sporades 0.9.39 → 0.9.41

package/CHANGES.md

@@ -1,5 +1,51 @@
 # Changes
 
+## v0.9.41 - 2026-10-24
+
+Changes since v0.9.40.
+
+### 🚀 Features
+
+- Allow any script version (4a43c515).
+- Add Capsule implicitMutations opt-out for the implicit table mutation surface (#304) (9692d63e).
+- Add explicitly sessionless public endpoints (#308) (1b367744).
+- Add atomic Capsule admission for additional Team creation (#305) (d74d7999).
+
+### 🐛 Bug Fixes
+
+- Prevent account-wide sign-in lockout with bounded verification (#299) (b73dc192).
+
+### 🔧 Improvements
+
+- Regenerate dist and bin [skip ci] (271b05d2).
+- Regenerate dist and bin [skip ci] (9c3e3204).
+
+### 📝 Documentation
+
+- Build dist and bin on main with local CI (#314) (3f555768).
+- Remove the runtime-owned ctx.env browser query (#289) (#301) (cde2b5cf).
+- Reject email signup from linked identities (#300) (e6348a83).
+- Make the full test suite pass in office worktrees (#309) (23d1663d).
+- Expose shared rate limits during Capsule File ingress admission (#307) (2f57e950).
+- Revoke all account authority atomically on a browser password change (#302) (32962832).
+- Isolate public collection budgets from server error delivery (#303) (c1956ad0).
+
+### 🧪 Tests
+
+- Wait for exported durable Job metrics (#311) (48951c93).
+
+## v0.9.40 - 2026-10-23
+
+Changes since v0.9.39.
+
+### 📝 Documentation
+
+- Upgrade Capsule base to Node 24 LTS and normalize npm pack JSON (#288) (8f5ecc5b).
+
+### 🧪 Tests
+
+- Describe SQLite inspection columns without StatementSync#columns() (#287) (9b29b3d5).
+
 ## v0.9.39 - 2026-10-22
 
 Changes since v0.9.38.
@@ -10,8 +56,40 @@ Changes since v0.9.38.
 
 ## Unreleased
 
+### 🔒 Security
+
+- Remove the runtime-owned `ctx.env` browser query (#289). Query clients,
+  including Anonymous Sessions, could subscribe to the undeclared `ctx.env`
+  name and receive the entire server environment. That name now follows the
+  ordinary unknown-query response and returns no environment data, while
+  `ctx.env` stays available to trusted server handlers. A Capsule that declares
+  its own query with that name keeps the normal declared-query contract.
+
+### 📦 Packaging
+
+- Upgrade the default Capsule Base image to `0.3.0-node24-alpine`, using Node
+  24.22.1 LTS on Alpine 3.23 with a pinned upstream image digest. Upgrade the CLI
+  and Host helper and redeploy to replace existing containers; restarting a
+  release preserves its pinned image. Keep explicit image overrides unchanged.
+- Normalize npm pack JSON metadata across flat and package-keyed formats in
+  release verification and packaged compatibility checks, preserving artifact
+  hashes and rejecting ambiguous output.
+
 ### 🚀 Features
 
+- Let Capsules opt out of implicit table mutations (#292). Declaring
+  `implicitMutations: false` bounds the mutation surface to explicitly declared
+  names: every undeclared name answers the ordinary unknown-mutation refusal
+  before context middleware, any fallback write, mutation hooks, or success
+  effects such as the deferred query rebroadcast. Omitting the flag or passing
+  `true` keeps 0.9.x behavior, where undeclared names that describe a table
+  (`addNote`, `updateNoteText`) insert or update rows under their fallback
+  semantics. Declared mutations, server `ctx.db`, implicit table queries and
+  table ACLs keep their behavior, and a bundled declared mutation matching the
+  generated scaffold `add…` body stops riding the implicit path while the
+  surface is retired. Present non-boolean values are rejected at authoring and
+  at Capsule startup (`INVALID_IMPLICIT_MUTATIONS`). The flag is not business
+  quota enforcement; declare checks in mutations, ACL rules, or hooks.
 - Add read-only `sporades host db list|dump|query` for running Hosted Capsules (#285).
   It runs the Host helper over the operator's existing SSH access and the
   generated Bundle's one-shot action seam, opens the Capsule SQLite file
@@ -21,6 +99,16 @@ Changes since v0.9.38.
   defaults to the project's Host binding. Requires `sporades host upgrade` and
   a redeploy with this CLI; no public route is added.
 
+### 🐛 Bug Fixes
+
+- Fix `sporades host db query` failing with "columns is not a function" on
+  Hosted Capsules. The previous Base image ran Node 22.14, whose `node:sqlite` lacks
+  `StatementSync#columns()` (added in 22.16). SQLite inspection queries now
+  describe their columns without it, including zero-row results, so Hosted,
+  Dev and MCP ops queries on Node 22.13–22.15 return the same
+  `{ ok, data: { columns, rows }, error }` envelope. Requires a redeploy with
+  this CLI.
+
 ## v0.9.38 - 2026-10-22
 
 Changes since v0.9.37.

package/Dockerfile.base

@@ -1,12 +1,12 @@
-FROM node:22.14-alpine
+FROM node:24.22.1-alpine3.23@sha256:0468540aa58203ff9e40c2aab3907c52644ab818af6176b1c70a026137dc92a2
 
 LABEL org.opencontainers.image.title="Sporades Base Image"
-LABEL org.opencontainers.image.description="Thin Node 22 Base image for Sporades Container sessions and Hosted Capsules"
-LABEL org.opencontainers.image.version="0.2.0-node22-alpine"
+LABEL org.opencontainers.image.description="Thin Node 24 LTS Base image for Sporades Container sessions and Hosted Capsules"
+LABEL org.opencontainers.image.version="0.3.0-node24-alpine"
 LABEL org.opencontainers.image.source="https://github.com/sporades/sporades"
 LABEL com.sporades.base-image.name="sporades-base"
-LABEL com.sporades.base-image.version="0.2.0-node22-alpine"
-LABEL com.sporades.base-image.node="22"
+LABEL com.sporades.base-image.version="0.3.0-node24-alpine"
+LABEL com.sporades.base-image.node="24"
 
 RUN apk add --no-cache openssh-server fail2ban clamav clamav-daemon \
   && addgroup -g 10001 -S sporades \

package/README.md

@@ -360,6 +360,12 @@ Capsules through authorized public keys in `sporades.json`. Normal management
 remains the CLI and Host helper surfaces; SSH is a compatibility and emergency
 access path.
 
+## Contributing
+
+Run a local build and tests, but never commit `dist/` or `bin/` in a PR. CI
+regenerates their tracked copies on main after merge. See the
+[generated artifacts workflow](https://github.com/mgscox/sporades/blob/main/docs/agents/generated-artifacts.md).
+
 ## License
 
 MIT

package/bin/sporades-host-helper.js

@@ -256,8 +256,8 @@ var init_base_image = __esm({
     "use strict";
     SPORADES_BASE_IMAGE = {
       name: "sporades-base",
-      image: "ghcr.io/sporades/sporades-base:0.2.0-node22-alpine",
-      version: "0.2.0-node22-alpine",
+      image: "ghcr.io/sporades/sporades-base:0.3.0-node24-alpine",
+      version: "0.3.0-node24-alpine",
       runtimeUser: "sporades",
       runtimeUid: 10001,
       runtimeGid: 10001,
@@ -45813,6 +45813,7 @@ var clamavRefreshTimeoutMs = 5 * 60 * 1e3;
 // src/auth-runtime.ts
 var nodeCryptoModule3 = process.getBuiltinModule("node:crypto");
 var EMAIL_SIGN_IN_THROTTLE_WINDOW_MS = 15 * 60 * 1e3;
+var EMAIL_SIGN_IN_VERIFICATION_WINDOW_MS = 60 * 1e3;
 var PASSWORD_RESET_DEFAULT_TTL_MS = 60 * 60 * 1e3;
 var PASSWORD_RESET_MIN_TTL_MS = 5 * 60 * 1e3;
 var PASSWORD_RESET_MAX_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -45931,6 +45932,7 @@ var REVOCATION_CAUSES = /* @__PURE__ */ new Set([
   "owner",
   "operator",
   "password-reset",
+  "password-change",
   "owner-unlinked",
   "owner-deleted",
   "service-user-administrator",
@@ -46183,7 +46185,7 @@ var mutationExecution = new MutationExecutionStorage();
 init_cli_support();
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.39";
+var CLI_VERSION = "0.9.41";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([