@critical-path/core 0.51.0 → 0.51.1

package/CHANGELOG.md

@@ -0,0 +1,780 @@
+# @critical-path/core
+
+## 0.51.1
+
+### Patch Changes
+
+- da8c69b: Packages now include `CHANGELOG.md`, so agents and developers can read breaking changes in `node_modules`. READMEs link the new upgrade guide (`UPGRADING.md`, also at /getting-started/upgrading/ on the docs site), which coding agents in consumer apps can follow to migrate on their own.
+
+## 0.51.0
+
+### Minor Changes
+
+- a7e9f4a: Tool fixes for the CLI, client, MCP and analysis queries.
+  
+  - **BREAKING (server):** workload and ladder query parameters are validated with the new `WorkloadQuerySchema` and `LadderQuerySchema` (exported from core). Unknown or invalid values (e.g. `interval=fortnight`, `defaultWeeklyCapacityHours=abc`) return `400` instead of silently producing odd results.
+  - CLI `block`, `clarify` and `deliverable` merge into a task's existing `customFields` instead of replacing them. `deliverable` no longer swallows API errors. `subtask list` asks the server for the parent's subtasks instead of downloading every task. The CLI warns when sending an API key over plain HTTP to a remote host.
+  - CLI `propose` and `subtask`, `client.createSubtask` and MCP `create_task` no longer force `draft` or `todo`. New tasks use the project workflow's default status unless one is given.
+  - MCP `list_tasks` filters by `deliverableId`, `containerId` and `parentId` (`'none'` for top-level tasks). Resources and prompts wait for `engine.ready` and include at most 200 tasks. WebMCP sends standard `readOnlyHint`/`destructiveHint` annotations and registers nothing when its signal is already aborted.
+
+## 0.50.0
+
+### Minor Changes
+
+- 7896d0d: Engine correctness fixes.
+  
+  - Deleting a project no longer reloads every task in the project for each deleted task. Subtasks are found through the store's indexed parent filter, so large project deletes are no longer quadratic (they held the SQLite lock throughout).
+  - Auto-unblocking: `task.unblocked` is published only for tasks that were actually blocked. Canceled upstream tasks count as satisfied, and canceling a task also triggers the check. Upstream statuses are read with their own project's definitions, and upstream tasks the caller cannot read still block.
+  - **BREAKING:** `createTask`, `createContainer`, `createIteration` and `createDeliverable` reject unknown projects, and `addDependency` rejects missing tasks, even without an authorization policy. Adding an existing dependency returns it instead of creating a duplicate edge. A project's `workflowId` must name a workflow in the same tenant; cross-tenant workflows are also ignored when resolving.
+  - Engine `update*` methods ignore `id`, timestamps and ownership fields (`projectId`, `taskId`, `authorId`, `reactions`, and the tenant on actor views), not just the HTTP schemas. `updateWebhook` keeps `customFields`.
+
+## 0.49.0
+
+### Minor Changes
+
+- bbc4305: `customFields` on every entity.
+  
+  - Projects, workflows, teams, containers, iterations, comments, attachments, time entries, dependencies and webhooks now accept and return an optional `customFields` JSON object, as tasks and deliverables already did. Because request bodies are strict, this is the supported place for your own data. Task custom fields remain validated against `customFieldDefinitions`; on other entities any JSON object is stored as-is, and updates replace the whole object.
+  - `SQLiteStore` keeps it in each table's JSON `extra` column, which now exists on every table. The storage conformance suite round-trips `customFields` on every entity, so custom adapters must too.
+  - `UpdateIterationSchema` and `UpdateCommentSchema` are now strict, so unknown keys get `400` instead of being silently dropped.
+  - MCP `create_project`, `create_task`, `update_task`, `create_deliverable` and `add_comment` accept `customFields`.
+
+## 0.48.1
+
+### Patch Changes
+
+- cb71e39: Workload: when no `endDate` is given, the date range now includes each undated task's derived end (start plus one day per 8 hours). Before, effort that ran past every recorded date (e.g. a task created on a weekend with no dates) fell outside every bucket and was dropped.
+
+## 0.48.0
+
+### Minor Changes
+
+- f151568: Engine integrity fixes (security).
+  
+  - **BREAKING (authorization):** adding, removing or changing an `admin` project member now also requires the new `project.manage_admins` action, which the role policy grants to `admin` (and superusers). Project managers can no longer promote themselves and then delete the project. Custom policies must grant `project.manage_admins` where admin changes should be allowed.
+  - Task `parentId` must name a task in the same project, and cannot be the task itself or one of its descendants. A cycle previously crashed `deleteTask` with unbounded recursion; cascades now also skip tasks they are already deleting.
+  - `logTime` adds hours atomically through a new optional `StorageAdapter.incrementTaskHours` (implemented by `SQLiteStore` and `InMemoryStore`), so concurrent logs are no longer lost.
+  - Events from cascades inside a store transaction (SQLite) are routed to the right tenant's webhooks. Their tenant is resolved inside the transaction, before the records are deleted.
+
+## 0.47.0
+
+### Minor Changes
+
+- fde5883: Router hardening (security).
+  
+  - **BREAKING:** built-in routes match exact paths only. An unknown sub-path returns `404` (e.g. `DELETE /tasks/:id/time-entries/x` used to delete the task), and a known path with the wrong method returns `405` with an `Allow` header. Only paths in `ROUTES` or the documented aliases are dispatched.
+  - **BREAKING:** non-empty request bodies must be `application/json` (or `+json`); others return `415`. This blocks cross-site form posts against cookie-based `getContext`. The client SDK already sends JSON.
+  - **BREAKING:** `POST /status` takes a strict body (`taskId` or `projectId` required) and requires `task.update` on the project, so it can no longer trigger webhooks in other tenants or anonymously. It publishes a well-formed `agent.status_updated` event through the new `engine.reportAgentStatus`; the event is in `DOMAIN_EVENT_NAMES`, so webhooks can subscribe to it.
+
+## 0.46.0
+
+### Minor Changes
+
+- d82d168: Remaining effort and hidden work in critical path analysis.
+  
+  - New `effort` option (`'estimate'` by default, or `'remaining'`), with a `criticalPathEffort` engine default. With `'remaining'`, in-progress tasks are scheduled for `max(0, estimate - loggedHours)`, divided by allocation. Available on both critical path methods, `?effort=`, the client and the MCP tools. `getTaskScheduledHours(task, effort)` takes the basis.
+  - New `includeHiddenWork` option for `calculatePortfolioCriticalPath` (`?includeHiddenWork=true`, client, MCP). It requires `workspace.manage`. Every other project in the caller's tenant then counts toward people's and teams' capacity without appearing in the results. Tasks from projects the caller cannot read appear only as `'hidden'`, and over-allocations are reported only when they involve a task in the results. `calculatePortfolioCPM` project inputs accept `background: 'visible' | 'hidden'`.
+
+## 0.45.0
+
+### Minor Changes
+
+- 3c08dd9: Critical path analysis across projects, and finished tasks take no time.
+  
+  - New `engine.calculatePortfolioCriticalPath({ projectIds?, projectOrder?, ...options })` and `calculatePortfolioCPM`. They analyse several projects together. Each project keeps its own start and calendar, dependencies between projects are honoured, and with `calendars: 'assignee'` and `levelResources: true`, people and team pools are shared, so nobody is booked above capacity across projects. `projectOrder` ranks projects for levelling. The result has one analysis per project, the latest end, and the combined `overallocations`.
+  - Only projects the caller can read are included. Without `projectIds`, unreadable projects are left out; unreadable or unknown ids are rejected. Runs above `portfolioTaskLimit` (engine config, default 5000 tasks) are rejected.
+  - REST: `GET /portfolio/critical-path?projectIds=...&projectOrder=...`. Client: `calculatePortfolioCriticalPath`. MCP: `calculate_portfolio_critical_path`.
+  - **BREAKING (behaviour):** completed and canceled tasks now take no time in all critical path analysis and occupy nobody when levelling, so durations and dates reflect remaining work. New helpers: `isTaskFinished` and `getTaskScheduledHours`.
+
+## 0.44.0
+
+### Minor Changes
+
+- b3ef9c6: Team capacity pools in resource levelling.
+  
+  - New `Team.headcount`: how many people the team can put on work at once. Default: its member count.
+  - When levelling, team-only tasks use slots in their team's pool, and tasks assigned to members also use slots in every team the member belongs to. Teams with no members and no `headcount` stay unconstrained. A delayed task is linked to the task whose finish freed its capacity, so slack follows the chain that caused the delay.
+  - **BREAKING (types):** `Overallocation.assigneeId` is optional. Entries have `teamId` for pools and a new `capacity` field (1 for a person, headcount for a team).
+  - Assignee-mode analysis only uses teams from the project's tenant.
+
+## 0.43.1
+
+### Patch Changes
+
+- 867cdae: `engine.createTask` now stores every field accepted by `CreateTaskSchema` (including `todos`) instead of a hand-maintained list, so new task fields are no longer silently dropped on create. Keys outside the schema (`id`, timestamps, identity fields) are still discarded.
+
+## 0.43.0
+
+### Minor Changes
+
+- efa342f: Partial task allocation.
+  
+  - New `Task.allocation`, in (0, 1], default 1: the share of the assignee's time a task takes. Estimates are effort, so in critical path analysis (every mode) a task spans `effort / allocation` working hours. Results report `allocation` per task, and `durationHours` is the elapsed span. New helpers: `getTaskAllocation` and `getTaskElapsedHours`.
+  - Resource levelling uses capacity. Each assignee has 100% at any moment, so fractional tasks can run side by side and others wait for enough capacity. Slack links only tasks that cannot overlap.
+  - Assignee-mode results include `overallocations`: periods where an assignee is booked above 100%, with the total and the tasks involved. Empty after levelling.
+  - Fix: `createTask` stored only an explicit list of fields; it now keeps `allocation`.
+  - MCP `create_task` and `update_task` accept `allocation`.
+
+## 0.42.0
+
+### Minor Changes
+
+- f548659: Resource levelling for critical path analysis.
+  
+  - `calculateCriticalPath(id, { calendars: 'assignee', levelResources: true })`, or `criticalPathLevelResources` on the engine, schedules each assignee on one task at a time. Tasks are placed in priority order at the earliest time their predecessors are done and their assignee is free on their own calendar. Tasks are not split, and unassigned tasks are unconstrained.
+  - `levelingPriority`: `'slack'` (default: least unlevelled slack, then task priority), `'priority'`, `'dueDate'` or `'order'`.
+  - Slack and critical tasks are recomputed over dependencies plus each assignee's task sequence. Tasks report `levelingDelayHours` and `waitingOn`; the analysis reports `leveled` and `unleveledProjectEndDate`.
+  - REST: `?levelResources=true&levelingPriority=...` (400 for invalid values, or for levelling without `calendars=assignee`). Client options and MCP arguments to match.
+
+## 0.41.0
+
+### Minor Changes
+
+- 65044e3: Work schedules honour their time zone.
+  
+  - **BREAKING:** `WorkSchedule.timezone` (IANA name, default UTC) now applies. Hours, weekdays and holiday dates are wall-clock rules in that zone. `addWorkingHours`, `subtractWorkingHours`, `getWorkingHoursBetween`, `nextWorkingTime` and `previousWorkingTime` follow its UTC offset and daylight-saving changes. Day-level helpers use the local date an instant falls on. Critical path analysis (both modes) and workload inherit this, so work handed from a London assignee to a New York one continues at the New York assignee's next working moment.
+  - **BREAKING:** date-only strings and date-times without an offset (`2026-10-05T09:00`) are read as wall-clock time in the schedule's zone (UTC by default), instead of the server's local zone.
+  - Unknown zones are rejected by `WorkScheduleSchema` and throw a `RangeError` in calendar functions. New `isValidTimeZone` helper.
+  - Calendar arithmetic caches each schedule's per-day working windows and zone offsets, making critical path analysis on long projects about 8× faster. Treat schedule objects as immutable once used.
+
+## 0.40.0
+
+### Minor Changes
+
+- cfd3215: Critical path analysis can schedule each task on its assignee's calendar.
+  
+  - `calculateCriticalPath(projectId, { calendars: 'assignee' })`, or `criticalPathCalendars: 'assignee'` on the engine, schedules each task on the assignee's `schedule` (from `users`), then the task team's schedule, then the project calendar. Passes run on dates, so a Friday-off assignee pushes their successors to Monday. Slack is measured in each task's own working hours, and each task reports the `scheduleId` it used. Without a project start date, assignee mode starts today (UTC midnight). Calendars are evaluated in UTC.
+  - The default `'project'` mode is unchanged.
+  - REST: `GET /projects/:id/critical-path?calendars=assignee` (unknown values return 400). Client: `calculateCriticalPath(id, { calendars })`. MCP: a `calendars` argument on `calculate_critical_path`.
+  - New calendar helpers `nextWorkingTime` and `previousWorkingTime`, and `resolveTaskSchedule`.
+
+## 0.39.0
+
+### Minor Changes
+
+- c7ad4d4: Atomic cascading deletes through an optional `StorageAdapter.transaction(fn)`.
+  
+  - When the store provides `transaction`, the engine runs `deleteTask`, `deleteProject`, `deleteContainer`, `deleteIteration` and `deleteDeliverable` inside it. Domain events, `afterTask*` hooks and file deletions are deferred until commit, so a failed cascade (for example, a `beforeTaskDelete` hook throwing on a subtask) deletes nothing and publishes nothing.
+  - `SQLiteStore` implements it. Its constructor now returns a Proxy. Calls from inside an open transaction (found via `AsyncLocalStorage`) join it, other calls wait, and the transaction starts only after in-flight calls finish, so concurrent requests are never rolled back with it.
+  - `InMemoryStore` and `FirebaseStore` keep the previous non-transactional, idempotent cascades.
+
+## 0.38.0
+
+### Minor Changes
+
+- 8e52679: Webhooks: DNS-aware SSRF checks and a durable outbox.
+  
+  - Private-address detection now parses IPv4/IPv6 properly. It covers carrier-grade NAT, multicast, reserved and documentation ranges, encoded IPv4 (`http://2130706433/`), IPv4-mapped/NAT64/6to4 IPv6, and `*.local` names. `isPrivateAddress` is exported.
+  - **BREAKING:** before each attempt the webhook host is resolved (via `node:dns` where available, or `webhookDelivery.resolveHost`), and the delivery fails if any address is private, unless `allowPrivateUrls` is set. Redirects are no longer followed; a 3xx counts as a failed attempt.
+  - New `OutboxWebhookQueue` stores delivery attempts through the `WebhookOutboxStore` interface. `SQLiteStore`, `FirebaseStore` and `InMemoryStore` implement it. Claims are leased and delivery is at-least-once. Run it with `start()` or `processDue()`.
+  - `WebhookDeliveryQueue` gains an optional `attach(deliver)` hook.
+
+## 0.37.0
+
+### Minor Changes
+
+- d4477b1: Team-based project membership and store-level tenant filtering.
+  
+  - `project.members` entries can be teams: `{ teamId, role }` gives every user in `team.memberIds` that role. A user matching several entries gets all of their permissions. `AuthorizationRequest` gains `teamIds`, the actor's teams in their tenant. Memberships are cached per engine and refreshed whenever a team changes through the engine.
+  - **BREAKING (storage adapters):** `getProjects(filter?)` accepts `{ tenantId }`, applied by the store; SQLite uses a new index. The engine uses it for tenant-scoped actors instead of loading every project.
+
+## 0.36.1
+
+### Patch Changes
+
+- 85d9bb5: Publish only what consumers need.
+  
+  - Packages no longer ship compiled tests or TypeScript sources (`files: ["dist", "!dist/**/*.test.*"]`). `@critical-path/core` goes from 330 files to 146.
+  - `exports` maps list `types` first, as TypeScript's resolution expects.
+
+## 0.36.0
+
+### Minor Changes
+
+- 810d8d1: Upload and request body limits.
+  
+  - **@critical-path/core:** new `uploads: { maxBytes, allowedMimeTypes }` engine option, with `type/*` wildcards. It applies to direct uploads (decoded size), presigned uploads (content type) and registered attachments (declared size and type). Violations throw `ValidationError` (400).
+  - **@critical-path/server:** new `maxBodyBytes` router option (default 10 MiB). Larger bodies get `413`, checked while streaming rather than only through `Content-Length`. Previously bodies were read without any limit.
+
+## 0.35.0
+
+### Minor Changes
+
+- b13f7c4: `InMemoryStore` returns copies.
+  
+  - **BREAKING:** `InMemoryStore` deep-copies (`structuredClone`) every argument and result, so mutating a returned record, or an input object you keep using, no longer changes stored state. This matches SQLite and Firestore. Call `update*` to change records.
+  - The conformance suite checks that adapters return copies. `InMemoryFirestoreMock` now copies too, like real Firestore.
+
+## 0.34.0
+
+### Minor Changes
+
+- 1cc0d4c: Domain events for every team, container and iteration change, and collision-safe ids.
+  
+  - New events: `team.updated`, `team.deleted`, `container.updated`, `container.deleted`, `iteration.created`, `iteration.updated` and `iteration.deleted`. They are delivered to webhooks like other events; deleted events carry the ids needed to route them to the right tenant. Previously these changes published nothing.
+  - Event ids and the ids generated by `InMemoryStore`, `SQLiteStore` and domain entities now use `crypto.randomUUID()` (e.g. `task_<uuid>`) instead of 7 random characters, which were likely to collide at around a million records.
+
+## 0.33.0
+
+### Minor Changes
+
+- aa94129: Storage adapter conformance suite and parity fixes.
+  
+  - New `@critical-path/core/testing` entry with `runStorageAdapterConformance({ name, createStore, describe, it, expect })`, the suite the built-in adapters run, for verifying custom adapters.
+  - `SQLiteStore` no longer drops fields. Tasks keep `key`, `semanticStatus` and `todos`; projects keep `schedule`, `startDate` and `targetEndDate`; teams keep `weeklyCapacityHours` and `schedule`; attachments keep `artifactType`. Fields without a dedicated column are stored in a JSON `extra` column, which is added to existing databases automatically.
+  - `FirebaseStore` applies every filter passed to `getAttachments` and `getActivities` (previously only the first), returns activities newest first and comments oldest first.
+
+## 0.32.0
+
+### Minor Changes
+
+- a3fe03d: Honour engine configuration options.
+  
+  - **BREAKING:** `store` must be a storage adapter instance (e.g. `new SQLiteStore({ filename })`). Strings such as `'sqlite'` used to fall back to an in-memory store silently; they now throw.
+  - New `users` option: your app's user directory (an array, or a function called with the acting user), merged with `initialData.users`, which was previously ignored. New `engine.getUsers()`. Workload distribution now uses user names, weekly capacity and schedules.
+
+## 0.31.0
+
+### Minor Changes
+
+- 40e5958: Real S3 uploads and signed URLs, and server-chosen storage keys.
+  
+  **@critical-path/core**
+  - **BREAKING:** `S3StorageAdapter` now takes your AWS SDK v3 `client`, `commands` (`PutObjectCommand`, `DeleteObjectCommand`, optional `GetObjectCommand`) and a `presign` function (`getSignedUrl` from `@aws-sdk/s3-request-presigner`). Uploads send real commands and propagate S3 errors; previously failures were swallowed and reported as success. Presigned uploads are actually signed and cover `Content-Type`. New `signedDownloads` for private buckets. The unused `accessKeyId`/`secretAccessKey`/`sessionToken`/`s3Client` options are removed.
+  - **BREAKING:** `FirebaseStorageAdapter` requires a `bucket`; it no longer silently uses an in-memory mock. It throws instead of returning a public URL when the bucket cannot sign uploads.
+  - **BREAKING:** `engine.getPresignedAttachmentUploadUrl({ projectId, filename, contentType?, expiresInSeconds? })` generates the storage key under `projects/<projectId>/`, instead of accepting a caller-chosen `storageKey`.
+  - Attachments created through an actor view must use a `storageKey` under their project's prefix, so callers cannot register (and then delete) other projects' files. Uploads through views are always stored under the project prefix.
+  - New `buildStorageKey` (validates path prefixes, crypto-random component) and `contentDispositionFor`. HTML, SVG and script uploads are stored as downloads.
+  
+  **@critical-path/server**
+  - **BREAKING:** `POST /attachments/presign` takes `{ projectId, filename, contentType?, expiresInSeconds? }`. `POST /attachments/upload` no longer accepts `pathPrefix`.
+  
+  **@critical-path/client**
+  - `getPresignedAttachmentUploadUrl` and `uploadAttachmentFile` use the updated request bodies.
+
+## 0.30.0
+
+### Minor Changes
+
+- cdb300a: Task filtering and pagination.
+  
+  **@critical-path/core**
+  - New `engine.queryTasks(query)` and `engine.queryActivities(query)` return `Page<T>` (`{ items, nextCursor }`).
+    - Tasks are ordered oldest first, activities newest first, using keyset cursors on `createdAt` then `id`.
+    - Task filters: `status[]`, `priority[]`, `assigneeId` (also matches `assignees`), `iterationId`, `deliverableId`, `containerId`, `parentId` (`null` means top-level), `projectIds`.
+    - Results are limited to projects the actor can read.
+  - **BREAKING (storage adapters):** `queryTasks` and `queryActivities` are required. `SQLiteStore` filters and pages in SQL and adds indexes for tasks, activities, comments and dependencies. Helpers (`paginate`, `matchesTaskQuery`, cursors, `DEFAULT_PAGE_SIZE` / `MAX_PAGE_SIZE`) are exported for custom adapters.
+  
+  **@critical-path/server**
+  - **BREAKING:** `GET /tasks` and `GET /activities` are paginated (default 100, max 500) and return `nextCursor`. `GET /tasks` accepts the filters above as query parameters. Unknown parameters return `400`.
+  
+  **@critical-path/client**
+  - `getTasks` and `getActivities` follow pagination and still return everything. New `queryTasks` and `queryActivities` return single pages.
+  
+  **@critical-path/mcp**
+  - **BREAKING:** `list_tasks` returns `{ tasks, nextCursor }` and accepts `iterationId`, `limit` and `cursor`. It now filters in the store instead of loading every task.
+
+## 0.29.0
+
+### Minor Changes
+
+- a019d37: Cascading deletes and dependency removal.
+  
+  **@critical-path/core**
+  - **BREAKING:** `deleteTask` now also deletes subtasks (recursively), dependencies, comments, attachments (including stored files and comment attachments) and time entries. Pass `{ subtasks: 'detach' }` to keep subtasks.
+  - **BREAKING:** `deleteProject` also deletes containers, iterations, deliverables and project attachments. `project.deleted`'s `deletedTaskIds` includes subtasks.
+  - Deleting a container, iteration or deliverable clears the reference on its tasks; nested containers are detached.
+  - New `engine.removeDependency(id)` and `dependency.removed` event.
+  - **BREAKING (storage adapters):** `DependencyRepository` gains `getDependency` and `removeDependency`, and `TimeEntryRepository` gains `deleteTimeEntry`.
+  - `SQLiteStore` no longer returns `null` for unset optional fields.
+  - `FirebaseStore` updates now remove fields cleared with `undefined` (for example, reopening a completed task now clears `completedAt`).
+  
+  **@critical-path/server**
+  - New `DELETE /tasks/:id/dependencies/:dependencyId`. `DELETE /tasks/:id` accepts `?subtasks=detach`.
+  
+  **@critical-path/client**
+  - New `removeDependency(taskId, dependencyId)`. `deleteTask(id, { subtasks })`.
+
+## 0.28.0
+
+### Minor Changes
+
+- 4fbbc40: Complete the plugin system.
+  
+  **@critical-path/core**
+  - `plugin.init(engine)` now runs at startup. `engine.ready` resolves after seeding and every plugin's `init`; init failures reject `ready`.
+  - **BREAKING:** `customFieldTypes` is now `CustomFieldType[]` (`{ type, label?, validate(value, definition) }`), not unused definitions. Projects may use registered types in `customFieldDefinitions`; unknown types are rejected on project create and update. New `validateCustomFieldDefinitions`, and `validateCustomFieldValues` accepts the registered types.
+  - **BREAKING:** before-hook output is now validated (workflow transitions, custom fields) like caller input. Hooks cannot change a task's `projectId` (rejected on create, ignored on update), `id` or `createdAt`.
+  - After-hook errors are logged with the plugin id instead of failing an already-stored write.
+  - **BREAKING:** `beforeTaskDelete` and `afterTaskDelete` receive the task as a second argument.
+  - **BREAKING:** required custom fields are enforced even when `customFields` is omitted.
+  - New plugin `routes` and `middleware` types (`PluginRoute`, `PluginMiddleware`, `PluginRequestContext`).
+  
+  **@critical-path/server**
+  - Serves plugin `routes` (with `:param` patterns) before built-in routes, and runs plugin `middleware` around every routed request after authentication. Handlers receive the caller's `withActor` engine.
+  - Awaits `engine.ready` before handling requests.
+  
+  **@critical-path/mcp**
+  - Awaits `engine.ready` before running tools.
+
+## 0.27.0
+
+### Minor Changes
+
+- 1a516bd: Signed, retried webhooks driven by domain events.
+  
+  **@critical-path/core**
+  - **BREAKING:** webhooks are delivered from the domain event bus instead of ad-hoc calls, so every published event is deliverable, including `task.updated`, `time.logged` and `dependency.added`.
+    - The payload is now `{ id, event, occurredAt, tenantId?, data }`, where `data` is the domain event payload.
+    - A status change delivers both `task.status_changed` and `task.updated` to webhooks subscribed to both.
+  - Deliveries carry `X-CriticalPath-Event`, `X-CriticalPath-Delivery` (stable across retries), `X-CriticalPath-Timestamp` and `X-CriticalPath-Signature` (HMAC-SHA256). New exports: `verifyWebhookSignature`, `signWebhookPayload`, `generateWebhookSecret`.
+  - New `webhookDelivery` engine option:
+    - `timeoutMs` (default 10s), `maxAttempts` (default 5) and exponential `retryBaseDelayMs`.
+    - A pluggable `queue`; the default is in-process.
+    - `allowPrivateUrls` (default `false`).
+    - `onDelivered` and `onDeliveryFailed` callbacks.
+  - `engine.webhooks` exposes `deliver(job)` for custom queues and `idle()` for tests.
+  - `config.webhooks` are now honoured as static webhooks.
+  - New engine methods `getWebhooks`, `getWebhook`, `createWebhook` and `updateWebhook`/`deleteWebhook`. They require `workspace.manage` and are tenant-scoped. Secrets are generated when omitted, returned only on creation, and redacted afterwards (`PublicWebhook.hasSecret`).
+  - **BREAKING:** `WebhookRepository` gains `getWebhook`, `updateWebhook` and `deleteWebhook`; custom storage adapters must implement them. `Webhook` gains `tenantId`, and `WebhookEvent` is now any domain event name or `'*'`. SQLite now persists the webhook `name` and `tenantId`.
+  - New `DOMAIN_EVENT_NAMES`. The `project.deleted` and `workflow.deleted` payloads include `tenantId`; `attachment.deleted` includes `projectId`.
+  
+  **@critical-path/server**
+  - New `GET/POST /webhooks` and `GET/PATCH/DELETE /webhooks/:id` routes. Event names are validated.
+  
+  **@critical-path/client**
+  - New `getWebhooks`, `createWebhook`, `updateWebhook` and `deleteWebhook`.
+
+## 0.26.0
+
+### Minor Changes
+
+- 719e844: Role-based authorization and multi-tenancy.
+  
+  **@critical-path/core**
+  - New `authorize` engine option and `createRolePolicy()`:
+    - Project roles (`viewer`, `contributor`, `project_manager`, `admin`) come from `project.members`.
+    - Workspace superusers come from `actor.roles`.
+    - Authors manage their own comments and attachments.
+    - Checks run on `withActor` views. Unreadable or cross-tenant projects behave as not found, denied actions throw the new `ForbiddenError`, and lists are filtered.
+  - `Actor` gains `tenantId` and `roles`. Projects, workflows and teams gain `tenantId`, stamped from the actor and never accepted from payloads. Reads are scoped to the actor's tenant, including the default-workflow fallback.
+  - **BREAKING:** `Project.members` is now `{ userId, role }[]` (was `string[]`). Project creators become `admin` members.
+  - New `engine.getActivities()` and `engine.getTimeEntries()`, which respect authorization.
+  - **BREAKING:** on views, presigned uploads require `projectId` and are confined to `projects/<projectId>/`. The presign request schema now requires `projectId`.
+  - `SQLiteStore` persists `tenantId` (migrated automatically).
+  
+  **@critical-path/server**
+  - `RequestContext` gains `tenantId` and `roles`, which are passed to the actor. `ForbiddenError` maps to `403`. Activities and time entries are read through the engine.
+  
+  **@critical-path/client / @critical-path/mcp**
+  - Rebuilt for the new presign `projectId` requirement and project member shape.
+
+## 0.25.0
+
+### Minor Changes
+
+- fd79762: **BREAKING:** strict request bodies, no identity in payloads, and CORS off by default.
+  
+  **@critical-path/core**
+  - Request schemas are strict: unknown keys, server-assigned fields and identity fields are rejected instead of stripped.
+  - Identity is never read from payloads. `updateTask` no longer reads `actorId`/`actorName`/`actorType`/`actor` from the update object; pass them as the third `options` argument or use `withActor`. `addComment`, `addCommentReaction`, `removeCommentReaction` and `createAttachment` take the actor from `withActor`, falling back to an optional `authorId`/`userId`/`uploaderId`, then `'system'`.
+  - Schemas export request body types (`CreateTaskBody`, `UpdateTaskBody`, ...).
+  
+  **@critical-path/server**
+  - Bodies containing unknown, server-assigned or identity fields return `400`.
+  - Every request runs as the `getContext` user, or `ANONYMOUS_ACTOR` (`anonymous`). Authors of comments, reactions, attachments and time entries are no longer accepted from bodies.
+  - `DELETE /comments/:id/reactions` takes `?emoji=` only.
+  - CORS is off by default (`cors: false`). Pass `cors: { origins: [...] }` to allow cross-origin browsers.
+  
+  **@critical-path/client**
+  - Method parameters use the server's body types, so identity fields no longer type-check. `addCommentReaction`/`removeCommentReaction` take `{ emoji }`; `addTodo`/`toggleTodo` drop the actor options argument.
+  - New `updateProject`, `deleteProject` and `addDependency`. `uploadAttachmentFile` base64-encodes binary data (previously it sent unusable JSON for `Uint8Array`/`ArrayBuffer`).
+  - CLI: `--author`, `--actor-id`, `--actor-name`, `--agent-name` and `CRITICAL_PATH_AUTHOR_ID`/`ACTOR_ID`/`AGENT_NAME` are removed; identity comes from the `--key` token via the server's `getContext`.
+  
+  **@critical-path/mcp**
+  - Tool arguments are strict: undeclared arguments return an `isError` result.
+  - `add_comment` no longer takes `authorId`. With an `engine`, writes are attributed to the new `actor` server option (default `DEFAULT_MCP_ACTOR`).
+  
+  **@critical-path/react / @critical-path/svelte**
+  - `addReaction`/`removeReaction` take `(commentId, emoji)`; comment and attachment inputs no longer accept `authorId`/`uploaderId`. Task, comment and deliverable update parameters use the schema body types.
+
+## 0.24.0
+
+### Minor Changes
+
+- b54e22c: Validate request bodies with shared zod schemas and publish an OpenAPI document.
+  
+  **@critical-path/core**
+  - New `@critical-path/core/schemas` subpath with create/update schemas for every resource and `parsePayload(schema, data)`. Kept off the package root so browser bundles do not include zod. `zod` is now a dependency of core.
+  - `ValidationError` carries an optional `issues: { path, message }[]`.
+  
+  **@critical-path/server**
+  - All request bodies are validated. Invalid bodies return `400` with `issues`. Server-assigned fields (`id`, `createdAt`, `updatedAt`, task `key`, owning `projectId` on updates) and unknown keys are stripped, so a `PATCH` can no longer move a task to another project.
+  - Comments, reactions and attachments require an author unless `getContext` resolves the caller. Attachment `mimeType` and `sizeBytes` default to `application/octet-stream` and `0` for linked files.
+  - New `GET /openapi.json` and `buildOpenApiDocument()` (OpenAPI 3.1, request bodies generated from the validation schemas).
+  
+  **@critical-path/mcp**
+  - Tool `inputSchema`s are generated from their zod schemas via the new `defineTool`, removing the hand-written JSON copies.
+  
+  **@critical-path/svelte**
+  - Rebuilt with the bundled `@critical-path/mcp` changes.
+
+## 0.23.0
+
+### Minor Changes
+
+- 6dd5529: Add request context, authentication hooks and actor attribution.
+  
+  **@critical-path/core**
+  - New `engine.withActor(actor)` returns a per-request view that attributes every mutation (activity log, comment authors, reactions, time entries, attachment uploaders, task reporters) to the actor and ignores identity fields supplied in payloads. New exported `Actor` type.
+  
+  **@critical-path/server**
+  - New router options, accepted by all adapters as a second argument: `getContext` (resolve the caller per request), `requireAuth` (401 without a user), `basePath` (exact mount path), and `cors` (origin allow-list, credentials, or `false`).
+  - With a resolved user, identity fields in request bodies (`actorId`, `authorId`, `userId`, `uploaderId`) are ignored. Reaction routes no longer require `userId` in the body when a user is resolved.
+  - `createSvelteKitHandler` options take `getContext(event)` so `event.locals` is available; `configOrRouter` is now optional.
+  - New `createUniversalHandler(config, options)` for Workers, Deno, Bun and Hono.
+  - `handleRequest(request, { getContext })` lets custom adapters supply a per-request resolver.
+  
+  **@critical-path/mcp**
+  - CLI `--api` mode reads `CRITICAL_PATH_API_TOKEN` (sent as a Bearer token) and accepts repeatable `--header "Name: value"`, warning when credentials would go over plain http to a remote host.
+
+## 0.22.0
+
+### Minor Changes
+
+- b243a37: Fix correctness and safety issues found in a code audit.
+  
+  **@critical-path/core**
+  - `SQLiteStore` now loads `node:sqlite` via `process.getBuiltinModule`, fixing `require is not defined` when constructed from a filename in plain Node ESM.
+  - Removed the unused `better-sqlite3` runtime dependency.
+  - `engine.addDependency` now detects indirect cycles (e.g. A → B → C → D → A), not just cycles between direct neighbours.
+  - Fixed `generateKeyBetween` returning out-of-range, duplicate keys after repeated inserts after the same item. It now throws a `RangeError` when `a >= b`.
+  - Added `engine.deleteProject(id)`, which deletes a project's tasks through `deleteTask` and publishes a new `project.deleted` event and webhook.
+  - Added exported `ValidationError` and `NotFoundError` classes. `logTime` now rejects non-numeric hours.
+  
+  **@critical-path/server**
+  - `DELETE /projects/:id`, `POST /tasks/:id/dependencies` and `POST /time-entries` now go through the engine, so cycle checks, hour validation, roll-ups, events and webhooks apply.
+  - Added `PATCH /projects/:id`.
+  - `DELETE` on a resource that does not exist now returns `404` instead of `200 { success: false }`.
+  - Malformed JSON returns `400`, validation errors `400`, `NotFoundError` `404`, and dependency cycles `409`. Unexpected errors return a generic `500` message outside development.
+  - `OPTIONS` preflight requests return `204` with CORS headers.
+  - New router/adapter options: `onError(error, request)` to report unexpected errors or return a custom response, and `exposeErrors` to include real messages in 500 responses (defaults to on only when `NODE_ENV === 'development'`).
+  - `createNextHandler` returns a callable handler that also exposes per-method properties, so `export { handler as GET }` works as documented.
+  
+  **@critical-path/mcp**
+  - Tools excluded via the `tools` option can no longer be called by name.
+  - Tool arguments are validated with each tool's zod schema; undeclared fields are stripped.
+  - Tool listings include `title` and MCP `readOnlyHint` / `destructiveHint` annotations.
+  
+  **@critical-path/svelte**
+  - Rebuilt with the bundled `@critical-path/mcp` WebMCP argument validation.
+  
+  **@critical-path/client**
+  - Delete methods resolve to `false` when the server returns `404`, keeping their boolean contract with the new server behaviour.
+
+## 0.21.0
+
+### Minor Changes
+
+- f3301bf: - Added comprehensive task lifecycle and semantic status predicates (`isDraftTask`, `isArchivedTask`, `isTrashedTask`, `isTrashedOrArchivedTask`, `isWorkflowTask`, `getTaskSemanticStatus`, `isTaskCompleted`, `isTaskInProgress`, `isTaskNotStarted`, `isTaskCanceled`, `isTaskActive`, `isTaskUnassigned`).
+  - Hardened mention extraction with markdown code suppression (`stripMarkdownCode`) to prevent code blocks, inline code, HTML elements, and URLs from triggering false positive mentions while preserving rich-text mention nodes.
+  - Added Base-62 fractional indexing utilities (`generateKeyBetween`, `generateNKeysBetween`) for zero-cost lexical task/item reordering without array shifting or bulk database rewrites.
+  - Added `completedAt` lifecycle timestamp tracking alongside `actualEndDate`, automatic timestamp assignment upon entering `completed` or `canceled`, and timestamp + progress reset upon reopening to `not_started` or `in_progress`.
+  - Added `isTempTaskId` utility and hardened optimistic temporary task handling in `@critical-path/svelte` (`TaskState`) and `@critical-path/react` (`useTasks`) with in-flight creation resolution and ID mapping to prevent 404 errors during rapid optimistic updates and deletions.
+
+## 0.20.2
+
+### Patch Changes
+
+- b8a68dd: Track task blocked duration while active in progress:
+  - Add `blockedDurationSeconds` and `blockedSince` to `Task` and `TaskInferredActuals`
+  - Update `TaskEntity` to stamp `blockedSince` when blocked while `in_progress` and accumulate elapsed blocked time into `blockedDurationSeconds` upon unblocking or exiting `in_progress`
+  - Update `CriticalPathEngine.updateTask` and `checkAndUnblockDownstreamTasks` to manage `blockedSince` and `blockedDurationSeconds` lifecycle transitions
+  - Update SQLite storage schema and statements to persist `blockedDurationSeconds` and `blockedSince`
+
+## 0.20.1
+
+### Patch Changes
+
+- 500b353: Standardize task blocker state on `isBlocked` as the single source of truth:
+  - Persist `isBlocked` and `blockedReason` on task creation in `engine.createTask`
+  - Rely strictly on `task.isBlocked` in `engine.updateTask` when detecting blocked transitions
+  - Remove redundant checks and mutations of `customFields.isBlocked` and `status === 'blocked'` during downstream dependency auto-unblocking
+  - Update `deriveTaskLifecycleState` to evaluate `task.isBlocked === true`
+
+## 0.20.0
+
+### Minor Changes
+
+- c83235b: Add task execution timestamps and cumulative in-progress duration tracking:
+  - Introduce `actualDurationSeconds` and `inProgressSince` to `Task` and `TaskEntity`
+  - Automatically timestamp `actualStartDate` (retaining earliest) and begin session timer when transitioning to `in_progress`
+  - Automatically accumulate duration delta into `actualDurationSeconds` when leaving `in_progress` (pausing/completing)
+  - Automatically timestamp `actualEndDate` when entering `completed` or `canceled`, and reset `actualEndDate` to `undefined` upon reopening
+  - Mutually synchronize manual edits between `actualDurationSeconds` and `actualHours`
+  - Export `formatTaskDuration(seconds, options)` with dynamic scoping (`< 120s`, `< 1 day`, `>= 1 day`)
+  - Add `calendarDurationHours` and `actualDurationSeconds` to `TaskInferredActuals`
+
+## 0.19.1
+
+### Patch Changes
+
+- f816145: Preserve real actor identity and metadata in `updateTask`, activity logs, and domain events, preventing status changes and updates from erroneously attributing the task's assignee as the initiating actor.
+
+## 0.19.0
+
+### Minor Changes
+
+- 31a6dde: Promote task blocking state (`isBlocked: boolean` and `blockedReason: string | null`) to first-class fields on `Task`, `CreateTaskInput`, and `UpdateTaskInput`.
+  
+  - **Domain Events**: Introduced `TaskBlockedEvent` (`task.blocked`) and updated `TaskUnblockedEvent` (`task.unblocked`) to support explicit unblocking.
+  - **Lifecycle Derivation**: Updated `deriveTaskStatus` and `deriveTaskLifecycleState` to reflect `task.isBlocked` directly alongside upstream dependency checks.
+  - **Engines & Storage**: Added `isBlocked` and `blockedReason` persistence to `SQLiteStore`, `FirebaseStore`, and `InMemoryStore`.
+  - **MCP Server**: Added `isBlocked` and `blockedReason` parameter options to `create_task` and `update_task` tool schemas.
+- 31a6dde: Add comprehensive Work Schedule, Working Hours, Working Days & Holidays subsystem:
+  - Added `WorkSchedule`, `DaySchedule`, `WorkingHoursRange`, and `Holiday` types supporting custom shifts, weekend configurations, and organization/regional holidays.
+  - Integrated hierarchical calendar resolution: Task Assignee/Team -> Project -> Engine/Default (`DEFAULT_WORK_SCHEDULE`).
+  - Enhanced Critical Path Method (CPM) with calendar working-hours math (`earlyStartDate`, `earlyFinishDate`, `lateStartDate`, `lateFinishDate`, `totalWorkingHours`, `projectEndDate`) skipping weekends and holidays.
+  - Enhanced Workload & Capacity Engine with working-day effort distribution and holiday capacity deductions.
+  - Added working-days schedule variance (`scheduleVarianceWorkingDays`) to Reality Deltas in the Ladder of Abstraction.
+
+## 0.18.0
+
+### Minor Changes
+
+- adf44f6: Add headless workload and capacity distribution engine for streamgraphs, stacked area charts, and team capacity planning. Features include contiguous calendar bucketing (`day`, `week`, `month`), multi-dimension grouping (`assignee`, `team`, `taskType`, `priority`, `status`), effort metric distribution (`scheduled`, `logged`, `remaining`, `blended`), tabular zero-filled series matrix for D3 stack layouts, and capacity/utilization thresholds.
+
+## 0.17.0
+
+### Minor Changes
+
+- 9c31e8d: Introduce comprehensive Task Metrics, Inferred Actuals, Progress Inference, Earned Value Management (EVM), and Time-Series Progress History Curve Profiling.
+  - **Inferred Actuals**: Automatic start/completion auto-stamping on workflow transitions with fallback inference from activity logs, plus automatic completion timestamp clearing on task re-open.
+  - **Reality Delta**: Multi-dimensional variance analysis comparing planned estimates to logged hours (`effortVarianceHours`, `durationVarianceHours`, `accuracyRatio`, `isOverdue`, `isOverEstimate`).
+  - **Progress Inference**: Deterministic priority waterfall resolving completion progress across explicit values, checklist/todo completion ratios, logged effort, and elapsed schedule time.
+  - **Earned Value Management (EVM)**: Task-level PV, EV, AC, CV, SV, CPI, and SPI calculations.
+  - **Time-Series History & Curve Shapes**: Historical timeline reconstruction from activity logs with piecewise interpolation curve classification (`linear`, `s_curve`, `early_surge`, `late_rush`, `stalled`).
+  - **Full-Stack Integration**: REST endpoints (`/tasks/:id/metrics`, `/tasks/:id/progress-history`), Client SDK methods, React `useTaskMetrics` hook, Svelte 5 `TaskMetricsState`, and MCP tools (`get_task_metrics`, `get_task_progress_history`).
+
+## 0.16.0
+
+### Minor Changes
+
+- e2a7eef: Introduce Ladder of Abstraction and Critical Path Method (CPM) timeline synthesis to the framework data model:
+  - **Core Domain**: Multi-scale timeline synthesis model across Macro phase rollups, Standard CPM Gantt schedule (early/late bounds, float/slack calculation, bottleneck identification), and Concrete grounding (deliverables, file attachments, daily effort distribution, and reality deltas). Added `calculateCriticalPath`, `getTimelineLadder`, and `getTaskLadder` to `CriticalPathEngine`.
+  - **Server Router**: HTTP endpoints `GET /projects/:id/critical-path`, `GET /projects/:id/ladder`, and `GET /tasks/:id/ladder`.
+  - **Client SDK**: `CriticalPathClient` methods `calculateCriticalPath`, `getTimelineLadder`, and `getTaskLadder`.
+  - **MCP**: New AI tools `calculate_critical_path`, `get_timeline_ladder`, and `get_task_ladder`.
+  - **React**: Custom hooks `useTimelineLadder`, `useCriticalPath`, and `useTaskLadder`.
+  - **Svelte 5**: Svelte 5 Runes state classes `TimelineLadderState` and `CriticalPathState`.
+
+## 0.15.2
+
+### Patch Changes
+
+- dbd2072: Add comprehensive unit test coverage for task state lifecycle behaviors and upstream/downstream dependency validation.
+
+## 0.15.1
+
+### Patch Changes
+
+- f53afab: Add automated downstream task unblocking on task completion, full bidirectional VFX and Creative workflow transitions, and bidirectional dependency querying in FirebaseStore.
+
+## 0.15.0
+
+### Minor Changes
+
+- 21eb85c: Implement Universal Semantic Statuses & System-Derived Implied Statuses (3-Tier Status Architecture)
+  
+  - **Tier 1 (Universal Semantic Statuses)**: Defined canonical status enum `SemanticStatus = 'not_started' | 'in_progress' | 'completed' | 'canceled'` providing universal semantic meaning across any industry domain.
+  - **Tier 2 (Workflow-Defined Statuses)**: Updated `StatusDefinition` to map domain-specific statuses to a semantic `category`. Updated built-in workflows (Software, Creative, VFX, Simple) to classify statuses by category.
+  - **Tier 3 (System-Derived Implied Statuses)**: Added `deriveTaskLifecycleState` and `engine.getTaskLifecycleState(taskId)` returning dynamic indicators:
+    - Dependency: `isReady`, `isBlocked`, `blockingTaskIds`
+    - Schedule: `isOverdue`, `isUpcoming`, `isUnplanned`
+    - Ownership: `isUnassigned`, `isStalled`
+    - Estimate/Pace: `isOverEstimate`, `isPaceWarning`
+    - Convenience flags: `isDone`, `isActive`, `isCancelled`
+  - **Domain Entities & Engine**: Added automatic timestamp progression (`actualStartDate`, `actualEndDate`), progress completion, and event emission driven by semantic status categories.
+  - **React UI Hooks**: Updated `useKanban` to support dynamic custom workflow columns without dropping tasks, plus added `groupBy: 'semantic' | 'workflow'` option.
+  - **Client SDK**: Added `client.getTaskLifecycleState(taskId)`.
+
+## 0.14.0
+
+### Minor Changes
+
+- 3dc2798: feat(core): add readAttachmentText engine method, download on storage adapters, and artifactType metadata
+
+## 0.13.3
+
+### Patch Changes
+
+- 573a4fa: Fix mention regex to avoid capturing trailing punctuation like periods or commas in unquoted handles
+
+## 0.13.2
+
+### Patch Changes
+
+- 03d269c: Make getAllowedNextStatuses strictly forward and symmetrical with getAllowedPreviousStatuses by constraining to downstream statuses in workflow sequence.
+
+## 0.13.1
+
+### Patch Changes
+
+- a7d17c0: Add backward status transitions to default workflows and align allowed previous statuses with workflow transitions
+
+## 0.13.0
+
+### Minor Changes
+
+- a4a464b: Support multi-assignees and backward workflow status transitions:
+  - Add `TaskAssignee` interface (`id`, `name`, `role`, `type: 'user' | 'agent' | 'team'`, `avatarUrl`) and `assignees?: TaskAssignee[]` to `Task` entity and SQLite storage adapter.
+  - Add `getAllowedPreviousStatuses(workflow, currentStatus)` utility and `CriticalPathEngine.getAllowedPreviousTaskTransitions(taskId)` for calculating valid backward transitions.
+  - Expose `allowedPreviousStatuses` in server endpoint `GET /tasks/:taskId/transitions`.
+  - Add `getAllowedPreviousTaskTransitions(taskId)` to `CriticalPathClient` SDK.
+
+## 0.12.0
+
+### Minor Changes
+
+- 5a5930f: Add first-class Deliverable entity, Creative Workflow presets, and reactive UI bindings:
+  - `@critical-path/core`: Added `Deliverable` entity, `DeliverableSummary` rollup computation, `DEFAULT_CREATIVE_WORKFLOW` preset, `deliverableId` on tasks, store implementations (InMemory, SQLite, Firebase), domain events, and webhook integration.
+  - `@critical-path/server`: Added RESTful API endpoints for `/deliverables` and `/deliverables/:id/summary`.
+  - `@critical-path/client`: Added deliverable management and summary methods to `CriticalPathClient`.
+  - `@critical-path/react`: Added `useDeliverables` and `useDeliverableSummary` React hooks.
+  - `@critical-path/svelte`: Added `DeliverableState` and `createDeliverableState` Svelte 5 Runes state management.
+
+## 0.11.0
+
+### Minor Changes
+
+- 55549e9: Support @mentions in comments with extraction and segmentation utilities
+  
+  - Add `mentions?: string[]` to `Comment` interface
+  - Add `extractMentions` and `parseMentionSegments` utilities for mention parsing and UI rendering
+  - Auto-extract and populate mentions during `addComment` and `updateComment` in the engine
+  - Update SQLite comments schema with `mentions` column and migration
+  - Preserve and pass through mentions in server routes, client SDK, and Svelte bindings
+
+## 0.10.0
+
+### Minor Changes
+
+- e9003d3: Add emoji reactions support for comment conversations with domain events, deduplication, REST endpoints, client SDK, and React/Svelte state integrations.
+
+## 0.9.0
+
+### Minor Changes
+
+- e983557: Add first-class optional todo list (checklist) support to Task model and TaskEntity with helper methods (addTodo, toggleTodo, removeTodo) and updateTask helper in @critical-path/svelte.
+
+## 0.8.3
+
+### Patch Changes
+
+- 2d5ff04: fix(core): decode base64 strings and data URIs into binary Uint8Array in storage adapters
+
+## 0.8.2
+
+### Patch Changes
+
+- fix(core): decode base64 strings and data URIs into binary Uint8Array in storage adapters
+
+## 0.8.1
+
+### Patch Changes
+
+- 315425c: fix(core): generate Firebase Storage download tokens and construct valid public URLs
+
+## 0.8.0
+
+### Minor Changes
+
+- 1811922: Add attachment URL validation against large data URIs, sanitize undefined properties in FirebaseStore, provide direct attachment upload routes & SDK methods, and introduce TaskActivityState for combined comment & attachment threads.
+
+## 0.7.0
+
+### Minor Changes
+
+- a48a04a: Add threaded conversations, attachment metadata management, and storage adapters (S3 & Firebase Storage):
+  
+  - **`@critical-path/core`**:
+    - Added `Attachment` entity, `CreateAttachmentInput`, `UploadFileInput`, and `FileStorageAdapter` contracts.
+    - Added `InMemoryFileStore`, duck-typed `S3StorageAdapter` (compatible with AWS SDK v3, v2, MinIO, and Cloudflare R2), and `FirebaseStorageAdapter` (compatible with Google Cloud Storage and Firebase Admin SDK).
+    - Extended `Comment` with `authorType` (`user`, `agent`, `system`) and `parentId` for threaded discussions.
+    - Implemented full comment and attachment repository methods across `InMemoryStore`, `SQLiteStore`, and `FirebaseStore`.
+    - Added engine operations for upload, presigning, and deleting attachments with domain events (`comment.*`, `attachment.*`) and webhooks.
+  
+  - **`@critical-path/server`**:
+    - Added RESTful routes for comments (`GET/POST /tasks/:taskId/comments`, `GET/POST /comments`, `GET/PATCH/DELETE /comments/:id`).
+    - Added RESTful routes for attachments (`GET/POST /tasks/:taskId/attachments`, `GET/POST /attachments`, `GET/DELETE /attachments/:id`, `POST /attachments/presign`).
+  
+  - **`@critical-path/client`**:
+    - Added SDK methods `getComments`, `getComment`, `addComment`, `updateComment`, `deleteComment`.
+    - Added SDK methods `getAttachments`, `getAttachment`, `createAttachment`, `deleteAttachment`, and `getPresignedAttachmentUploadUrl`.
+  
+  - **`@critical-path/react`**:
+    - Added `useComments(taskId)` with reactive thread tree derivation (`threads` containing nested `replies`) and comment mutations.
+    - Added `useAttachments(filter)` with attachment creation and deletion.
+  
+  - **`@critical-path/svelte`**:
+    - Added Svelte 5 Rune-based `CommentState` / `createCommentState(client, taskId)` with derived threaded hierarchy.
+    - Added Svelte 5 Rune-based `AttachmentState` / `createAttachmentState(client, filter)`.
+
+## 0.6.0
+
+### Minor Changes
+
+- 6e9dece: Introduce Domain-Driven Design (DDD) constructs:
+  - Rich Domain Aggregates (`TaskEntity`, `ProjectEntity`, `BaseEntity`) encapsulating invariants, transitions, and uncommitted events.
+  - Typed `DomainEventBus` and domain event interfaces (`task.created`, `task.status_changed`, `time.logged`, `dependency.added`, etc.).
+  - DAG task dependency graph cycle detection (`detectDependencyCycle`, `CircularDependencyError`).
+  - Custom field value object validation (`validateCustomFieldValues`, `CustomFieldValidationError`).
+  - Interface segregation for discrete repositories (`ProjectRepository`, `TaskRepository`, `WorkflowRepository`, etc.).
+
+## 0.5.2
+
+### Patch Changes
+
+- c24b76c: Set `isDefault: false` on DEFAULT_SOFTWARE_WORKFLOW so only DEFAULT_SIMPLE_WORKFLOW is default
+
+## 0.5.1
+
+### Patch Changes
+
+- 34067fd: Make node:sqlite import browser-safe for web bundlers
+
+## 0.5.0
+
+### Minor Changes
+
+- 83a5c17: Add `DEFAULT_VFX_WORKFLOW` preset and validation suite for Software Development and Visual Effects (VFX) production use cases.
+
+## 0.4.0
+
+### Minor Changes
+
+- 35576a6: Introduce Workflow concept to the project management model with status definitions, allowed transition validation, task types, webhook events (workflow.created, workflow.updated, workflow.deleted), server routes, SDK methods, and React/Svelte state hooks.
+
+## 0.3.0
+
+### Minor Changes
+
+- 4b92228: Add project short key utilities (`generateProjectKey`, `validateProjectKey`, `formatTaskKey`) and automatic key generation fallback in `createProject`.
+
+## 0.2.1
+
+### Patch Changes
+
+- df22aad: Remove implicit InMemoryFirestoreMock fallback and require explicit db parameter in FirebaseStore constructor
+
+## 0.2.0
+
+### Minor Changes
+
+- 755286a: Add native `SQLiteStore` (using `node:sqlite`) and `FirebaseStore` (Firestore) storage adapters with full CRUD support for projects, tasks, sprints, comments, activities, time entries, dependencies, and webhooks.
+
+## 0.1.2
+
+### Patch Changes
+
+- Initial open-source release of the core headless domain engine, plugin lifecycle hooks, and in-memory store.

package/README.md

@@ -2,6 +2,9 @@
 
 > The foundational domain engine, Domain-Driven Design (DDD) aggregate roots, domain event bus, graph cycle detection, and storage adapters for **Critical Path**.
 
+> **Upgrading?** Upgrade every `@critical-path/*` package together. Coding agents: follow [UPGRADING.md](https://github.com/Pixerate/critical-path/blob/main/UPGRADING.md); breaking changes are marked **BREAKING** in this package's `CHANGELOG.md`.
+
+
 ---
 
 ## 📦 Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@critical-path/core",
-  "version": "0.51.0",
+  "version": "0.51.1",
   "description": "Core headless domain engine, plugin architecture, and data stores for Critical Path",
   "author": "Jack James",
   "license": "MIT",
@@ -39,6 +39,7 @@
   },
   "files": [
     "dist",
+    "CHANGELOG.md",
     "!dist/**/*.test.*"
   ],
   "scripts": {