v0.24.1

VeriKit v0.24.1

This patch fixes compatibility between Core resources and Runtime action schemas.

Fixed

• Fixed @verikit/core resource action typing so ActionBuilder instances from @verikit/runtime can be passed directly to a resource's actions configuration.
• Removed the overly restrictive action schema typing that caused valid Runtime actions to fail TypeScript checks.

Resources can now define runtime actions as expected:

actions: [
  action("create"),
  action("update"),
  action("delete"),
]

Upgrade

pnpm add "@verikit/core@^0.24.1" \
  "@verikit/drizzle@^0.24.1" \
  "@verikit/runtime@^0.24.1" \
  "@verikit/server@^0.24.1" \
  "@verikit/theme@^0.24.1" \
  "@verikit/vue@^0.24.1"

Full Changelog: v0.24.0...v0.24.1

v0.24.0

This release adds first-class resource and API introspection, including JSON Schema generation and OpenAPI document generation.

Resource introspection

• Added field applicability introspection.
• Added permission introspection.
• Resource schemas now expose actions and permissions.

JSON Schema

• Added JSON Schema generation for VeriKit fields.
• Added resource-level JSON Schema generation.
• Added operation-aware schemas for different resource operations.
• Expanded test coverage for JSON Schema generation.

OpenAPI

• Added OpenAPI types and reusable error schemas.
• Added OpenAPI document generation for VeriKit server APIs.
• Exported the OpenAPI document generator for application use.
• Added coverage for remaining OpenAPI generation branches.
• Aligned record-permission responses in generated OpenAPI definitions.

Client

• Added support for custom resource paths.

Server and security

• Invalid and unreadable filters are now rejected.
• Uploads now require explicit upload permission.
• Avoided regex processing of untrusted input.
• Improved handling of literal wildcard search candidates in the Prisma adapter.

CI and maintenance

• Restricted CI workflow token permissions.
• Pinned Node and pnpm versions for more deterministic CI and coverage runs.
• Added additional server query-parsing and filtering coverage.

Full Changelog: v0.23.7...v0.24.0

v0.23.7

Verikit v0.23.7 focuses on security hardening, Prisma adapter correctness, permission enforcement, safer uploads, and transactional pagination. It also strengthens CI supply-chain security and addresses vulnerable transitive dependencies.

Highlights

Secure upload processing

The server now provides a secure upload processing hook, creating a safer extension point for handling uploaded files.

Upload signatures are now verified before files are passed to storage, preventing invalid or incorrectly identified files from reaching the storage layer.

Stronger permission enforcement

Record-aware field permissions are now correctly enforced when returning list results.

Write permission evaluation has also been hardened to fail closed when a permission rule throws an error. A failing authorization rule can therefore no longer accidentally result in a write operation being permitted.

Field permission processing has additionally been optimized to avoid redundant permission checks during server operations.

Transactional list pagination

The Prisma adapter now supports transactional list pagination, allowing the list query and its associated count operation to execute within a consistent transaction.

This provides stronger consistency for paginated responses when underlying records may be changing concurrently.

Safer Prisma search

Search handling now treats SQL LIKE metacharacters as literal input where appropriate.

Characters with special LIKE semantics are no longer unintentionally interpreted as search patterns when they are intended to be part of the user's search value.

Additional tests cover the sorted literal-search path.

Prisma adapter reliability

Several Prisma adapter behaviours have been corrected and expanded with additional test coverage.

Scoped updates no longer depend on JavaScript this binding, removing an unnecessary execution-context dependency and making adapter behaviour more predictable.

Dependency security

Overrides have been introduced for vulnerable versions of:

• postcss
• nanoid

This ensures affected transitive dependency versions are replaced with safer releases within the dependency graph.

CI supply-chain hardening

GitHub Actions used by Verikit's CI workflows are now pinned to immutable commit SHAs rather than relying solely on mutable version tags.

This reduces the risk of upstream action tags changing unexpectedly or being compromised.

npm provenance metadata

Repository metadata has been added to support npm provenance and improve traceability between published Verikit packages and their source repository.

Testing and maintenance

This release adds and improves coverage around several of the hardened behaviours, including:

• Sorted literal search.
• Prisma adapter behaviour.
• Client integration fixture permissions.
• Permission-related behaviour.

Prettier formatting updates are also included across affected code.

Summary

v0.23.7 is primarily a security, correctness, and reliability release.

The most significant changes are stricter authorization behaviour, record-aware field permissions, upload signature verification before storage, safer Prisma searches, transactional pagination, hardened GitHub Actions, vulnerable dependency overrides, and improvements to the Prisma adapter.

Users running earlier v0.23.x releases should consider upgrading, particularly applications relying on file uploads, field-level permissions, Prisma-backed searching, or paginated resource APIs.

Full Changelog: v0.23.6...v0.23.7

v0.23.6

This release consolidates the changes made since v0.23.1, focusing on package documentation and a more reliable release and publishing process.

Documentation

• Added dedicated README files across all Verikit packages.
• Updated the main project README.
• Simplified source-code comments for clearer package documentation.

Release automation

• Added automated npm publishing through GitHub Actions.
• Added npm Trusted Publishing using OIDC, removing the need for long-lived npm authentication tokens.
• Added release validation to prevent publishing packages with mismatched versions.
• Added pnpm vsync --check for verifying that all workspace package versions match the root version.
• Improved vsync to make version releases atomic.
• Added support for:
  • pnpm vsync patch
  • pnpm vsync minor
  • pnpm vsync major
• Version bumps now update the root and all workspace packages together.
• Release commits and Git tags are now created from the same synchronized state, preventing tags from pointing to commits with stale package versions.
• Release tags remain explicitly pushed, keeping publishing an intentional operation.

CI

• Added release-time build and package smoke-test validation.
• Configured the publishing workflow for Node.js 24 and pnpm 11.
• Added package-version consistency checks before npm publishing.
• Improved pnpm 11 CI configuration for upgrade-compatible setup.

Publishing

All Verikit workspace packages are now published through the same validated release pipeline:

• @verikit/core
• @verikit/runtime
• @verikit/server
• @verikit/client
• @verikit/react
• @verikit/vue
• @verikit/ui-core
• @verikit/theme
• @verikit/prisma
• @verikit/drizzle

Publishing now uses npm Trusted Publishing through GitHub Actions with OIDC. Published packages include npm provenance, providing verifiable information linking package artifacts back to the Verikit GitHub repository and release workflow.

Upgrade

pnpm update '@verikit/*'

Full Changelog: v0.23.1...v0.23.6

v0.23.2

Documentation-focused patch release improving package-level documentation across the Verikit ecosystem.

Documentation

• Added dedicated READMEs to Verikit packages, making package purpose, installation, and usage information available directly from npm.
• Simplified code comments for improved readability and maintainability.
• Updated the main project README with clearer project information and guidance.

Maintenance

• No runtime or API behavior changes.
• No breaking changes.

Full Changelog: v0.23.1...v0.23.2

v0.23.1

This release improves package-manager compatibility and CI stability while expanding Verikit's generated API documentation to cover the UI Core and Vue packages.

Highlights

More flexible pnpm version requirements

Verikit no longer pins development to a specific pnpm patch release.

The pnpm requirement has been relaxed so compatible pnpm 11.x releases can be used without requiring the repository configuration to be updated every time pnpm receives an upgrade.

This reduces unnecessary tooling friction for contributors while keeping the project within the supported pnpm major version.

CI updated for pnpm 11

GitHub Actions workflows now explicitly configure pnpm 11.

This allows CI to install an appropriate pnpm 11 release without depending on an exact packageManager version in the root package configuration.

Together with the relaxed local requirement, this provides a more upgrade-compatible setup across:

• Local development
• Workspace package commands
• GitHub Actions
• Dependency installation
• Documentation generation

Lockfile cleanup

The pnpm lockfile has been regenerated without the previous exact pnpm version pin.

This removes stale package-manager dependencies associated with the previous fixed pnpm release and aligns the lockfile with the new versioning strategy.

Expanded API documentation

API documentation generation now includes both:

• ui-core
• vue

This expands the generated framework API reference beyond the previously documented packages and makes the newer UI framework APIs easier to discover and use.

Vue documentation

Following the Vue resource component work introduced in v0.23.0, the Vue package is now incorporated into Verikit's API documentation pipeline.

This helps ensure the Vue APIs are represented alongside the rest of the framework as the integration continues to mature.

Summary

v0.23.1 is primarily a tooling, CI, and documentation maintenance release.

The release removes the need to continuously update an exact pnpm patch-version pin, configures CI around the supported pnpm 11 major release, cleans the generated lockfile, and expands API documentation coverage to Verikit's UI Core and Vue packages.

Full Changelog: v0.23.0...v0.23.1

v0.23.0

Verikit now supports Vue.

This release introduces @verikit/vue, bringing the resource-driven forms, tables, relationships, schema layouts, queries, and UI components available in @verikit/react to Vue applications.

It also expands @verikit/ui-core so React and Vue can share framework-independent behavior while keeping their framework integrations native.

Vue support

@verikit/vue

Added the new Vue package with support for:

• VerikitProvider and useVerikitClient
• TanStack Vue Query integration
• Resource queries and mutations
• Resource table composables
• Schema-driven forms
• Resource forms and tables
• Filtering, sorting, and pagination
• Relationship fields
• Schema-tree layout rendering
• Field registration and overrides
• Conditional field handling
• Optimistic updates
• Loading and error states

Resource forms

Vue applications can now build schema-driven forms using the same Verikit resource definitions used by the server and other framework integrations.

The Vue implementation includes:

• ResourceForm
• Field resolution and registry
• Field shells
• Text inputs
• Textareas
• Selects
• Checkboxes
• Relationship fields
• Validation states
• Schema-driven layouts

Resource tables

Added Vue resource-table support including:

• ResourceTable
• useResourceTable
• Filtering
• Sorting
• Pagination
• Resource actions
• Filter panels
• Query integration

This provides both a ready-to-use table component and a headless composable for applications that need custom presentation.

Schema-driven layouts

Vue now supports rendering Verikit schema trees, including:

• Fields
• Sections
• Grids
• Tabs
• Wizards
• Repeaters
• Actions
• Relationships

This brings Vue's schema-driven rendering capabilities in line with the existing React integration.

Relationships

Added Vue relationship components, including BelongsToRelationshipField, with resource querying and form integration.

Relationship composables are initialized during component setup rather than render, preventing duplicate queries and watchers during reactive updates.

Vue UI primitives

Added Vue component primitives built on Reka UI, including:

• Button
• Label
• Input
• Textarea
• Checkbox
• Select
• Dialog

These provide accessible interaction primitives while allowing Verikit to retain control over its component API and styling.

Shared UI core

@verikit/ui-core now includes shared field-resolution behavior used by framework adapters.

@verikit/react has been updated to consume this shared implementation, reducing duplicated form logic between React and Vue.

The architecture now follows:

@verikit/core
      │
@verikit/ui-core
      │
 ┌────┴────┐
 │         │
React     Vue

Framework-independent behavior lives in ui-core, while React and Vue retain native framework APIs and rendering.

Quality

The Vue implementation includes comprehensive coverage across:

• Fields
• Relationships
• Queries
• Layout rendering
• Resource forms
• Resource tables
• Component primitives
• Public package exports

The Vue package reaches feature parity with the existing React implementation while preserving the shared architecture introduced in v0.22.0.

Upgrade

This release does not intentionally introduce breaking changes to existing @verikit/react applications.

Existing React integrations can continue using Verikit as before. Vue applications can now adopt the new @verikit/vue package.

Full Changelog: v0.22.0...v0.23.0

v0.22.0

This release introduces @verikit/ui-core, a new framework-agnostic package for shared UI behavior. It begins separating reusable application logic from the React integration, laying the foundation for additional framework adapters such as Vue.

What's new

@verikit/ui-core

• Added a new framework-agnostic UI package.
• Extracted shared form schema-tree utilities from @verikit/react.
• Extracted form submission logic into the shared layer.
• Moved layout/path utilities into ui-core.
• Moved query-key and optimistic-update utilities into ui-core.
• Added public API exports and package-level configuration for the new package.

React

• Updated @verikit/react to consume shared primitives from @verikit/ui-core.
• Kept React-specific hooks, components, rendering, and framework integration within the React package.
• Updated form, resource, layout, query, and mutation integrations around the new shared architecture.

Testing

• Migrated applicable framework-independent tests to ui-core.
• Updated React layout tests for the new package boundaries.
• Expanded schema-tree and shared UI coverage.
• Added public API coverage for @verikit/ui-core.

Why this matters

Previously, reusable UI behavior lived inside @verikit/react, making it difficult for another framework integration to share the same behavior without duplicating React-owned code.

@verikit/ui-core establishes a common framework-neutral layer:

@verikit/core
      ↓
@verikit/ui-core
      ↓
 ┌────┴────┐
React     Vue

This keeps framework adapters focused on framework-specific concerns while allowing forms, queries, schema traversal, optimistic updates, and other reusable behavior to evolve from a common foundation.

This release is primarily an architectural step toward first-class Vue support while keeping the existing React integration aligned with the same shared primitives.

Full Changelog: v0.21.0...v0.22.0

v0.21.0

This release introduces a first-class error handling system across Verikit, with centralized server-side error processing, stable error codes, structured client errors, and improved React error handling. It also includes several fixes to optimistic updates, forms, relationship pickers, filtering, and table behaviour.

Highlights

First-class error handling

Verikit now provides a dedicated error hierarchy with stable error codes, making errors more predictable and easier to handle across the stack.

• Added the VerikitError hierarchy with stable error codes.
• Added centralized server error handling through the new onError hook.
• Added standardized error-response formatting.
• Refactored server handlers to throw VerikitError instances instead of manually constructing error responses.
• HTTP parsing errors now flow through the same error system.
• Added structured client-side error handling for React applications.
• Added comprehensive tests covering error behaviour and error-code contracts.

This establishes a consistent error path from the server through to client applications and provides a stronger foundation for applications that need to react programmatically to specific failures.

React error handling improvements

React components now make better use of structured errors returned by the server.

In particular, server-side unique constraint errors can now be surfaced directly on the appropriate ResourceForm fields, providing users with useful validation feedback instead of generic request failures.

Relationship picker failures are also surfaced correctly rather than being silently lost.

Safer optimistic updates

Fixed race conditions involving optimistic cache updates and rollbacks.

Bulk-delete failures could previously cause a rollback to restore sibling rows that had already been successfully removed by another operation. Rollback behaviour has been corrected to prevent deleted records from being unintentionally resurrected.

Additional tests have been added specifically around optimistic-cache rollback races.

ResourceTable improvements

Several table and filtering behaviours have been improved:

• Changing a filter or search query now resets the table to the first page.
• Date filtering and filter-clearing behaviour have been improved.
• Relationship pickers request the complete required result set.
• Relationship picker errors are now surfaced correctly.
• Bulk-delete confirmation titles no longer incorrectly double-pluralize resource names.

Testing

This release expands test coverage around the new error architecture and React state-management behaviour, including:

• Error hierarchy and stable error-code contracts.
• Centralized server error handling.
• Structured client errors.
• Optimistic cache rollback race conditions.
• Bulk-delete rollback behaviour.

These tests are intended to make both the public error contract and optimistic-update behaviour safer to evolve in future releases.

Summary

v0.21.0 primarily strengthens reliability and error handling across Verikit's core, server, and React packages. Applications now have a more consistent way to identify, transport, display, and customize errors, while the accompanying React fixes improve behaviour around forms, tables, relationships, and concurrent optimistic updates.

Full Changelog: v0.20.0...v0.21.0

v0.20.0

Verikit 0.20.0 expands resource-driven UI with first-class relationships, conditional field visibility, table filtering, and bulk actions.

What's new

• First-class relationships in ResourceForm - relationship fields can now be rendered and managed directly through generated resource forms, including relationship picker control states.
• Relationship validation on writes - @verikit/server validates belongsTo relationships before create/update operations, preventing writes that reference invalid related records.
• Conditional field visibility - resource fields can dynamically control their visibility based on form state.
• Per-field table filters -ResourceTable can expose filters based on resource field definitions.
• Bulk row actions - tables can perform actions against multiple selected records.
• Expanded React test coverage around relationship picker states and related form behavior.

This release continues moving Verikit toward defining application behavior once at the resource level and deriving consistent forms, tables, validation, relationships, and server behavior from that definition.

Full Changelog: v0.19.4...v0.20.0