--- title: "Changelog" description: "Release notes aggregated directly from the package changelogs." --- > Documentation Index > Fetch the complete documentation index at: https://pupitre.rikology.com/llms.txt > Use this file to discover all available pages before exploring further. # Changelog These notes are imported from each package's CHANGELOG.md at build time. Unreleased entries describe work on the current source branch, not a published npm release. ## create-pupitre-plugin [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/create-pupitre-plugin/CHANGELOG.md) ### Changelog ### Unreleased - Add opt-in `--with-ui` (`createPlugin({ withUi: true })`) scaffolding: shared catalog extension, typed server field factory, accessible React component, published `.`/`./catalog`/`./react` subpaths and generated tests; generated factory names avoid collisions. ### 0.1.0 - Added CLI and reusable createPlugin API with kebab-case/scoped names, safe directory handling and force overwrites. - Ship a working navigation plugin template with TypeScript, tsdown and a public-manager Japa integration test. - Security (WP42): reject parent traversal before path normalization and refuse symlink destinations/output files, including forced writes. - Generated packages run npm test against published build exports without source-only conditions; regression coverage uses an extracted Pupitre tarball outside the workspace. ## pupitre [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre/CHANGELOG.md) ### Changelog ### Unreleased (1.1.0) ### Changed - Localization (breaking for strict comparisons): server `t()` no longer returns its input unchanged. It returns the readable, interpolated English text followed by invisible signed translation metadata, so `t('Title') === 'Title'` is false. Resolve with `resolveTranslations()` / `stripTranslationMarkers()` before strict comparison, string transformation or delivery outside Pupitre responses, and use `captureTranslation()` / `restoreTranslation()` to persist translation intent. `Error.message`, logs and regex/`includes` checks keep reading the English text. - Tables: toggle/checkbox inline-edit cells display "Enabled"/"Disabled" instead of "On"/"Off"; Shield permission checkboxes show human labels ("View any", "View") instead of ability names. - Tenancy: the default column tenancy scope binds the tenant id as a string so TEXT ownership columns match on SQLite (better-sqlite3 binds JS numbers as REAL); integer ownership columns keep comparing and filling as integers on SQLite and PostgreSQL. ### Added - Localization: request-local English/Indonesian localization. Server `t(key, params?)` markers are resolved at every Pupitre response boundary (structured Inertia props including full-page/SSR visits, JSON actions/options/search/notifications, auth mail, CSV/progress output); plural `{ one, other, zero? }` messages and `{name}` interpolation; `defineConfig({ i18n })` host dictionaries and `definePlugin({ messages })` plugin dictionaries; localized VineJS messages with field labels (host Vine providers keep precedence for untranslated rules); panel `.locale(string)` / `.locales([...])`, user/session/Accept-Language resolution, profile language selector and an optional `locale` users-column migration stub; `locale` is a reserved page/resource slug. Record data is never translated. ADR-0023. - Localization: persisted notifications and queued CSV headers store readable text plus translation intent and are translated at read/render time (survives `APP_KEY` rotation); `tools/i18n-check` (`npm run i18n:check`) enforces Indonesian coverage of every literal `t()` key in CI. - Catalog extensions: `defineCatalogExtension()` / `mergeCatalogExtensions()` in `@rikology/pupitre/catalog` and `defineField()`, `defineColumn()`, `defineEntry()` factories with typed custom methods, inherited field methods, Zod-validated props, VineJS value validation, server formatting/dehydration and live/repeater/action-modal support; `definePlugin({ catalog })` and `page.catalogExtensions` metadata. Element `type` in specs is now an open string validated by the client registry. ADR-0024. - Tables: `table.filter.queryBuilder(name).constraints([...])` with `qb.text/number/date/boolean/select/relationship` constraints (`qb.number(...).integer()` for integer columns), negation, AND-within/OR-between groups, strict allowlist validation (400 on malformed, fractional-for-integer, out-of-range or year-zero values), size caps, scope-safe OR wrapping and timezone-aware calendar comparisons across table data, summaries, groups, relation tables, table widgets and exports. ADR-0025. - Tables: opt-in `.multiSort(max = 3)`, ordered `.defaultSort([...])` and URL `sort=title,-price` with deterministic qualified primary-key tiebreakers; existing single-sort links keep working and `sort=` clears defaults. - Validation: public `compileValidator()` / `FormValidator` so plugins, commands and jobs can validate data with a form's VineJS rules. - Authorization: opt-in panel `.strictAuthorization()` validates after panel/plugin resolution that every resource, nested resource and relation-manager related model has an explicit or discovered policy (`E_PUPITRE_MISSING_POLICY`), denies policy-less checks at runtime, and is reported by `pupitre:inspect`. - Panels: `.environmentIndicator({ visible?, label?, color? })` shares an `environment` prop (shown outside production by default); `.impersonation({ canImpersonate?, canBeImpersonated?, redirectTo? })` with `actions.impersonate()` (fail-closed `impersonate` policy ability, scoped tenant lookup, actor MFA required, rotated sessions, leave endpoint, profile security mutations blocked while impersonating, `pupitre:impersonation:started|stopped` events); `.sessions({ history?, retentionDays? })` tracks hashed browser-session tokens per login method, revokes unknown/revoked sessions on the next request, records authentication history (failed logins never store unknown emails), adds profile session management (password/passkey-confirmed "log out other sessions") and the policy-protected `loginHistoryWidget()`; `pupitre:prune` applies session/history retention. Migration stubs 1791700000045/46. - Navigation: `defineCluster(slug)` with `.label/.icon/.navigationGroup/.sort/.subNavigationPosition`, `resource.cluster()` and `page.cluster()`; clusters are discovered from their children, collapse to one authorized navigation entry, prefix child routes (tenancy URL mode and nested resources included), render sibling sub-navigation and breadcrumbs, and reject slug collisions at boot. `node ace make:cluster`. - Widgets: `.component(name, loader?)` delivers loader data to host components; `.actions([...])` runs authorized, Vine-validated widget actions through the JSON action transport; radar and scatter chart types with typed loaders. - Tables: model-free custom-data tables via `t.records()`, `t.recordKey()` and `t.resolveRecord()` with URL-backed validated search/sort/filter/pagination, count-free pagination, server-resolved row/header/bulk actions and definition-time rejection of Lucid-only features (ADR-0026); `authorizeAbility()` passes the resolved row to host abilities. - Tables: opt-in saved views (`t.savedViews()`, `t.presetViews([tableView(name).query(...).columns(...).default()])`) for resource and relation-manager tables, scoped per user/panel/tenant/table with validated stored queries, per-user defaults, explicit column visibility and fail-closed `managePublicViews` for public views. Migration stub 1791700000044. - Exports: `actions.export().formats(['csv', 'xlsx'])` with a dependency-free streaming XLSX writer (inline strings, typed cells, bold header, CSV formula-injection policy), persisted format metadata, locale-resolved headers and private queued downloads; queued CSV output now streams too. - Forms: `s.repeater(...).table([s.tableColumn(label).width().alignment().markAsRequired()])` table repeaters (positional or derived headers, `E_PUPITRE_INVALID_REPEATER_TABLE`); rich editor `.mergeTags()`, `.mentions([mentionProvider(char).options()/.search()])` through the protected options endpoint with save-time forgery stripping, and Vine-validated `.customBlocks([richBlock(id)...])`; `renderRichContent()` and `textEntry.html()/.richContent()` render escaped merge values and block HTML. - Plugin support: public `parseInZone()`/`toIsoInZone()` timezone helpers; custom and resource pages accept structural widget builders. - Plugin support: public `panelRouteGroups()` (authenticated, tenant-resolved panel route groups for plugin endpoints) and storage/upload helpers `createPupitreStorage`, `consumeFormUploads`, `sniffUploadMime`, `isUploadMimeAllowed`, `DEFAULT_UPLOAD_MAX_BYTES`. ### Fixed - Action modals: uploads inside action forms use the server-issued `uploadOwner` (resource/record context) and action validation passes the resource slug to owned-upload validation, so session-owned uploads in header-action forms validate. - Forms: `.hidden()` closures compile to a correct negated visibility condition — boolean literals flip (`.hidden(() => true)` → `visible: false`), `&&`/`||` conditions negate via De Morgan, and `!get(x)` drops its `not` — instead of spreading `not: true` onto non-condition values (which produced an invalid `{"not":true}` spec, e.g. the media resource's hidden `path` upload). Lifted `.visible()`/`.hidden()` results that are not valid json-render visibility conditions now fall back to server evaluation. ### Unreleased (1.0.0, milestone M4) ### Changed - Catalog (M4): `Repeater` and `Builder` accept the common field props; the schema compiler now emits `name`, `label`, `helperText`, `hint`, `required` and `columnSpan` for repeaters, as it already did for builders. - Actions (M4): confirmation descriptors default the submit label to the action label ("Delete", "Restore") instead of "Confirm", and destructive confirmations carry a default "This action cannot be undone." description. `confirmation.description` is now forwarded. Camel-case built-in labels are split into words ("Force Delete", not "ForceDelete"). ### Added - Shield (WP37): official `@rikology/pupitre-shield` plugin with Lucid roles/permissions, grouped role-management forms, request-cached Bouncer policies, super-admin bypass, explicit-policy preservation, custom action and nested resource grants, `shield:sync`, User-role assignment helper and custom-page access helper. - Shield review (M4): hidden relationship fields skip preload authorization/options queries using the current request context; Shield inventories are panel-local and include related-model custom abilities only for enforced resources. - Documentation (WP41): English docs site (Cloudflare Nimbus) at pupitre.rikology.com with M1–M3 guides, plugin authoring, Filament API migration, source-generated TypeScript references and package changelogs; static output publishes the generated shadcn registry index and payloads. - Plugin generators (WP36): `make:plugin ` creates an idempotent local plugin; `--force` overwrites, while `--package [--dir]` executes the standalone scaffolder pinned to the core major without a shell. - Registry (WP40): `pupitre:ui add` validates names and runs shadcn@4. Explicit root-relative file targets preserve the Inertia source tree; unsafe flattening `--path` passthrough is removed. Hook item names use kebab-case. Real CLI smoke type-checks copied Select and its dependency closure. - Plugins (WP36): `definePlugin({ name, register, resources, pages, widgets, middleware, navigation, extendResource, boot })` and panel `.plugins([...])`. Plugins apply in declaration order at boot: `register(panel)` returns a new immutable panel builder, contributions are appended to the panel's own entries, `extendResource()` runs for every (nested) resource, and `boot({ app, manager, panel })` runs before routes are registered. Plugin navigation merges into explicit panel navigation by group label, or follows the derived navigation and claims the resources it references. - Audit (WP38): optional `audit` adapter configuration and lazy `drivers/audit` reader over audit-trail, configurable model discriminators, normalized changes and pagination; timeline widgets format timestamps in the panel/user timezone and require record view authorization even on edit pages. - Read-only activity resources omit mutation routes and implicit Delete actions. Text-column/text-entry URLs support authorized asynchronous subject links, with request context passed through table rendering. Audit timestamps handle the peer's real SQLite ISO storage and UTC-normalized filter bounds. - Realtime (WP39): optional lazy `RealtimeAdapter`, boot initialization, URI-encoded user/resource channels, tenant-scoped table subscriptions, authenticated shared client metadata, and best-effort post-commit mutation/inbox pings (including queued imports and bulk actions). Existing polling remains available without a realtime client. - Realtime review (M4): namespace wire pings as `pupitre:notification` / `pupitre:table`, notify every enabled panel's user channel, and share authorization patterns plus panel guard resolution with transport plugins. - Audit review (M4): remove unused `recent`/`AuditFilters` contract; custom adapters serve record timelines while Activity queries the audit-trail model. - Import/export lifecycle records persist canonical string tenant identifiers, keeping queued worker ownership checks consistent across SQLite and PostgreSQL. - Security audit (WP42): enumerate all example mutating routes for missing/invalid XSRF rejection, enforce explicit 403 CSRF responses, disable browser Zod JIT probes under strict CSP, and publish the 1.x private disclosure policy. - Restrict UI installer registry URLs and validate component names before network access; block sensitive paths, symlinks and recognizable embedded credentials from registry publication. - Release performance audit (WP42): enforce measured gzip/Brotli budgets and lazy heavy-feature boundaries after the example CI build; load the example Transmit client only for an enabled realtime driver. - Packaging audit (WP42): verify every built runtime import uses a declared dependency/peer and resolves under ESM conditions; validate all seven package tarballs and release assets, and exclude configure-test `tmp` declarations from the core build. - Harden MIME validation and bounded tempfile buffering for resource/plugin uploads, avatars and CSV imports; apply default ceilings and serve CSV attachments with nosniff. - Throttle sensitive panel and example-host authentication endpoints with bounded local fallback or installed shared limiter, propagating limiter backend failures instead of bypassing protection. - Bind synthetic queued HttpContext into the Bouncer container resolver so injected authorization policies work in production jobs. - Login and passkey-options quotas: the IP-wide auth budget is 60/minute (it counts successful sign-ins, so shared IPs are not locked out) while the per-email failure window stays at 5/minute and clears on success. - Nested resources reused by a parent's relation manager (or reached outside nested routes) no longer fail with `.where expects value to be defined`: the nested scope constrains `:parentId` only when the route carries it. - Release 1.0 (WP42): `@rikology/pupitre`, `-react` and `-ui` move lockstep to `1.0.0`; official plugins and `create-pupitre-plugin` start at `1.0.0`; inter-package peer ranges are `^1.0.0`; `catalogVersion` is `1.0` (clients on a different major reload once); npm dist-tag `latest` via the new `release.yml` trusted-publishing workflow. - Final confirmation remediation: nested child scopes now fail closed outside an explicitly bound parent; owning relation managers bind that parent without leaking global-search or relationship-option rows. - Preserve preloaded options for client-reactive visibility while still skipping server-hidden relationship authorization and queries. - Align passkey login verification and social callbacks with the 60/minute shared-IP sign-in budget; evict the oldest local limiter key at the 10,000-key cap rather than locking out every new identity. - Initialize browser CSP jitless configuration before every catalog schema module and probe the built catalog in a fresh process during `verify:exports`; retain repeated-success login and version-derived scaffolder regressions. - Widgets: stats widgets span the full dashboard row by default (Filament `StatsOverviewWidget` parity); an explicit `.span()` before or after `.stats()` still wins. - Passkeys: deleting your own passkey from the profile no longer fails with "`limit` has no effect on a `delete` statement". The ownership lookup and the delete now use separate query builders. - Option labels: `table.text()`/`table.badge()` columns and `textEntry`/`badgeEntry` entries accept `.options(...)` (same shapes as select options) and display the label of the stored enum value instead of the raw value (`Published`, not `published`). Array values map item by item, badge colors stay keyed by the raw value, and table group headings use the options of the same-named column. `resource` scaffolding emits the options for enum columns. `BadgeEntryBuilder` is exported and types `colors()`. ### Fixed - Schema cache: field actions (`prefixAction`/`suffixAction`/`hintAction`), page actions, select action links, option/upload URLs and other request-derived props are re-evaluated per request on cache hits; previously the first request's record, URL and authorization result could be served to later users and tenants in production. - Actions: header actions (no record, not bulk) require `viewAny` before running, matching the action form endpoint; custom actions without `.can()` could otherwise run for users denied the resource. Form field actions on the create page (no record) authorize with `create`. - Tenancy: host `.scope()`, `table.query()`, custom filter/tab and relationship scope callbacks are applied as one AND-grouped `WHERE` clause, so a top-level `orWhere`, `orHas`/`orDoesntHave` or an OR inside a model scope (`withScopes`/`apply`) can no longer widen results past the tenant predicate. Non-`WHERE` calls (`orderBy`, `preload`, `join`, `select`, `withCount`) still apply to the main query. Nested resources keep the parent constraint outside the host scope group. - Tenancy: related models that are not panel resources but carry the ownership column are tenant-scoped in relationship options, relationship validation and inline option creation, matching relation managers. - CSV: exported cells and headers starting with `=`, `+`, `-`, `@`, tab or carriage return are prefixed with `'` to prevent spreadsheet formula execution (sync, queued and failed-row CSVs). Numeric values are unchanged. - Imports: CSV imports call `beforeSave` in the same lifecycle position as resource create/update. - Exports: queued exports persist the export action name; progress and download recheck that action's current `.can()` grant and fail closed when it is missing. Exports queued before this change must be recreated. - Return URLs: `X-Pupitre-Url` is validated by one helper for resource, relation-manager, page and export requests; relation managers previously used it unvalidated, and `/\host` forms are now rejected everywhere. - Records: identifiers that PostgreSQL cannot parse for the primary-key type (e.g. `/activity/create` on a UUID resource) return 404 instead of 500 on record, relation-manager, nested-parent, upload and bulk lookups. - Uploads: permanent deletes (destroy, force delete, bulk and relation-manager deletes) remove the record's file-upload objects after the transaction commits when no other row references them; soft deletes keep files and storage errors are logged without failing the delete. Reference checks are batched per field. - Uploads: new optional `pupitre_uploads` table tracks uploaded keys until a resource, list-page modal, custom page or action-form submission consumes them (after validation, before the save handler). `node ace pupitre:prune-uploads --older-than=24h` removes abandoned uploads: it claims each row before deleting its object and skips, without consuming, file fields whose references it cannot check (relationship repeaters, custom pages, removed fields). Run `node ace pupitre:install` and `node ace migration:run` to enable it; without the table uploads keep working and the command exits with an error. - Queued bulk actions validate their form in the request, so field errors reach the action modal before anything is enqueued. - Tables: image URL resolution is memoized per page and resolved concurrently instead of one storage `exists` round-trip per cell. - Tests: the PostgreSQL suite passes (relation fixtures no longer replay DDL); c8 enforces 85% line coverage on `src/compiler`, `src/query` and `src/authz`. ### Unreleased (0.3.0-beta, milestone M3) ### Added - Widgets (WP27): added immutable widget definitions, dashboard/custom/resource-page widget grids, deferred props, an authorized widget endpoint, and `make:widget` generation. - Testing (WP34): completed `@rikology/pupitre/testing` with controller-backed Japa resource/custom-page visits, VineJS form submission assertions, and action execution; added package integration and example functional coverage. - Relations (WP28): added `.relations()`/`defineRelationManager()` with grouped hasMany/manyToMany table/form tabs, tenant/parent scoping, authorization fallbacks, attach/detach/associate/dissociate and related CRUD actions; nested resources, record sub-navigation, `pages.list().modals()`, and `make:relation-manager`. - Social login (WP32b): panel `.social()` provider configuration, lazy Ally loading, guest redirect/callback, verified-email matching/registration, and MFA-aware completion. - Import/export (WP30): added `actions.export()`/`actions.import()` CSV actions, immutable `exportColumn()` formatting, prefix-aware filtered exports, schema-derived header mapping (including Skip), per-row VineJS validation/upsert transactions and failed-row CSVs. Added `maxSyncRows` hand-off, chunked scoped export jobs, boot-registered serializable import/bulk/export handlers, nested parent authorization/ownership, `pupitre_exports` progress/download lifecycle, private storage, notifications and pruning. - MfaPasskeys (WP32a): added the `completeLogin` MFA continuation seam, panel `.mfa()`/`.passkeys()` configuration, TOTP enrollment/challenge with single-use recovery codes, profile security UI, and passkey registration/management plus usernameless login; WebAuthn assertions consume one-time challenges and update credential counters/last-use timestamps. - Theme (WP33): added validated `defineTheme()` definitions and panel theme compilation for font, density, colors, sidebar modes, content width, and safe stylesheet/font URLs; `indexAdmin()` now discovers theme files. - Table interaction (WP29b): added immutable inline-edit columns with Vine validation and scoped PATCH transactions, scoped reorder endpoints, polling, persisted column toggles, responsive card layout, and deferred filter application. - Timezone (WP35): date/time parsing now respects effective component/user/panel timezone, rejects DST gaps, selects the earlier overlap offset, and keeps native datetime inputs independent of the browser zone. - Editors (WP26b): added MarkdownEditor and CodeEditor schema builders, image editor metadata, sanitized server-side Markdown rendering for TextEntry, and Vine string validation. - TableData (WP29a): added filtered-query summaries, group results, relation counts, per-column search, safe row classes, manual soft-delete scoping/actions, and deferred list data; resolved deferred response validation and now serialize column summary/image metadata. - Action extras (WP32c): action deep links, per-user/IP action rate limits, modal footer actions and submit/cancel visibility, and action-bearing flash/database notifications. - Server evaluation (WP31): added server-backed `afterStateUpdated` form closures, guarded tenant-scoped evaluation endpoint, and complete `pupitre:inspect` closure/index diagnostics. - WizardBuilder (WP26a): added immutable `s.builder()` typed block schemas, per-block Vine validation and form wizard steps with server-error step mapping. - SchemaParity (M1–M3): added masked/tel/URL text validation, textarea autosize and field hint actions, bounded `s.slider()`, transactionally synchronized `hasMany` repeaters, and related-model policy checks for Select validation. - SchemaParity/WizardBuilder (M3): apply builder field validation, metadata, defaults, and visibility; share schema traversal across wizard steps, builder blocks, and repeaters, and preserve explicit nested item bindings and form-field actions. ### Changed - Wire protocol: `catalogVersion` is now `0.3` (new catalog components, descriptor fields, page props and endpoints listed above); packages released lockstep as `0.3.0-beta`. New optional peers: `@adonisjs/ally`, `@adonisjs/queue`, `@simplewebauthn/server`, `otplib`, `qrcode`. - Authorization: Pupitre authenticates through `ctx.auth.authenticateUsing([panelGuard])`, so Bouncer policies see the panel user without relying on the host's silent-auth middleware; a policy that defines an ability method is final (fallbacks such as `replicate → create` apply only when the method is missing). - Widgets/TableData (WP27/WP29a): preserve resource/custom-page context with pagination-safe widget refresh URLs, require explicit record-page context, and recheck nested parent/page access; normalize SQL group keys through Lucid attribute serialization, merge colliding groups with weighted averages, and correlate relation summary expressions so filtered-set totals survive pagination. - MfaPasskeys (WP32a): bound MFA guesses atomically per actual user primary key across renewed password-login sessions, recovery-code regeneration and MFA disable; retain a fail-closed in-memory budget without an available optional limiter, and consume recovery codes under a transactional row lock. - WizardBuilder (WP26a): retain owning-resource metadata and full nested upload paths during block validation, persist transformed block output and propagate validation backend errors; match uploads and nested image entries by full schema path and resolve typed block `.data` paths consistently for persisted files and cleanup. - Import/export/Table interaction (WP30/WP29b): remove ordering from export counts, use primary-key batch tiebreakers and tolerate queued result-count drift; persist setup failures, keep completed exports downloadable after notification failures, and respect explicit reorder denials. - Relations/Security (WP28/WP30): require record view permission and server-side visibility for custom relation actions, resolve bulk selections through parent/tenant scopes with per-record authorization, preserve explicit policy denials, skip ownership columns for tenant-less unregistered related models, and re-check nested parent access in queued bulk workers. - Server evaluation (WP31): accept incomplete form state containing empty strings and nulls without rejecting unrelated fields. - Auth (WP32): clear the login-attempt window after valid credentials while retaining failed-password and MFA throttles. - MfaPasskeys/SocialLogin (WP32): cap MFA continuation at five failed attempts, preserve MFA enforcement for passkeys without verified user verification, expose enrollment routes without `.profile()`, and publish social identity migration with query-free callback redirects. - Widgets (WP27): table widgets now run model-backed table queries through the compiler, prefix-aware query parser, and shared server formatter; custom pages accept `.widgets()` and `.filters()`. - Widgets/TableData (WP27/WP29a): calculate summaries in SQL over scoped, filtered queries; support grouped summaries without loading all matching rows. Widget registries accept lazy barrel objects, widget descriptors expose their GET data endpoint, and generated table widgets bind a model. - Testing (WP34): isolate fixture rows in integration tests, represent deferred props in helper contexts, and resolve notification inbox database access from the active request app instead of a cached app binding. - Security (M3): enforce record and relation authorization, tenant-scope unregistered related models, preserve soft-delete hooks for relation deletes, and make panel-guard users visible to Bouncer policies. - Action extras (WP32c): resolve record-page header deep links independently of record row actions while preserving scoped record authorization. - Table interaction (WP29b): reorder requests accept a page-window offset so moving page-two rows preserves preceding global positions. ### Unreleased (0.2.0-beta, milestone M2) ### Added - Panel builder: `.login()`, `.registration()`, `.passwordReset()`, `.emailVerification()`, `.profile({ avatar })` (`.login(false)` keeps host auth), `.navigation([...])` with the new `nav.group()/nav.item()` builders (sort, badge closures, visibility, collapsible groups, external links), `.userMenu([...])`, `.domain()`, `.theme({ primary, darkMode, radius, vars })`, `.tenancy({ mode: 'url' | 'implicit', ... })`, `.notifications({ interval })`, `.globalSearch({ keyBinding } | false)`, `.pages([...])`. - Auth (WP17): spec-based login/logout, forgot/reset password (`pupitre_password_resets`, SHA-256 one-time tokens per guard with TTL, `pupitre:prune`), optional registration and signed email verification gate, profile (name/email/password with current-password check, avatar via the storage adapter), login/reset throttling through `@adonisjs/limiter` when configured. `MailAdapter` + `@rikology/pupitre/drivers/mail` over `@adonisjs/mail`. Migration stubs published by `configure`. - Navigation & panels (WP18): permission-filtered nav (`viewAny`, page `canAccess`), boot-time validation of nav slugs, multi-panel support, `make:panel`. - Authorization (WP19): full Bouncer mapping incl. `authorizeModel()` for related models, self-handled `E_PUPITRE_FORBIDDEN` (JSON 403 / Inertia redirect back + flash), `pupitre:inspect [--json]` reporting missing policies/abilities. - Tenancy (WP20): `TenancyAdapter`, default `tenant_id` column driver, `@rikology/pupitre/drivers/tenant` over `@rikology/adonisjs-tenant`, tenant-prefixed routes (mode `url`) or user current tenant (mode `implicit`), switch endpoint, automatic ownership fill, resource `.scope(false)`; every resource query goes through `scopedQuery()`. - Notifications (WP21): `NotificationsAdapter`, `@rikology/pupitre/drivers/notifications` over `@rikology/adonisjs-notifications`, `/_pupitre/notifications` (+ `/read`), `notify.*().sendToDatabase(user?)`. - Global search (WP22): resource `.globallySearchable([...])` / `.globalSearchDetails()`, `GET /_pupitre/search` (parallel, 5 authorized results per resource, tenant/policy scoped). - Custom pages (WP23): `definePage()` (path, form, fill/save, actions, `component()` escape hatch), page discovery in `indexAdmin()`, `make:page`. - `make:resource` (WP24): Lucid model introspection (columns, types, enum meta, relations) or `--from-migration`. - Dynamic options (WP25): select `options(closure)` (with `values` for validation/label resolution), `relationship(name, title, scope?)`, `searchable()`, `preload()`, `createOptionForm()`/`createOptionUsing()`, `prefixAction()`/`suffixAction()`; `GET/POST /_pupitre/options/:resource/:field`; server-side validation of submitted option values. ### Changed - Wire protocol: `pupitre.panel` gains `profileUrl`, `userMenu`, `search`; `pupitre.tenant`/`tenants` (`TenantOption`), `pupitre.notifications` (`{ unread, url, readUrl, interval }`), `navGroup.collapsed`, `brand.logoDark`; new response schemas for search, notifications and options. `catalogVersion` is now `0.2`. - `page.key` includes the tenant id; spec cache keys include the request-bound panel path. ### Unreleased (0.1.0-beta, milestone M1) ### Added - Builders: `definePanel` (path, guard, middleware, resources, brand, theme, timezone, breadcrumbs), `defineResource` with model-typed form/infolist schema, table, actions, pages and lifecycle hooks (`fill`, `mutateBeforeCreate/Save`, `before/after Create/Save/Delete`, `create`/`update` overrides; hooks receive the Lucid transaction after `ctx`), `schema` (inputs, layouts, repeater, file upload, rich editor, infolist entries), `table` (text/badge/icon/image/color/custom/fragment columns; select/ternary/dateRange/custom filters), `action`/`actions` (create/edit/view/delete/bulk), `pages`. - `@rikology/pupitre/catalog`: zod-only component catalog, wire-protocol schemas (`pageProps`, `actionDescriptor`, `actionResult`, `tableDescriptor`, `tableData`, …), `dynamic()`/`raw()` expression helpers, fixtures and `assertRegistryComplete`. - Compilers: schema → json-render spec with closure lifting (expressions/`$computed`, static fallback, `E_PUPITRE_UNLIFTABLE_CLOSURE`), record/user-independent spec cache, VineJS validator (one `vine.compile` per definition, nested repeater paths, model-aware `unique`, upload key ownership, disabled/hidden dehydration), table query/descriptor/data with server-side formatting, action descriptors/forms/execution. - HTTP runtime: per-panel routes (`..`), Inertia page props with top-level `data` for tables, JSON `ActionResult` protocol for actions, Bouncer mapping (fail-closed when a policy exists without Bouncer), uploads (`/_pupitre/upload` with MIME sniffing, size limits, session ownership, cleanup of replaced files), HTML sanitization. - `node ace configure @rikology/pupitre` / `pupitre:install`, `pupitre:routes`, `indexAdmin()` discovery hook. ## pupitre-audit [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-audit/CHANGELOG.md) ### Changelog ### Unreleased - Localize Activity navigation, fields and timeline headings. - Keep historical audit entries visible without subject links when PostgreSQL cannot parse their IDs as the subject model's primary-key type. ### 0.1.0 - Add record activity timelines backed by the configured Pupitre audit adapter. - Add a read-only Activity resource with event, subject, and date-range filters, old/new detail, and authorized subject links. - Require explicit authorization or AuditPolicy/ActivityPolicy for activity access. - Security (WP42): add regression coverage for Activity tenant isolation and subject links requiring scoped records and list/detail authorization. - M4 review: use the supported `activity` icon and clarify that custom audit adapters provide timelines, not Activity resource queries. ## pupitre-backup [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-backup/CHANGELOG.md) ### Changelog ### Unreleased - Add server-only Backups resource with fail-closed authorization, tenant-scoped metadata, private streamed downloads, and file-removing deletion. - Add consistent SQLite, PostgreSQL custom-format, and transactional MySQL snapshots, gzip-streamed to Drive with credential-safe errors and guaranteed ordinary-path temporary cleanup. - Add durable cross-process concurrency exclusion, post-success count/age retention, optional jobs dispatch, and schedulable `backup:run` command. - Document administrator-only access and manual restoration procedures; no web restoration endpoint is exposed. ## pupitre-calendar [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-calendar/CHANGELOG.md) ### Changelog ### Unreleased - Add immutable calendar widgets and calendar page plugin, custom event loaders, tenant-scoped resource event sources, policy-aware navigation, and validated UTC rescheduling. - Add lazy month/week/day/agenda UI in pupitre-ui with responsive agenda defaults, drag moves, accessible keyboard Move dialogs, and optimistic rollback. ## pupitre-health [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-health/CHANGELOG.md) ### @rikology/pupitre-health ### Unreleased - Add a fail-closed AdonisJS health dashboard with process-local TTL caching, concurrent-run coalescing, forced refresh, summary statistics and custom-data check tables. - Filter diagnostic metadata to known numeric measurements; publish a host-owned disk/memory/database check registry. ## pupitre-jobs [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-jobs/CHANGELOG.md) ### @rikology/pupitre-jobs ### Unreleased - Monitor all AdonisJS Queue jobs through supported lifecycle tracing channels, preserving each execution attempt. - Add tenant-scoped Jobs lists, status tabs, payload/error details and 24-hour stats. - Encrypt original retry payloads, recursively redact credentials, and fail closed on authorization and retry eligibility. - Add terminal-run retention pruning, an Ace command, migration publishing and a runnable host-job example. ## pupitre-kanban [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-kanban/CHANGELOG.md) ### Changelog ### Unreleased - Add resource-scoped Kanban board pages, policy-aware card/create links, immutable business-rule gates, and transactional status/position moves. - Add lazy sortable board UI with keyboard and pointer interaction, per-column loading, announcements, optimistic rollback, and bilingual copy. ## pupitre-media [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-media/CHANGELOG.md) ### Changelog ### Unreleased - Add a fail-closed, tenant-aware Media resource with thumbnail grids, search/type/date filters, multi-file uploads, metadata editing, and original/conversion cleanup on delete. - Add immutable mediaPicker/mediaEntry/mediaColumn catalog extension factories, ordered multi-selection, MIME/count/ownership validation, and private signed thumbnails. - Reuse Pupitre's owned-upload pipeline and expose an authenticated media browse/adoption protocol for inline uploads. - Add lazy optional Sharp conversions, a default 320px WebP thumbnail, and original-only fallback without Sharp. ## pupitre-react [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-react/CHANGELOG.md) ### Changelog ### Unreleased (1.1.0) ### Added - Toasts: optional `` auto-dismiss delay in milliseconds; default `0` retains manual dismissal, with per-toast deadlines preserved across navigation. - Localization: client `t(key, params?)` resolves synchronously from the compact `pupitre.messages` shared prop and follows locale changes across Inertia visits. - Catalog extensions: `defineRegistry(components, { extensions })` merges extension schemas, requires a component per extension, and reports unregistered or unknown spec types with an actionable developer error. - Tables: `useTable` supports JSON QueryBuilder filter state and ordered multi-column sort, including explicit default clearing. - Widgets: `useWidget(descriptor, initialData)` returns `{ data, loading, errors, reload(params?), runAction(name, data?) }` with stale-response suppression and `WidgetRequestError`; component widgets receive unwrapped loader data. - Tables: `useTableViews(descriptor, onColumns)` lists, applies (prefix-preserving Inertia visits) and mutates saved views. - Shell: optional `environment`, `impersonation` and cluster navigation props are forwarded through built-in and host-owned shells; export confirmations support XLSX downloads and format choice. ### Fixed - Action modals: uploads use the server-issued `uploadOwner` instead of deriving resource context from the action name. ### Unreleased (1.0.0, milestone M4) ### Added - Realtime (WP39): optional `Pupitre`/`PupitreShell` client context, SSR-safe `useRealtimeSubscription` with stable callbacks and cleanup, coalesced descriptor-scoped `useTableRealtime`, and notification push refresh with polling fallback. - Security (WP42): preserve Request-input methods and headers in `jsonFetch`, ensuring XSRF headers on all mutating methods; add multipart/upload/deletion regressions. ### Changed - Navigation guard (M4): `useNavigationGuard(shouldBlock)` no longer calls `window.confirm`. It returns `{ pending, proceed, cancel }` and holds the blocked Inertia visit, so the caller can render its own confirmation; `proceed()` re-issues the visit with its original options. Prefetch visits are no longer blocked. Tab close/reload still use the browser's native prompt. ### Fixed - Options: abort superseded searches during debounce and discard late responses without changing options, paging, loading, or errors. ### Unreleased (0.3.0-beta, milestone M3) ### Added - Widgets (WP27): added polling-driven partial reloads for widget props and widget grid rendering integration. - Relations (WP28): `useTable` reads descriptor-selected top-level data props and namespaces table query keys while preserving list-page `data` behavior. - Action extras (WP32c): modal deep-link URL synchronization and initial query-param opening, modal footer action execution with form data, and global shortcuts for non-row actions. - Server evaluation (WP31): wired debounced `evaluate` actions to `/_pupitre/evaluate`, ignored stale responses, and applied only safe `/data/**` state updates. - WizardBuilder (WP26a): action modals navigate wizard steps, submit on the final step, select the first errored step after a 422, and retain Next/Back navigation alongside footer actions when modal submit is disabled. - Import/export (WP30): direct CSV downloads and jobs-backed export/import polling now flow through the action bridge, with progress/completion toasts and file delivery. ### Changed - Confirm fixes (M3): share Cmd/Ctrl shortcut matching across page and UI actions, include field affix/hint shortcuts, and suppress export cancellation errors on navigation. - Widgets (WP27): resolve and submit resource forms nested beneath widget layouts, without selecting disconnected forms. - Widgets (WP27): widget tables can render outside the spec runtime while retaining `useTable` URL-prefix sorting, pagination, and prop-only reloads. - Action extras (WP32c): import actions now stop before form submission and page-level shortcuts dispatch once; footer confirmations gate requests. - WizardBuilder (WP26a): 422 errors select the first invalid step once per submit, without pinning navigation to stale errors. ### Unreleased (0.2.0-beta, milestone M2) ### Added - `kind: 'auth'` pages render inside the registry `AuthShell`; `kind: 'custom'` pages and host pages can keep the panel shell through `PupitreShell`. - `ShellProps` gains `tenant`, `tenants` and `notifications`; `ShellRegistry` gains `AuthShell`. - Hooks: `useOptions` (debounced, abortable, paged dynamic select options), `useNotificationsPolling` (pauses while the tab is hidden); shared `jsonFetch`/`xsrfToken` bridge helpers. ### Unreleased (0.1.0-beta, milestone M1) ### Added - `Pupitre` Inertia page, `PupitreRenderer` (store reset only on `page.key` change; reloads refresh `/errors`, `/meta/record`, `/options`), `SpecRenderer` for nested specs, `defineRegistry` (catalog + shell components, built-in `$computed` functions, `$raw` directive). - Inertia bridge: form submission with 422 → `/errors/**`, action protocol (link/direct/confirm/form) over JSON `fetch` with `X-Pupitre-Action`, `X-Pupitre-Url`, XSRF header and descriptor HTTP method, `ActionResult` handling (flash, redirect, reload, patch, deselect), uploads, toasts surviving redirects, catalog-version mismatch reload guard. - Hooks: `useBoundValue`, `useFieldError`, `useStateValue`, `useSetState`, `usePanel`, `usePage`, `useRunAction`, `useTable` (URL-driven table state with partial visits), `useSubmitForm`, `useEmbedded`, `useUpload`, `useToast`, `useVisit`, `useNavigationGuard`; test seams `setRouter`, `setFetch`. ## pupitre-settings [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-settings/CHANGELOG.md) ### @rikology/pupitre-settings ### Unreleased - Add immutable typed settings groups, generated custom pages and optional page actions. - Every writable form field must have a `.defaults()` entry; missing defaults fail at plugin registration. - Persist JSON values with merged defaults, shared VineJS validation and atomic transactions. - Add fail-closed group authorization, tenant isolation and request-scoped caching. - Publish an idempotent SQLite/PostgreSQL migration through the configure hook. ## pupitre-shield [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-shield/CHANGELOG.md) ### Changelog ### Unreleased - Localize role and permission management labels and user-facing errors. ### 0.1.0 — Milestone M4 - Add Lucid Role and Permission models, global role-management resource with resource-grouped permission checkboxes, and configurable host user relation/table integration. - Add request/user-cached Bouncer policies, explicit-policy preservation, independent standard ability checks, custom action abilities, nested-resource discovery, and super-admin bypass. - Add `shieldCan` page authorization and `shieldRolesField` User-resource relationship helper. - Add configure migration publishing and lazy Ace command registration; `shield:sync` idempotently synchronizes resource permissions and can bootstrap a super administrator by ID/email. - Add SQLite HTTP integration coverage and seeded example editor/super-admin integration. - Security (WP42): forbid non-super-admin escalation through role names or permission delegation, protect the reserved role, and invalidate request-cached grants after edits; expose `invalidateShieldPermissions()` for host-managed pivot changes. - Persist `shieldRolesField()` assignments and revocations transactionally with authenticated delegation checks, preserving host hooks and invalidating grants after pivot synchronization. - Cover Shield-protected production queued workers, permission revocation, changed principals, cross-tenant records and revoked memberships. - Thread active transactions through permission checks, isolate request caches from transaction snapshots, and authorize both permission additions and removals while preserving unchanged grants. - Restrict Roles form inventories to enforced resources, discover relation-manager abilities on related resources, and isolate inventories when a plugin instance is reused across panels. - Hide unauthorized role-assignment fields without blocking User forms or preloading forbidden options; preload existing role selections on edit. - Reject deletion of roles containing any resource or host permission the actor lacks, while retaining super-admin bypass and deletion of fully delegated roles. - Validate role-assignment IDs as positive PostgreSQL-range integers before querying Roles; normalize equivalent numeric IDs and cover create/update rejection with query-spy regressions. ## pupitre-transmit [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-transmit/CHANGELOG.md) ### Changelog ### Unreleased (milestone M4) - Add `transmitRealtime()` with panel-guard, user identity, tenant membership, and resource policy channel authorization. - Add SSR-safe `transmitRealtimeClient()` at `/client`, shared subscriptions, catalog payload validation, and Shield XSRF request headers. - Security (WP42): add malformed-channel and guard-principal/tenant isolation regressions alongside subscribe/unsubscribe XSRF coverage. - M4 review: reuse core channel patterns and panel guard helper; accept only namespaced `pupitre:notification` and `pupitre:table` wire pings. ## pupitre-ui [Package source](https://github.com/rikoriswandha/pupitre/blob/main/packages/pupitre-ui/CHANGELOG.md) ### Changelog ### Unreleased (1.1.0) ### Added - Localization: accessible, tenant-aware language switcher in the user menu and profile; built-in dialogs, forms, editors, uploads, widgets and accessibility text are translated. - Tables: QueryBuilder editor (typed values, negation, AND/OR groups, active summaries) in every filter layout, and keyboard-accessible multi-column sort controls with priority announcements. - Catalog extensions: DataTable and nested infolist entries render registered custom columns/entries with formatted values and row/record context. - Shell: environment badge and top strip across sidebar/collapsed/top-nav layouts, impersonation banner with CSRF-protected leave, responsive cluster sub-navigation. - Tables: Views toolbar (save/update/rename/default/public/delete, saved column visibility), simple pagination and header actions for custom-data tables, CSV/Excel format picker for exports. - Forms: accessible table repeater (numbered row controls, drag and keyboard reorder, per-cell errors, horizontal scroll at narrow widths); rich editor merge-tag and mention suggestions and custom-block preview cards with isolated edit modals. - Widgets: radar and scatter charts in the lazy chart chunk with screen-reader data tables. - Profile: Browser sessions and Recent logins sections. - Plugin surfaces (lazy): `Calendar` (month/week/day/agenda, drag and keyboard rescheduling with rollback), `KanbanBoard` (dnd-kit sortable cards, keyboard moves, per-column loading, rollback), `MediaPicker`/`MediaEntry`/`MediaColumn`. ### Fixed - Dark theme primary (`oklch(0.545 0.1 163)`) raises primary-button text contrast above WCAG AA (4.53:1). - Table grid cards: the selection checkbox sits beside the card title instead of being pushed to the opposite edge, and long field values wrap inside the card instead of overflowing it. ### Unreleased (1.0.0, milestone M4) ### Changed - Redesign (M4): new default "writing desk" skin. Warm OKLCH neutrals (canvas, sidebar, card layers), blotter-green default primary, semantic `success`/`warning`/`danger`/`info` tokens with derived `-soft`/`-ink` variants (mixed in oklab so a `theme.primary` override re-skins every state), `--input-strong` for checkbox/radio/switch boundaries, chart palette, elevation and density (`--control-h`, `--row-py`) tokens. See the root `DESIGN.md`. - Primitives (M4): `Button` now takes `variant` (`solid`/`outline`/`ghost`/`link`) × `color` (`primary`/`gray`/`success`/`warning`/`danger`/`info`) × `size` (`xs`–`lg`) plus `square` and `loading`; the old `default`/`secondary`/`outline`/`destructive` variants are removed. New exports: `buttonClasses`, `controlClasses`, `Textarea`, `InputGroup`/`InputAddon`/`InputSlot`, `FieldDescription`, `RequiredMark`, `CheckboxControl`, `SwitchControl`, `Avatar`, `Kbd`, `Spinner`, `Skeleton`, `Tooltip`, `Panel`/`PanelHeader`, `EmptyState`, `toTone`, and popup/dialog/tab class helpers. - Shell (M4): sticky topbar (search field, notifications, avatar menu), breadcrumbs above the page title, raised active navigation items, icon-rail tooltips, tenant switcher card, mobile drawer, and header actions laid out by the new `ActionList` (leading action promoted to primary, overflow in a "More actions" menu). - Components (M4): every catalog component restyled: tables in a single panel with toolbar search, filter/column popovers, bulk-action menu and row actions collapsed after two; form sections, tabs and wizards as panels (nested panels flatten through `PanelNestingContext`); selects and pickers open popups; infolists, widgets, modals, toasts, auth and profile screens follow the same system in light and dark. - Testing (M4): `AdminPage.openAction(name, row)` opens a row's "More actions" menu when the action is not inline. - Motion (M4): shared easing tokens (`ease-ui`, `ease-move`, `ease-drawer`) replace ad hoc curves. The desktop sidebar rail toggle morphs via the View Transitions API (sidebar crossfades and resizes, content slides; instant under reduced motion or without browser support). Section, Repeater item, Builder block and sidebar nav group bodies open and close with a height and fade transition through the new `Collapse` primitive, with rotating chevrons. Toasts grow in from the bottom edge and close their slot on dismissal instead of disappearing. Top-navigation group dropdowns and the bulk-selection toolbar fade in, and buttons give subtle press feedback. ### Added - Registry (WP40): deterministic shadcn registry generated from UI sources, versioned npm/import-graph dependencies, preserved relative targets, public `/r/*.json` payloads and index, CI drift check, and copy-ability tests. - Audit (WP38): `Widget.Timeline` catalog renderer and exported `WidgetTimeline` display server-formatted activity times, actors, icons/colors, structured field changes, and empty states; `WidgetGrid` supports timeline spans and deferred data. - Realtime (WP39): DataTable and NotificationTray replace polling with configured channel subscriptions, retain polling fallback, and clean up subscriptions and pending reloads on unmount. - Realtime inbox (WP39): open notification trays refresh items on user-channel pings through the existing single subscription; superseded requests are aborted and late responses cannot overwrite the current inbox. - Accessibility (WP42): strict WCAG 2.1 A/AA axe coverage across registry fixtures, shell/account components, dialogs and interactive popup/editor/table states, plus an example auth/CRUD/settings/security audit. ### Fixed - DataTable: preserve versioned pending and settled inline edits across older in-flight refreshes (including rollback to a previously saved edit), release saved overrides when the server confirms them, a refresh issued after settlement lands, or host-supplied props change; ignore visits cancelled before they start, revert failures to the latest authoritative value, and memoize column definitions and descriptor lookup. - Accessibility: table selection and inline toggle targets are at least 24px without enlarging checkbox visuals, switch tracks, or text-only rows in compact and comfortable density. - Class merging (M4): `cn()` now resolves conflicting utilities with `tailwind-merge`, so a component's `className` reliably overrides primitive defaults instead of depending on CSS order. Template-literal class concatenations with conflicts now go through `cn()`. - Selects (M4): table filters, grouping, rows-per-page, editable cells, widget filters and import mapping use the new `SelectMenu` primitive, the same Base UI trigger and listbox as form `Select`, instead of native `