I changed shutdown cleanup to keep running each cleanup step after an earlier failure, then rethrow the first failure. This prevents one broken step from leaving the database, telemetry, client, or worker running.
I made DELETE USING fall back to UPDATE USING when no explicit delete rule exists, while keeping explicit DELETE USING rules in charge. This brings schema conversion in line with the documented contract and inherited policy checks.
I cleared staged edits, inserts, deletes, errors, and pending scroll state when the Inspector changes routed tables. Sorting, filtering, pagination, and column layout changes within one table still retain staged state.
I made client configuration identity use recursively sorted keys. Configurations that differ only in property order now share the same identity instead of causing duplicate runtimes or unnecessary replacement.
I applied the size limit to the complete shape-registration request before deriving keys or retaining state. Oversized peer registrations are rejected early, while the existing public limits and wire format stay unchanged.
I capped nested AuthorizationScopeView decoding at eight wrappers and reject deeper peer messages during deserialisation. The existing wire format and exact boundary remain supported.
I charged descriptor-only upload starts against the existing work budget and capped restart-persistent pending upload metadata at 1,024 records. This stops small requests from creating unlimited durable metadata while existing uploads can still resume.
I added an 8 MiB budget for frames waiting in the native WebSocket queue. Producers now get a backpressure error when the budget is full, and space is released only after queued frames are dropped.
I capped auxiliary immutable-chunk requests at four entries per decoded message and rejected oversized sequences before storage work. Local one-request frames and the exact limit remain supported.
I attached each persistence receipt to the database that created it. Foreign receipts are now rejected before they can change metrics, publication state, or the durable frontier.
I required a message sender profile to belong to the authenticated session. This stops a writer from attributing a message to somebody else's profile while leaving reads and existing reaction protections unchanged.
I stopped live indexes being registered while applied writes are still resident. Registration can continue once those writes are durable and the index can backfill from complete storage.
I made each todo REST and event-stream request use a database tied to its authenticated session. Ownership now comes from that session rather than request input, so routes use the normal permission checks.
I made the HTTP WebSocket layer use the same 2 MiB limit as the wire decoder. Valid fragmented messages up to that size can now reach the decoder instead of being rejected early, with a regression test for a 1.5 MiB message.
I added deny rules for every generated Better Auth table, including names that do not work as JavaScript identifiers. This keeps ordinary clients from reading or changing authentication records while the backend adapter can still use them.
I brought the guides, examples, and search index back into line with the current public APIs. I also added a reference guide for the new core and explained transactions, durability, and errors around the unified mutation results.
I replaced several different write-result shapes with one consistent database mutation result. Inserts and restores still return their rows, while updates, upserts, and deletes clearly return no row, and each result keeps its value, batch ID, and wait operation.
I stabilised browser tests that use a file worker by limiting how many browser files run at once and allowing slow operations more time before failing. This stops the browser's main work from being starved by too much parallel file activity, while still warning when responsiveness falls below the target.
I separated the Vue provider that creates and shuts down a database client from the provider used with a client supplied by the caller. This makes it clear who owns the client's lifetime, keeps rapid configuration changes in order, and updates the examples and documentation.
I separated the Svelte provider that creates and shuts down a database client from the provider used with a client supplied by the caller. This makes it clear who owns the client's lifetime and updates the examples and documentation to use the right provider.