sporades 0.8.5 → 0.8.7

package/CHANGES.md

@@ -1,12 +1,41 @@
 # Changes
 
-## Unreleased - 2026-08-15
+## Unreleased - 2026-08-18
+
+Changes since v0.8.6.
+
+### 🚀 Features
+
+- Add transaction-bound trusted reads (9d23493).
+
+### 🐛 Bug Fixes
+
+- Keep admission logs in transaction (5a9d012).
+- Revoke trusted reads at settlement (dca0fea).
+- Reject trusted reads from snapshots (9abe441).
+- Bind Join cancellation to commit (e37058d).
+- Close Team admission boundary races (b12dbde).
+- Trust Team Join admission reads (32b65ee).
+- Close trusted-read review gaps (da0c453).
+
+### 📝 Documentation
+
+- Complete trusted Join admission ticket (0347c0e).
+- Complete trusted-read foundation ticket (2a24b7b).
+
+### 🧪 Tests
+
+- Restore PostgreSQL SQL quoting audit (c1fcf7c).
+- Tidy up test (f643360).
+
+## 0.8.5 - 2026-08-15
 
 Changes since v0.8.1.
 
 ### 🚀 Features
 
-- Add reactive query arguments (5b882f5).
+- Add JSON-safe positional arguments to reactive Custom queries across the
+  client transport and framework adapters (5b882f5).
 - Add exact pagination and join admission (63f68a0).
 
 ### 🐛 Bug Fixes
@@ -18,10 +47,6 @@ Changes since v0.8.1.
 - Describe parameterized queries (287ef63).
 - Plan reactive query arguments (4876db8).
 
-### 📦 Packaging
-
-- Release v0.8.3 (c17bb1b).
-
 ## 0.8.1 - 2026-08-14
 
 Corrects the incomplete `0.8.0` package release with the merged `main` runtime,

package/README.md

@@ -54,6 +54,8 @@ sporades host push --restart
 - **Built-in collaboration, explicitly authorized**: runtime-owned Teams,
   email-bound Join links, membership application roles, and explicit Team ACL
   decisions—without a hidden current Team or automatic data partitioning.
+  Trusted `teams.admitJoin` policies may make atomic seat decisions from
+  read-only app state hidden by the joining user's ordinary row ACLs.
 - **Realtime everything**: configuration free - automatic notifications, even for Postgress and AWS-S3
 
 ## Documentation

package/bin/sporades-host-helper.js

@@ -165,6 +165,8 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 
 // src/jobs-runtime.ts
 var nodeCryptoModule = process.getBuiltinModule("node:crypto");
+var MAX_JOB_TIMESTAMP_MS = Date.parse("9999-12-31T23:59:59.999Z");
+var MIN_JOB_TIMESTAMP_MS = Date.parse("0000-01-01T00:00:00.000Z");
 
 // src/runtime-log-policy.ts
 function isSensitiveLogKey(key) {
@@ -251,6 +253,7 @@ var nodeCryptoModule2 = process.getBuiltinModule("node:crypto");
 var TEAM_JOIN_LINK_DEFAULT_TTL_SECONDS = 60 * 60 * 24;
 var TEAM_JOIN_LINK_MIN_TTL_SECONDS = 5 * 60;
 var TEAM_JOIN_LINK_MAX_TTL_SECONDS = 60 * 60 * 24 * 7;
+var transactionBeforeCommitChecks = Symbol.for("sporades.database.transactionBeforeCommitChecks");
 
 // src/auth-runtime.ts
 var nodeCryptoModule3 = process.getBuiltinModule("node:crypto");
@@ -262,8 +265,11 @@ var PASSWORD_RESET_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
 // src/database-runtime.ts
 var nodeCryptoModule4 = process.getBuiltinModule("node:crypto");
 var nodeFsModule = process.getBuiltinModule("node:fs");
+var transactionOperations = Symbol.for("sporades.database.transactionOperations");
+var transactionBeforeCommitChecks2 = Symbol.for("sporades.database.transactionBeforeCommitChecks");
 
 // src/server-runtime-source.ts
+var trustedReadTransactionAdapter = Symbol("sporades.trustedReadTransactionAdapter");
 function logPayloadMaxBytes(config = {}) {
   const configured = Number(config.logs?.payloadMaxBytes ?? config.logging?.payloadMaxBytes);
   return Number.isInteger(configured) && configured > 0 ? configured : 4096;
@@ -271,6 +277,7 @@ function logPayloadMaxBytes(config = {}) {
 function logRedactedValue() {
   return "[REDACTED]";
 }
+var transactionPendingLogWrites = Symbol("sporades.transactionPendingLogWrites");
 function createLogEnvelope(input) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const config = input.config ?? {};
@@ -418,7 +425,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.8.5";
+var CLI_VERSION = "0.8.7";
 
 // src/cli/schedule-inspection-envelope.ts
 function sanitizeScheduleInspectionEnvelope(envelope, invalid) {