v0.6.3

0.6.3

Patch Changes

• chore: check the packed tarball can resolve its own imports

v0.6.2

0.6.2

Patch Changes

• chore(renovate): drop dead @kernhq automerge rule

v0.6.1

0.6.1

Patch Changes

• 4c3e235: Scope the demo seeder's emptiness guard to the workspace.

  The guard left workspace_id to row-level security. The transaction is bound to the workspace, so
  on a correctly-configured instance RLS scopes it — and on any database whose owner can bypass a
  policy it does not, so the guard saw the previous workspace's rows and reported an empty workspace
  as used. Measured on a development database: the first workspace filled, and every one after it was
  created empty while the log said "workspace not empty". The predicate is written out now, and each
  seeder's test seeds a second workspace in the same database, which is what reproduces it.

v0.6.0

0.6.0

Minor Changes

• 5bda66a: Fill a workspace created with example content: forty items across six categories, three workspace
  fields, three handovers and two repairs.

  The categories are found rather than created — onWorkspaceEnabled already puts five there, and
  CategoryService.create refuses a duplicate name with a conflict that would abort the whole seed on
  its first statement. Custody goes through CustodyService.assign, so a handed-over item has the
  period behind it that its own history screen reads, rather than a column somebody set.

v0.5.8

0.5.8

Patch Changes

• build: force one @kernhq/kernel copy with pnpm.overrides

v0.5.7

0.5.7

Patch Changes

• build(deps): raise @kernhq/testing to ^0.1.14

v0.5.6

0.5.6

Patch Changes

• docs(rls): drop the version numbers from the 0010 comments

v0.5.5

0.5.5

Patch Changes

• dff8780: Bind the '*' sentinel for the registry read the nightly sweeps start from

  mod_inventory.workspaces is the table both nightly sweeps enumerate, and it was readable by a
  transaction with no workspace bound — so any code path that reached it having forgotten to bind
  got rows back rather than a refusal, silently. module-chat and module-mail answer the same
  question with a sentinel the caller types on purpose, and 0010_workspace_registry_all_binding.sql
  brings this module into line: a for select policy admitting app.workspace_id = '*', and
  activeWorkspaces binds it.

  Append-only, and both policies stand for one release. The previous version enumerates this table
  unbound, and a rolling deploy runs two adjacent releases against one schema — so dropping the
  unbound policy now would hand the image being replaced zero rows and the silent do-nothing sweep it
  was written to fix. The migration header names the release that may drop it.

v0.5.4

0.5.4

Patch Changes

• test: fail on a tenant table with no policy, not only an unforced one

v0.5.3

0.5.3

Patch Changes

• cbe4bec: Peer @kernhq/contracts@^0.8.0, which adds archivedAt to WorkspaceSummary. A caret on 0.x does
  not cross a minor, so the previous ^0.7.0 could not reach it.