v5.0.0

.changeset/callable-compiled-queries.md

@@ -0,0 +1,8 @@
+---
+'@cleverbrush/knex-schema': minor
+'@cleverbrush/orm': minor
+---
+
+Add `parameter('name')` for callable PostgreSQL SELECT templates with schema-inferred positional arguments. Compile SQL, binding slots and decoding once on first invocation or `.toSQL(...)`; reuse them with independent values on later calls. `.query(...)` returns an ordinary composable bound reader.
+
+Support repeated names, grouped filters, fixed membership/range slots, alias joins, relation and STI/CTI customizers, and caller-owned transactions. Preserve storage types, null comparison semantics, result schemas, property navigation, and ORM identity tracking. Reject unsupported placeholder positions and unbound terminals or writes before execution.

.changeset/circular-object-hashing.md

@@ -0,0 +1,5 @@
+---
+'@cleverbrush/deep': patch
+---
+
+Prevent circular object references from overflowing the stack during internal object hashing while preserving acyclic hash results.

.changeset/close-rejected-subscriptions.md

@@ -0,0 +1,6 @@
+---
+'@cleverbrush/server': patch
+---
+
+Close WebSocket subscriptions when middleware rejects the request without
+calling the next handler, preventing idle unauthorized connections.

.changeset/composable-typed-queries.md

@@ -0,0 +1,11 @@
+---
+'@cleverbrush/knex-schema': minor
+'@cleverbrush/orm': minor
+---
+
+Add typed flat joined projections, aggregate expressions and scalar helpers
+with optional output schemas, and composite keyset pagination. Preserve parent
+ordering during eager loading and infer related-query customization types.
+Existing aggregate and single-column cursor APIs remain available unchanged.
+Export reusable SQL identifier validation, preserve schema inference throughout
+bound query factories, and document the public query/ORM APIs for IDE tooltips.

.changeset/config.json

@@ -9,6 +9,7 @@
             "@cleverbrush/deep",
             "@cleverbrush/async",
             "@cleverbrush/scheduler",
+            "@cleverbrush/scheduler-postgres",
             "@cleverbrush/mapper",
             "@cleverbrush/knex-clickhouse",
             "@cleverbrush/react-form",
@@ -22,7 +23,9 @@
             "@cleverbrush/server",
             "@cleverbrush/server-openapi",
             "@cleverbrush/orm",
-            "@cleverbrush/orm-cli"
+            "@cleverbrush/orm-cli",
+            "@cleverbrush/storage",
+            "@cleverbrush/storage-s3"
         ]
     ],
     "linked": [],

.changeset/connection-independent-queries.md

@@ -0,0 +1,14 @@
+---
+'@cleverbrush/knex-schema': minor
+'@cleverbrush/orm': minor
+---
+
+Add immutable connection-independent query definitions with `query(Schema)`.
+Define typed reads once and supply a Knex connection or transaction through
+`definition(knex, ...values)`, `.query(knex, ...values)` or `.toSQL(knex, ...values)`.
+
+Preserve inferred parameters, projections, relation/variant schemas and existing
+connection-first APIs. Capture selectors/scopes/customizers once, compile SELECTs
+lazily per definition and actual Knex instance, and bind ordinary readers before
+native SQL composition, pagination or supported writes. Include runtime,
+declaration and PostgreSQL integration coverage and multi-file usage guidance.

.changeset/cors-preflight.md

@@ -0,0 +1,10 @@
+---
+"@cleverbrush/server": minor
+---
+
+Add opt-in server-wide CORS through `ServerBuilder.useCors()` and
+`ServerCorsOptions`. Handle route-aware preflights before authentication while
+preserving the normal pipeline for actual requests. Support exact origins,
+origin predicates, explicit request/response header policies, credentials and
+preflight cache duration. Reject disallowed origins before handlers and finalize
+CORS headers per physical response, including errors and cache/idempotency replays.

.changeset/durable-job-execution.md

@@ -0,0 +1,28 @@
+---
+"@cleverbrush/scheduler": major
+"@cleverbrush/scheduler-postgres": major
+---
+
+Redesign the scheduler for versioned immediate, delayed and recurring jobs,
+typed separate handlers, durable ordered progress and fenced worker leases.
+Add an independently installed PostgreSQL adapter using Framework ORM and
+knex-schema, explicit migrations, transactional enqueue and restart recovery.
+
+Retries are opt-in and rerun whole handlers. Calendar triggers use explicit UTC
+or IANA zones with persisted cursors and missed/overlap policies. See the
+scheduler v4.x-to-v5 migration guide for the breaking API and rollout steps.
+The adapter joins the fixed Framework release group.
+
+Retain schema-driven minute/day/week/month/year definitions and their
+discriminated Schedule type, exposing individual schemas and the Schemas facade.
+Normalize recurrence defaults, dates and weekday order before fingerprinting;
+unchanged registrations retain their cursor and start anchor. Preserve the
+one-based calculator index and accept the deprecated maxOccurences spelling
+while rejecting ambiguous dual spelling. Name the explicit persistence option
+storageRepository. Derive PostgreSQL row and entity types from schema definitions
+without parallel hand-written row types.
+
+Use native Date/Intl calendar calculations without an additional date-time
+runtime dependency. Preserve DST-gap skipping and earlier-fold selection,
+including non-hour transitions and skipped calendar dates, independently of
+the host time zone. Bound minute schedules to the representable Date range.

.changeset/immutable-query-major.md

@@ -0,0 +1,31 @@
+---
+"@cleverbrush/async": major
+"@cleverbrush/auth": major
+"@cleverbrush/client": major
+"@cleverbrush/deep": major
+"@cleverbrush/di": major
+"@cleverbrush/env": major
+"@cleverbrush/knex-clickhouse": major
+"@cleverbrush/knex-schema": major
+"@cleverbrush/log": major
+"@cleverbrush/mapper": major
+"@cleverbrush/orm-cli": major
+"@cleverbrush/orm": major
+"@cleverbrush/otel": major
+"@cleverbrush/react-form": major
+"@cleverbrush/scheduler": major
+"@cleverbrush/schema-json": major
+"@cleverbrush/schema": major
+"@cleverbrush/server-openapi": major
+"@cleverbrush/server": major
+---
+
+Make Framework query builders immutable and infer row schemas automatically.
+
+Retain returned query builders, return synchronous builders from scopes and grouped predicates, and supply an explicit Framework object output schema for opaque raw SELECTs. Ordinary, aliased, polymorphic and ORM queries expose their row schemas directly. Projections replace scalar selections, and projected/aggregate/raw queries cannot perform entity writes. Reads and write-returning rows consistently preserve exact decimal/bigint strings, Date objects and SQL nulls.
+
+All published Framework packages advance together to the next major version. Tracked entity objects remain mutable.
+
+### Migrating from v4.x to v5
+
+Remove `withRowSchema()` calls and retain each configured query instead of relying on mutation. Replace raw base-query overloads with explicit output contracts. See `libs/knex-schema/MIGRATION-v5.md` for the complete migration guide.

.changeset/modular-implementations-and-error-policies.md

@@ -0,0 +1,9 @@
+---
+"@cleverbrush/server": minor
+---
+
+Add immutable, contract-bound implementation scopes and feature-module composition
+with complete operation coverage, cross-file handler inference, shared/per-operation
+DI, and unchanged HTTP/subscription registration. Add reusable, endpoint-checked
+error policies and a standalone handler wrapper. Existing registration APIs and
+the browser-safe contract entry point remain supported.

.changeset/object-storage-s3.md

@@ -0,0 +1,13 @@
+---
+"@cleverbrush/storage": minor
+"@cleverbrush/storage-s3": minor
+---
+
+Add provider-neutral object storage contracts, portable errors and safe public URL
+mapping. Add an S3-compatible adapter with explicit custom endpoints, credentials,
+addressing style, key prefixes and independently configured public asset URLs.
+Support streamed reads, bounded multipart writes, metadata-preserving copies,
+idempotent deletion, cancellation and asynchronous disposal through `await using`
+on the shared storage contract. Include shared contract
+coverage, real Garage integration tests, and configuration examples for hosted
+and self-hosted services.

.changeset/polymorphic-write-lifecycle.md

@@ -0,0 +1,19 @@
+---
+"@cleverbrush/orm": major
+"@cleverbrush/knex-schema": patch
+---
+
+Honor hooks, timestamps and base-schema soft deletion in explicit variant writes
+and tracked polymorphic saves, for single-table and class-table inheritance.
+Add `ofVariant(key).restore()` and `hardDelete()`; CTI soft deletion retains the
+child row, while permanent deletion removes both rows atomically.
+
+**Migration:** Variant `delete()` now respects the base schema's `.softDelete()`.
+Use `hardDelete()` for physical removal, and `withDeleted()` to include hidden
+rows. Review lifecycle hooks that now run, and remove identity/discriminator/join
+keys from update patches. This change is part of the coordinated v5 major release.
+
+Capture mutation targets inside the write transaction, preserve query restrictions
+and transaction bindings, and use savepoints for caller-owned transactions. Fix
+base/variant column mapping and visibility of extension-managed deletion columns;
+retain exact numeric keys and tracked optimistic-concurrency/rollback semantics.

.changeset/preserve-column-default-changes.md

@@ -0,0 +1,9 @@
+---
+'@cleverbrush/knex-schema': patch
+---
+
+Apply and generate column default changes without dropping, retyping or changing
+the nullability of the existing column. Removing a default executes DROP DEFAULT;
+setting one executes SET DEFAULT with safely quoted values (including question
+marks and backslashes) and support for explicit SQL expressions. Generated down
+migrations restore the original default instead of assuming a timestamp column.

.changeset/projection-aware-synchronous-mapping.md

@@ -0,0 +1,23 @@
+---
+"@cleverbrush/mapper": minor
+"@cleverbrush/knex-schema": minor
+"@cleverbrush/orm": minor
+"@cleverbrush/schema": minor
+"@cleverbrush/di": minor
+---
+
+Add opt-in immutable, detached PostgreSQL reads with projection-aware runtime
+schemas, precise decimal/bigint decoding, nested relation graphs and explicit
+STI/CTI branch schemas. Reuse result schemas directly in separately defined
+application mappings without duplicating projection schemas.
+
+Add `getSyncMapper()` with synchronous eligibility inferred through the existing
+`configure()` API, completeness checks, nested mapping propagation and runtime
+thenable guards. Existing queries and asynchronous mapping behavior are unchanged.
+
+Add application-agnostic typed metadata extension methods that retain metadata
+through immutable chains. Use these in database extensions without modifying
+global schema prototypes.
+
+Preserve typed function-schema compatibility in dependency injection when a
+function declares its return schema.

.changeset/property-definition-navigation.md

@@ -0,0 +1,14 @@
+---
+'@cleverbrush/knex-schema': patch
+'@cleverbrush/orm': patch
+'@cleverbrush/mapper': patch
+'@cleverbrush/schema-json': patch
+'@cleverbrush/server': patch
+'@cleverbrush/deep': patch
+---
+
+Preserve original property declarations and JSDoc through derived types so
+editors can navigate to definitions and show property documentation. This covers
+query selectors, rows, projections and write payloads; declared relation includes;
+mapper targets; JSON Schema inferred values; composed API groups and injected
+services; and merged object properties. Runtime behavior is unchanged.

.changeset/schema-aware-read-predicates.md

@@ -0,0 +1,10 @@
+---
+"@cleverbrush/knex-schema": minor
+---
+
+Add shape-preserving grouped AND/OR predicates, captured IN/EXISTS subqueries,
+bound raw predicates and ordering, and typed SQL column references to ordinary
+and aliased schema-aware readers. These capabilities also work in ordinary ORM
+reads and nested relation customizers while retaining immutable query plans and
+stable row-schema identity. Group callbacks are synchronous and predicate-only;
+unrestricted raw query mutation remains unavailable.

.changeset/schema-boundaries.md

@@ -0,0 +1,13 @@
+---
+"@cleverbrush/schema": minor
+"@cleverbrush/schema-json": minor
+"@cleverbrush/server-openapi": minor
+---
+
+Add optional-aware fallbacks and preprocessing, and automatic named schema
+references through ordinary immutable use-site modifiers, without a wrapper API.
+Shape, validation-rule, default, fallback and extension changes clear inherited
+names; apply schemaName after those edits to establish a new named definition.
+Preserve one canonical definition in JSON
+Schema, OpenAPI and AsyncAPI with strict name collision checks. Keep existing
+type inference and optional null acceptance unchanged.

.changeset/secure-v5-release-readiness.md

@@ -0,0 +1,32 @@
+---
+'@cleverbrush/async': major
+'@cleverbrush/auth': major
+'@cleverbrush/client': major
+'@cleverbrush/deep': major
+'@cleverbrush/di': major
+'@cleverbrush/env': major
+'@cleverbrush/knex-clickhouse': major
+'@cleverbrush/knex-schema': major
+'@cleverbrush/log': major
+'@cleverbrush/mapper': major
+'@cleverbrush/orm': major
+'@cleverbrush/orm-cli': major
+'@cleverbrush/otel': major
+'@cleverbrush/react-form': major
+'@cleverbrush/scheduler': major
+'@cleverbrush/scheduler-postgres': major
+'@cleverbrush/schema': major
+'@cleverbrush/schema-json': major
+'@cleverbrush/server': major
+'@cleverbrush/server-openapi': major
+'@cleverbrush/storage': major
+'@cleverbrush/storage-s3': major
+---
+
+Require Node.js 24+ consistently across all published packages. Correct the root and all published-package license files to BSD-3-Clause, matching package metadata and documentation, and verify license consistency in source and npm tarballs. See docs/MIGRATION-v5.md for migration guidance.
+
+Harden JWT key/algorithm and claim validation, cookie parsing/serialization, and request-body lifecycle handling. Require explicit authorization scope for bounded server idempotency; coalesce concurrent retries and capture full response bodies. Bound response caching and bypass private, no-store and cookie-setting responses.
+
+Preserve DI scope validation through factories and propagate registered optional-service failures. Fix batch response status/header capture, timeout abort-listener cleanup, concurrent deduplication response cloning, CLI database cleanup on validation/production-guard failures, and the missing client idempotency JavaScript export. Update security-sensitive dependencies and ensure OpenTelemetry disable flags override SDK defaults.
+
+Add regression tests, package-consumer smoke checks, package-level unit coverage floors, migration/security documentation and release validation gates.

.changeset/server-form-validation.md

@@ -0,0 +1,10 @@
+---
+'@cleverbrush/schema': minor
+'@cleverbrush/server': minor
+'@cleverbrush/client': minor
+'@cleverbrush/react-form': minor
+---
+
+Preserve structured server validation issues through typed clients and form
+submissions. Add transport-independent external form issues, typed indexed array
+fields, and precise indexed validation paths without changing existing form APIs.

.changeset/subscription-empty-history.md

@@ -0,0 +1,5 @@
+---
+'@cleverbrush/client': patch
+---
+
+Respect maxEvents: 0 in useSubscription by retaining only lastEvent and leaving the event history empty.

.changeset/typed-idempotent-operations.md

@@ -0,0 +1,11 @@
+---
+"@cleverbrush/server": minor
+"@cleverbrush/client": minor
+"@cleverbrush/server-openapi": minor
+---
+
+Add contract-declared mutation replay with typed async request preparation,
+explicit authorization scopes, and consistent endpoint error policies. Generate
+client keys and coordinate HTTP retries/batching from the contract without
+changing ordinary client calls. Document replay headers and framework errors in
+OpenAPI while preserving domain response schemas.

.changeset/typed-multipart-json-documents.md

@@ -0,0 +1,20 @@
+---
+"@cleverbrush/server": minor
+"@cleverbrush/client": minor
+"@cleverbrush/server-openapi": minor
+"@cleverbrush/knex-schema": minor
+"@cleverbrush/orm": minor
+---
+
+Add schema-based single and multiple file upload contracts, typed multipart client
+serialization, and matching OpenAPI schemas. Enforce multipart body, file, field,
+and part limits, reject truncated or duplicate singleton uploads, and support
+file-only endpoints. Existing options-only uploads retain their single-file
+shape and explicit MIME rejection reporting.
+
+Add lossless JSONB object reads and writes using native object schemas with
+`.acceptUnknownProps().jsonb()`. Preserve nested extension data through returning
+rows and projections, validate JSON extensions in the database layer, align
+nullable object column DDL with reads, and track nested edits independently in
+the ORM. Fix the PostgreSQL
+upsert returning path exercised by document round trips.