Skip to content

chore(deps): bump the objectstack group with 11 updates - #95

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/objectstack-e3d21e480d
Open

chore(deps): bump the objectstack group with 11 updates#95
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/objectstack-e3d21e480d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown

Bumps the objectstack group with 11 updates:

Package From To
@objectstack/account 15.1.1 16.1.0
@objectstack/cli 15.1.1 16.1.0
@objectstack/driver-sqlite-wasm 15.1.1 16.1.0
@objectstack/runtime 15.1.1 16.1.0
@objectstack/driver-memory 15.1.1 16.1.0
@objectstack/driver-sql 15.1.1 16.1.0
@objectstack/metadata 15.1.1 16.1.0
@objectstack/objectql 15.1.1 16.1.0
@objectstack/service-analytics 15.1.1 16.1.0
@objectstack/service-automation 15.1.1 16.1.0
@objectstack/spec 15.1.1 16.1.0

Updates @objectstack/account from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/account's releases.

@​objectstack/account@​16.1.0

Patch Changes

  • Updated dependencies [212b66a]
  • Updated dependencies [d10c4dc]
  • Updated dependencies [9e45b63]
    • @​objectstack/platform-objects@​16.1.0
    • @​objectstack/spec@​16.1.0
Changelog

Sourced from @​objectstack/account's changelog.

16.1.0

Patch Changes

  • Updated dependencies [212b66a]
  • Updated dependencies [d10c4dc]
  • Updated dependencies [9e45b63]
    • @​objectstack/platform-objects@​16.1.0
    • @​objectstack/spec@​16.1.0

16.0.0

Patch Changes

  • Updated dependencies [f972574]
  • Updated dependencies [6289ec3]
  • Updated dependencies [22013aa]
  • Updated dependencies [3ad3dd5]
  • Updated dependencies [8efa395]
  • Updated dependencies [3a18b60]
  • Updated dependencies [a8aa34c]
  • Updated dependencies [a3823b2]
  • Updated dependencies [bc65105]
  • Updated dependencies [43a3efb]
  • Updated dependencies [524696a]
  • Updated dependencies [bfa3c3f]
  • Updated dependencies [5e3301d]
  • Updated dependencies [46e876c]
  • Updated dependencies [158aa14]
  • Updated dependencies [62a2117]
  • Updated dependencies [d2723e2]
  • Updated dependencies [fefcd54]
  • Updated dependencies [beaf2de]
  • Updated dependencies [369eb6e]
  • Updated dependencies [06ff734]
  • Updated dependencies [b659111]
  • Updated dependencies [5754a23]
  • Updated dependencies [6c270a6]
  • Updated dependencies [668dd17]
  • Updated dependencies [8abf133]
  • Updated dependencies [e0859b1]
  • Updated dependencies [04ecd4e]
  • Updated dependencies [4d5a892]
  • Updated dependencies [16cebeb]
  • Updated dependencies [86d30af]
  • Updated dependencies [8923843]
  • Updated dependencies [a2795f6]
  • Updated dependencies [f16b492]
  • Updated dependencies [4b6fde8]
  • Updated dependencies [2018df9]

... (truncated)

Commits

Updates @objectstack/cli from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/cli's releases.

@​objectstack/client-react@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/client@​16.1.0

@​objectstack/cli@​16.1.0

Minor Changes

  • 9e45b63: feat(cli): preflight that every requires capability has an installable provider in the current edition (#3366)

    A capability listed in requires: [...] was only checked at serve/start time, and a missing provider produced a generic "not installed — add it to your dependencies" error even when the provider has no installable version in the current edition. os validate (token-vocabulary only) and os build (never resolved providers) both passed, so a validate && build && test CI script never caught it — it surfaced only as an opaque boot crash. Seen upgrading an open-edition app from 14.7 to 16 after @objectstack/service-ai went cloud-only (ADR-0025).

    • @objectstack/spec/kernel now exports PLATFORM_CAPABILITY_PROVIDERS (token → provider package + edition) and a pure classifyRequiredCapability() — one machine-readable source of truth for the provider/edition knowledge the serve resolver previously encoded informally.
    • os build and os validate gained a provider preflight. A requires entry whose provider has no installable version in the active edition (e.g. ai → @objectstack/service-ai, cloud-only) now fails fast with an edition-aware message; an absent-but-installable provider is an advisory pnpm add hint, not a hard error; a satisfied requires list passes unchanged.
    • The os serve boot error now renders the same classification, so preflight and boot read identically.

  • db160dd: Flag dead action/route references in dashboard header & widget actions (ADR-0049 for references, #3367).

    os validate / os build now run a new validateDashboardActionRefs gate over every dashboard header.actions[] and widget actionUrl:

    • actionType: 'script' | 'modal' — error unless actionUrl resolves to a defined action (stack.actions or an object's actions). modal also resolves via the runtime <verb>_<object> convention (create_/new_/add_/edit_/update_ + a real object) and bare object names. A dangling target ships a button that renders and silently does nothing on click — a false affordance, exactly the "declared ≠ enforced" gap ADR-0049 closes, applied to references.
    • actionType: 'url' — warning when a relative in-app path names a objects/reports/dashboards/pages/views route whose target does not exist in the stack. External URLs, interpolated (${…}) targets, and opaque routes are skipped to keep false positives near zero.

Patch Changes

  • Updated dependencies [212b66a]
  • Updated dependencies [d10c4dc]
  • Updated dependencies [9e45b63]
  • Updated dependencies [7b07417]
  • Updated dependencies [fa006fb]

... (truncated)

Changelog

Sourced from @​objectstack/cli's changelog.

16.1.0

Minor Changes

  • 9e45b63: feat(cli): preflight that every requires capability has an installable provider in the current edition (#3366)

    A capability listed in requires: [...] was only checked at serve/start time, and a missing provider produced a generic "not installed — add it to your dependencies" error even when the provider has no installable version in the current edition. os validate (token-vocabulary only) and os build (never resolved providers) both passed, so a validate && build && test CI script never caught it — it surfaced only as an opaque boot crash. Seen upgrading an open-edition app from 14.7 to 16 after @objectstack/service-ai went cloud-only (ADR-0025).

    • @objectstack/spec/kernel now exports PLATFORM_CAPABILITY_PROVIDERS (token → provider package + edition) and a pure classifyRequiredCapability() — one machine-readable source of truth for the provider/edition knowledge the serve resolver previously encoded informally.
    • os build and os validate gained a provider preflight. A requires entry whose provider has no installable version in the active edition (e.g. ai → @objectstack/service-ai, cloud-only) now fails fast with an edition-aware message; an absent-but-installable provider is an advisory pnpm add hint, not a hard error; a satisfied requires list passes unchanged.
    • The os serve boot error now renders the same classification, so preflight and boot read identically.

  • db160dd: Flag dead action/route references in dashboard header & widget actions (ADR-0049 for references, #3367).

    os validate / os build now run a new validateDashboardActionRefs gate over every dashboard header.actions[] and widget actionUrl:

    • actionType: 'script' | 'modal' — error unless actionUrl resolves to a defined action (stack.actions or an object's actions). modal also resolves via the runtime <verb>_<object> convention (create_/new_/add_/edit_/update_ + a real object) and bare object names. A dangling target ships a button that renders and silently does nothing on click — a false affordance, exactly the "declared ≠ enforced" gap ADR-0049 closes, applied to references.
    • actionType: 'url' — warning when a relative in-app path names a objects/reports/dashboards/pages/views route whose target does not exist in the stack. External URLs, interpolated (${…}) targets, and opaque routes are skipped to keep false positives near zero.

Patch Changes

  • Updated dependencies [212b66a]
  • Updated dependencies [d10c4dc]
  • Updated dependencies [9e45b63]
  • Updated dependencies [7b07417]
  • Updated dependencies [fa006fb]
  • Updated dependencies [db160dd]
  • Updated dependencies [b20201f]
  • Updated dependencies [818e6a3]
    • @​objectstack/platform-objects@​16.1.0
    • @​objectstack/spec@​16.1.0
    • @​objectstack/console@​16.1.0
    • @​objectstack/lint@​16.1.0
    • @​objectstack/core@​16.1.0

... (truncated)

Commits
  • 76f18c2 chore: version packages
  • 4f150e5 chore: rename residual framework→objectstack dir/pin references (#3396)
  • db160dd feat(lint): flag dead action/route references in dashboard header actions (#3...
  • 9e45b63 feat(cli): preflight installable provider for required capabilities (#3366) (...
  • 9a43e04 docs: update repo references for framework → objectstack rename (#3380)
  • ce3780b chore: version packages
  • 888791d chore: version packages (rc)
  • 6289ec3 feat(i18n): make action resultDialog copy translatable (schema slot + resolve...
  • 42dc0d9 chore(deps)(deps): bump the production-dependencies group with 7 updates (#3341)
  • 06ff734 feat(spec)!: remove deprecated aiStudio/aiSeat capability aliases (#3308) (#3...
  • Additional commits viewable in compare view

Updates @objectstack/driver-sqlite-wasm from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/driver-sqlite-wasm's releases.

@​objectstack/driver-sqlite-wasm@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/driver-sql@​16.1.0
Changelog

Sourced from @​objectstack/driver-sqlite-wasm's changelog.

16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/driver-sql@​16.1.0

16.0.0

Patch Changes

  • Updated dependencies [f972574]
  • Updated dependencies [6289ec3]
  • Updated dependencies [22013aa]
  • Updated dependencies [3ad3dd5]
  • Updated dependencies [8efa395]
  • Updated dependencies [3a18b60]
  • Updated dependencies [a8aa34c]
  • Updated dependencies [e057f42]
  • Updated dependencies [a3823b2]
  • Updated dependencies [43a3efb]
  • Updated dependencies [524696a]
  • Updated dependencies [bfa3c3f]
  • Updated dependencies [5e3301d]
  • Updated dependencies [dd9f223]
  • Updated dependencies [47d923c]
  • Updated dependencies [46e876c]
  • Updated dependencies [5f05de2]
  • Updated dependencies [021ba4c]
  • Updated dependencies [158aa14]
  • Updated dependencies [62a2117]
  • Updated dependencies [d2723e2]
  • Updated dependencies [fefcd54]
  • Updated dependencies [efbcfe1]
  • Updated dependencies [beaf2de]
  • Updated dependencies [369eb6e]
  • Updated dependencies [06ff734]
  • Updated dependencies [b659111]
  • Updated dependencies [5754a23]
  • Updated dependencies [6c270a6]
  • Updated dependencies [290e2f0]
  • Updated dependencies [668dd17]
  • Updated dependencies [8abf133]
  • Updated dependencies [e0859b1]
  • Updated dependencies [ce468c8]
  • Updated dependencies [04ecd4e]
  • Updated dependencies [4d5a892]

... (truncated)

Commits
  • 76f18c2 chore: version packages
  • 4f150e5 chore: rename residual framework→objectstack dir/pin references (#3396)
  • 9a43e04 docs: update repo references for framework → objectstack rename (#3380)
  • ce3780b chore: version packages
  • 888791d chore: version packages (rc)
  • 9fbce98 chore: version packages (rc) (#3098)
  • 86d30af fix(tenancy): platform-global (tenancy.enabled:false) objects are never drive...
  • See full diff in compare view

Updates @objectstack/runtime from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/runtime's releases.

@​objectstack/runtime@​16.1.0

Patch Changes

  • 818e6a3: fix(server-timing): emit the per-request, admin-gated Server-Timing header on the standard server (os serve/dev) (#3361)

    The per-request Server-Timing path (#2408) — where an admin sends X-OS-Debug-Timing: 1 (or json) and gets phase timings while an ordinary user gets nothing — never emitted on the shipped Hono server. The disclosure gate the Hono middleware opens is only ever flipped by the runtime dispatcher's timedResolveExecutionContext, but the data (/api/v1/data/*) and metadata (/api/v1/meta/*) routes on os serve/dev are served by @objectstack/rest's RestServer (which shadows the Hono plugin's own CRUD), and its identity resolver never opened the gate. Only global mode (OS_SERVER_TIMING=true) — which discloses to every caller, not just admins — worked.

    • observability: the disclosure predicate isPerfDisclosurePrincipal(ec) now lives here (the home of the gate), the single definition of "who may pull per-request timings" shared by every HTTP entry point. @objectstack/runtime re-exports it for back-compat.
    • rest: RestServer.resolveExecCtx opens the gate for an admin/service principal (via the carried posture rung), the REST-server analog of the dispatcher — this is the fix that makes os serve/dev emit.
    • plugin-hono-server: the standalone CRUD surface's self-contained resolveCtx opens the gate too (deriving the rung for the gate decision only, never writing it onto the enforcement context). Adds an e2e test that boots the Hono app and asserts an admin gets Server-Timing while a member/anon does not.

  • Updated dependencies [9e45b63]

  • Updated dependencies [b20201f]

  • Updated dependencies [818e6a3]

    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/observability@​16.1.0
    • @​objectstack/rest@​16.1.0
    • @​objectstack/metadata@​16.1.0
    • @​objectstack/plugin-auth@​16.1.0
    • @​objectstack/plugin-security@​16.1.0
    • @​objectstack/formula@​16.1.0
    • @​objectstack/metadata-core@​16.1.0
    • @​objectstack/objectql@​16.1.0
    • @​objectstack/driver-memory@​16.1.0
    • @​objectstack/driver-sql@​16.1.0
    • @​objectstack/driver-sqlite-wasm@​16.1.0
    • @​objectstack/service-cluster@​16.1.0
    • @​objectstack/service-datasource@​16.1.0
    • @​objectstack/service-i18n@​16.1.0
    • @​objectstack/types@​16.1.0

@​objectstack/runtime@​16.0.0

Major Changes

... (truncated)

Changelog

Sourced from @​objectstack/runtime's changelog.

16.1.0

Patch Changes

  • 818e6a3: fix(server-timing): emit the per-request, admin-gated Server-Timing header on the standard server (os serve/dev) (#3361)

    The per-request Server-Timing path (#2408) — where an admin sends X-OS-Debug-Timing: 1 (or json) and gets phase timings while an ordinary user gets nothing — never emitted on the shipped Hono server. The disclosure gate the Hono middleware opens is only ever flipped by the runtime dispatcher's timedResolveExecutionContext, but the data (/api/v1/data/*) and metadata (/api/v1/meta/*) routes on os serve/dev are served by @objectstack/rest's RestServer (which shadows the Hono plugin's own CRUD), and its identity resolver never opened the gate. Only global mode (OS_SERVER_TIMING=true) — which discloses to every caller, not just admins — worked.

    • observability: the disclosure predicate isPerfDisclosurePrincipal(ec) now lives here (the home of the gate), the single definition of "who may pull per-request timings" shared by every HTTP entry point. @objectstack/runtime re-exports it for back-compat.
    • rest: RestServer.resolveExecCtx opens the gate for an admin/service principal (via the carried posture rung), the REST-server analog of the dispatcher — this is the fix that makes os serve/dev emit.
    • plugin-hono-server: the standalone CRUD surface's self-contained resolveCtx opens the gate too (deriving the rung for the gate decision only, never writing it onto the enforcement context). Adds an e2e test that boots the Hono app and asserts an admin gets Server-Timing while a member/anon does not.

  • Updated dependencies [9e45b63]

  • Updated dependencies [b20201f]

  • Updated dependencies [818e6a3]

    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/observability@​16.1.0
    • @​objectstack/rest@​16.1.0
    • @​objectstack/metadata@​16.1.0
    • @​objectstack/plugin-auth@​16.1.0
    • @​objectstack/plugin-security@​16.1.0
    • @​objectstack/formula@​16.1.0
    • @​objectstack/metadata-core@​16.1.0
    • @​objectstack/objectql@​16.1.0
    • @​objectstack/driver-memory@​16.1.0
    • @​objectstack/driver-sql@​16.1.0
    • @​objectstack/driver-sqlite-wasm@​16.1.0
    • @​objectstack/service-cluster@​16.1.0
    • @​objectstack/service-datasource@​16.1.0
    • @​objectstack/service-i18n@​16.1.0
    • @​objectstack/types@​16.1.0

16.0.0

... (truncated)

Commits
  • 76f18c2 chore: version packages
  • 70c0e7a test(route-parity): declared===enforced e2e gate for os serve routes (#3369) ...
  • 50cfb3d test(runtime): e2e regression for notifications mark-read on the hono server ...
  • 818e6a3 fix(server-timing): emit admin-gated per-request Server-Timing on the standar...
  • 9a43e04 docs: update repo references for framework → objectstack rename (#3380)
  • ce3780b chore: version packages
  • 888791d chore: version packages (rc)
  • ee0a499 fix(i18n/notifications): localize collab notification titles + storage object...
  • dc5c733 test(runtime): add the #3259 flake canary (nested writes stay green at the st...
  • 9fbce98 chore: version packages (rc) (#3098)
  • Additional commits viewable in compare view

Updates @objectstack/driver-memory from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/driver-memory's releases.

@​objectstack/driver-memory@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
Changelog

Sourced from @​objectstack/driver-memory's changelog.

16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0

16.0.0

Patch Changes

  • Updated dependencies [f972574]
  • Updated dependencies [6289ec3]
  • Updated dependencies [22013aa]
  • Updated dependencies [3ad3dd5]
  • Updated dependencies [8efa395]
  • Updated dependencies [3a18b60]
  • Updated dependencies [a8aa34c]
  • Updated dependencies [e057f42]
  • Updated dependencies [a3823b2]
  • Updated dependencies [43a3efb]
  • Updated dependencies [524696a]
  • Updated dependencies [bfa3c3f]
  • Updated dependencies [5e3301d]
  • Updated dependencies [dd9f223]
  • Updated dependencies [46e876c]
  • Updated dependencies [5f05de2]
  • Updated dependencies [021ba4c]
  • Updated dependencies [158aa14]
  • Updated dependencies [62a2117]
  • Updated dependencies [d2723e2]
  • Updated dependencies [fefcd54]
  • Updated dependencies [beaf2de]
  • Updated dependencies [369eb6e]
  • Updated dependencies [06ff734]
  • Updated dependencies [b659111]
  • Updated dependencies [5754a23]
  • Updated dependencies [6c270a6]
  • Updated dependencies [290e2f0]
  • Updated dependencies [668dd17]
  • Updated dependencies [8abf133]
  • Updated dependencies [e0859b1]
  • Updated dependencies [04ecd4e]
  • Updated dependencies [4d5a892]
  • Updated dependencies [16cebeb]
  • Updated dependencies [86d30af]
  • Updated dependencies [8923843]
  • Updated dependencies [a2795f6]

... (truncated)

Commits

Updates @objectstack/driver-sql from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/driver-sql's releases.

@​objectstack/driver-sqlite-wasm@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/driver-sql@​16.1.0

@​objectstack/driver-sql@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
  • Updated dependencies [818e6a3]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/observability@​16.1.0
    • @​objectstack/types@​16.1.0
Changelog

Sourced from @​objectstack/driver-sql's changelog.

16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
  • Updated dependencies [818e6a3]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/observability@​16.1.0
    • @​objectstack/types@​16.1.0

16.0.0

Minor Changes

  • efbcfe1: feat(observability): admin-only richer per-request timing detail via X-OS-Debug-Timing: json (#2408)

    Completes the optional "richer JSON" diagnostic from #2408. In addition to the basic Server-Timing header, an admin/service caller can now request a per-query breakdown — the slowest SQL statements and a query count — by sending X-OS-Debug-Timing: json. The detail is returned in a separate X-OS-Debug-Timing-Detail response header (compact JSON) and is admin-only, even under global mode: an ordinary caller never sees SQL shapes.

    • observability: PerfTiming gains opt-in per-event detail capture (enableDetail / recordDetail / details) plus the ambient recordServerTimingDetail. The disclosure gate gains a privileged level (set by allowPerfDisclosure, read via isPerfDisclosurePrivileged) so the richer detail can be gated independently of the basic header.
    • driver-sql: when detail capture is on, the query listener additionally records each query's parametrized statement (knex's q.sql, ? placeholders) — never the bindings, so no literal row value ever enters the collector. Zero overhead when detail is off.
    • plugin-hono-server: X-OS-Debug-Timing: json enables detail capture; the middleware emits X-OS-Debug-Timing-Detail (slowest queries, capped and sanitized to header-safe ASCII) only when the principal is a proven admin.

    Basic and global behavior are unchanged; json is purely additive.

Patch Changes

  • 47d923c: fix(driver-sql): drop the vestigial sqlite3 peerDependency — the SQLite path uses better-sqlite3 (#3277)

    package.json advertised peerDependencies.sqlite3: "^5.0.0", but the driver never loads sqlite3 at runtime. Every first-party SQLite construction site builds a client: 'better-sqlite3' Knex driver (resolveSqliteDriver in @objectstack/service-datasource, the datasource driver factory, and the whole driver test suite), and the README already tells consumers to pnpm add better-sqlite3. better-sqlite3 is auto-provided as an optionalDependency (with the native → wasm →

... (truncated)

Commits
  • 76f18c2 chore: version packages
  • 9a43e04 docs: update repo references for framework → objectstack rename (#3380)
  • ce3780b chore: version packages
  • 888791d chore: version packages (rc)
  • 9fbce98 chore: version packages (rc) (#3098)
  • 47d923c fix(driver-sql): drop vestigial sqlite3 peerDependency; SQLite uses better-sq...
  • 86d30af fix(tenancy): platform-global (tenancy.enabled:false) objects are never drive...
  • efbcfe1 feat(observability): admin-only per-request timing detail via X-OS-Debug-Timi...
  • ce468c8 feat(observability): decompose Server-Timing into auth/db/hooks/serialize spa...
  • See full diff in compare view

Updates @objectstack/metadata from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/metadata's releases.

@​objectstack/metadata-protocol@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/formula@​16.1.0
    • @​objectstack/metadata-core@​16.1.0
    • @​objectstack/types@​16.1.0

@​objectstack/metadata-core@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
    • @​objectstack/spec@​16.1.0

@​objectstack/metadata-fs@​16.1.0

Patch Changes

  • @​objectstack/metadata-core@​16.1.0

@​objectstack/metadata@​16.1.0

Patch Changes

  • Updated dependencies [212b66a]
  • Updated dependencies [d10c4dc]
  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/platform-objects@​16.1.0
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/metadata-core@​16.1.0
    • @​objectstack/types@​16.1.0
    • @​objectstack/metadata-fs@​16.1.0
Changelog

Sourced from @​objectstack/metadata's changelog.

16.1.0

Patch Changes

  • Updated dependencies [212b66a]
  • Updated dependencies [d10c4dc]
  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/platform-objects@​16.1.0
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/metadata-core@​16.1.0
    • @​objectstack/types@​16.1.0
    • @​objectstack/metadata-fs@​16.1.0

16.0.0

Patch Changes

  • fdc244e: Dev-loop DX fixes from the 15.1 third-party evaluation (P2 batch):

    • Hot-added objects are now queryable without a restart. Adding a *.object.ts under os dev used to recompile "green" while every query answered no such table (or not registered) until a manual restart: the artifact reload never notified the ObjectQL registry, tables were only created at boot, and seeds only loaded from the boot-time bundle. The metadata:reloaded payload now carries the parsed artifact; ObjectQL ingests the object definitions and re-runs the idempotent schema sync (same skipSchemaSync opt-out as boot), and the runtime loads seeds for first-seen objects (dev, single-tenant). os dev also prints ✚ new object(s): … on recompile.
    • Dev admin credentials stay visible. The os dev startup banner only showed admin@objectos.ai / admin123 on the boot that actually seeded it; with the persistent default DB every later boot hid it, and the Console login page never knew it existed. The hint now re-arms on every dev boot for as long as the account still verifies against the default password, and GET /api/v1/auth/config exposes a dev-gated devSeedAdmin field (never present outside NODE_ENV=development) so the login page can show it.
    • os doctor reference analysis understands current metadata shapes. Objects bound through defineView containers (list/listViews/form/formViews → data.object, subform childObject, lookup form fields) and app navigation (objectName, nested children, areas) were reported as "defined but not referenced". The collector now walks the canonical shapes (plus flow node config.object/objectName) and the orphan-view check descends into containers.

  • d2723e2: MetadataManager.register() / unregister() now announce to subscribe() watchers. Both updated the registry, persisted to writable loaders and published to realtime, but never fired the watch callbacks — so subscribe() looked like it covered every write while silently missing all of them. Only the saveMetaItem path (via the repository watch stream) and the filesystem watcher ever reached a subscriber. Runtime consumers that cache metadata — notably ObjectQL's SchemaRegistry bridge, the component that decides what is queryable — went stale on every other write until the process restarted.

    Announcing is now the default, so a new call site is correct without knowing this contract exists. This is a contract fix rather than a bug fix: the one live behavior change is that runtime datasource writes (datasource-admin) now reach the HMR SSE stream, which subscribes to every registered type. unregisterPackage() / bulkUnregister() also announce their deletes now — correct, but latent, since neither has a production caller today.

    Bulk ingest opts out explicitly with the new MetadataWriteOptions ({ notify: false }) — boot-time filesystem priming, artifact ingest, and ObjectQL's registry bridge, each of which either runs before consumers cache anything or announces the whole batch once (as the artifact reload path does via metadata:reloaded). The bridge in particular MUST stay silent: it copies objects out of the SchemaRegistry, and announcing would feed them back through a handler that re-registers under _packageId ?? 'metadata-service', overwriting the true package provenance of every object whose body carries no _packageId.

    Additive only — register(type, name, data) and unregister(type, name) keep working unchanged.

    Fixes #3112.

  • Updated dependencies [f972574]

  • Updated dependencies [6289ec3]

  • Updated dependencies [22013aa]

  • Updated dependencies [3ad3dd5]

  • Updated dependencies [8efa395]

  • Updated dependencies [3a18b60]

  • Updated dependencies [a8aa34c]

  • Updated dependencies [e057f42]

  • Updated dependencies [a3823b2]

  • Updated dependencies [bc65105]

  • Updated dependencies [43a3efb]

  • Updated dependencies [524696a]

  • Updated dependencies [bfa3c3f]

  • Updated dependencies [5e3301d]

  • Updated dependencies [dd9f223]

... (truncated)

Commits
  • 76f18c2 chore: version packages
  • 9a43e04 docs: update repo references for framework → objectstack rename (#3380)
  • ce3780b chore: version packages
  • 888791d chore: version packages (rc)
  • 9fbce98 chore: version packages (rc) (#3098)
  • d2723e2 fix(metadata): register()/unregister() announce to subscribe() watchers (#311...
  • fdc244e fix(dev-dx): hot-reload new objects end to end, persistent dev-admin hint, do...
  • See full diff in compare view

Updates @objectstack/objectql from 15.1.1 to 16.1.0

Release notes

Sourced from @​objectstack/objectql's releases.

@​objectstack/objectql@​16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/formula@​16.1.0
    • @​objectstack/metadata-core@​16.1.0
    • @​objectstack/metadata-protocol@​16.1.0
    • @​objectstack/types@​16.1.0
Changelog

Sourced from @​objectstack/objectql's changelog.

16.1.0

Patch Changes

  • Updated dependencies [9e45b63]
  • Updated dependencies [b20201f]
    • @​objectstack/spec@​16.1.0
    • @​objectstack/core@​16.1.0
    • @​objectstack/formula@​16.1.0
    • @​objectstack/metadata-core@​16.1.0
    • @​objectstack/metadata-protocol@​16.1.0
    • @​objectstack/types@​16.1.0

16.0.0

Major Changes

  • 6c270a6: BREAKING: remove the deprecated ctx.session.tenantId / ctx.user.tenantId alias from the hook & action authoring surface — converge on organizationId (#3290).

    #3280 made organizationId the blessed developer-facing name for the caller's active org across the JS authoring surface and kept tenantId as a @deprecated alias carrying the identical value. That alias is now removed from the hook ctx.session, the action-body ctx.session, and the action-body ctx.user. Read the caller's active org under the single blessed name:

    - const org = ctx.session.tenantId;   // hook or action body
+ const org = ctx.user?.organizationId ?? ctx.session?.organizationId;

    FROM → TO migration (in any *.hook.ts / *.action.ts body):

    • ctx.session.tenantId → ctx.session.organizationId
    • ctx.user.tenantId (action body) → ctx.user.organizationId

    The value is unchanged — organizationId is the same active-org id, matching the organization_id column and current_user.organizationId in RLS/sharing. ctx.user is undefined for system / unauthenticated writes, so read ctx.session?.organizationId when a hook or action must work regardless of a resolved user.

    What changed internally:

    • @objectstack/spec — HookContextSchema.session drops the tenantId field (only organizationId remains). A stray tenantId on a constructed session is now stripped by the schema.
    • @objectstack/objectql — the engine's buildSession() no longer emits session.tenantId; the audit-stamp plugin sources the tenant_id column from session.organizationId.
    • @objectstack/runtime — buildActionSession() and the REST action ctx.user no longer emit tenantId.
    • @objectstack/trigger-record-change — reads session.organizationId (was session.tenantId) when forwarding the writer's org to a runAs:'user' flow; behavior is identical.

    Explicit non-goal (unchanged): the generic driver-layer tenancy abstraction is not touched — ExecutionContext.tenantId, DriverOptions.tenantId, SqlDriver.applyTenantScope / TenancyConfig.tenantField, and ExecutionLog.tenantId. That isolation column is configurable and legitimately carries an environment id in database-per-tenant kernels; it is a distinct axis from the developer-facing org. The build-time check:org-identifier guard now also covers packages/** to keep reference bodies off the removed name.

Minor Changes

  • 22013aa: Split the overloaded managedBy: 'system' bucket into engine-owned vs. admin-writable, and enforce engine-owned writes (ADR-0103, #3220). The system bucket conflated two incompatible write policies: rows a platform service owns end to end (never user-written), and platform-defined schema whose rows are legitimately admin/user-writable. It carried the same all-false affordance row as better-auth/append-only but, unlike better-auth, had no engine enforcement — a wildcard admin could raw-write these rows through the generic data API (ADR-0049 gap).

    Rather than add a new managedBy enum value (which would fall through to fully-editable platform defaults on already-deployed Console clients), the write policy is now the resolved affordance (resolveCrudAffordances = bucket default + userActions), and engine-owned is defined as a system/append-only object that grants no write:

    • Writable set declares userActions — the RBAC link tables (sys_user_position, sys_user_permission_set, sys_position_permission_set), sys_user_preference, sys_approval_delegation, and the messaging config grids (sys_notification_preference / …_subscription / …_template) now declare userActions: { create, edit, delete: true }. The affordance is a declaration only — the DelegatedAdminGate / RLS / permission sets remain the authz.
    • Engine-owned objects locked to reads — apiMethods: ['get','list'] added where absent (jobs, notifications, approval request/approver/token/action, sys_record_share, sys_automation_run, mail/settings/secret audit, the messaging delivery pipeline). sys_secret is explicitly read-locked (an empty apiMethods array fails open).

... (truncated)

Commits
  • 76f18c2 chore: version packages
  • 9a43e04 docs: update repo references for framework → objectstack rename (#3380)
  • ce3780b chore: version packages
  • 888791d chore: version packages (rc)
  • 674457a fix(objectql): enforce per-option visibleWhen on checkboxes + match option va...

@dependabot
chore(deps): bump the objectstack group with 11 updates
683dfc9 
Bumps the objectstack group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [@objectstack/account](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/apps/account) | `15.1.1` | `16.1.0` |
| [@objectstack/cli](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/cli) | `15.1.1` | `16.1.0` |
| [@objectstack/driver-sqlite-wasm](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/plugins/driver-sqlite-wasm) | `15.1.1` | `16.1.0` |
| [@objectstack/runtime](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/runtime) | `15.1.1` | `16.1.0` |
| [@objectstack/driver-memory](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/plugins/driver-memory) | `15.1.1` | `16.1.0` |
| [@objectstack/driver-sql](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/plugins/driver-sql) | `15.1.1` | `16.1.0` |
| [@objectstack/metadata](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/metadata) | `15.1.1` | `16.1.0` |
| [@objectstack/objectql](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/objectql) | `15.1.1` | `16.1.0` |
| [@objectstack/service-analytics](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/services/service-analytics) | `15.1.1` | `16.1.0` |
| [@objectstack/service-automation](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/services/service-automation) | `15.1.1` | `16.1.0` |
| [@objectstack/spec](https://github.com/objectstack-ai/objectstack/tree/HEAD/packages/spec) | `15.1.1` | `16.1.0` |


Updates `@objectstack/account` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/apps/account/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/account@16.1.0/packages/apps/account)

Updates `@objectstack/cli` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/cli@16.1.0/packages/cli)

Updates `@objectstack/driver-sqlite-wasm` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/plugins/driver-sqlite-wasm/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/driver-sqlite-wasm@16.1.0/packages/plugins/driver-sqlite-wasm)

Updates `@objectstack/runtime` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/runtime/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/runtime@16.1.0/packages/runtime)

Updates `@objectstack/driver-memory` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/plugins/driver-memory/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/driver-memory@16.1.0/packages/plugins/driver-memory)

Updates `@objectstack/driver-sql` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/plugins/driver-sql/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/driver-sql@16.1.0/packages/plugins/driver-sql)

Updates `@objectstack/metadata` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/metadata/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/metadata@16.1.0/packages/metadata)

Updates `@objectstack/objectql` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/objectql/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/objectql@16.1.0/packages/objectql)

Updates `@objectstack/service-analytics` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/services/service-analytics/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/service-analytics@16.1.0/packages/services/service-analytics)

Updates `@objectstack/service-automation` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/services/service-automation/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/service-automation@16.1.0/packages/services/service-automation)

Updates `@objectstack/spec` from 15.1.1 to 16.1.0
- [Release notes](https://github.com/objectstack-ai/objectstack/releases)
- [Changelog](https://github.com/objectstack-ai/objectstack/blob/main/packages/spec/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/objectstack/commits/@objectstack/spec@16.1.0/packages/spec)

---
updated-dependencies:
- dependency-name: "@objectstack/account"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/cli"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/driver-sqlite-wasm"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/runtime"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/driver-memory"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/driver-sql"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/metadata"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/objectql"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/service-analytics"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/service-automation"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/spec"
  dependency-version: 16.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants