v5.0.0 - RAG Foundation, Client-Mode Agent, Ambient Sessions, Redis Cache

Headline Release

Largest feature release since the v4 MCP server. Adds first-class RAG support (:vector property + six embedding-provider adapters + find_similar + embed DSL), a client-mode Parse::Agent that authorizes through session tokens instead of the master key, fiber-local ambient session tokens for ergonomic auth scoping, a managed Parse::Cache::Redis cache with built-in pooling and namespacing, a GraphQL type generator, and end-to-end ActiveSupport::Notifications coverage of the cache and MongoDB paths.

Breaking Changes

• BREAKING: Parse::Hyperdrive.config! removed. The remote-ENV-merge helper had no env-var allowlist, no SSRF gate, and no response authentication — a compromised config endpoint could write PATH, RUBYLIB, LD_PRELOAD, PARSE_MASTER_KEY, etc. into the process at boot. Operators should switch to dotenv, Rails encrypted credentials, Vault, AWS/GCP secret managers, or platform-native config vars.
• BREAKING: Parse::Agent.new(acl_user:/acl_role:) now refuses construction when the underlying client has no master_key, instead of failing per-call at first dispatch with an unclear error. Use session_token: for client-mode agents or switch to a master-key client.

Changes

• NEW: Parse::Vector value class and :vector property type. Declare a dense numeric embedding on any Parse::Object subclass with property :embedding, :vector, dimensions: 1536, provider: :openai, model: "text-embedding-3-small". Validates element types, caps dimensions at 16384, and serializes as a plain JSON array.
• NEW: Parse::Embeddings provider registry with six text-embedding adapters out of the box — OpenAI, Cohere (v3 + v4 families), Voyage (v4 + v3 + domain-specific), Jina (v3 / v4 / v5), Qwen3-Embedding via DashScope, and a generic LocalHTTP for self-hosted gateways (Ollama, LM Studio, vLLM, TEI, llama.cpp). Includes a deterministic Fixture provider for tests. SSRF gate on LocalHTTP reuses Parse::File::BLOCKED_CIDRS.
• NEW: Klass.find_similar(vector:/text:, k:, ...) class method on any model with a :vector property. Resolves the field automatically, auto-discovers the covering Atlas vectorSearch index, and routes through Parse::MongoDB so ACL / CLP / protectedFields enforcement runs for scoped agents.
• NEW: embed *source_fields, into: :vector_property class macro. Concatenates source fields, SHA-256-digests them, and only re-embeds when the digest changes. Direct assignment to the managed vector field is locked behind the digest-tracked recompute path.
• NEW: Client-mode Parse::Agent — construct an agent against a Parse::Client with session_token: and no master_key, and every dispatched tool routes through session-token REST so Parse Server natively enforces ACL + CLP + protectedFields. Per-agent allow_mutations: gate (default false in client mode, true in master-key mode), and a Tools.register(client_safe: true) flag for custom tools.
• NEW: Parse.with_session(token) { ... } runs a block with a fiber-local ambient session token. Parse.login(username, password, mfa_token:) / Parse.logout(revoke: true) provide imperative companions for REPL and Rake-console use. Parse::User#with_session { ... } instance sugar. Resolution order: explicit kwarg > ambient > master key.
• NEW: Parse.watch(klass, where:, on:, ...) { ... } and Parse.wait_for(klass, where:, timeout:, ...) { predicate } LiveQuery convenience helpers for blocking-until-event console use. Also available as Klass.watch / Klass.wait_for.
• NEW: acl_policy :public_read and acl_policy :owner_but_public_read, owner: :author. Catalog/lookup tables and publicly-viewable single-author content respectively.
• NEW: Parse::User.anonymous_signup creates an anonymous user with a client-generated UUID. Parse::User#upgrade_anonymous!(username:, password:, email:) upgrades in place and unlinks the anonymous provider in a single PUT to close a known auth-takeover foot-gun.
• NEW: Parse::Cache::Redis — ergonomic Redis cache with a built-in ConnectionPool, key namespacing (namespace:), and per-call expires_in: honoring. Drop-in for the existing cache contract.
• NEW: Parse::GraphQL::TypeGenerator — generates graphql-ruby type definitions from a Parse Server schema. Mirrors fields, ACLs, and pointers.
• NEW: Parse.slow_query_threshold_ms and parse.mongodb.aggregate / parse.mongodb.find ActiveSupport::Notifications events. Slow-query subscriber auto-attaches when threshold is set at boot via ENV.
• NEW: Cache instrumentation via ActiveSupport::Notifications — parse.cache.read / write / delete / fetch_hit / fetch_miss.
• CHANGED: Parse::Client#request resolves the ambient session token when the caller didn't pass an explicit session_token: and didn't pass use_master_key: true. Sets X-Disable-Parse-Master-Key: true whenever a session token is in play so the auth context cannot silently widen.
• CHANGED: MCP Streamable HTTP transport — session-id header renamed to spec-compliant Mcp-Session-Id, protocol-version validation, and explicit session lifecycle handling.
• CHANGED: Built-in MCP tools now emit structuredContent per MCP spec 2025-06-18.
• CHANGED: Gem published as parse-stack-next on RubyGems under the neurosynq organization (was parse-stack).
• CHANGED: Cross-user _User hydration strips authData and limits trusted self-fetch scope to the authenticated user.
• CHANGED: Parse::User.session! rejects session_token: in the opts hash to prevent a client-mode caller from impersonating a different session at the API boundary.
• CHANGED: request_password_reset is now rate-limited per email address.
• CHANGED: Ruby 3.x optimization — class variables (@@) replaced with mutex-guarded class-instance state on Parse::Model and Parse::LiveQuery::Subscription.
• CHANGED: Deprecation warning emitted on connection to unsupported Parse Server versions.
• NEW: mongo_relation_index :field, dedup: true — compound {owningId, relatedId} unique index.
• NEW: Parse::NOT_PROVIDED promoted to a top-level sentinel for distinguishing nil from omitted in optional parameters.
• NEW: MCP health check endpoint helper.

Date: May 24, 2026