Input; the Object scalar no longer JSON-parses string variables; duplicate GraphQL type/field names are startup errors; operations declaring grpc.streaming: "client" | "bidi" now receive an async iterable of messages instead of a collected array.
Skip to main content

Changelog

4.0.0-beta.10 (2026-10-22)​

⚠ BREAKING CHANGES​

  • core: instance actions declaring non-context parameters now receive them instead of the operation context. Take the context with a context-typed parameter or useContext().

Features​

  • auth: track MFA verification time and enforce step-up freshness (maxMfaAge) (#963) (86cda56)
  • binary: attach direct uploads on verified client completion (#944) (736942e)
  • core: model actions receive their typed parameters (#946, phase 1) (#955) (7e8eebd)
  • end-to-end encrypted model fields (SealedField, UserKeys, @webda/sealed-client) (#941) (fbc5bd2)
  • sql-schema: relational schema plan built from model metadata (#937) (6f50192)

Bug Fixes​

  • content-mapper: list Events of an optional [WEBDA_EVENTS]? member under strict (#978) (c303962)
  • content-mapper: record relation aliases, the ModelRelated attribute and @enum values (#940) (6e7e701)

4.0.0-beta.9 (2026-10-15)​

Features​

  • auth: add model-scoped MFA with typed behavior configuration (#888) (ee068e8)

4.0.0-beta.8 (2026-10-14)​

⚠ BREAKING CHANGES​

  • the unused store parameters modelAliases, defaultModel and forceModel are removed; use @WebdaAlias for renamed models. The runtime MigrationStore is removed: use webda migrate.

Features​

  • sdk: typed frontend SDK over REST, GraphQL, gRPC and offline (#850) (#885) (4d68a6a)
  • transparent Webda 3 → 4 data upgrade — legacy types, store migrations (core) (#889) (#890) (01d4efb)

4.0.0-beta.7 (2026-10-11)​

⚠ BREAKING CHANGES​

  • GraphQL now exposes every non-CRUD operation by default (opt out with exposeOperations: []); titled nested input types are renamed

Features​

  • core: config encrypt encrypts every secret field, --check fails on unencrypted secrets (#854) (8926a02)
  • core: pki configuration encrypter and default encrypter (#851) (8777e06)
  • stable and documented configuration secret encryption (#837) (55fad94)
  • streaming operations on gRPC, WebSocket and GraphQL (#829) (e67bfea)

Bug Fixes​

  • support Windows paths when loading and building modules (#827) (0d88747)

4.0.0-beta.6 (2026-10-09)​

⚠ BREAKING CHANGES​

  • ql: DELETE, UPDATE, SELECT, SET and WHERE are reserved uppercase keywords; Query.type is required; parse().toString() prints the canonical query instead of the source tokens; the root parse rule is now (statement | filterQuery) EOF for code walking the ANTLR tree.

Features​

  • ql: WebdaQL DELETE/UPDATE/SELECT statements, bulk deleteMany/updateMany, filter-only Query operations (#818) (add9503)

4.0.0-beta.5 (2026-10-08)​

Bug Fixes​

  • packaging: point every package's repository at its monorepo folder (#812) (3717b73)

4.0.0-beta.4 (2026-10-08)​

⚠ BREAKING CHANGES​

  • auth: redesign authentication with @webda/auth (#800)
  • @webda/ts-plugin and the tsc-esm binary are removed, and applications now build with TypeScript 7.1. Generated code changes where TypeScript 6 was wrong, each verified against the shipped output:
    • AuditEntry.timestamp, declared number, is no longer coerced to Date;
    • AbstractOwnerModel no longer emits new ModelLink(T), a ReferenceError on first raw-uuid assignment;
    • sample-app's User extends WebdaUser is now treated as a model (TS6's base-chain guard was keyed on class name), so its relations are initialised and coerced;
    • imports use the specifier the author wrote, not monorepo-relative paths that only resolve inside this repository;
    • the emitted .d.ts is valid (TS6 referenced PrimaryKeyType unimported and wrote BelongTo without its type argument). A build that cannot write its module now fails; under TS6 a strict file-naming violation was logged and the build still reported success.
  • the @webda/schema package is removed, along with its webda-schema-generator CLI. Schema generation lives in @webda/content-mapper and is driven by @webda/compiler; nothing in the repo imported @webda/schema any more after the previous commit.
  • compiler: model relations are now type: "string" in Input, Output and Stored schemas instead of an object with no properties, and six services gain the type property they inherit from ServiceParameters. Anything generated from these schemas — API validation, client types — changes with them.

Features​

  • add @webda/create (npm create @webda) with agent guidance (#799) (e29822a)
  • auth: redesign authentication with @webda/auth (#800) (74dc5df)
  • build on TypeScript 7.1; delete @webda/ts-plugin and ts-patch (0008e97)
  • compiler: generate schemas with @webda/content-mapper (af3b7c5)
  • compiler: optional TypeScript 7 schema backend, off by default (b58e72c)
  • content-mapper: close generator parity with the TypeScript 6 transforms (807688c)
  • content-mapper: emit-parity oracle for stage 9; drop loadParameters default (1a32862)
  • content-mapper: generate the whole webda.module.json on TypeScript 7.1 (1996b85)
  • content-mapper: model schemas, every divergence now proven (4f9cc60)
  • content-mapper: port model structural metadata, verified byte-for-byte (234c4b4)
  • content-mapper: port Reflection and Relations, verified byte-for-byte (69c4bb3)
  • content-mapper: port the behaviours transform (04e8559)
  • content-mapper: port the WebdaQL validator (4ee7137)
  • content-mapper: port Webda object discovery, verified byte-for-byte (ce63d08)
  • content-mapper: report duplicate Webda names instead of keeping the last silently (9bb1818)
  • content-mapper: schema converter, service parameters identical (4b88c7b)
  • content-mapper: top-level schemas, all three groups identical (074af29)
  • content-mapper: TypeScript 7.1 content mapper package (9b57565)
  • content-mapper: validate the schema port across the monorepo (ccff4a5)
  • ql: bind ? and :name query parameters (#788) (4a8647b)
  • ql: support IS NULL and IS NOT NULL (553d143)
  • schema: out-of-process schema worker, 22 of 29 schemas identical (d983846)

Bug Fixes​

  • compiler metadata, CLI commands, cron/async hooks and long-running command lifecycle (#785) (0515715)
  • content-mapper: close the initialiser and constructor-argument gaps (447e566)
  • content-mapper: drop the @webda/compiler devDependency cycle (#802) (8af66d6)
  • content-mapper: follow the model base chain through the checker (fd84a26)
  • unit test models relations (2d160f1)

Miscellaneous Chores​