chore: release main

[bc-solutions-coder]

🤖 I have created a release beep boop

5.0.0

5.0.0 (2026-08-05)

⚠ BREAKING CHANGES

• identity: CreateAdminRequest requires organizationName. Roles are granted per organization, so an administrator created without one holds no permission anywhere.
• announcements: AnnouncementTarget.Plan no longer exists. Any announcement row stored with target "Plan" will fail to deserialize; re-seed instead.
• identity: IOrganizationService.AddMemberAsync/RemoveMemberAsync and IUserManagementService.AssignRoleAsync/RemoveRoleAsync take a Guid actorId before the CancellationToken.
• identity: OrganizationSettingsDto gains three members and the "user" role no longer carries OrganizationsCreate or OrganizationsUpdate. A fork that wants self-service organization creation grants it on a role of its own.
• identity: POST /v1/identity/invitations now returns 422 Identity.AlreadyAMember when the address already belongs to the organization, and re-inviting returns the existing token rather than a new one.
• identity: IInvitationService.CreateInvitationAsync no longer takes a tenantId; it invites into the caller's own organization.
• identity: POST /v1/identity/invitations/{token}/accept now returns 422 when the caller is not the invited verified user or the invitation has lapsed.
• identity: access tokens are now validated against the token entry on every request, so revoked tokens are refused immediately.
• identity: refuse token issuance for a membership that is not active
• identity: WallowUser has no TenantId, and the person-scoped identity integration events carry a nullable one.
• identity: the auth cookie carries neither org_id nor role claims.
• identity: drop OrgMemberRole in favour of the shared role catalog
• identity: keep global role claims out of the auth cookie
• identity: refreshed tokens carry only the roles the token's own organization grants.
• identity: authorize refuses a client that carries no tenant binding, and role claims are scoped to the client's organization.
• identity: grant the scopes a caller is entitled to instead of refusing the request
• identity: write role assignments to memberships, not the global role store
• identity: gate cross-organization access on per-org permissions
• identity: POST /v1/identity/organizations/{id}/members now requires a "role" field naming the role granted in that organization.
• packages/web-shell no longer exists. Its createQueryClient() moved to @bc-solutions-coder/query and its current-user helpers moved to @bc-solutions-coder/auth; consumers must switch imports to the new packages.
• @bc-solutions-coder/sdk drops its h3 dependency and collapses its hand-written surface. The server entry now exports web-standard Request to Response handlers instead of h3 EventHandlers, and consumers must construct a per-request client with createWallowSdk() rather than importing a module-global singleton. The operation and query surfaces are generated, so hand-written wrappers and inline query keys are gone; all query keys come from the generated factory.

Features

• add packages/query and packages/auth, delete packages/web-shell (521fd1b)
• auth: add the zone alias map and its tsconfig pin test (eedddfe)
• auth: migrate password recovery forms to the forms package (c5d72a9)
• auth: resolve the zone aliases in vite and vitest (2dff070)
• auth: support serving under a base path for path-hosted deployments (b343b65)
• branding: restore the cream and gold palette and add docsUrl (a841b50)
• docker: fail closed on missing production secrets, add a bootstrap script (8dc960d)
• docker: reference Caddy ingress, loopback port bindings, hex secrets for production compose (5f8dce4)
• env: add @bc-solutions-coder/env and rewire the apps onto it (188bfc9)
• forms: add form core contexts, testids and error normalization (cb0da09)
• forms: add the AppForm shell, SubmitButton and FormError (4e0ec6a)
• forms: add the catalog field components (9892047)
• forms: add the useAppForm hook (f0b6677)
• forms: export public surface (5a66ab4)
• forms: revalidate flagged fields as the user types (fb16178)
• forms: scaffold the @bc-solutions-coder/forms package (a9d33a9)
• hosting: add WorkerRunOutcome for one-shot worker exit codes (ffb7469)
• identity: add membership approve, deny, suspend and reinstate (60fd0e1)
• identity: add per-organization enrollment policy (3fda0a6)
• identity: add the access-requested integration event (a53ccba)
• identity: add the Membership aggregate carrying per-org authorization (aa86667)
• identity: add the membership repository (d95b314)
• identity: decide enrollment in a service, not a controller branch (d9e42e9)
• identity: describe every scope on the consent screen (496eeea)
• identity: drop identity.user_roles and give bootstrap an organization (3a0099a)
• identity: emit audit events for every membership transition (eb8f101)
• identity: grant a client the scopes it may request (7bbe3ad)
• identity: keep an organization from losing its last owner (fa80e5f)
• identity: let a denial expire instead of standing forever (1ce5856)
• identity: let a member leave an organization (508febc)
• identity: list suspended and denied memberships per organization (c06797e)
• identity: persist memberships and their per-org role assignments (07c36f2)
• identity: refuse token issuance for a membership that is not active (764f04c)
• identity: report the signed-in organization on userinfo (4965ae1)
• identity: resolve role names per (user, organization) (1d06b18)
• identity: revoke access when a membership leaves active (e03f668)
• identity: seed explicit per-organization memberships and roles (ec6681f)
• identity: seed how each organization admits people (5f2371a)
• identity: stop granting membership from anonymous registration (4b7b45f)
• identity: tell a person which organizations they belong to (137f960)
• logger: add @bc-solutions-coder/logger and wire both apps (b03d7ea)
• migrate apps to tanstack start and streamline sdk (cc8311e)
• navigation: extract the app shell into @bc-solutions-coder/navigation (53da0f7)
• notifications: email an organization's reviewers when someone requests access (e093db1)
• sdk: expose rfc 7807 field errors on WallowError (3a15ad8)
• sdk: regenerate OpenAPI snapshot and typed client (002c2c8)
• styles: add sidebar and success semantic tokens (165bc6a)
• styles: add the warning token pair (e11dd02)
• styles: resolve the fork's outbound links from the environment (8f3036d)
• testing: add console guard with consume-based error assertions (b419be5)
• testing: add consume-based hand-off assertions and wire wallow-auth navigation guard (26be562)
• testing: add network-escape guard blocking unharnessed fetch (39b03f8)
• ui: add CardHeader (639d1ab)
• ui: add NoticeBanner for success and warning notices (44b98d7)
• ui: add QuietLink for muted footer and back links (488a8ff)
• ui: add textarea component (b3cc74d)
• ui: add the EmptyState component (72f665b)
• ui: add the PageHeader component (e3e84aa)
• ui: add the Text component (58455d5)
• ui: adopt 20px (text-xl) as the catalog-wide card-heading standard (dd49f14)
• ui: rebuild @bc-solutions-coder/ui as a Base UI + CVA catalog (79dbb80)
• ui: upgrade the Button recipe with outline/ghost/link, sizes, and focus states (741aa22)
• utils: add @bc-solutions-coder/utils and rewire the apps onto it (bc7c5c7)
• wallow-auth: add the AuthScreen shell (df8fbea)
• wallow-auth: add the shared useReturnUrlGuard hook (c09097a)
• wallow-auth: give a pending join request its own screen (c18c21c)
• wallow-web: add member role management screen with own-org gate (c719272)
• wallow-web: add member-facing leave-organization screen (1175333)
• wallow-web: add pending-request review and invitation screens (d2ebf1e)
• wallow-web: migrate org-detail route to $orgId directory form (b1479af)
• web: add an oxlint gate enforcing the catalog migration (a315558)
• web: add sidebar with expanded, icon-rail, and mobile overlay modes (ca7c258)
• web: add the ported Blazor landing page body (6177a64)
• web: add the zone alias map and its tsconfig pin test (2434359)
• web: migrate dashboard forms to the forms package (cf747fd)
• web: migrate wallow-web page shells, lists, text, and forms onto the catalog (9c20721)
• web: name every unlabelled control and drop the bare textarea (2acfab0)
• web: navigate the apps register CTA client-side (9bdb6a0)
• web: navigate to detail routes from list rows (ebe0def)
• web: pin heading variants with text-heading-variant (a480973)
• web: render an error state for every query (a1bce54)
• web: resolve org members by email in a searchable picker (e4d8659)
• web: resolve the zone aliases in vite and vitest (3059192)
• web: restore the original marketing landing page (6b44912)
• web: sweep the last raw text elements out of bff-demo (a94cb9d)
• web: wire membership screens into nav and org detail (09eb4d7)

Bug Fixes

• align tanstack router-plugin with router-cli (7426a74)
• announcements: remove plan targeting and the claim nothing issues (dbf2d2b)
• api: collapse each module's schema name to one constant (0f3e3b0)
• api: commit handler writes and cascaded messages together (a2eec93)
• api: give each handler its own chain and retry loop (4800cd6)
• api: keep OpenIddict endpoints relative so PathBase survives, raise dev-only passwordless rate limit (551066a)
• api: pin the Wolverine application assembly explicitly (3c7d161)
• api: register fluentvalidation validators once per command (0a3aff8)
• api: stop routing a disabled module's controllers (4f9b0f1)
• apphost: disable Secure BFF cookies for plain-http local dev (08872a6)
• apphost: hand wallow-web a REDIS_URL so dev uses Valkey sessions like prod (3920383)
• apphost: serve the React apps unproxied and align the OIDC issuer (6cba455)
• apps: name server-only modules .server. so import protection fires (3d5d687)
• auth: standardize wallow-auth card headings to one 16px scale (23408a9)
• branding: bypass the tenant filter in the client-branding lookup (a284b02)
• build: run build before typecheck and test in the check gate (de08d2a)
• docker: disable Secure cookies in the plain-http e2e stack (a126bd8)
• docker: make the COOKIE_PASSWORDS rotation example non-destructive (84eb7df)
• docs: make docs/toc.yml the single site-root toc and guard it (f0af8d4)
• docs: restore the frontend state boundary the CLAUDE.md split dropped (99d090b)
• e2e: derive mailpit and auth origins from the backend, not the serving mode (02c4e26)
• e2e: isolate the test compose project from the dev-infra stack (bd6b5a2)
• forms: thread the mutation error type through useAppForm (7157483)
• identity: bind invitation acceptance to the invited verified email and create the membership (ffe56f8)
• identity: carry an invitation returnUrl through registration (2cc7074)
• identity: carry tenant identity on org_id alone (2265cdf)
• identity: delete removed clients after the list reader closes (b7b0f31)
• identity: evaluate MFA exemption against every active membership (c47959e)
• identity: gate cross-organization access on per-org permissions (73db37b)
• identity: grant the scopes a caller is entitled to instead of refusing the request (14f77af)
• identity: issue org-scoped roles from the authorize endpoint (8071315)
• identity: keep global role claims out of the auth cookie (f2c9690)
• identity: keep one live invitation per email and organization (9dc7cd7)
• identity: re-check membership status on the refresh grant (14e4eba)
• identity: record who granted membership and roles, not the subject (ac214e1)
• identity: register ILastOwnerGuard in the seeder's DI container (5a26b0c)
• identity: reject invitation acceptance from an unverified registration (b5b8044)
• identity: resolve invitations outside the ambient tenant (6726b5d)
• identity: resolve org-scoped roles on the refresh grant (728a70a)
• identity: scope invitation queries on their own parameters (08fb7ff)
• identity: stop permission expansion granting across or without a tenant (0892647)
• identity: validate enrollment requests on the constructor parameter (fb0d5a7)
• identity: write role assignments to memberships, not the global role store (58e11f7)
• inquiries: type the 201 response on inquiry comment creation (8eeea2d)
• link the dev stylesheet so first paint is styled (fe83631)
• lint: clear the diagnostics the inherited config surfaced (7af64f7)
• lint: inherit the root oxlint config in ui and forms (41610cd)
• lint: register the wallow/* plugin in navigation, ui and forms (d600e25)
• logger: derive the ingest client IP from the host, not a header (d343968)
• migrations: exit non-zero when a migration fails (2bef239)
• notifications: make the preference checker public so sends generate (f62c221)
• observability: point the Node logger at Alloy's HTTP port (e4f3616)
• pin js-yaml to ^4.3.0 via pnpm override (760bce2)
• replace stale localhost:5000 fallbacks with the real service urls (74be8e8)
• scripts: make run-tests.sh reach every integration assembly (5d03093)
• sdk: fail at boot on a too-short COOKIE_PASSWORD (3438efc)
• sdk: fall back to the double-submit cookie in the CSRF interceptor (4d3aec4)
• sdk: forward the real client IP through the BFF api proxy (01ce6fb)
• sdk: idempotent logout, cookie-password rotation, refresh coalescing, and split-horizon URL pinning (acb1794)
• sdk: preserve the issuer path when pinning browser-facing OIDC endpoints (3a3c192)
• sdk: read a blank COOKIE_NAME as unset, and surface the BFF's remaining knobs (3520ff1)
• seeder: exit non-zero when a seed step fails (62bcb9e)
• styles: resolve branding asset urls under the app base path (151a2cb)
• styles: serve the fork theme as a virtual stylesheet for test harnesses (1eba844)
• testing: budget the node project for the cold route-graph import (5981e15)
• testing: emit types for the console and network guards (a8892f8)
• tests: expect the wallow-auth origin as the dev OIDC issuer (4ea2e07)
• ui: add a surface axis to fix illegible sidebar-composed controls (eca77a5)
• ui: fix contrast on the sidebar navigation menu trigger (f5e3d92)
• ui: let composed anchors announce as links, not buttons (de9dd46)
• ui: match select popup width to trigger and add a default chevron (da4c171)
• ui: settle the promise toast on demand so loading is observable (baee3ed)
• ui: stamp document.documentElement for scheme-scoped stories (671d5b8)
• wallow-web: settle the heading-scale spec on its loaded sections (a912511)
• web,auth: keep one React Query instance in the SSR bundle (185f9bb)
• web: apply register-app branding as a post-register upsert (fec26f9)
• web: derive the SSR origin scheme from x-forwarded-proto (ade57df)
• web: point repository and docs links at the fork (4c45286)
• web: replace the typography guard's regex comment-stripper (0f263f9)
• web: resolve the mobile-nav SSR flash via a CSS breakpoint (69aea1b)

Code Refactoring

• identity: drop OrgMemberRole in favour of the shared role catalog (2dbd4d7)
• identity: drop the frozen home tenant from WallowUser (77bf14c)
• identity: read and write organization members through memberships (d1eaa3d)

sdk: 1.0.0

1.0.0 (2026-08-05)

⚠ BREAKING CHANGES

• identity: CreateAdminRequest requires organizationName. Roles are granted per organization, so an administrator created without one holds no permission anywhere.
• identity: OrganizationSettingsDto gains three members and the "user" role no longer carries OrganizationsCreate or OrganizationsUpdate. A fork that wants self-service organization creation grants it on a role of its own.
• identity: POST /v1/identity/organizations/{id}/members now requires a "role" field naming the role granted in that organization.
• packages/web-shell no longer exists. Its createQueryClient() moved to @bc-solutions-coder/query and its current-user helpers moved to @bc-solutions-coder/auth; consumers must switch imports to the new packages.
• @bc-solutions-coder/sdk drops its h3 dependency and collapses its hand-written surface. The server entry now exports web-standard Request to Response handlers instead of h3 EventHandlers, and consumers must construct a per-request client with createWallowSdk() rather than importing a module-global singleton. The operation and query surfaces are generated, so hand-written wrappers and inline query keys are gone; all query keys come from the generated factory.

Features

• add packages/query and packages/auth, delete packages/web-shell (521fd1b)
• env: add @bc-solutions-coder/env and rewire the apps onto it (188bfc9)
• identity: add per-organization enrollment policy (3fda0a6)
• identity: drop identity.user_roles and give bootstrap an organization (3a0099a)
• identity: grant a client the scopes it may request (7bbe3ad)
• identity: list suspended and denied memberships per organization (c06797e)
• identity: report the signed-in organization on userinfo (4965ae1)
• logger: add @bc-solutions-coder/logger and wire both apps (b03d7ea)
• migrate apps to tanstack start and streamline sdk (cc8311e)
• sdk: expose rfc 7807 field errors on WallowError (3a15ad8)
• sdk: regenerate OpenAPI snapshot and typed client (002c2c8)
• utils: add @bc-solutions-coder/utils and rewire the apps onto it (bc7c5c7)

Bug Fixes

• docs: make docs/toc.yml the single site-root toc and guard it (f0af8d4)
• docs: restore the frontend state boundary the CLAUDE.md split dropped (99d090b)
• identity: validate enrollment requests on the constructor parameter (fb0d5a7)
• inquiries: type the 201 response on inquiry comment creation (8eeea2d)
• lint: clear the diagnostics the inherited config surfaced (7af64f7)
• lint: register the wallow/* plugin in navigation, ui and forms (d600e25)
• sdk: fail at boot on a too-short COOKIE_PASSWORD (3438efc)
• sdk: fall back to the double-submit cookie in the CSRF interceptor (4d3aec4)
• sdk: forward the real client IP through the BFF api proxy (01ce6fb)
• sdk: idempotent logout, cookie-password rotation, refresh coalescing, and split-horizon URL pinning (acb1794)
• sdk: preserve the issuer path when pinning browser-facing OIDC endpoints (3a3c192)
• sdk: read a blank COOKIE_NAME as unset, and surface the BFF's remaining knobs (3520ff1)

Code Refactoring

• identity: read and write organization members through memberships (d1eaa3d)

---

This PR was generated with Release Please. See documentation.