v2.0.0-beta.0

Container image

docker pull ghcr.io/instazdll/waveflow-server:2.0.0-beta.0

Also published as beta, for linux/amd64 and linux/arm64.

What's Changed

• feat: axum skeleton with /health endpoint (Phase 1.b.1) by @InstaZDLL in #1
• chore: wire dependabot + CodeQL + CodeRabbit + SECURITY.md by @InstaZDLL in #2
• feat: Postgres pool + first migration + /ready (Phase 1.b.2b) by @InstaZDLL in #3
• feat: OpenAPI 3.1 spec + Scalar UI (Phase 1.b.3) by @InstaZDLL in #4
• feat(db): enable sqlx rustls TLS so managed providers work by @InstaZDLL in #5
• feat: profile CRUD + X-User-Id shim (Phase 1.b.4b) by @InstaZDLL in #6
• chore: bump waveflow-core rev + simplify rename handler by @InstaZDLL in #7
• feat(library): tenant-scoped CRUD nested under profile (Phase 1.b.5a-B) by @InstaZDLL in #8
• feat(track): tenant-scoped CRUD nested under library (Phase 1.b.5b-B) by @InstaZDLL in #9
• feat(playlist): tenant-scoped CRUD nested under profile (Phase 1.b.5c-B) by @InstaZDLL in #10
• feat(users): add external_id seed for JWT auth (Phase 1.d.1-PR1) by @InstaZDLL in #11
• feat(auth): JWT verifier with JWKS cache (Phase 1.d.1-PR2) by @InstaZDLL in #12
• feat(auth): wire JWT middleware alongside X-User-Id shim (Phase 1.d.1-PR3) by @InstaZDLL in #14
• chore(auth): bump jsonwebtoken 9→10 + dedupe harness + ES256 coverage by @InstaZDLL in #15
• feat(auth): lazy auto-provision users on first jwt request by @InstaZDLL in #16
• feat(auth): retire x-user-id dev shim — jwt is the only auth path by @InstaZDLL in #17
• feat(stream): http range streaming + hmac signed urls by @InstaZDLL in #18
• feat(sync): append-only ops log + websocket fan-out + compaction (Phase 1.f) by @InstaZDLL in #19
• feat(share): public share-link surface for playlists (Phase 1.g.1) by @InstaZDLL in #25
• feat(apply): server-side materialisation of desktop sync ops (phase 1.g.0) by @InstaZDLL in #26
• feat(share): mint + revoke by canonical id (phase 1.g.1b) by @InstaZDLL in #27
• feat(artwork): shared object-store cache for cover art (phase 1.h.1) by @InstaZDLL in #28
• feat(artwork): S3-compatible backend (phase 1.h.2) by @InstaZDLL in #29
• feat(artwork): synchronous resize pipeline + variant endpoint (phase 1.h.3) by @InstaZDLL in #30
• feat(artwork): background self-heal scanner (phase 1.i.1) by @InstaZDLL in #31
• feat(playlist_track): server-side materialisation + share preview (phase 1.j.a) by @InstaZDLL in #32
• feat(playlists): owner-facing /tracks read endpoint (phase 1.j.c) by @InstaZDLL in #33
• feat(album_artist): server-side schema for album + artist + track_artist (phase 4.d.0.1) by @InstaZDLL in #34
• feat(track-sync): apply pipeline for the track entity (phase 4.d.0.2) by @InstaZDLL in #35
• feat(albums,artists): browse endpoints for per-library album + artist surface (phase 4.d.0.4) by @InstaZDLL in #36
• chore(deps): bump waveflow-core rev to pick up t.album_id projection by @InstaZDLL in #39
• chore: bump chrono from 0.4.44 to 0.4.45 in the cargo-patch-and-minor group by @dependabot[bot] in #37
• chore: bump object_store from 0.12.5 to 0.13.2 by @dependabot[bot] in #38
• chore(deps): bump sha2 0.10 \xe2\x86\x92 0.11 + hmac 0.12 \xe2\x86\x92 0.13 by @InstaZDLL in #40
• chore: consolidate waveflow-web into the monorepo under web/ by @InstaZDLL in #41
• chore: root package.json orchestrating both halves by @InstaZDLL in #47
• redesign web experience by @InstaZDLL in #48
• fix: replace stale waveflow-web URLs ahead of repo archive by @InstaZDLL in #49
• feat(sync): rfc-003 phase a.1 — additive hlc fields on sync_op by @InstaZDLL in #50
• feat(sync): rfc-003 phase a.1.2 — entity tables hlc + payload_hash + metadata_digest_version by @InstaZDLL in #51
• feat(sync): rfc-003 phase a.2.1 — dual-shape ingest on /sync/ops by @InstaZDLL in #52
• feat(sync): rfc-003 phase a.2.2.0 — user_metadata_digest_version table by @InstaZDLL in #53
• feat(sync): rfc-003 phase a.2.2.1 — payload_hash + hlc total-order helpers by @InstaZDLL in #54
• feat(sync): rfc-003 phase a.2.2 — apply pipeline stamps hlc + origin_device_id by @InstaZDLL in #55
• feat(sync): rfc-003 phase a.2.3 — digest endpoint + payload_hash + metadata_digest_version bump by @InstaZDLL in #56
• feat(sync): rfc-003 phase a.4.3 — retire payload_hash + pin core to A.4.2 by @InstaZDLL in #58
• chore(deps): bump waveflow-core pin to drop wasmtime + Cranelift tree by @InstaZDLL in #59
• fix(web,ci): issue #43 batch P1 — security + correctness (7 items) by @InstaZDLL in #60
• fix(web): issue #43 batch P2 — UX + a11y (4/5 items) by @InstaZDLL in #61
• fix(web,ci): issue #43 batch P3+P4 — tooling / tests / labeler (7 items) by @InstaZDLL in #62
• fix(web): unify styles.css translucent overlays via color-mix (closes #63) by @InstaZDLL in #64
• fix(ci): resolve frozen lockfile failure and dependabot label config by @dependabot[bot] in #57
• chore: bump tower-http from 0.6.11 to 0.7.0 by @dependabot[bot] in #65
• feat(sync): rfc-003 phase b.2 — entity fetch-by-canonical endpoint by @InstaZDLL in #66
• chore(auth): pause sign-up + sign-in for 1.5.0 by @InstaZDLL in #67
• chore: bump the github-actions-all group with 2 updates by @dependabot[bot] in #70
• chore: bump @types/node from 25.9.4 to 26.0.0 in /web by @dependabot[bot] in #69
• chore: bump the npm-patch-and-minor group in /web with 2 updates by @dependabot[bot] in #68
• chore: bump the github-actions-all group across 1 directory with 3 updates by @dependabot[bot] in #79
• feat: complete M4 — native API, embedded web client, PKCE, and v1 removal by @InstaZDLL in #83
• chore: bump the cargo-patch-and-minor group across 1 directory with 10 updates by @dependabot[bot] in #82
• fix(server-v2): harden real-library compatibility by @InstaZDLL in #85
• chore(web): retire the v1 front end, keeping its design tokens by @InstaZDLL in #84
• chore: bump the github-actions-all group with 2 updates by @dependabot[bot] in #91
• chore(repo): standardize hygiene (gitattributes, code of conduct, template names) by @InstaZDLL in #95
• feat(sync-v2): complete native server convergence by @InstaZDLL in #94
• chore(ci): unblock dependency bumps (Windows FFmpeg guard, vite client types) by @InstaZDLL in #98
• chore: bump base64 from 0.22.1 to 0.23.1 by @dependabot[bot] in #92
• chore: bump the cargo-patch-and-minor group across 1 directory with 2 updates by @dependabot[bot] in #97
• chore: bump md-5 from 0.10.6 to 0.11.0 by @dependabot[bot] in #93
• chore: bump vite from 6.4.3 to 8.2.1 in /webapp by @dependabot[bot] in #88
• chore: bump chacha20poly1305 from 0.10.1 to 0.11.0 by @dependabot[bot] in #90
• chore: bump typescript from 5.9.3 to 7.0.2 in /webapp by @dependabot[bot] in #87
• chore: bump @vitejs/plugin-react from 4.7.0 to 6.0.5 in /webapp by @dependabot[bot] in #86
• chore: bump @tanstack/react-router from 1.170.20 to 1.170.21 in /webapp in the npm-patch-and-minor group by @dependabot[bot] in #99
• fix(sync): derive the retention floor from the journal, not from one user by @InstaZDLL in #100
• fix(subsonic): support dsub artist info probes by @InstaZDLL in #101
• feat(api): expose primary artist ids on tracks by @InstaZDLL in #102
• feat(lyrics): expose native and subsonic lyrics by @InstaZDLL in #103
• fix(database): accept legacy crlf migration checksums by @InstaZDLL in #104
• docs(m5): define reconciliation contract by @InstaZDLL in #108
• chore: bump the npm-patch-and-minor group in /webapp with 2 updates by @dependabot[bot] in #107
• chore: bump the cargo-patch-and-minor group with 4 updates by @dependabot[bot] in #105
• feat(webapp): deliver studio-nocturne experience by @InstaZDLL in #109
• fix(subsonic): align the facade with the opensubsonic contract by @InstaZDLL in #110
• feat(services): move album discovery into the domain services by @InstaZDLL in #111
• feat(subsonic): emit the modern opensubsonic media fields by @InstaZDLL in #112
• feat(subsonic): close the facade's remaining asymmetries by @InstaZDLL in #113
• feat(scanner): read the canonical identifiers and remaining media tags by @InstaZDLL in #114
• chore(deps): bump lofty to 0.25 with the waveflow-core rev that carries it by @InstaZDLL in #115
• feat(subsonic): persist bookmarks and read the last two media tags by @InstaZDLL in #116
• feat(catalog): reserve rescans to owners, and expose album and artist MBIDs by @InstaZDLL in #117
• ci(cache): bound the Actions cache instead of letting eviction pick by @InstaZDLL in #118
• feat: close the second-pass audit — native routes, targeted reads, genre matching, album fields by @InstaZDLL in #119
• feat(auth): check token scopes at every route, not only the admin door by @InstaZDLL in #120
• fix(auth): a narrowed credential can no longer mint an unrestricted one by @InstaZDLL in #121
• fix(media,subsonic): two defects found by replaying the client matrix by @InstaZDLL in #122
• feat(api): close the four gaps the fifth audit named by @InstaZDLL in #123
• fix(subsonic): bound the album-less tail of a folder listing by @InstaZDLL in #124
• chore(deps): take the core commits that landed after the AIFF work by @InstaZDLL in #125
• feat(catalog): align the artist and album model on Navidrome by @InstaZDLL in #126
• fix(database): migrate with foreign keys suspended by @InstaZDLL in #127
• fix(api): search an artist by their own name by @InstaZDLL in #128
• chore(release): publish a container image on tag, and a README that reads by @InstaZDLL in #129
• chore: close the stale claims before the tag by @InstaZDLL in #130

New Contributors

• @dependabot[bot] made their first contribution in #37

Full Changelog: https://github.com/InstaZDLL/waveflow-server/commits/v2.0.0-beta.0