi-tenant-insert-postimage` 行。配套 cloud `@objectstack/organizations` 的 auto-stamp + 权威覆盖(纵深防御)。Closes objectstack-ai/framework#2937。 + +- ef70521: fix(plugin-security): 堵跨租户 UPDATE 写 + org_admin 越 private 租户对象墙（security） + + **安全修复 + 行为变更（release-notes callout）。** 修复 security review 确认的两个租户墙授权漏洞，两者同在 `security-plugin.ts` / `tenant-layer.ts` 的写侧热路径。多组织模式（`tenancy.mode='multi'` + `@objectstack/organizations`）下生效。 + + **Finding 1 [BLOCKER] — 经 UPDATE 重指 `organization_id` 的跨租户写。** #2937 的 Layer 0 insert post-image 检查（中间件 step 3.7）只管 insert。对称的 update 路径无人管：成员拥有 org A 的记录 R，对 R 发 by-id 或 bulk `update` 带 `{organization_id: 受害者 org B}`，即可把行**移动进任意租户**——auto-stamp（insert-only）、FLS、服务端未强制的 `readonly`、Layer 0 pre-image（只校验旧 org）、显式 RLS check 全部漏过。修法（Option B，最小面 + 与 insert 对称）：把 step 3.7 的 Layer 0 post-image 检查扩到 update，复用**同一套** Layer 0 决策（`computeWriteTenantCheckFilter` → `computeLayeredRlsFilter` 的 `layer0`）。一个**显式提供**的 `organization_id` 必须过 Layer 0（== 调用者活动组织），否则 fail-closed 拒绝——这令非平台用户上下文里 `organization_id` **事实不可变**（只有活动组织值能过，而 pre-image 已把目标锁在活动组织内，故重指到任何**其他**租户被拒）。缺省（不碰 org_id）的 update 不受影响；bulk update 的跨租户 change-set 也被堵。 + + **Finding 2 [HIGH] — org_admin 在 private 租户对象上越租户墙。** Layer 0 跨租户豁免门此前用「持有 `viewAllRecords`/`modifyAllRecords`」判定。`organization_admin`（自动授给每个 org owner/admin）经其 `'*'` 通配持有这两个超级位，于是在 `access.default:'private'` 的**租户业务对象**上触发豁免 → 零过滤 → 读写所有租户的行。修法：把 Layer 0 豁免门从「超级位」收窄为**真正的平台管理员判定**（`hasPlatformAdminPosture`：持有平台专属能力 `manage_metadata`/`manage_platform_settings`/`studio.access`/`manage_users`，即 `admin_full_access` 携带而 `organization_admin` 刻意不给的那组）。超级位继续只驱动 Layer 1 业务 RLS 短路（TENANT_ADMIN 组织内见全行、无所有权收窄）。因新豁免是旧门的严格子集，只会**收窄**、绝不放宽（fail-safe）。 + + **行为收窄（预期的安全收窄，需注意）：** org admin 不再在 private/platform-global/better-auth 的**租户**对象上越租户墙——它现在被 Layer 0 墙到自己的 org。真·平台管理员（`admin_full_access` + 平台 systemPermissions）仍豁免；better-auth 托管身份表 carve-out 不受影响（无 `organization_id` 列，Layer 0 本就 inert）。系统上下文（`isSystem`，含 import/迁移/seed 的合法跨组织移动）在中间件入口即短路，完全不受影响。 + + **为何不用 `ctx.posture` 作豁免门：** B2 已把 `PLATFORM_ADMIN` posture 落进 `resolve-authz-context.ts` 的 `ctx.posture`，但该字段**未被 plumb 进** enforcement 中间件收到的 ExecutionContext（rest-server 与 runtime dispatcher 都丢弃了它），直接消费会静默 no-op。改用平台专属能力探针，读的是 enforcement 已用的同一套 permission sets，覆盖所有入口，且天然 fail-safe。 + + 矩阵门：`authz-matrix-gate.test.ts` 更新 `private_obj.org_admin` 格（read `null` → `{organization_id:'org-1'}`）并新增 `[Finding 1 …]`（8 格：成员重指异租户 → 拒、同租户 → 通过、不碰 org_id→ 放行、无活动组织 → 拒、org_admin 重指 → 拒、platform-admin private 对象 → 放行、public 对象 → 拒、单组织 → 不检查）与 `[Finding 2 …]`（5 格：org_admin private 对象读/写墙到本租户、真平台管理员仍豁免、org_admin public 对象回归、better-auth carve-out 不受影响）。授权一致性 ledger 更新 `multi-tenant-write-postimage`（覆盖 insert+update）并新增 `multi-tenant-exemption-posture`。关联 objectstack-ai/framework#2920。 + +### Minor Changes + +- 5febe3f: feat(plugin-security): A4 — managed_by tri-state unification + listView exposure (#2920) + + Unifies the record-level provenance vocabulary across the three RBAC catalogs + (`sys_capability`, `sys_permission_set`, `sys_position`) onto a single tri-state + — **platform / package / admin** — so an administrator reads one vocabulary for + "who owns this" everywhere. + + - **`sys_permission_set.managed_by`** and **`sys_position.managed_by`** converted + from free `text` to a constrained `select` matching `sys_capability` (options + `platform` / `package` / `admin`, `defaultValue: 'admin'`, `readonly`). + - **Writers re-stamped to canonical vocab:** built-in identity/anchor positions + now seed `managed_by: 'platform'` (was `'system'`); env/Studio-authored + permission sets project as `managed_by: 'admin'` (was `'user'`). Declared + package sets (`'package'`) and platform capabilities (`'platform'`) were + already canonical. + - **`sys_position` list views** (`active` / `default_positions` / `custom` / + `all_positions`) now surface the `managed_by` column, matching the capability + and permission-set views. + - **Back-compat, no destructive migration.** No runtime path branches on the + legacy values — every access decision keys on `'package'` / `'platform'` + (both unchanged) — so the rename never changes an authorization outcome. + Built-in positions and declared sets self-heal on their next bootstrap upsert; + a new idempotent `kernel:ready` reconciler (`normalizeManagedByVocab`) rewrites + the residual legacy values (`system`→`platform`, `config`→`package`, + `user`→`admin`) on existing `sys_position` / `sys_permission_set` rows. + - **i18n:** `managed_by` field + option labels (`platform` / `package` / `admin`) + added for `sys_capability` / `sys_permission_set` / `sys_position` across + en / zh-CN / ja-JP / es-ES. + + Pairs with objectui `feat(app-shell): A4 — provenance tri-state badge` + (framework#2920). + +- e62c233: feat(spec,plugin-security): package-level capability declaration API (ADR-0066 D1) + + Packages can now DEFINE their own authorization capabilities explicitly via the + new `defineCapability` factory and a stack's `capabilities` array, instead of + relying on the implicit "derive an untitled capability from whatever a permission + set references in `systemPermissions[]`" back-door. + + - `@objectstack/spec`: new `defineCapability` / `CapabilityDeclarationSchema` + (`{ name, label?, description?, scope, packageId? }`) and a `capabilities` + field on the stack definition. + - `@objectstack/plugin-security`: new `bootstrapDeclaredCapabilities` seeds + declared capabilities into `sys_capability` with `managed_by:'package'` + + `package_id` provenance (new `package_id` field on the object). Idempotent, + upgrade-aware; refuses to hijack curated platform capabilities or another + package's rows, never clobbers admin-authored rows, and CLAIMS a pre-existing + derived placeholder (upgrading it to package provenance). The implicit + derive-from-`systemPermissions` path still runs for back-compat but now skips + any explicitly-declared name so it can't clobber authored metadata. + - `@objectstack/runtime`: stack-declared `capabilities` are registered into the + metadata registry (type `capability`) so the boot seeder can read them. + - `@objectstack/lint`: `validateCapabilityReferences` treats + `stack.capabilities` names as a known capability source. + + A capability is not a contract: DEFINE it (`defineCapability`), GRANT it + (`systemPermissions`), REQUIRE it (`requiredPermissions`) — no `inputs`. + Aligns with ADR-0094 D5 (retire implicit `managed_by`-guessing back-doors). + +- a581a65: feat(plugin-security): C2-β — explain 引擎 record 粒度行级归因 (#2920) + + `explain(principal, object, operation, recordId?)` 现支持记录级解释。透传 `recordId` 时，引擎在对象级流水线之上叠加**行级归因**，全部复用 enforcement 同一批函数（explained-by-construction）： + + - **`tenant_isolation` Layer 0**：作为永远最先的层被 prepend；每层打上 `kernelTier`（`layer_0_tenant` vs `layer_1_business`），可区分「租户墙挡的」还是「业务 RLS 挡的」。 + - **每层 `record` 归因**（tenant / owd_baseline / sharing / rls）：`outcome`（admitted/excluded/not_evaluated）、有效 `rowFilter`、`matchesRecord`（用 `@objectstack/formula` 的 `matchesFilterCondition` 对同一条 FilterCondition 求值)、命中的 `rules[]`（tenant_filter/owd_baseline/ownership/record_share/sharing_rule/team/rls_policy，含 grants/via/effect）。 + - **顶层 `record` 判定**：`visible` + `decidedBy` 决定性层。读走复合行过滤匹配，写走 sharing service 的 `canEdit`（均为 enforcement 原语）。 + - **`principal.posture`**：ADR-0095 D2 档位（PLATFORM_ADMIN/TENANT_ADMIN/MEMBER/EXTERNAL）的 B2 stand-in 派生（复用 `resolveAuthzContext` 已投影的 platform_admin / org 角色证据），待 B2 合并后替换。 + - `computeRlsFilter` 重构为 `computeLayeredRlsFilter`（暴露 `{ layer0, layer1 }` 拆分）+ 薄 andCompose 包装，单一代码路径，行级归因不会与执行漂移。 + - REST `security.explain`（GET/POST）接受可选 `recordId`。 + + **向后兼容**:无 `recordId` 的对象级请求输出 **byte-identical**——无 `tenant_isolation` 层、无 `kernelTier`、无 `posture`、无 `record`。 + +### Patch Changes + +- ca2b2f6: fix(plugin-security): #2936 — RLS field-existence / tenancy-disabled safety nets now recognize canonical `==` + + `extractTargetField` (the lightweight left-hand-field parser feeding the Layer 1 + **field-existence** net and the **tenancy-disabled** skip net in + `computeLayeredRlsFilter`) only matched the legacy single-`=` / `IN` shape. It + returned `null` for canonical CEL `==` (`field == …`), which is how real seeds + and business policies author equality. A `null` target field means "keep the + policy", so both safety nets were **inert** for every `==` policy: a wildcard + policy targeting a column the object lacks was NOT failed closed, and a + `==`-form `organization_id` policy on a `tenancy.enabled:false` object was NOT + skipped. The regex now recognizes `==` (listed before `=` so the ordered + alternation does not mis-match the first `=`), alongside the existing `=`/`IN`. + Recognition is only **extended** — the net semantics are unchanged, and + `!=`/`>`/`<`/`>=`/`<=` still return `null` (conservative keep), matching prior + behavior for any unmatched shape. + + Behavior delta (fail-closed strengthening, same effective visibility): the + wildcard `owner_only_writes` / `owner_only_deletes` seed policies + (`created_by == current_user.id`) now correctly fail closed on an object that + lacks a `created_by` column (platform-global / system tables). Previously they + slipped the net and compiled to a phantom `{ created_by: … }` filter against a + missing column — a driver-dependent, effectively-deny result; now the net drops + the sole applicable write policy and yields the deny sentinel. A member could not + by-id write such a column-less object either way, so the visible/writable row set + is unchanged; only the mechanism is now an explicit fail-closed deny. All ordinary + tenant/business objects carry `created_by`, so they are unaffected (proven green by + the dogfood authz-conformance + RLS matrices). The tenancy-disabled skip net has no + effect on any current seed (no `==` seed policy targets `organization_id` on a + tenancy-disabled object). The tenant wall itself is Layer 0 (`tenant-layer.ts`), + which never used this parser, so tenant isolation is unaffected (ADR-0095 D1). + +- 698454e: Security fix: constrain self-delegation (D3) position anchor to prevent lateral + visibility escalation (cloud#830 follow-up). + + cloud#830 (C1 position-anchor) made `sys_user_position.business_unit_id` + visibility **load-bearing** — it is the readScope depth anchor, so a + `unit`/`unit_and_below` holder sees the owner set rooted at that BU (and, for + `unit_and_below`, its whole subtree). The delegated-admin gate's self-service + delegation path (`assertSelfDelegation`) stamped this anchor with **no + subtree/source constraint**: a holder of a delegatable, non-admin-scope position + anchored at a LOW business unit could delegate it to a co-conspirator with an + **ancestor / arbitrary-high** anchor, leaking that BU's whole subtree of member + records — visibility beyond the delegator's own range. Mutual delegation could + grant it both ways. + + The gate now requires a self-delegated `business_unit_id` to fall inside the + delegator's **own effective anchor** for that position (the subtree of their own + direct holding's anchor, or of their member BU when the holding is unanchored) — + the same "assignments must target your subtree" spirit as the D12 + delegated-admin boundary. Fail-closed: an anchor that cannot be proven inside the + delegator's range is rejected. Unanchored delegation rows keep prior behavior + (the delegate resolves to their own member BU — not a widening). The + "anchoring only narrows, never widens" invariant now holds on the D3 path too. + +- 29a4c90: fix(plugin-security): explain posture 证据对齐 enforcement 派生（消除标签漂移） + + Security review 低危项。explain-engine 的 `derivePosture(context)` 之前用**松名字匹配**作 + posture 证据——`permissions.includes(ADMIN_FULL_ACCESS)`（不校验非作用域）+ `positions.includes( +'org_owner'/'org_admin')`（读 better-auth 角色），比 enforcement（`resolve-authz-context.ts` 的 + `hasPlatformAdminGrant`：要求**非作用域 admin_full_access user grant**；TENANT_ADMIN 用 + `organization_admin` **能力**而非角色）更松，可能让 explain 面板给运维显示**偏高**的 posture 标签 + （作用域 org-admin grant 被误标 PLATFORM/TENANT_ADMIN）。 + + 修法——让 explain 的 posture 走 enforcement 已用的同一份证据： + + - **优先直接消费 `ctx.posture`**：principal 经完整 `resolveAuthzContext` 时已带 enforcement 派生的 + rung，逐字返回 → 结构上不可能漂移。 + - **回退（explain 用 `buildContextForUser` 自建 context，不经完整 resolveAuthzContext）**：复制 + enforcement 的非作用域 grant 判定——`buildContextForUser` 现按与 `hasPlatformAdminGrant` 逐字节 + 一致的规则（`admin_full_access` 且 `organization_id == null` 的 active user grant）计算并挂出 + `hasPlatformAdminGrant`；`derivePosture` 以此 + 投影出的 `platform_admin` 内建岗位判 PLATFORM_ADMIN， + 以 `organization_admin` **能力**判 TENANT_ADMIN，**不再**读 `org_owner`/`org_admin` 角色岗位 + （ADR-0095 D3：角色只是 provisioning 来源，非裁决输入 — explain 侧同样闭合 #2836 dual-track）。 + - 保留 explain 特有的 **guest → EXTERNAL** 底（enforcement floor 是 MEMBER），且置于最前。 + + 只改 explain 的 **posture 标签**证据，不改 explain 的 allow/deny verdict（来自复用的 enforcement + filter），不改 enforcement。#2947 跟踪的「posture 未 plumb 进 enforcement context」更广缺口不在本 + 任务范围。关联 #2920。 + +- 5774a75: 内置行写护栏：`sys_position` / `sys_capability` 的平台/应用托管行不再可被客户管理员删改。 + + `sys_permission_set` 早有两道门写护栏（`assertPackageManagedWriteGate`）拦截对 package 托管行的写入，但 `sys_position` / `sys_capability` 缺失对应保护——平台/应用发布的系统岗位与能力（provenance 记录在 `managed_by`）可被管理员直接 delete / update 直达驱动，静默破坏应用的授权基线（ADR-0049：provenance 字段存在却无强制 = 正是要补的 enforcement gap）。 + + 新增 **`assertSystemRowWriteGate`**（`packages/plugins/plugin-security/src/security-plugin.ts`，data-write hook 接线与 package 门同处），对这两个对象的托管行施加一道无条件的数据层边界： + + - **禁止伪造托管来源**：管理员门的 insert / update 载荷（单对象或数组）不得把 `managed_by` 盖成平台/应用值——只有携带 `isSystem` 的平台 seeder / 包发布路径可写；同时封堵 update-to-forge（把自建行改 badge 成托管行）。 + - **拒绝改删托管行**：对 `managed_by` 已是平台/应用值的行，`delete` / `update` / `transfer` / `restore` / `purge` 一律拒绝。与 `sys_permission_set` 不同，这两个对象没有 ADR-0094 overlay write-through，故写护栏必须在此层直接拒绝，而非下放给下游翻译。 + - **管理员自建行不受限**：`managed_by` 为 `user`/∅（sys_position）或 `admin`（sys_capability）的行完全归管理员所有（含委派管理员在自己 subtree 内的自建行）。 + + 护栏 fail-closed 且不依赖调用方授权——持 `modifyAllRecords` 的超管也无法删除平台岗位。两对象的 `managed_by` 词表不同（sys_position：`system`/`config` 托管，`user`/∅ 自建；sys_capability：`platform`/`package` 托管，`admin` 自建），网关按对象分别判定。错误信息仅含业务文案（"此岗位/能力由 平台|应用包 提供，不可删除/修改"）。 + + 与 delegated-admin 边界不冲突：`GOVERNED_OBJECTS` 本就不含这两个对象，委派管理仍治理 RBAC 链接表而非定义对象。 + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/formula@15.0.0 + ## 14.8.0 ### Minor Changes diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json index d18e03d85f..2eab2010dd 100644 --- a/packages/plugins/plugin-security/package.json +++ b/packages/plugins/plugin-security/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-security", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime", "main": "dist/index.js", diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md index bdcfa792dc..052a8cfa84 100644 --- a/packages/plugins/plugin-sharing/CHANGELOG.md +++ b/packages/plugins/plugin-sharing/CHANGELOG.md @@ -1,5 +1,21 @@ # @objectstack/plugin-sharing +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/formula@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json index 60b087870e..25a5a4efcc 100644 --- a/packages/plugins/plugin-sharing/package.json +++ b/packages/plugins/plugin-sharing/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-sharing", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.", "main": "dist/index.js", diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md index 890e0c9311..7543025bbc 100644 --- a/packages/plugins/plugin-webhooks/CHANGELOG.md +++ b/packages/plugins/plugin-webhooks/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/plugin-webhooks +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/service-messaging@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json index b405e93c4b..d8f6d97399 100644 --- a/packages/plugins/plugin-webhooks/package.json +++ b/packages/plugins/plugin-webhooks/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/plugin-webhooks", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.", "type": "module", diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md index fa41801e00..78d5f41004 100644 --- a/packages/rest/CHANGELOG.md +++ b/packages/rest/CHANGELOG.md @@ -1,5 +1,45 @@ # @objectstack/rest +## 15.0.0 + +### Patch Changes + +- a581a65: feat(plugin-security): C2-β — explain 引擎 record 粒度行级归因 (#2920) + + `explain(principal, object, operation, recordId?)` 现支持记录级解释。透传 `recordId` 时，引擎在对象级流水线之上叠加**行级归因**，全部复用 enforcement 同一批函数（explained-by-construction）： + + - **`tenant_isolation` Layer 0**：作为永远最先的层被 prepend；每层打上 `kernelTier`（`layer_0_tenant` vs `layer_1_business`），可区分「租户墙挡的」还是「业务 RLS 挡的」。 + - **每层 `record` 归因**（tenant / owd_baseline / sharing / rls）：`outcome`（admitted/excluded/not_evaluated）、有效 `rowFilter`、`matchesRecord`（用 `@objectstack/formula` 的 `matchesFilterCondition` 对同一条 FilterCondition 求值)、命中的 `rules[]`（tenant_filter/owd_baseline/ownership/record_share/sharing_rule/team/rls_policy，含 grants/via/effect）。 + - **顶层 `record` 判定**：`visible` + `decidedBy` 决定性层。读走复合行过滤匹配，写走 sharing service 的 `canEdit`（均为 enforcement 原语）。 + - **`principal.posture`**：ADR-0095 D2 档位（PLATFORM_ADMIN/TENANT_ADMIN/MEMBER/EXTERNAL）的 B2 stand-in 派生（复用 `resolveAuthzContext` 已投影的 platform_admin / org 角色证据），待 B2 合并后替换。 + - `computeRlsFilter` 重构为 `computeLayeredRlsFilter`（暴露 `{ layer0, layer1 }` 拆分）+ 薄 andCompose 包装，单一代码路径，行级归因不会与执行漂移。 + - REST `security.explain`（GET/POST）接受可选 `recordId`。 + + **向后兼容**:无 `recordId` 的对象级请求输出 **byte-identical**——无 `tenant_isolation` 层、无 `kernelTier`、无 `posture`、无 `record`。 + +- 31d04d4: Fix the data-import automation chain (#2922). Batch `engine.insert` now fires + `beforeInsert`/`afterInsert` once **per row** with single-record hook contexts, + so flat-input proxies, declarative hook conditions, audit writers, and + record-change triggers see real records instead of arrays. A new + `ExecutionContext.skipAutomations` flag (mirrored into `HookContext.session`) + lets callers suppress metadata-bound automation hooks and flow dispatch while + code-registered system hooks (audit, security, sharing) still run — making the + import wizard's "run automations & triggers" checkbox and import undo actually + effective. The REST import default flips to running automations unless the + request explicitly opts out (`runAutomations: false`), matching historical + behavior. +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/service-package@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/rest/package.json b/packages/rest/package.json index b398052a1e..2ab32122bf 100644 --- a/packages/rest/package.json +++ b/packages/rest/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/rest", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol", "type": "module", diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md index 8c28d441d4..d1eb1ba126 100644 --- a/packages/runtime/CHANGELOG.md +++ b/packages/runtime/CHANGELOG.md @@ -1,5 +1,69 @@ # @objectstack/runtime +## 15.0.0 + +### Minor Changes + +- e62c233: feat(spec,plugin-security): package-level capability declaration API (ADR-0066 D1) + + Packages can now DEFINE their own authorization capabilities explicitly via the + new `defineCapability` factory and a stack's `capabilities` array, instead of + relying on the implicit "derive an untitled capability from whatever a permission + set references in `systemPermissions[]`" back-door. + + - `@objectstack/spec`: new `defineCapability` / `CapabilityDeclarationSchema` + (`{ name, label?, description?, scope, packageId? }`) and a `capabilities` + field on the stack definition. + - `@objectstack/plugin-security`: new `bootstrapDeclaredCapabilities` seeds + declared capabilities into `sys_capability` with `managed_by:'package'` + + `package_id` provenance (new `package_id` field on the object). Idempotent, + upgrade-aware; refuses to hijack curated platform capabilities or another + package's rows, never clobbers admin-authored rows, and CLAIMS a pre-existing + derived placeholder (upgrading it to package provenance). The implicit + derive-from-`systemPermissions` path still runs for back-compat but now skips + any explicitly-declared name so it can't clobber authored metadata. + - `@objectstack/runtime`: stack-declared `capabilities` are registered into the + metadata registry (type `capability`) so the boot seeder can read them. + - `@objectstack/lint`: `validateCapabilityReferences` treats + `stack.capabilities` names as a known capability source. + + A capability is not a contract: DEFINE it (`defineCapability`), GRANT it + (`systemPermissions`), REQUIRE it (`requiredPermissions`) — no `inputs`. + Aligns with ADR-0094 D5 (retire implicit `managed_by`-guessing back-doors). + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [0fcef9b] +- Updated dependencies [13749ec] +- Updated dependencies [ca2b2f6] +- Updated dependencies [2ae78c6] +- Updated dependencies [5febe3f] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [698454e] +- Updated dependencies [29a4c90] +- Updated dependencies [ef70521] +- Updated dependencies [a581a65] +- Updated dependencies [31d04d4] +- Updated dependencies [5774a75] + - @objectstack/spec@15.0.0 + - @objectstack/plugin-security@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/rest@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/metadata@15.0.0 + - @objectstack/plugin-auth@15.0.0 + - @objectstack/formula@15.0.0 + - @objectstack/observability@15.0.0 + - @objectstack/driver-memory@15.0.0 + - @objectstack/driver-sql@15.0.0 + - @objectstack/driver-sqlite-wasm@15.0.0 + - @objectstack/service-cluster@15.0.0 + - @objectstack/service-datasource@15.0.0 + - @objectstack/service-i18n@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/runtime/package.json b/packages/runtime/package.json index f08cc44091..db3f0cb35e 100644 --- a/packages/runtime/package.json +++ b/packages/runtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/runtime", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack Core Runtime & Query Engine", "type": "module", diff --git a/packages/sdui-parser/CHANGELOG.md b/packages/sdui-parser/CHANGELOG.md index 1b88e69753..9bd1e1af9d 100644 --- a/packages/sdui-parser/CHANGELOG.md +++ b/packages/sdui-parser/CHANGELOG.md @@ -1,5 +1,7 @@ # @objectstack/sdui-parser +## 15.0.0 + ## 14.8.0 ## 14.7.0 diff --git a/packages/sdui-parser/package.json b/packages/sdui-parser/package.json index ee0301fbf9..a0e33bd20d 100644 --- a/packages/sdui-parser/package.json +++ b/packages/sdui-parser/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/sdui-parser", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "ObjectStack constrained JSX-source → SDUI SchemaNode tree compiler (parse, never execute). Isomorphic, zero React. ADR-0080.", "main": "dist/index.js", diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md index 33a4c94390..6566b4457c 100644 --- a/packages/services/service-analytics/CHANGELOG.md +++ b/packages/services/service-analytics/CHANGELOG.md @@ -1,5 +1,17 @@ # Changelog — @objectstack/service-analytics +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json index b397f85e3b..e0701d523c 100644 --- a/packages/services/service-analytics/package.json +++ b/packages/services/service-analytics/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-analytics", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)", "type": "module", diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md index a5bf8a6ea9..b8af1dcecf 100644 --- a/packages/services/service-automation/CHANGELOG.md +++ b/packages/services/service-automation/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-automation +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/formula@15.0.0 + ## 14.8.0 ### Minor Changes diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json index 8783d8ec16..5aa4204b2d 100644 --- a/packages/services/service-automation/package.json +++ b/packages/services/service-automation/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-automation", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine", "type": "module", diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md index c4ddfecbe6..5c86d49afb 100644 --- a/packages/services/service-cache/CHANGELOG.md +++ b/packages/services/service-cache/CHANGELOG.md @@ -1,5 +1,18 @@ # @objectstack/service-cache +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/observability@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json index 31495c9bd8..485ee2aa35 100644 --- a/packages/services/service-cache/package.json +++ b/packages/services/service-cache/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cache", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters", "type": "module", diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md index 22f79a916c..08ba401d48 100644 --- a/packages/services/service-cluster-redis/CHANGELOG.md +++ b/packages/services/service-cluster-redis/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-cluster-redis +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/service-cluster@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json index b43d010588..080f906152 100644 --- a/packages/services/service-cluster-redis/package.json +++ b/packages/services/service-cluster-redis/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster-redis", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.", "type": "module", diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md index 36ddd86f7b..3a950e5275 100644 --- a/packages/services/service-cluster/CHANGELOG.md +++ b/packages/services/service-cluster/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-cluster +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json index 455b82d2aa..06ab31c720 100644 --- a/packages/services/service-cluster/package.json +++ b/packages/services/service-cluster/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-cluster", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.", "type": "module", diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md index 24b6708a6c..a31642e2f8 100644 --- a/packages/services/service-datasource/CHANGELOG.md +++ b/packages/services/service-datasource/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-external-datasource +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json index 41be79fb72..213f980cf1 100644 --- a/packages/services/service-datasource/package.json +++ b/packages/services/service-datasource/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-datasource", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.", "type": "module", diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md index 366829661f..90d5acecbc 100644 --- a/packages/services/service-i18n/CHANGELOG.md +++ b/packages/services/service-i18n/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-i18n +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json index d36608b753..4c85abce1d 100644 --- a/packages/services/service-i18n/package.json +++ b/packages/services/service-i18n/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-i18n", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading", "type": "module", diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md index 9e2a9cdc7f..e32baeef33 100644 --- a/packages/services/service-job/CHANGELOG.md +++ b/packages/services/service-job/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-job +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json index d9e645c9c4..9f9b1aca26 100644 --- a/packages/services/service-job/package.json +++ b/packages/services/service-job/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-job", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling", "type": "module", diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md index 5694a70fbc..e562f7742d 100644 --- a/packages/services/service-knowledge/CHANGELOG.md +++ b/packages/services/service-knowledge/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-knowledge +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json index c8cd75de88..7b5bd294b9 100644 --- a/packages/services/service-knowledge/package.json +++ b/packages/services/service-knowledge/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-knowledge", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).", "type": "module", diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md index 97071aaaf9..b735ad4521 100644 --- a/packages/services/service-messaging/CHANGELOG.md +++ b/packages/services/service-messaging/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-messaging +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Minor Changes diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json index bbaf5ab041..43098a16f8 100644 --- a/packages/services/service-messaging/package.json +++ b/packages/services/service-messaging/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-messaging", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.", "type": "module", diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md index 88b2f7402c..14b0cd99c5 100644 --- a/packages/services/service-package/CHANGELOG.md +++ b/packages/services/service-package/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-package +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json index fda07d8ff8..ff1574aabb 100644 --- a/packages/services/service-package/package.json +++ b/packages/services/service-package/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-package", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Package management service for ObjectStack — publish, install, and manage packages", "type": "module", diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md index d8111fafbe..9a6e547927 100644 --- a/packages/services/service-queue/CHANGELOG.md +++ b/packages/services/service-queue/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-queue +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json index c12bd47421..96137b5a15 100644 --- a/packages/services/service-queue/package.json +++ b/packages/services/service-queue/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-queue", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters", "type": "module", diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md index bccf378929..12b9e95f31 100644 --- a/packages/services/service-realtime/CHANGELOG.md +++ b/packages/services/service-realtime/CHANGELOG.md @@ -1,5 +1,19 @@ # @objectstack/service-realtime +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json index 43e3a6d627..1c4d883f8c 100644 --- a/packages/services/service-realtime/package.json +++ b/packages/services/service-realtime/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-realtime", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub", "type": "module", diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md index ec1209bdf2..194dfe1b90 100644 --- a/packages/services/service-settings/CHANGELOG.md +++ b/packages/services/service-settings/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-settings +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/types@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json index 7929a6ab8b..9efe4a18b7 100644 --- a/packages/services/service-settings/package.json +++ b/packages/services/service-settings/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-settings", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.", "type": "module", diff --git a/packages/services/service-sms/CHANGELOG.md b/packages/services/service-sms/CHANGELOG.md index 9724e8da74..e7b800a53e 100644 --- a/packages/services/service-sms/CHANGELOG.md +++ b/packages/services/service-sms/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/service-sms +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-sms/package.json b/packages/services/service-sms/package.json index 38952cfc09..c8b328c8a7 100644 --- a/packages/services/service-sms/package.json +++ b/packages/services/service-sms/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-sms", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "SMS service for ObjectStack — ISmsService + transport-pluggable outbound delivery (Aliyun / Twilio / log).", "main": "dist/index.js", diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md index d611e355b2..cc26156a06 100644 --- a/packages/services/service-storage/CHANGELOG.md +++ b/packages/services/service-storage/CHANGELOG.md @@ -1,5 +1,20 @@ # @objectstack/service-storage +## 15.0.0 + +### Patch Changes + +- Updated dependencies [02a014b] +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/platform-objects@15.0.0 + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/observability@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json index 3257e21a60..29f3970ac3 100644 --- a/packages/services/service-storage/package.json +++ b/packages/services/service-storage/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/service-storage", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton", "type": "module", diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md index 220d794b4b..14ca950030 100644 --- a/packages/spec/CHANGELOG.md +++ b/packages/spec/CHANGELOG.md @@ -1,5 +1,130 @@ # @objectstack/spec +## 15.0.0 + +### Major Changes + +- 28b7c28: ADR-0089 D3a: flip `.strict()` on the view form + page component schemas so a mis-layered or stale conditional-visibility key is a **loud parse error** instead of a silent strip. + + `FormFieldSchema`, `FormSectionSchema` (`view.zod.ts`) and `PageComponentSchema` (`page.zod.ts`) now reject unknown keys. Previously zod's default strip mode discarded any key these schemas did not declare — including a `visibleWhen` typo, a page-only `visibility` pasted onto a view field (or vice-versa), or a key surviving past its deprecation window — with no diagnostic, shipping inert metadata (ADR-0049 enforce-or-remove, ADR-0078 no-silently-inert). + + - **Breaking:** metadata carrying a key not declared by these three schemas now fails validation at parse. A monorepo + examples sweep found a single offender (a test fixture using `id`/`title` on a form section instead of the canonical `name`/`label`); all first-party apps and platform metadata parse clean. + - The deprecated `visibleOn` (view form) / `visibility` (page component) aliases are **declared** keys, so they keep parsing and normalizing to `visibleWhen` — unchanged. + - Rejection messages name the offending key(s) and, when a key looks like the visibility predicate, point the author at the canonical `visibleWhen` (new `strictVisibilityError` zod error map, exported from `shared/visibility`). + +### Minor Changes + +- 13749ec: ADR-0095 D2/D3: the authorization kernel now resolves an explicit **posture + ladder** — a monotonic principal tier `PLATFORM_ADMIN > TENANT_ADMIN > MEMBER > +EXTERNAL` — once, in `resolveAuthzContext`, and carries it on + `ResolvedAuthzContext.posture`. + + - **D2 — the ladder.** New `@objectstack/core/security` module `posture-ladder.ts` + reuses the spec `AuthzPosture` enum and pins the rung → row-visibility + injection-rule mapping (exactly one rule per rung) plus its two ADR-required + invariants as unit-tested properties: strict nesting (rung _n_'s visible set ⊇ + rung _n−1_'s) and the `EXTERNAL` deny-by-default semantics (explicitly shared + rows only — OWD baselines and sharing rules never widen it). `EXTERNAL` is + defined and test-locked now but never resolved: no external principal type + exists yet (portal/ADR-0093), so the resolver's floor is `MEMBER`. + - **D3 — capability-derived, single track.** The rung derives from held + **capability grants**, never a better-auth role: `PLATFORM_ADMIN` from the + unscoped `admin_full_access` grant (the same `viewAllRecords`/`modifyAllRecords` + evidence the superuser bypass trusts), `TENANT_ADMIN` from the + `organization_admin` grant. The better-auth `role='admin'` remains only a + _provisioning source_ of those grants (`auto-org-admin-grant.ts`, + `mapMembershipRole`); no enforcement path reads the raw role, closing the + #2836 dual-track adjudication class by construction. + - New spec export `ORGANIZATION_ADMIN` (the org-admin capability-grant name), + alongside the existing `ADMIN_FULL_ACCESS`. + + **Behavior-preserving.** Enforcement is unchanged — the per-object Layer 0 + exemption and per-side superuser bypass still gate access exactly as before; + `posture` is an additive, derived, explainable field. The `authz-matrix-gate` + unit snapshot and the dogfood authz-conformance matrix stay green. No migration + required. + +- e62c233: feat(spec,plugin-security): package-level capability declaration API (ADR-0066 D1) + + Packages can now DEFINE their own authorization capabilities explicitly via the + new `defineCapability` factory and a stack's `capabilities` array, instead of + relying on the implicit "derive an untitled capability from whatever a permission + set references in `systemPermissions[]`" back-door. + + - `@objectstack/spec`: new `defineCapability` / `CapabilityDeclarationSchema` + (`{ name, label?, description?, scope, packageId? }`) and a `capabilities` + field on the stack definition. + - `@objectstack/plugin-security`: new `bootstrapDeclaredCapabilities` seeds + declared capabilities into `sys_capability` with `managed_by:'package'` + + `package_id` provenance (new `package_id` field on the object). Idempotent, + upgrade-aware; refuses to hijack curated platform capabilities or another + package's rows, never clobbers admin-authored rows, and CLAIMS a pre-existing + derived placeholder (upgrading it to package provenance). The implicit + derive-from-`systemPermissions` path still runs for back-compat but now skips + any explicitly-declared name so it can't clobber authored metadata. + - `@objectstack/runtime`: stack-declared `capabilities` are registered into the + metadata registry (type `capability`) so the boot seeder can read them. + - `@objectstack/lint`: `validateCapabilityReferences` treats + `stack.capabilities` names as a known capability source. + + A capability is not a contract: DEFINE it (`defineCapability`), GRANT it + (`systemPermissions`), REQUIRE it (`requiredPermissions`) — no `inputs`. + Aligns with ADR-0094 D5 (retire implicit `managed_by`-guessing back-doors). + +- ed61c9b: feat(spec): C2-α — extend the `explain` contract to record granularity (#2920) + + The access-explanation contract (ADR-0090 D6) now carries the schema for + record-level authorization explanations, so the β-phase engine + (`plugin-security` + `plugin-sharing`) and the Studio/Setup "view as" UI can be + built against a stable wire shape. Contract-only: no engine or UI changes ship + here. + + Request side: + + - `ExplainRequest.recordId` (optional) — explain one concrete record at row + granularity. Omitted = the pre-C2 object-level question, answered identically + (backward compatible). + + Response side (row-level attribution, present only for record-grained requests): + + - New `ExplainMatchedRule` — a concrete share / sharing rule / ownership fact / + team / territory / RLS policy / Layer 0 tenant filter that admitted or + excluded the record at a layer, with its access level (`grants`), how it + reached the principal (`via`), the row predicate (`predicate`), and its + `effect` on the record. + - New `ExplainRecordAttribution` — a layer's per-record determination + (`outcome`, effective `rowFilter`, `matchesRecord`, matched `rules`), attached + as the optional `ExplainLayer.record`. + - New top-level `ExplainDecision.record` — the row-level bottom line + (`recordId`, `visible`, `decidedBy`). + + Reserved for the ADR-0095 kernel chain (β fills these; optional, backward + compatible): + + - New `tenant_isolation` layer id (Layer 0, the always-first tenant wall). + - New `ExplainLayer.kernelTier` (`layer_0_tenant` | `layer_1_business`) so a + consumer can tell the tenant wall from business RLS without hard-coding ids. + - New `AuthzPosture` enum (`PLATFORM_ADMIN` > `TENANT_ADMIN` > `MEMBER` > + `EXTERNAL`) exposed as the optional `ExplainDecision.principal.posture`. + + Backward compatibility: every new field is optional or additive; existing + object-level requests and reports parse unchanged. The contract test locks the + new field shapes alongside the existing ones. + +### Patch Changes + +- 31d04d4: Fix the data-import automation chain (#2922). Batch `engine.insert` now fires + `beforeInsert`/`afterInsert` once **per row** with single-record hook contexts, + so flat-input proxies, declarative hook conditions, audit writers, and + record-change triggers see real records instead of arrays. A new + `ExecutionContext.skipAutomations` flag (mirrored into `HookContext.session`) + lets callers suppress metadata-bound automation hooks and flow dispatch while + code-registered system hooks (audit, security, sharing) still run — making the + import wizard's "run automations & triggers" checkbox and import undo actually + effective. The REST import default flips to running automations unless the + request explicitly opts out (`runAutomations: false`), matching historical + behavior. + ## 14.8.0 ### Minor Changes diff --git a/packages/spec/package.json b/packages/spec/package.json index f714ef9638..0ee00f6022 100644 --- a/packages/spec/package.json +++ b/packages/spec/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/spec", - "version": "14.8.0", + "version": "15.0.0", "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations", "license": "Apache-2.0", "main": "dist/index.js", diff --git a/packages/spec/src/kernel/protocol-version.ts b/packages/spec/src/kernel/protocol-version.ts index f545bbbe05..3fe27d7b8d 100644 --- a/packages/spec/src/kernel/protocol-version.ts +++ b/packages/spec/src/kernel/protocol-version.ts @@ -15,7 +15,7 @@ * Kept in lockstep with the package's own major; `protocol-version.test.ts` * asserts it against `package.json` so the two cannot drift. */ -export const PROTOCOL_VERSION = '14.0.0'; +export const PROTOCOL_VERSION = '15.0.0'; /** The protocol major as an integer — the value the handshake compares. */ export const PROTOCOL_MAJOR: number = Number.parseInt(PROTOCOL_VERSION.split('.')[0]!, 10); diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md index 7af4ce6e1d..2596bcf679 100644 --- a/packages/triggers/trigger-api/CHANGELOG.md +++ b/packages/triggers/trigger-api/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/trigger-api +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json index 88e43942f4..e0a99eca06 100644 --- a/packages/triggers/trigger-api/package.json +++ b/packages/triggers/trigger-api/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-api", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md index fdfd8a6d0e..d0fbef0c2e 100644 --- a/packages/triggers/trigger-record-change/CHANGELOG.md +++ b/packages/triggers/trigger-record-change/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/plugin-trigger-record-change +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json index 7adae19943..7dd174f8c4 100644 --- a/packages/triggers/trigger-record-change/package.json +++ b/packages/triggers/trigger-record-change/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-record-change", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)", "main": "dist/index.js", diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md index 63a279a516..63c8d37bf2 100644 --- a/packages/triggers/trigger-schedule/CHANGELOG.md +++ b/packages/triggers/trigger-schedule/CHANGELOG.md @@ -1,5 +1,17 @@ # @objectstack/plugin-trigger-schedule +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + - @objectstack/core@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json index caf7290381..d0948772f9 100644 --- a/packages/triggers/trigger-schedule/package.json +++ b/packages/triggers/trigger-schedule/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/trigger-schedule", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)", "main": "dist/index.js", diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md index 692aff1151..73165fd319 100644 --- a/packages/types/CHANGELOG.md +++ b/packages/types/CHANGELOG.md @@ -1,5 +1,16 @@ # @objectstack/types +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [13749ec] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [31d04d4] + - @objectstack/spec@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/types/package.json b/packages/types/package.json index 4dba3dc322..1cd2887015 100644 --- a/packages/types/package.json +++ b/packages/types/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/types", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Shared interfaces describing the ObjectStack Runtime environment", "main": "dist/index.js", diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md index 13a4b9e4c0..4a313d9927 100644 --- a/packages/verify/CHANGELOG.md +++ b/packages/verify/CHANGELOG.md @@ -1,5 +1,38 @@ # @objectstack/verify +## 15.0.0 + +### Patch Changes + +- Updated dependencies [28b7c28] +- Updated dependencies [0fcef9b] +- Updated dependencies [13749ec] +- Updated dependencies [ca2b2f6] +- Updated dependencies [2ae78c6] +- Updated dependencies [5febe3f] +- Updated dependencies [e62c233] +- Updated dependencies [ed61c9b] +- Updated dependencies [698454e] +- Updated dependencies [29a4c90] +- Updated dependencies [ef70521] +- Updated dependencies [a581a65] +- Updated dependencies [31d04d4] +- Updated dependencies [5774a75] + - @objectstack/spec@15.0.0 + - @objectstack/plugin-security@15.0.0 + - @objectstack/core@15.0.0 + - @objectstack/runtime@15.0.0 + - @objectstack/rest@15.0.0 + - @objectstack/objectql@15.0.0 + - @objectstack/plugin-auth@15.0.0 + - @objectstack/plugin-sharing@15.0.0 + - @objectstack/service-settings@15.0.0 + - @objectstack/driver-sqlite-wasm@15.0.0 + - @objectstack/plugin-hono-server@15.0.0 + - @objectstack/service-analytics@15.0.0 + - @objectstack/service-automation@15.0.0 + - @objectstack/service-datasource@15.0.0 + ## 14.8.0 ### Patch Changes diff --git a/packages/verify/package.json b/packages/verify/package.json index 36c92ffa12..740ceb8e52 100644 --- a/packages/verify/package.json +++ b/packages/verify/package.json @@ -1,6 +1,6 @@ { "name": "@objectstack/verify", - "version": "14.8.0", + "version": "15.0.0", "license": "Apache-2.0", "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.", "type": "module", diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md index a13e4e265f..e9dd8c50ba 100644 --- a/packages/vscode-objectstack/CHANGELOG.md +++ b/packages/vscode-objectstack/CHANGELOG.md @@ -1,5 +1,7 @@ # objectstack-vscode +## 15.0.0 + ## 14.8.0 ## 14.7.0 diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json index 2d78b5ff7f..4824266da7 100644 --- a/packages/vscode-objectstack/package.json +++ b/packages/vscode-objectstack/package.json @@ -2,7 +2,7 @@ "name": "objectstack-vscode", "displayName": "ObjectStack", "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files", - "version": "14.8.0", + "version": "15.0.0", "publisher": "objectstack", "license": "Apache-2.0", "repository": {