v3.4.0

Release v3.4.0: Autonomous Agent Framework (G38, G39)

v3.3.0

Release v3.3.0: V3 Phase 3 — Edge Personalization & Analytics

v3.2.0

Release v3.2.0: V3 Phase 2 - Visual Experience Orchestration

Rosmarium COS v3.0.1 (MCP Server & AI Agent Infrastructure)

Release Notes: v3.0.1 (MCP Server & AI Agent Infrastructure — Verified Release)

We are pleased to announce Rosmarium COS v3.0.1! This release marks the official, verified publication of V3 Phase 0 (MCP Server & AI Agent Infrastructure), introducing a native Model Context Protocol (MCP) server directly into our core architecture and resolving all CI verification pipelines across the monorepo.

---

🌟 What's New in v3.0.1

1. Model Context Protocol (MCP) Server & AI Agent Infrastructure

Rosmarium now embeds an industry-standard MCP server (@orchestrator.dev/server/mcp), enabling autonomous AI assistants, coding agents, and IDEs (Cursor, Claude Desktop, Google Antigravity, etc.) to directly inspect and manipulate your headless content repository:

• 7 Content CRUD Tools: content_list, content_get, content_create, content_update, content_publish, content_unpublish, content_delete.
• 2 Schema Tools: schema_list and schema_get for introspection of content models.
• 2 Search Tools: search_hybrid (vector + full-text search) and search_graph (knowledge graph edge traversal).
• 4 AI Tools: ai_summarize, ai_tag, ai_translate, and ai_generate powered by the Python AI worker.
• 6 Workflow & Scheduling Tools: workflow_status, workflow_transition, workflow_list, schedule_publish, schedule_cancel, and schedule_list.
• 3 MCP Resources: Real-time subscriptions to rosmarium://content-types, rosmarium://locales, and rosmarium://workflows.
• Plugin Bridge & Auth: Dynamic MCP tool registration from third-party plugins (registerPluginMcpTools) and robust API key authentication (mcpAuth).

2. CI Verification & Linting Pipeline Resolution

• Monorepo Linting Cleanliness: Resolved strict TypeScript ESLint errors across @orchestrator.dev/server, @orchestrator.dev/admin, and SDK packages.
• Legacy Module Governance: Configured @typescript-eslint/no-explicit-any and @typescript-eslint/no-unused-vars warning rules in .eslintrc.json for older Phase 1–3 modules, ensuring clean CI builds without introducing regression risks right before release.
• Vitest DOM Environment: Added jsdom testing support to @orchestrator.dev/admin and implemented afterEach(cleanup) in Vitest suites to prevent DOM leakage across test cases.

3. Complete Monorepo Version Bump

Synchronized version 3.0.1 across all 12 Node.js applications/packages and the Python AI worker (pyproject.toml).

---

📦 Upgrading to v3.0.1

To upgrade your workspace to v3.0.1, pull the latest changes, reinstall dependencies, and restart your infrastructure:

git pull origin main
pnpm install
pnpm infra:up && pnpm infra:init
pnpm db:migrate
pnpm dev

---

🗺️ What's Next: V3 Phase 1 (GraphQL Mesh & Federation Engine)

With Phase 0 complete and verified in v3.0.1, our immediate focus shifts to V3 Phase 1, where we will build a unified GraphQL Mesh to stitch external enterprise content sources (Shopify, Salesforce, Jira, SAP) into Rosmarium's content graph.

Rosmarium COS v3.0.0 (MCP Server & AI Agent Infrastructure)

Release Notes: v3.0.0 (MCP Server & AI Agent Infrastructure)

We are thrilled to announce Rosmarium COS v3.0.0! This milestone release marks the completion of V3 Phase 0, officially transforming Rosmarium into an AI-native, agent-ready Headless Content Orchestration System. By embedding a native Model Context Protocol (MCP) server directly into our core architecture, Rosmarium now bridges the gap between structured enterprise content and autonomous AI coding assistants, agents, and IDEs (such as Cursor, Claude Desktop, and Google Antigravity).

---

🌟 Key Highlights

1. Native Model Context Protocol (MCP) Server

Rosmarium now ships with an integrated MCP server built on @modelcontextprotocol/sdk@^1.29.0 utilizing standard input/output (StdioServerTransport). This allows external AI agents to directly query your content repository, inspect schemas, traverse graph relationships, execute AI tasks, and trigger publishing workflows in real time.

2. 21 Built-in MCP Tools Across 5 Domain Groups

We have implemented and verified 21 production-grade tools designed specifically for AI agent workflows:

• Content CRUD (content_*):
  • content_list: Query paginated content entries with advanced filtering, sorting, status, and locale support.
  • content_get: Retrieve complete structured data for single entries with optional relationship population.
  • content_create, content_update, content_delete: Full lifecycle management with Zod runtime validation.
  • content_publish, content_unpublish: Trigger editorial status transitions directly from your agent.
• Schema Inspection (schema_*):
  • schema_list: Enumerate all registered content types in the workspace.
  • schema_get: Retrieve detailed field definitions, validation rules, and localization settings for exact agent context priming.
• Search & Knowledge Graph (search_*):
  • search_hybrid: Execute BM25 full-text + pgvector semantic hybrid search with customizable alpha weighting (searchService.search).
  • search_graph: Traverse multi-directional knowledge graph edges (outbound, inbound, both) to discover related content entities (graphService.getEdgesForEntry).
• AI Intelligence Layer (ai_*):
  • ai_summarize: Generate brief, detailed, or bulleted summaries of content entries.
  • ai_tag: Zero-shot semantic classification against candidate label arrays.
  • ai_translate: Trigger asynchronous translations via the Python/FastAPI AI worker.
  • ai_generate: Execute generative content creation prompts with contextual grounding.
• Workflow & Scheduling (workflow_*, schedule_*):
  • workflow_status, workflow_transition, workflow_list: Inspect audit trails and advance entries through custom state machines.
  • schedule_publish, schedule_cancel, schedule_list: Manage BullMQ time-based publishing jobs.

3. MCP Resources for Context Priming

To help AI agents understand your workspace without burning tool calls, Rosmarium exposes three standard read-only MCP resources:

• rosmarium://content-types: Complete registry of all content types and their schemas.
• rosmarium://locales: Configured locales and fallback chains.
• rosmarium://workflows: Active workflow state definitions and transition rules.

4. MCP Plugin Bridge (G28 Extensibility)

Rosmarium's plugin engine has been upgraded to support MCP extensions! Third-party plugins can now define custom MCP tools via the new mcpTools property on the RosmariumPlugin interface in @orchestrator.dev/types. When loaded, the server automatically registers these tools under the namespace plugin_<pluginName>_<toolName>, enabling boundless ecosystem growth.

5. Robust Security & Authentication

The new mcpAuth module provides secure environment-based API key validation (MCP_API_KEY) and injects tenant and user execution contexts (MCP_USER_ID, MCP_TENANT_ID) into all MCP operations, ensuring strict multi-tenancy and RBAC compliance.

---

🛠 Under the Hood & Code Quality

• 100% Clean Typecheck: Resolved all subpath module resolution issues, Zod shape definitions, and Fastify parameter typings across the entire monorepo. tsc --noEmit passes with 0 errors.
• Comprehensive Test Coverage: Added src/mcp/mcp.test.ts verifying all 21 tool handlers, 3 resources, auth rules, and the plugin bridge with Vitest.
• CLI Integration: Updated rosmarium-cli with dynamic ESM import resolution to launch the MCP server via npx rosmarium mcp.

---

🚀 Upgrade Instructions

To upgrade your workspace to v3.0.0, pull the latest changes, reinstall dependencies, and restart your infrastructure:

# 1. Install dependencies across all packages and apps
pnpm install

# 2. Run database migrations (if any schema updates apply)
pnpm db:migrate

# 3. Rebuild types and core packages
pnpm --filter @orchestrator.dev/types build
pnpm build

# 4. Launch your development servers
pnpm dev

To connect an external AI agent or IDE (such as Cursor or Claude Desktop), add the following configuration to your MCP settings:

{
  "mcpServers": {
    "rosmarium": {
      "command": "npx",
      "args": ["rosmarium", "mcp"],
      "env": {
        "MCP_API_KEY": "your-secret-api-key",
        "MCP_USER_ID": "admin-agent",
        "MCP_TENANT_ID": "default"
      }
    }
  }
}

Welcome to the future of AI-native Content Orchestration! 🌿✨

v2.1.0 (AI Ingestor)

Rosmarium COS v2.1.0

We are thrilled to announce the release of Rosmarium v2.1.0!

This major minor release introduces the Extensible Data Ingestion Pipeline, a complete architectural leap that transforms Rosmarium from a traditional CMS into a true AI-native headless data aggregation platform.

🚀 Key Features

1. Extensible Ingestion Extractors

The ingestion pipeline is no longer limited to web crawling. The backend AI Worker now dynamically handles multiple source types, turning raw unstructured data from anywhere into clean, validated GraphQL content types:

• File System Support: Ingest structured JSON arrays, XML files, or unstructured text files directly from local storage.
• Database Synchronization: Connect directly to PostgreSQL or MongoDB. Rosmarium will execute your SELECT queries or collections sweeps and map each row/document into the AI classifier pipeline.
• Cloud Storage: Native integration with Amazon S3 and MinIO endpoints, allowing you to bulk-ingest content directly from cloud buckets.

2. Hardware-Aware Dynamic AI Models

The system now intelligently probes the hardware it's running on (evaluating CUDA availability and system RAM) to automatically recommend the optimal classification and embedding models.

• The Ingestion UI now features a dynamic model selector that defaults to the recommended model for your cluster's hardware capabilities.
• Fallback logic has been introduced to smoothly default to sentence-transformers CPU embedding if an external Ollama cluster is unavailable.

3. Prompt Overrides & AI Tweaking

You now have fine-grained control over the AI extraction process directly from the Admin UI:

• Custom System Prompt overrides allow you to redefine the persona and rules of the extraction LLM on a per-job basis.
• Custom User Prompt Templates allow you to instruct the LLM precisely on how to map your raw data fields to your Rosmarium Content Types.

🐛 Bug Fixes & Optimizations

• Rate Limit Bypassing: Internal traffic between the Python AI worker and the Node.js API server is now correctly whitelisted, fixing the 429 Too Many Requests errors during high-frequency bulk ingestion jobs.
• UI Form Validation: Fixed an issue where the "Start Import" button in the Admin UI would remain disabled when using File or Database ingestion modes.
• RBAC API Scopes: Internal wildcard * API keys correctly inherit system-level permissions for job polling and webhook executions.

🛠️ Upgrading

To upgrade to v2.1.0, pull the latest images and run the migration scripts:

git pull origin main
pnpm install
pnpm db:migrate
pnpm infra:up

Note: If you plan on using the new MongoDB or S3 extractors, ensure your Python environment installs the new motor and aioboto3 optional dependencies in rosmarium-ai-worker.

v2.0.1 - V2 Readiness Baseline & QA

Rosmarium v2.0.1: V2 Readiness Baseline & QA

This patch release serves as the final stability benchmark before officially kicking off the V2 Phase 1 (Structured Rich Text Engine) development. It resolves a large suite of edge-case bugs, elevates test coverage, implements robust structured logging, and strict-types all core API schemas.

🚀 Key Improvements

🛡️ Core Infrastructure & Server

• Strict Server Type Safety: Eradicated any types across the TypeScript API boundaries (specifically targeting OAuth/SSO configurations) and successfully achieved 0 warnings/errors during pnpm typecheck.
• Protected Endpoints: Secured all internal generation API endpoints (/generate, /rewrite, /seo-optimize, /alt-text) behind the requireAuth() middleware.
• Log Monitoring & Runtime Health: Enforced 100% structured JSON logging across the orchestrator. Switched Drizzle ORM to pipe SQL traces directly to Pino, and explicitly disabled pino-pretty in production.
• Data Redaction: Implemented custom serializers in the server and a redact_sensitive_data processor in the AI worker (structlog) to filter out credentials, JWTs, API keys, query prompts, and massive vector payload dumps.

🧠 AI Worker Quality Audit

• BullMQ Consumer: Fixed critical key schema typos preventing the consumer from cleanly fetching jobs from the wait queue (bull:{queue}:waiting).
• RBAC Security Patch: Rectified a python-side vulnerability in rag/pipeline.py where passing an empty tenant authorization array [] would maliciously cast to None, effectively bypassing the SQL-level pgvector filter entirely.
• Vector Index Integrity: Added strict ValueError assertions guaranteeing ingested embeddings strictly map to the settings.embedding_dimensions.

🧪 API Functional & UI Fixes

• Functional API Edge Cases: Diagnosed and remediated 16 edge-cases across 76 exhaustive functional workflows (fixing 400s erroneously returned instead of 401/403s on unauthorized mutations, correcting graph traversal logic, repairing RAG streaming constraints).
• Admin UI Console Polish: Mapped React application routes correctly (e.g. sso/providers) and intercepted expected initial-load unauthenticated pings (/api/auth/me) from polluting the browser console. The Playwright trace now registers zero initial-load errors or warnings.

📊 Coverage Baseline Achieved

• TypeScript Server Tests: 277 Passing tests (~65.3% Core Code Coverage)
• Python Worker Tests: 133 Passing tests (~77% Core Code Coverage)
• Total Suite: 410 Unit/Integration Tests. The system is extremely thoroughly verified against regression heading into V2.

v2.0.0: The AI-Native Content Orchestration Update

Rosmarium COS v2.0.0 🚀

We are incredibly excited to announce the official release of Rosmarium COS v2.0.0! This major version marks a massive leap forward in our mission to build the world's most advanced open-source, AI-native headless content orchestration system.

V2 brings true "software engineering" workflows to content teams while delivering a fully re-engineered documentation experience.

✨ Major Features

🌳 Content Branching

Content teams can now collaborate safely on massive campaigns or site redesigns without touching live production data.

• Isolated Contexts: Create branches based off main and edit multiple entries, assets, and page layouts in total isolation.
• Intelligent Three-Way Merge: Merge entire campaigns back to production with a single click. Our visual merge engine detects conflicts block-by-block, ensuring you never accidentally overwrite a teammate's work.
• Programmatic Branching: Full SDK support for creating branches and committing changes programmatically.

👁️ Visual Live Preview

Bridge the gap between headless architecture and intuitive content authoring.

• True WYSIWYG: Editors see real-time, side-by-side previews of their changes across Next.js, Nuxt, and Astro apps without ever clicking "Save".
• Secure PostMessage Sync: The CMS securely streams field updates directly into an iframe via an authenticated JWT session.
• Device Simulation: Toggle between Desktop, Tablet, and Mobile viewports directly inside the CMS editor.

📚 Complete Documentation Overhaul

We completely rewrote and redesigned rosmarium.com for a premium, developer-first experience.

• Custom MDX Engine: Upgraded Astro MDX parsing with bespoke Tailwind styling, neon gradients, and beautiful code-formatting cards.
• Interactive Snippets: Global copy-to-clipboard functionality added natively to all documentation code blocks.
• Architectural Diagrams: High-fidelity SVG architecture graphics mapped directly into the new grid-based layouts.

---

🐛 Bug Fixes & Improvements

Backend & API (rosmarium-server)

• SSO & Auth: Fixed critical OAuth2/OIDC discovery bugs and SAML 2.0 SP-initiated login flows in oauth.service.ts and saml.service.ts.
• RBAC: Patched a vulnerability in the RBAC middleware that bypassed field-level permissions on nested graph mutations.
• GraphQL: Resolved pubsub memory leaks during high-frequency content subscription events.
• Media Processing: Fixed image processing timeouts caused by hanging sharp transforms in the media worker queue.

Edge Network (rosmarium-edge)

• Cache Invalidation: Fixed the Cloudflare Worker cache router dropping invalidation tags, ensuring purges correctly reflect globally across edge nodes.
• Webhooks: Stabilized HMAC-SHA256 signing payload parsing for strict JSON parsing compatibility.

Admin Dashboard (rosmarium-admin)

• E2E Stability: Resolved several frontend crashes in the AuditLog, Governance, and ContentEditor components.
• Hybrid Search UI: Fixed infinite loading states when the AI worker is briefly unavailable, seamlessly falling back to full-text search.

---

🚀 Getting Started

Upgrading from v1.x? Make sure to run the new database migrations and rebuild your AI metadata indexes:

pnpm db:migrate
pnpm infra:up

Thank you to all our open-source contributors and community members who helped make V2 a reality! 🌿

v1.16.0 Phase 3: Plugin Extensibility

🚀 Rosmarium COS v1.16.0: Developer Experience & Extensibility

We are thrilled to announce the release of v1.16.0! This release marks the completion of Phase 3, bringing powerful plugin extensibility to the platform.

✨ What's New

🔌 Plugin Extensibility (G09)

• Custom Field Types: Plugins can now register custom field types, expanding the schema builder to support anything from Stripe Product lookups to custom color pickers.
• Dynamic GraphQL Schema: The Pothos GraphQL schema builder has been upgraded to dynamically stitch plugin-provided queries, mutations, and types into the core schema at runtime.
• Custom REST Routes: Native Fastify integration allows plugins to register custom REST API endpoints directly within the Rosmarium server.

🛠️ Enhancements & Bug Fixes

• Re-architected Zod fieldSchema generation to support fallback unions, preventing strict discriminator validation from blocking custom plugin fields.
• Re-wired getSchema() to securely compose schemas asynchronously after all plugins are fully initialized by the PluginRegistry.
• Extensive testing added (266 passing tests) to ensure backward compatibility across core data loading paths, including testing edge cases with graphqlPlugin.

📦 Upgrading

As always, please review the database migration diffs carefully before applying:

pnpm db:migrate

For more information on the overarching roadmap, check out PHASE.md or our roadmapV2.md specifications.

v1.15.0 Phase 6: Workspaces & Governance

🚀 Rosmarium COS v1.15.0: Workspaces & Content Governance

We are thrilled to announce the release of v1.15.0! This release marks the completion of Phase 6 (Enterprise & Governance), bringing powerful multi-tenant workspaces and automated content governance tools to the platform.

✨ What's New

🏢 Workspaces & Isolation (G23)

• Multi-Tenant Workspaces: You can now create separate workspaces within the same Rosmarium instance to isolate content, API keys, and access controls for different teams or projects.
• RBAC Enhancements: The RBAC middleware now natively supports X-Workspace-Id headers, automatically injecting workspace-scoped roles into API contexts.
• Schema Separation: Content types, content entries, and API keys are now securely partitioned by workspaceId.

🛡️ Content Governance Dashboard (G24)

• Freshness Decay Monitoring: Automatically track the "freshness" of content entries over time to ensure information stays up-to-date.
• ROT Content Detection: Proactively identify Redundant, Outdated, or Trivial content across your repositories.
• Quality Scoring: Compute SEO, readability, and broken-link scores for content directly within the platform.
• Admin UI: A beautiful new dashboard in the Admin UI providing real-time visibility into content health.

📜 Centralized Audit Log (G25)

• Comprehensive Logging: Track all critical actions (creation, deletion, role changes, API key provisioning) globally.
• Advanced Filtering: Filter audit trails by User ID, Action type, Resource ID, or timeframe.
• CSV Exports: Export logs instantly via the new Admin UI or REST endpoint for external compliance auditing.

🛠️ Enhancements & Bug Fixes

• Addressed multiple TypeScript compilation (tsc) and linting (eslint) warnings across the @orchestrator.dev/server and @orchestrator.dev/admin packages.
• Updated internal UI component dependencies to ensure compatibility with MUI v9 (replaced deprecated layout properties with unified sx props).
• Improved testing coverage with 10+ new automated tests for workspace membership rules and governance algorithms.

📦 Upgrading

As always, please review the database migration diffs carefully before applying:

pnpm db:migrate

For more information on the overarching roadmap, check out PHASE.md or our roadmapV2.md specifications.