Commits

History for

onmain

Commits on Oct 1, 2026

feat(drk-deploy): db:runtime-login moves production onto a least-privilege login in one command, checked against the gate's target line, and retires old logins (DEP4)

devresponse
and
claude
committed
951da1f
feat(db): least-privilege runtime role: privilege manifest reconciled on every migrate, pnpm db:runtime-login, the gate's privilege check and ratchet, CI runs the app as a non-owner login (DEP3)

devresponse
and
claude
committed
fdca6c7
feat(deploy): migrate production on every push to main, refuse unsafe migration sessions, retire deploy.yml (DEP2)

devresponse
and
claude
committed
a0644f3
feat(deploy): fail-closed schema gate in the Vercel production build, plus the expand/contract rule and its guard (DEP1)

devresponse
and
claude
committed
7d77f9d
feat(shell): link the brand home and add Administration Console to the app switcher (NAVK)

devresponse
and
claude
committed
9e37be5
refactor(db): consolidate core migrations 0002-0008 into 0002-release.sql, keep pre-consolidation databases working (MIG)

devresponse
and
claude
committed
66754df

Navigation Menu

Commits

Commits on Oct 1, 2026

feat(drk-deploy): db:runtime-login moves production onto a least-privilege login in one command, checked against the gate's target line, and retires old logins (DEP4)

feat(db): least-privilege runtime role: privilege manifest reconciled on every migrate, pnpm db:runtime-login, the gate's privilege check and ratchet, CI runs the app as a non-owner login (DEP3)

feat(deploy): migrate production on every push to main, refuse unsafe migration sessions, retire deploy.yml (DEP2)

feat(deploy): fail-closed schema gate in the Vercel production build, plus the expand/contract rule and its guard (DEP1)

feat(shell): link the brand home and add Administration Console to the app switcher (NAVK)

refactor(db): consolidate core migrations 0002-0008 into 0002-release.sql, keep pre-consolidation databases working (MIG)

Commits on Sep 30, 2026

fix(admin): hold an org admin's enterprise-app audience to the <prefix>:<app id> a satellite can consume (R15, I-01)

refactor(http): move the route wrappers, request id, error envelopes, origin guard and rate limiters into src/lib/http (R13, I-13)

fix(admin): let an org admin create an enterprise app from the console, prefill and hint its org's slug namespace (R14, I-01)

fix(admin): save each dual-list editor in one atomic PATCH, refuse a stale organization, role or group save with an ETag, name the F-09 409s, regenerate the admin SDK (F-38, F-39, F-09)

chore(deps): port to @sentry/nextjs 11.1 with span scrubbing on the streamed span shape (R11, supersedes #485)

chore(deps): replace the deprecated prom-client with @prometheus-io/client, floor overrides at the declared versions (F-113, #489)

feat(privacy): per-user data export and SECURITY DEFINER erasure with migration 0008 (F-151)

fix(admin-api): honour a repeated filter on every admin list and export, answer the create and revoke shapes the spec declares (F-74)

fix(security): clear the four open CodeQL alerts in code, say what the CodeQL gate really blocks (F-112)

fix(sso): end a handoff session 8 hours after the handoff, and end an app's handoff sessions when it is disabled or deleted (F-82)

fix(email): write invitations and the admin test email in the recipient's language, with a matching invite link (F-102)

fix(admin): org admins name enterprise apps under their org's slug, and never claim a global app id or SSO audience (I-01)

fix(admin): gate an org's members, invitations and bindings on admin.orgs.manage, and keep every catalog key on a guard (F-69)

docs: make topology, migration tags, handoff claims, SSO wording and UAT citations match the code (F-107, F-135, I-05, M-01, A-09, I-16)

refactor(db,admin): type timestamp columns as Date, route sibling code through loadScopedOrg, isUuid and status-values (F-131, F-133)

fix(api): one error envelope and one 429 per surface, count every denial, stamp request ids on the MCP pair (F-129, F-130, A-12)

fix(auth): make sign-up provisioning, invitation acceptance and sign-in activation atomic, converge on concurrent duplicates (F-95)

fix(email): drop queued invitation mail once its invitation dies, share the token TTLs, pin the seeded templates (F-100, F-103)

fix(email): retry transient sends inline, lease rows from the drain, report invitation delivery (F-99, F-101, F-104)

fix(ci): keep the docs functions' traces to their content, one-pass unescape, allowlist a fixture (F-88, #488)

fix(i18n): send the errors namespace to sign-in pages, align two tests with the combined lanes

fix(db): lock role and permission deletes, make global role keys and the default flag unique, index the search ORs, store no provider tokens (F-97, F-93, M-02, F-150)

fix(authz): check the scope, rate-limit and guard invariants per handler, gate every access-context caller (F-127, I-15)

fix(sso): send a browser's failed handoff to the confirm page, and report an expiry as token_expired (F-85)

fix(api): cap request bodies on the public endpoints before they authenticate (F-78)

fix(mcp): reap stale registrations in bounded batches and audit each expiry (F-75, F-79)

fix(mcp): spec conformance, a per-credential tool-call limit, and a design doc that matches the code (I-04, F-76)

perf(i18n): send each route group only the messages its client components read (F-123)

fix(ui): make the shadcn primitives' Tailwind 3 classes compile under Tailwind 4 (F-119)

Breadcrumbs

User selector

Datepicker

Commit history

Commits on Oct 1, 2026

Commits on Sep 30, 2026