Version 1.1.0

Version 1.1.0 is a security and reliability hardening release for applications sharing databases, caches, object storage, gateways, and workers. It is versioned as a minor release, but existing applications must review the coordinated migration guide.

Highlights

• Trusted identity is derived from verified principals or explicitly trusted gateways; conflicting identity sources fail authentication.
• @Scoped() repositories fail closed across reads, relations, creates, imports, all mutation variants, batches, and caller-owned transactions. Bypass requires a bounded audited grant.
• detail() no longer includes soft-deleted rows by default; { withDeleted: true } is explicit.
• Cache keys require declared global/tenant/user scope, Redis prefixes are isolated, and outbound HTTP propagates identity only to exact trusted origins.
• Uploaded files use owner/tenant authorization, server-owned immutable keys, bounded validation, hardened remote fetch, S3 SDK v3, and crash-durable pending-first cleanup with separate upload tombstones and deletion claims, including future retry backoff so poison batches do not starve later cleanup work.
• Action history is tenant/resource authorized, deny-by-default for reads, recursively redacted, and snapshot-bounded.
• Job leases rotate owner tokens, heartbeat against the database clock, and expose a stable logical idempotencyKey for consumer outbox/deduplication.
• Built-in English/Vietnamese catalogs cover all production core.* codes; Zod pagination now matches the repository's zero-based, 200-row cap.
• Runtime dependency floors move to Axios 1.18+ and body-parser 2.3+ to keep the published tree clear of known npm audit advisories at release time.
• Node.js 20+ is required. CJS/ESM public exports retain shared Nest DI identities.

Upgrade order

1. Upgrade runtime and take database/object-store backups.
2. Add nullable schema fields and indexes, then backfill authoritative tenant/owner data.
3. Update gateway/principal mapping, scopes, policies, cache prefixes, file storage, and job callers.
4. Stop old workers, migrate lock/object identities, deploy the new application and workers.
5. Run tenant/user security matrices, storage reconciliation, pending cleanup, and release gates.

See security, database schema, and the complete examples.