VEXPLOR AAS Studio 2.8.0

VEXPLOR AAS Studio 2.8.0 — collection link security, kept read errors, remote collector health

Added

• Remote collector health. Each row in Settings → Remote collectors carries a server-judged OK · Warning · Problem badge and its first reason. Open a row for the factory PC (CPU, memory, disk, uptime, clock offset, version), the line to the server (last success, round trip, failures, batches waiting, oldest waiting) and each machine (connected, response time, read success, reconnects, last drop, last error), with a 24-hour trend. Warning: disk under 10 %, sending failing for 1 min or more, clock off by more than 5 s, read success under 90 %, queue write failures, batches held in memory or dropped. Problem: no values past the stale limit, no machine connected, disk under 2 %. Needs VEXPLOR Edge 1.1.0; older collectors show "not sent by this version".
• Server status for admins — store connection, disk, batches received and refused in the last hour, server version (GET /server/status).
• OPC UA security and logins from the screen. "Create collection link" now sets the security mode (Sign · SignAndEncrypt), policy and "Login required" for OPC UA and MQTT; the link records them as standard security definitions and "Load from equipment" connects the same way.
• Unit, Modbus byte/word order (ABCD · CDAB · BADC · DCBA) and a read period per machine on the screen. "Edit link" opens with the current link filled in.
• Read errors are kept. Automatic collection and remote collectors store why a tag could not be read; the Collect pane shows "Read failed — reason" after a reload, including Modbus and MQTT.

Changed

• MQTT logins leave the equipment file. The file keeps only "Login required"; the read list carries a credentialRef, and the user name and password live in the server's credentials file and the factory PC's credentials.json. A link with the password in its address is left out of remote read lists and flagged on screen and by the new rule AID-1 (44 rules). Upgrading: if a remote collector read an MQTT broker with the password in the address, use "Edit link" to take it out, put it in credentials.json, and update the collector to VEXPLOR Edge 1.1.0.
• The contract copy follows VEXPLOR Edge 1.1.0 (vexplor.edge/1, optional status fields). The site bundle pins VEXPLOR Edge 1.1.0.

Install the libraries by release URL, never by version number:

"@aas/core":      "https://github.com/waceinc/vexplor-aas/releases/download/v2.8.0/aas-core-2.8.0.tgz",
"@aas/aasx":      "https://github.com/waceinc/vexplor-aas/releases/download/v2.8.0/aas-aasx-2.8.0.tgz",
"@aas/linter":    "https://github.com/waceinc/vexplor-aas/releases/download/v2.8.0/aas-linter-2.8.0.tgz",
"@aas/bundle":    "https://github.com/waceinc/vexplor-aas/releases/download/v2.8.0/aas-bundle-2.8.0.tgz",
"@aas/collector": "https://github.com/waceinc/vexplor-aas/releases/download/v2.8.0/aas-collector-2.8.0.tgz",
"@aas/fieldbus":  "https://github.com/waceinc/vexplor-aas/releases/download/v2.8.0/aas-fieldbus-2.8.0.tgz",
"@aas/opcua":     "https://github.com/waceinc/vexplor-aas/releases/download/v2.8.0/aas-opcua-2.8.0.tgz"

Guides: docs/usage.md §8 (collection links) and §8-8 (remote collectors), docs/edge-install.md. Checksums: SHA256SUMS. Details: #45 · #47 · #48 · #49

VEXPLOR AAS Studio 2.7.0

VEXPLOR AAS Studio 2.7.0 — one-click remote collector

Added

• One-click connect for remote collectors. Settings → Remote collectors → "+ Connect a collector": check the server
  address and the read list, press one button, paste the one line it shows on the factory Linux PC. That line downloads
  VEXPLOR Edge, checks it against SHA256SUMS, installs, registers and — with "Approve this list" ticked — starts
  reading. The window shows the PC the moment it connects.
• Collectors at a glance. Last batch, values received, tags read, machines connected, batches waiting, the version
  each runs now; pause, resume (new) and revoke on the same screen. A collector waiting for approval asks every 10 s.
• Turn it on from the screen. With EDGE empty (the new default) an admin switches remote collection on in the
  window; EDGE=on / EDGE=off still decide when set.
• The Collect pane refreshes itself every 10 s for files with a collection link, and says "Receiving" while a remote
  collector's values arrive.
• Equipment reader libraries — @aas/collector, @aas/fieldbus, @aas/opcua join the release packages.

Changed

• VEXPLOR Edge is its own open source: waceinc/vexplor-edge (Apache-2.0,
  version 1.0.0), built on the reader libraries above. The canonical contract vexplor.edge/1 lives there; this server
  receives it unchanged. Collector packages are no longer attached here — the site bundle takes the pinned collector
  release and checks its SHA256SUMS.

Install the libraries by release URL, never by version number:

"@aas/core":      "https://github.com/waceinc/vexplor-aas/releases/download/v2.7.0/aas-core-2.7.0.tgz",
"@aas/aasx":      "https://github.com/waceinc/vexplor-aas/releases/download/v2.7.0/aas-aasx-2.7.0.tgz",
"@aas/linter":    "https://github.com/waceinc/vexplor-aas/releases/download/v2.7.0/aas-linter-2.7.0.tgz",
"@aas/bundle":    "https://github.com/waceinc/vexplor-aas/releases/download/v2.7.0/aas-bundle-2.7.0.tgz",
"@aas/collector": "https://github.com/waceinc/vexplor-aas/releases/download/v2.7.0/aas-collector-2.7.0.tgz",
"@aas/fieldbus":  "https://github.com/waceinc/vexplor-aas/releases/download/v2.7.0/aas-fieldbus-2.7.0.tgz",
"@aas/opcua":     "https://github.com/waceinc/vexplor-aas/releases/download/v2.7.0/aas-opcua-2.7.0.tgz"

Guides: docs/edge-install.md (this server's side), docs/usage.md §8-8. Checksums: SHA256SUMS. Details: #44

VEXPLOR AAS Studio 2.6.0

VEXPLOR AAS Studio 2.6.0 — Logic Studio guide

Added

• In-app help: "Use it in VEXPLOR Logic Studio". ? Help explains how a checked AASX becomes the equipment register
  of VEXPLOR Logic Studio Cloud — download it, drop it on the equipment screen, check the preview, import. Nothing to
  install in the factory, nothing to convert. Dropping the same file again changes nothing; a changed file shows only
  what changed, as proposals. Live values from the remote collector to Logic Studio are in preparation.
• Guide — docs/logic-studio.md (English) and docs/로직스튜디오.md (Korean): three steps, what Logic Studio reads
  from the file, what stays where. Linked from the README, the user guide and the in-app help.

Install the libraries by release URL, never by version number:

"@aas/core":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.6.0/aas-core-2.6.0.tgz",
"@aas/aasx":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.6.0/aas-aasx-2.6.0.tgz",
"@aas/linter": "https://github.com/waceinc/vexplor-aas/releases/download/v2.6.0/aas-linter-2.6.0.tgz",
"@aas/bundle": "https://github.com/waceinc/vexplor-aas/releases/download/v2.6.0/aas-bundle-2.6.0.tgz"

• Remote collector for Linux: vexplor-edge-2.6.0-linux-x64.tar.gz and -linux-arm64.tar.gz (docs/edge-install.md).
  Windows will be covered later.

Checksums for every file: SHA256SUMS. Details: #42

VEXPLOR AAS Studio 2.5.0

VEXPLOR AAS Studio 2.5.0 — read-list tag hints

Added

• Tag hints in the read list and in aidReadList (@aas/bundle). Each tag names the semanticId of the model
  element its value belongs to, a suggestedRole (run_state · counter · alarm_source · meter · condition ·
  quality · value) and limits from properties of the same file (e.g. TechnicalData MaxSettingForce for
  SettingForce, with the source path). A receiver pre-fills roles and SPC limits for a person to confirm.
  Contract vexplor.edge/1 §4.1 (docs/edge-contract.md) — optional fields only.
• Hints are not part of the list revision: updating the server never asks a site to approve its list again, and
  edges ignore the new fields.

Docs

• CONTRIBUTING (EN/KO) — "Releasing a version": a release also updates What's new, the feature guides and the
  product website.

Install the libraries by release URL, never by version number:

"@aas/core":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.5.0/aas-core-2.5.0.tgz",
"@aas/aasx":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.5.0/aas-aasx-2.5.0.tgz",
"@aas/linter": "https://github.com/waceinc/vexplor-aas/releases/download/v2.5.0/aas-linter-2.5.0.tgz",
"@aas/bundle": "https://github.com/waceinc/vexplor-aas/releases/download/v2.5.0/aas-bundle-2.5.0.tgz"

• Remote collector for Linux: vexplor-edge-2.5.0-linux-x64.tar.gz and -linux-arm64.tar.gz (docs/edge-install.md).
  Windows will be covered later.

Checksums for every file: SHA256SUMS. Details: #39 · #40

VEXPLOR AAS Studio 2.4.0

VEXPLOR AAS Studio 2.4.0 — site server, TimescaleDB compression and aggregates, edge sends changes only

Added

• Site server install on Linux (docs/site-install.md): one command puts AAS Studio, the database and the remote
  collector on one factory server; comes back after a reboot. The app uses its own non-superuser database account.
  Install bundles are built by scripts/make-release.sh in two editions — TimescaleDB Apache-2 Edition (default) and
  TimescaleDB Community Edition (licence notice and TSL copy included); they are handed over directly, not attached here.
• TimescaleDB Community Edition features: compression of collected values (COLLECT_COMPRESS_AFTER_DAYS, default 7 —
  1 099 MB → 50 MB measured for 1 000 tags × 1 s × 1 h), 1-minute and 1-hour continuous aggregates
  (collected_value_1m / _1h), retention by whole chunks. TimescaleDB Apache-2 Edition and plain PostgreSQL work as before.
• Edge: send changes only — "opcua": { "mode": "subscribe", "deadband": …, "resendMs": … }. Measured 6 tags × 1 s × 5 min:
  283 KB polling → 130 KB subscribe → 88 KB with deadband 1.0.

Fixed

• The edge no longer stops for good on an answer the contract does not name (e.g. a 404 from a proxy); only 401 and 403
  stop it (contract §6, row added).
• The database healthcheck runs over TCP — on a new volume the app could start before the database and restart once.

Packages

• @aas/* 2.4.0 libraries (install by release URL, never by version number):

"@aas/core":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.4.0/aas-core-2.4.0.tgz",
"@aas/aasx":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.4.0/aas-aasx-2.4.0.tgz",
"@aas/linter": "https://github.com/waceinc/vexplor-aas/releases/download/v2.4.0/aas-linter-2.4.0.tgz",
"@aas/bundle": "https://github.com/waceinc/vexplor-aas/releases/download/v2.4.0/aas-bundle-2.4.0.tgz"

• Remote collector for Linux: vexplor-edge-2.4.0-linux-x64.tar.gz and -linux-arm64.tar.gz (docs/edge-install.md).
  Windows will be covered later.

Checksums for every file: SHA256SUMS. Details: #31 · #32 · #33 · #34 · #35 · #36

VEXPLOR AAS Studio 2.3.0

VEXPLOR AAS Studio 2.3.0 — read list without a server, remote collector packages

Added

• aidReadList(environment, packageId, intervalMs?) in @aas/bundle. The AID interfaces of one AASX resolved into
  the tags a remote collector reads (docs/edge-contract.md §4) — the server's own read-list code, so the same
  packageId gives the same tagIds. A product that builds its own read list from AASX files needs no AID parser.
• Remote collector (VEXPLOR Edge) for Linux — vexplor-edge-2.3.0-linux-x64.tar.gz with its installer, checked on a
  fresh Ubuntu 24.04. Guide: docs/edge-install.md. Windows will be covered later; the -win-x64.zip attached here
  is not offered for use (installed on no Windows PC yet, not code-signed).

Changed

• The collector sends one batch at a time, oldest first — a backlog after an outage arrives before newer batches
  (contract §5).
• Unsent batches are kept at most maxQueueDays (default 30) and then dropped and counted in status.droppedBatches;
  receivers keep their duplicate memory longer than that (contract §6). Contract changes are additions only.

Install the libraries by release URL, never by version number:

"@aas/core":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.3.0/aas-core-2.3.0.tgz",
"@aas/aasx":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.3.0/aas-aasx-2.3.0.tgz",
"@aas/linter": "https://github.com/waceinc/vexplor-aas/releases/download/v2.3.0/aas-linter-2.3.0.tgz",
"@aas/bundle": "https://github.com/waceinc/vexplor-aas/releases/download/v2.3.0/aas-bundle-2.3.0.tgz"

Checksums for every file: SHA256SUMS. Details: #29 · #30

VEXPLOR AAS Studio 2.2.1 — Type link from derivedFrom

VEXPLOR AAS Studio 2.2.1 — Type link from derivedFrom

Fixed

• typeAasId from derivedFrom. The equipment master — and so @aas/bundle (buildBundle) — now names an
  Instance's Type from the shell's own AAS derivedFrom reference when the server has no link of its own. Before, a
  unit uploaded as a file (and every unit buildBundle sees) had typeAasId: null, so a receiver could not attach it to
  its Type. The server's link still wins when both exist.
• The sample bundle (docs/examples/integration-bundle/) now links both Instances to the Type.

Note: typeAasId is part of the equipment digest, so a unit that had only derivedFrom gives one equipment-updated
event the next time it is projected.

Install by release URL, never by version number:

"@aas/core":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.1/aas-core-2.2.1.tgz",
"@aas/aasx":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.1/aas-aasx-2.2.1.tgz",
"@aas/linter": "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.1/aas-linter-2.2.1.tgz",
"@aas/bundle": "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.1/aas-bundle-2.2.1.tgz"

Checksums: SHA256SUMS. Details: #16 · #17

VEXPLOR AAS Studio 2.2.0 — integration bundle without a server

VEXPLOR AAS Studio 2.2.0 — the integration bundle without a server

New

• @aas/bundle — buildBundle(files, options). Builds the integration bundle (vexplor.integrationBundle/1) from
  AASX files without an AAS Studio server, for a product that takes AASX directly (drag and drop). It runs this API's
  own export code over an in-memory store: the same files in the same order with the same exportedAt give the same
  zip as GET /integrations/exports/bundle, byte for byte. See docs/integration.md §7.4.
• Sample bundle. docs/examples/integration-bundle/ — four AASX files (a Type, two Instances made from it, a
  company file placing both on a line) and the bundle built from them, for a receiver's import gate. A test fails when
  the sample and the code disagree.

Install by release URL, never by version number (the @aas scope on the public npm registry is not ours):

"@aas/core":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.0/aas-core-2.2.0.tgz",
"@aas/aasx":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.0/aas-aasx-2.2.0.tgz",
"@aas/linter": "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.0/aas-linter-2.2.0.tgz",
"@aas/bundle": "https://github.com/waceinc/vexplor-aas/releases/download/v2.2.0/aas-bundle-2.2.0.tgz"

Fixed

• ZIP output (AASX files, bundles) no longer depends on the machine's time zone — the same content now gives the same
  bytes in Seoul and on a UTC server.

Checksums: SHA256SUMS. Details: #13 · #15

VEXPLOR AAS Studio 2.1.0 — integration bundle and libraries

VEXPLOR AAS Studio 2.1.0 — integration bundle and libraries

New

• Integration bundle. GET /integrations/exports/bundle returns every export of the visible files in one zip:
  manifest.json (vexplor.integrationBundle/1, sha256 and item count per part), equipment.json (Type shells
  included) and packages/<id>/{hierarchy,bom,maintenance,documents}.json. Each part is exactly what the single export
  route answers. In the UI: Integrations → Exports → Download everything (zip). See docs/integration.md §7.4.
• Libraries for other products. @aas/core, @aas/aasx and @aas/linter are attached below as npm tarballs.
  Install them by release URL, never by version number (the @aas scope on the public npm registry is not ours):

"@aas/core":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.1.0/aas-core-2.1.0.tgz",
"@aas/aasx":   "https://github.com/waceinc/vexplor-aas/releases/download/v2.1.0/aas-aasx-2.1.0.tgz",
"@aas/linter": "https://github.com/waceinc/vexplor-aas/releases/download/v2.1.0/aas-linter-2.1.0.tgz"

Fixed

• Outbound connections always refuse the Azure platform address 168.63.129.16 (#10).

Checksums: SHA256SUMS. Details: #10 · #11 · #12

VEXPLOR AAS Studio 2.0.1 — security fixes

VEXPLOR AAS Studio 2.0.1 — security fixes

A red-team assessment of 2.0.0 (authentication, uploads and parsers, authorization, deployment) found one high, three
medium and twelve low issues. All are fixed with regression tests and were verified independently. Upgrade is
recommended for every 2.0.0 installation.

High

• Uploaded files could run as active content. An editor could store HTML or JavaScript as a thumbnail or file
  attachment and have it run in another user's session. User files are now served inline only when their bytes are a
  raster image or a PDF, otherwise as a download, always with a sandbox CSP. Thumbnail uploads accept PNG, JPEG, GIF
  and WebP only.

Medium

• Login no longer reveals through its response time whether an account exists.
• A read-only API key can no longer list users' contact details.
• The folder store refuses package ids that are not plain names (400).

Low

• Repeated failures against one login now slow it down instead of locking out its owner.
• Cookie writes with Origin: null or a cross-site origin are refused; CORS_ORIGIN=* no longer counts as trusted.
• Two simultaneous first-administrator setups can no longer create two administrators.
• Password hashing runs at most four at a time; overload answers 503 with Retry-After.
• Security headers are present on error responses; a malformed JSON body is a 400.
• Deeply nested JSON and broken AASX parts are rejected with a 400 instead of a server error.
• Large uploads: at most two bodies over 32 MB at once; the body limit follows AASX_MAX_TOTAL_MB.
• AAS_WORKSPACE=private on a server without accounts or keys refuses file requests until the first administrator exists.
• GitHub Actions are pinned to commit SHAs.

Behaviour changes to note

• Thumbnails: only PNG, JPEG, GIF and WebP can be uploaded. AASX files keep their original thumbnail on import and export.
• Attachments other than images and PDFs download instead of opening in the browser.

Details: #8 · SECURITY.md