Version Packages (alpha)

packages/auth/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @opensaas/stack-auth
 
+## 0.44.0-alpha.6
+
+### Minor Changes
+
+- [#2201](https://github.com/OpenSaasAU/stack/pull/2201) [`0933b4b`](https://github.com/OpenSaasAU/stack/commit/0933b4bb6e19f56a2629623c3e5facb28fe8af73) Thanks [@dependabot](https://github.com/apps/dependabot)! - Upgrade to Prisma ORM 8.0.0-rc.22 and the `prisma` CLI to 8.0.0-rc.30
+
+  The stack's date and time columns are unchanged: `timestamp()` and `calendarDay()` keep reading and writing ISO strings, and `contract.json` is byte-identical. Prisma ORM now refuses to run from two installed copies, so every `@prisma/orm-*` package and the `prisma` CLI must move together:
+
+  ```json
+  {
+    "dependencies": { "@prisma/orm-postgres": "8.0.0-rc.22" },
+    "devDependencies": { "prisma": "8.0.0-rc.30" }
+  }
+  ```
+
+  Then run `pnpm generate` and commit what it writes. A project using `ragPlugin` or another pgvector declaration gets a new head for `migrations/pgvector/`: run `prisma db migrate` on each database to move the pack's marker.
+
+### Patch Changes
+
+- [#2144](https://github.com/OpenSaasAU/stack/pull/2144) [`8bbaeae`](https://github.com/OpenSaasAU/stack/commit/8bbaeaef7e544c69cb17756ca67813521e0ef490) Thanks [@borisno2](https://github.com/borisno2)! - Auth adapter `update` and `incrementOne` now throw `AuthWhereError` on an empty `where` instead of silently no-oping (completes [#1980](https://github.com/OpenSaasAU/stack/issues/1980)).
+
 ## 0.44.0-alpha.5
 
 No changes in this release.

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-auth",
-  "version": "0.44.0-alpha.5",
+  "version": "0.44.0-alpha.6",
   "description": "Better-auth integration for OpenSaas Stack",
   "type": "module",
   "engines": {

packages/cli/CHANGELOG.md

@@ -1,5 +1,37 @@
 # @opensaas/stack-cli
 
+## 0.44.0-alpha.6
+
+### Minor Changes
+
+- [#2201](https://github.com/OpenSaasAU/stack/pull/2201) [`0933b4b`](https://github.com/OpenSaasAU/stack/commit/0933b4bb6e19f56a2629623c3e5facb28fe8af73) Thanks [@dependabot](https://github.com/apps/dependabot)! - Upgrade to Prisma ORM 8.0.0-rc.22 and the `prisma` CLI to 8.0.0-rc.30
+
+  The stack's date and time columns are unchanged: `timestamp()` and `calendarDay()` keep reading and writing ISO strings, and `contract.json` is byte-identical. Prisma ORM now refuses to run from two installed copies, so every `@prisma/orm-*` package and the `prisma` CLI must move together:
+
+  ```json
+  {
+    "dependencies": { "@prisma/orm-postgres": "8.0.0-rc.22" },
+    "devDependencies": { "prisma": "8.0.0-rc.30" }
+  }
+  ```
+
+  Then run `pnpm generate` and commit what it writes. A project using `ragPlugin` or another pgvector declaration gets a new head for `migrations/pgvector/`: run `prisma db migrate` on each database to move the pack's marker.
+
+### Patch Changes
+
+- [#2142](https://github.com/OpenSaasAU/stack/pull/2142) [`bb87f3b`](https://github.com/OpenSaasAU/stack/commit/bb87f3bf253f31c9aee6b91338f54057ee923ffe) Thanks [@borisno2](https://github.com/borisno2)! - Fix the dev loop reading `accessWidening` instead of the `accessChanges` the Prisma CLI reports, so access changes now count as destructive and reach the plan id and `--allow`.
+
+- [#2196](https://github.com/OpenSaasAU/stack/pull/2196) [`80c9ac0`](https://github.com/OpenSaasAU/stack/commit/80c9ac0f721058b566dc93dea1caf97d39c1cc94) Thanks [@borisno2](https://github.com/borisno2)! - Fix `opensaas dev` freezing on stale config after a failed load; `db update --plan <id>` now refuses a plan the current config no longer wants.
+
+- [#2205](https://github.com/OpenSaasAU/stack/pull/2205) [`dec240b`](https://github.com/OpenSaasAU/stack/commit/dec240b2e1596cb7edfa4da21cb7c2e146d05ab4) Thanks [@borisno2](https://github.com/borisno2)! - Render the admin's Sign Out control only with an `onSignOut` handler, instead of a button that only redirected, warn the user if the handler rejects, and reload an admin page restored from the back-forward cache.
+  The feature generator now emits `signOutAction` and tells you to pass it as `onSignOut`.
+
+- [#2209](https://github.com/OpenSaasAU/stack/pull/2209) [`4a8b631`](https://github.com/OpenSaasAU/stack/commit/4a8b631e7dcfb3bf5e3eb118193722b2e31d842e) Thanks [@borisno2](https://github.com/borisno2)! - Fix `opensaas generate` failing with "gen is not defined" when a config uses the `cuid` id strategy and no list uses `uuid7`, `cuid2` or `updatedAt`
+
+- [#2146](https://github.com/OpenSaasAU/stack/pull/2146) [`28650ed`](https://github.com/OpenSaasAU/stack/commit/28650ed4cd7a8e31343732b8ff15194be0afd0dd) Thanks [@borisno2](https://github.com/borisno2)! - `opensaas generate` now refuses to write live artifacts while an `opensaas dev` loop is running for the project, so a parked destructive change is no longer promoted over the loop's database.
+- Updated dependencies [[`eaeee36`](https://github.com/OpenSaasAU/stack/commit/eaeee363778e5717371720deec7c4518dfaa80e1), [`0933b4b`](https://github.com/OpenSaasAU/stack/commit/0933b4bb6e19f56a2629623c3e5facb28fe8af73), [`357f9bb`](https://github.com/OpenSaasAU/stack/commit/357f9bbf16499fd1d7da1a02e5c9370d60ae661a), [`ddb9e8c`](https://github.com/OpenSaasAU/stack/commit/ddb9e8cdbf67e42467ec3fec98f22c037f2a5de2), [`0dd7eb4`](https://github.com/OpenSaasAU/stack/commit/0dd7eb4b4a9e5b3ec338b39f8ca83e135de36480), [`4a8b631`](https://github.com/OpenSaasAU/stack/commit/4a8b631e7dcfb3bf5e3eb118193722b2e31d842e), [`fa03c43`](https://github.com/OpenSaasAU/stack/commit/fa03c4313851a5f2caf016190843bb8a21f15f41), [`a854243`](https://github.com/OpenSaasAU/stack/commit/a85424322701f3db9682b0f54acdc51bee404912), [`af04b65`](https://github.com/OpenSaasAU/stack/commit/af04b65745d55e0e174c2b95b04f0577651f0861), [`ca51e67`](https://github.com/OpenSaasAU/stack/commit/ca51e67ed52a803cfeac60b2084c5409c7815f5a)]:
+  - @opensaas/stack-core@0.44.0-alpha.6
+
 ## 0.44.0-alpha.5
 
 ### Patch Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-cli",
-  "version": "0.44.0-alpha.5",
+  "version": "0.44.0-alpha.6",
   "description": "CLI tools for OpenSaas Stack",
   "type": "module",
   "engines": {

packages/core/CHANGELOG.md

@@ -1,5 +1,66 @@
 # @opensaas/stack-core
 
+## 0.44.0-alpha.6
+
+### Minor Changes
+
+- [#2201](https://github.com/OpenSaasAU/stack/pull/2201) [`0933b4b`](https://github.com/OpenSaasAU/stack/commit/0933b4bb6e19f56a2629623c3e5facb28fe8af73) Thanks [@dependabot](https://github.com/apps/dependabot)! - Upgrade to Prisma ORM 8.0.0-rc.22 and the `prisma` CLI to 8.0.0-rc.30
+
+  The stack's date and time columns are unchanged: `timestamp()` and `calendarDay()` keep reading and writing ISO strings, and `contract.json` is byte-identical. Prisma ORM now refuses to run from two installed copies, so every `@prisma/orm-*` package and the `prisma` CLI must move together:
+
+  ```json
+  {
+    "dependencies": { "@prisma/orm-postgres": "8.0.0-rc.22" },
+    "devDependencies": { "prisma": "8.0.0-rc.30" }
+  }
+  ```
+
+  Then run `pnpm generate` and commit what it writes. A project using `ragPlugin` or another pgvector declaration gets a new head for `migrations/pgvector/`: run `prisma db migrate` on each database to move the pack's marker.
+
+- [#2232](https://github.com/OpenSaasAU/stack/pull/2232) [`fa03c43`](https://github.com/OpenSaasAU/stack/commit/fa03c4313851a5f2caf016190843bb8a21f15f41) Thanks [@borisno2](https://github.com/borisno2)! - A field's `read` rule now denies when it reaches for a relation the row does not carry, closing a count, a `combine` of counts or an absent relation making a rule fail open.
+
+  This changes what rules see. A relation the read did not deliver whole — not included, narrowed by the caller with `where`, `limit`, `offset`, `orderBy`, `select` or a nested `include`, or reduced to counts with no rows — is withheld, and reading it denies that rule. A foreign key's rule takes the same decision on the same rows as every other rule on the row.
+
+  ```typescript
+  const notes = relationship({
+    ref: 'Note.ticket',
+    many: true,
+    access: { read: ({ item }) => !item.notes?.some((note) => note.private) },
+  })
+
+  await context.db.Ticket.include('notes').all() // decides on the rows, as before
+  await context.db.Ticket.include('notes', (rows) => rows.count()).all() // denies, and used to pass
+  await context.db.Ticket.include('notes', (rows) => rows.limit(10)).all() // denies, and used to pass
+  ```
+
+  - A rule that throws the `TypeError` of reading it, like `item.logs.length`, denies rather than failing the read, so the admin item view renders where it showed "Item not found". The section says it can't be shown, and the list view shows no count, rather than a false empty or `0`.
+  - An included to-one the related list's access left out is withheld, not `null`, so `!item.owner?.banned` no longer grants under `include('owner')`. `null` on a to-one with no foreign key set is a real answer. The inverse side of a one-to-one has no column to tell the two apart, so a rule reading it denies whenever the related list's access can leave a row out, even where there is no row. Rules that never read a relation, like an ownership check, are unaffected.
+  - A rule that catches a throw from `item` is now row-dependent, so `select` and `where` can no longer open it.
+  - A rule that enumerates or spreads `item` denies on a row withholding any relation, and a rule that writes through `item` denies and changes nothing. Use `toSorted()` rather than `sort()` on a relation.
+  - Everything a rule can see of a related list is what the session can see, so never grant on an absence there. Grant on a row the session can see, or keep the fact in a column on the row that only rises. See "What a read rule sees" in the access control docs and ADR-0082.
+
+### Patch Changes
+
+- [#2217](https://github.com/OpenSaasAU/stack/pull/2217) [`eaeee36`](https://github.com/OpenSaasAU/stack/commit/eaeee363778e5717371720deec7c4518dfaa80e1) Thanks [@borisno2](https://github.com/borisno2)! - Fix `create`, `update` and `delete` throwing or returning a wrong value on a list whose computed field declares a relation in `needs`; a write now returns that field exactly as `first()` does.
+
+- [#2218](https://github.com/OpenSaasAU/stack/pull/2218) [`357f9bb`](https://github.com/OpenSaasAU/stack/commit/357f9bbf16499fd1d7da1a02e5c9370d60ae661a) Thanks [@borisno2](https://github.com/borisno2)! - Fix optional JSON, select and text admin fields not clearing to `null`; `json()` now refuses a `null` for a NOT NULL column with an error on the field.
+  A hook on an optional text field now receives `null`, not `''`, when it's emptied in the admin, so an `=== ''` check no longer fires. Guard with `typeof value === 'string'`, not `?.`, which turns `null` into `undefined` and silently drops the write.
+
+- [#2195](https://github.com/OpenSaasAU/stack/pull/2195) [`ddb9e8c`](https://github.com/OpenSaasAU/stack/commit/ddb9e8cdbf67e42467ec3fec98f22c037f2a5de2) Thanks [@borisno2](https://github.com/borisno2)! - Root `update` locks `FOR NO KEY UPDATE`, fixing the deadlock between racers that insert a child and update its parent.
+  A transaction that then needs `FOR UPDATE` on that row, or changes a column in a unique index, can now deadlock with a racer holding its foreign-key lock (ADR-0078).
+
+- [#2208](https://github.com/OpenSaasAU/stack/pull/2208) [`0dd7eb4`](https://github.com/OpenSaasAU/stack/commit/0dd7eb4b4a9e5b3ec338b39f8ca83e135de36480) Thanks [@borisno2](https://github.com/borisno2)! - Fix a caller-shaped `combine()` rows branch, or an MCP `count` beside `take: 0`, bypassing a relationship's own `read` rule and revealing the count.
+  A `combine()` with a rows branch now strips as the plain include does.
+
+- [#2209](https://github.com/OpenSaasAU/stack/pull/2209) [`4a8b631`](https://github.com/OpenSaasAU/stack/commit/4a8b631e7dcfb3bf5e3eb118193722b2e31d842e) Thanks [@borisno2](https://github.com/borisno2)! - Fix `opensaas generate` failing with "gen is not defined" when a config uses the `cuid` id strategy and no list uses `uuid7`, `cuid2` or `updatedAt`
+
+- [#2143](https://github.com/OpenSaasAU/stack/pull/2143) [`a854243`](https://github.com/OpenSaasAU/stack/commit/a85424322701f3db9682b0f54acdc51bee404912) Thanks [@borisno2](https://github.com/borisno2)! - MCP `where` relation predicates into a list with `mcp.enabled: false`, `mcp.tools.read: false` or denied query access are now refused as an unknown key.
+
+- [#2211](https://github.com/OpenSaasAU/stack/pull/2211) [`af04b65`](https://github.com/OpenSaasAU/stack/commit/af04b65745d55e0e174c2b95b04f0577651f0861) Thanks [@borisno2](https://github.com/borisno2)! - Fix admin lists emptying on a sort the column cannot take: sorting now follows the ORM's own `order` answer per column, and `orderBy` refuses a virtual or multi-column field as a `ValidationError`.
+  A failed list read now shows an error state rather than the first-run empty state.
+
+- [#2239](https://github.com/OpenSaasAU/stack/pull/2239) [`ca51e67`](https://github.com/OpenSaasAU/stack/commit/ca51e67ed52a803cfeac60b2084c5409c7815f5a) Thanks [@borisno2](https://github.com/borisno2)! - An `update`/`delete` operation rule and a field `update` rule that reach for a relation the write did not deliver now deny instead of reading absence as permission ([#2233](https://github.com/OpenSaasAU/stack/issues/2233)). A rule that enumerates `item` (spread, `Object.keys`) on a list with a relationship denies too.
+
 ## 0.44.0-alpha.5
 
 ### Patch Changes

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-core",
-  "version": "0.44.0-alpha.5",
+  "version": "0.44.0-alpha.6",
   "description": "Core stack for OpenSaas - schema definition, access control, and runtime utilities",
   "type": "module",
   "sideEffects": false,

packages/create-opensaas-app/CHANGELOG.md

@@ -1,5 +1,56 @@
 # create-opensaas-app
 
+## 0.4.0-alpha.4
+
+### Patch Changes
+
+- [#2144](https://github.com/OpenSaasAU/stack/pull/2144) [`8bbaeae`](https://github.com/OpenSaasAU/stack/commit/8bbaeaef7e544c69cb17756ca67813521e0ef490) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2217](https://github.com/OpenSaasAU/stack/pull/2217) [`eaeee36`](https://github.com/OpenSaasAU/stack/commit/eaeee363778e5717371720deec7c4518dfaa80e1) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2201](https://github.com/OpenSaasAU/stack/pull/2201) [`0933b4b`](https://github.com/OpenSaasAU/stack/commit/0933b4bb6e19f56a2629623c3e5facb28fe8af73) Thanks [@dependabot](https://github.com/apps/dependabot)! - Scaffold projects on Prisma ORM 8.0.0-rc.22 and the `prisma` CLI 8.0.0-rc.30.
+
+- [#2196](https://github.com/OpenSaasAU/stack/pull/2196) [`80c9ac0`](https://github.com/OpenSaasAU/stack/commit/80c9ac0f721058b566dc93dea1caf97d39c1cc94) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2143](https://github.com/OpenSaasAU/stack/pull/2143) [`a854243`](https://github.com/OpenSaasAU/stack/commit/a85424322701f3db9682b0f54acdc51bee404912) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2141](https://github.com/OpenSaasAU/stack/pull/2141) [`2f287d5`](https://github.com/OpenSaasAU/stack/commit/2f287d5624fdcf107dddf68d52843d3d43c49f6e) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2218](https://github.com/OpenSaasAU/stack/pull/2218) [`357f9bb`](https://github.com/OpenSaasAU/stack/commit/357f9bbf16499fd1d7da1a02e5c9370d60ae661a) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2230](https://github.com/OpenSaasAU/stack/pull/2230) [`ad45bd0`](https://github.com/OpenSaasAU/stack/commit/ad45bd0bf8dcaf63f023344f9de7d376205be697) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2195](https://github.com/OpenSaasAU/stack/pull/2195) [`ddb9e8c`](https://github.com/OpenSaasAU/stack/commit/ddb9e8cdbf67e42467ec3fec98f22c037f2a5de2) Thanks [@borisno2](https://github.com/borisno2)! - Scaffold against the stack release with the root update lock fix.
+
+- [#2205](https://github.com/OpenSaasAU/stack/pull/2205) [`dec240b`](https://github.com/OpenSaasAU/stack/commit/dec240b2e1596cb7edfa4da21cb7c2e146d05ab4) Thanks [@borisno2](https://github.com/borisno2)! - The with-auth template wires a real sign-out into the admin UI.
+
+- [#2202](https://github.com/OpenSaasAU/stack/pull/2202) [`bd03766`](https://github.com/OpenSaasAU/stack/commit/bd03766d61aff8c72423bd9255f0b5b9d736ff50) Thanks [@dependabot](https://github.com/apps/dependabot)! - Refresh templates for the latest stack release.
+
+- [#2219](https://github.com/OpenSaasAU/stack/pull/2219) [`9a87cfa`](https://github.com/OpenSaasAU/stack/commit/9a87cfa75c464b1940908d20c0fe16c2a30ebf60) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2208](https://github.com/OpenSaasAU/stack/pull/2208) [`0dd7eb4`](https://github.com/OpenSaasAU/stack/commit/0dd7eb4b4a9e5b3ec338b39f8ca83e135de36480) Thanks [@borisno2](https://github.com/borisno2)! - Stamp the stack version carrying the `combine()` read-rule fix into new projects.
+
+- [#2209](https://github.com/OpenSaasAU/stack/pull/2209) [`4a8b631`](https://github.com/OpenSaasAU/stack/commit/4a8b631e7dcfb3bf5e3eb118193722b2e31d842e) Thanks [@borisno2](https://github.com/borisno2)! - Fix `opensaas generate` failing with "gen is not defined" when a config uses the `cuid` id strategy and no list uses `uuid7`, `cuid2` or `updatedAt`
+
+- [#2232](https://github.com/OpenSaasAU/stack/pull/2232) [`fa03c43`](https://github.com/OpenSaasAU/stack/commit/fa03c4313851a5f2caf016190843bb8a21f15f41) Thanks [@borisno2](https://github.com/borisno2)! - Templates pick up the read-rule fix for withheld relations.
+
+- [#2142](https://github.com/OpenSaasAU/stack/pull/2142) [`bb87f3b`](https://github.com/OpenSaasAU/stack/commit/bb87f3bf253f31c9aee6b91338f54057ee923ffe) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2236](https://github.com/OpenSaasAU/stack/pull/2236) [`384e007`](https://github.com/OpenSaasAU/stack/commit/384e0074f26f05f50cd279fcc0bea81c4aa24c7e) Thanks [@borisno2](https://github.com/borisno2)! - Scaffolds write an allowed-builds `pnpm-workspace.yaml`, and ignored build scripts no longer abort setup on current pnpm.
+
+- [#2212](https://github.com/OpenSaasAU/stack/pull/2212) [`bea32ad`](https://github.com/OpenSaasAU/stack/commit/bea32adade0c2aa73ab4a923692656929165d020) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2211](https://github.com/OpenSaasAU/stack/pull/2211) [`af04b65`](https://github.com/OpenSaasAU/stack/commit/af04b65745d55e0e174c2b95b04f0577651f0861) Thanks [@borisno2](https://github.com/borisno2)! - Fix admin lists emptying on a sort the column cannot take: sorting now follows the ORM's own `order` answer per column, and `orderBy` refuses a virtual or multi-column field as a `ValidationError`.
+  A failed list read now shows an error state rather than the first-run empty state.
+
+- [#2222](https://github.com/OpenSaasAU/stack/pull/2222) [`97a9e88`](https://github.com/OpenSaasAU/stack/commit/97a9e882a52733d3a8217fdf15b045a6a73220f8) Thanks [@borisno2](https://github.com/borisno2)! - Templates pick up the admin's keyboard and labelling fixes.
+
+- [#2231](https://github.com/OpenSaasAU/stack/pull/2231) [`5177197`](https://github.com/OpenSaasAU/stack/commit/517719783862d3e6034611c9c5889f47e3575546) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2198](https://github.com/OpenSaasAU/stack/pull/2198) [`1a6333f`](https://github.com/OpenSaasAU/stack/commit/1a6333f188b51d240048c7255fd28321d8a429f9) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
+- [#2259](https://github.com/OpenSaasAU/stack/pull/2259) [`f2af7cb`](https://github.com/OpenSaasAU/stack/commit/f2af7cb048f4c0000c44bbae209d4cc987037834) Thanks [@borisno2](https://github.com/borisno2)! - Refresh templates for the latest stack release.
+
 ## 0.4.0-alpha.3
 
 ### Patch Changes