Release v3.9.0 · Byline-CMS/bylinecms.dev

Highlights

@byline/db-postgres, @byline/core — added a request-scoped withTransaction capability to the database adapter. Until now every storage command owned its own transaction internally and two commands could not be composed into one unit of work — so a single logical operation that must write two things atomically had no way to guarantee it. withTransaction(fn) opens one transaction and propagates it to every commands.* call made within fn via Node's AsyncLocalStorage, so the commands commit or roll back together with no transaction handle threaded through their signatures (the same ALS mechanism the logger already uses). It's exposed as an optional capability on the IDbAdapter contract — adapters that cannot offer interactive transactions (e.g. a pure HTTP-gateway serverless driver) omit it, and a consumer that requires atomicity asserts its presence and fails loudly rather than running non-atomically. This is the load-bearing foundation for the upcoming document-grain audit log, where a change and its audit record must be written atomically. The design — the ALS propagation, the DB↔DB vs DB↔external-side-effect distinction, the incremental-adoption path, and the serverless contract-seam decisions — is documented in the new docs/TRANSACTIONS.md. Additive and dormant: no existing read or write path changes behaviour this release.

@byline/core — fixed a v3.8.0 regression where any write performed by a script, seed, or tool acting as a synthetic super-admin crashed at the database. The v3.8.0 version-attribution work began writing the acting user's id into the new byline_document_versions.created_by uuid column; synthetic actors created via createSuperAdminContext({ id: 'import-docs-script' }) (and the default 'super-admin') carry non-UUID ids, which Postgres rejected (invalid input syntax for type uuid) — breaking the docs importer, regenerate-media, and the example scripts the CLI scaffolds. created_by is now attributed only when the actor id is a real persisted user id (a UUID); synthetic system/tooling actors correctly persist NULL (rendered "unknown" in the history audit strip), which was the intended semantics. Real AdminAuth / UserAuth actors always carry UUID ids, so attribution is unaffected for them. No script changes are required — the fix is at the single attribution chokepoint.

monorepo — set minimumReleaseAge in pnpm-workspace.yaml (supply-chain safety: delays adoption of freshly-published dependency versions).

All other @byline/* packages bumped to 3.9.0 in lockstep with no behavioural changes this cycle.