Flowmark v0.6.3

Flowmark v0.6.3 restores the provider's normal authentication boundaries and adds durable, shared abuse limits. It also improves internal API read paths and project metadata correctness.

Authentication and resource limits

• Hosted email/password sign-in uses Better Auth's normal security behavior. Registration delegates to its protected HTTP handler, with generic failures and safe provider diagnostics.
• Atomic PostgreSQL limits cover auth attempts across instances and bound project/key creation. Storage failures remain unavailable responses rather than an in-memory allow fallback; retry guidance is preserved.
• A separate server-only secret signs client-source metadata across the dashboard/API auth hop. Staging and Production have distinct values managed through Pulumi; existing auth-signing and database secrets were preserved.
• Password-reset session revocation is explicitly configured for the future recovery flow. Verification/recovery email delivery remains disabled until its separate implementation is ready.

API correctness and maintenance

• Return the stored project creation timestamp.
• Authorize workflow reads through a shared reader and load workflow summaries without fetching the full snapshot.
• Consolidate persistence-error translation, enforce read-model contracts, clarify result-declaration types and remove unused internal API paths.

Deployment and verification

The controlled Production rollout passed on 335d3f64f75fdcc184932a236db1e399543e891b:

• Migration history verified at 18/18 after applying additive 0017_auth_rate_limits, before API deployment.
• All four Production apps are READY on that exact revision and their canonical domains.
• All 42 approved functional checks passed, covering registration, direct/proxied sign-in, secure cookies, trusted-source handling, two-owner isolation, ingestion and key/session revocation. Synthetic test keys and sessions were revoked afterward.
• Required CI/PostgreSQL checks passed. Full Pulumi preview and refresh-preview are clean with 29 unchanged Production state resources.
• Public landing/docs/sign-in/sign-up pages and the signed-out dashboard redirect passed their final HTTP checks.

Production workflow · Release PR #73 · Authentication policy

Upgrade notes

Apply migration 0017_auth_rate_limits before deploying dependent API code. Configure the matching FLOWMARK_AUTH_PROXY_SECRET on API and dashboard separately for each hosted environment; it is not the Better Auth signing secret. The guarded local fixture now uses local@flowmark.test; never seed a hosted database.

No SDK/npm release or auth package extraction is included. Automatic feature Preview deployments remain paused.

Full changes: v0.6.2...v0.6.3