# @t4h.framework/dev

## 0.22.8

### Patch Changes

- [#229](https://github.com/tech4humans-brasil/framework/pull/229) [`d4d7d97`](https://github.com/tech4humans-brasil/framework/commit/d4d7d973233ec1f4d78628a69283701b9a55fbf9) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Fixes the published packages:
  - harness: the published types import `typings/PublicProperties.js`, which was not in `dist`. `uuidv7` is now a dependency.
  - dev: `tar` is now a dependency.
  - fs: the published types of `FileSplitActivity` no longer import `typebox`, which `fs` does not depend on.

- [#227](https://github.com/tech4humans-brasil/framework/pull/227) [`40824ac`](https://github.com/tech4humans-brasil/framework/commit/40824ac2e2c4ad6102a5e887fd09e05c7cefeeea) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Reads JSON-RPC messages, codec values and worker results as `unknown` and checks their shape. `tsBuild` returns `parsed` as `ts.ParsedCommandLine | null` in place of `any`.

- Updated dependencies [[`d29e1ab`](https://github.com/tech4humans-brasil/framework/commit/d29e1ab29a039b13c3e4b075472bd615566ae75e)]:
  - @t4h.framework/vite-panel-plugin@0.4.1

## 0.22.7

## 0.22.6

### Patch Changes

- [#214](https://github.com/tech4humans-brasil/framework/pull/214) [`fc4db5f`](https://github.com/tech4humans-brasil/framework/commit/fc4db5fa01454a45a3727b76dbacc215aa6b3ab7) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - `WorkflowClaim.startMany` accepts its inputs as an `Iterable` or an
  `AsyncIterable`, not only an array. The runtime reads them once, as a stream,
  so a batch no longer has to fit in memory before its first child starts.

## 0.22.5

### Patch Changes

- Updated dependencies [[`8f50cc5`](https://github.com/tech4humans-brasil/framework/commit/8f50cc5c494fd76b08536a08da397d2255d47d31)]:
  - @t4h.framework/vite-panel-plugin@0.4.0

## 0.22.4

## 0.22.3

### Patch Changes

- [#201](https://github.com/tech4humans-brasil/framework/pull/201) [`374e2d7`](https://github.com/tech4humans-brasil/framework/commit/374e2d759ac1fda954981545a791652dede445ae) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Registers `MapCollection` as the `orm:map-collection` JSON codec kind, and
  `DevORMClaim` reads several rows in one query with `getSnapshots`.

## 0.22.2

### Patch Changes

- [#198](https://github.com/tech4humans-brasil/framework/pull/198) [`e16ad69`](https://github.com/tech4humans-brasil/framework/commit/e16ad6963fc0d29dfd0d9033654e22c2ed4ee860) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - A finished child of `startWorkflow` advances the parent with the batch payload
  (`{ batch, count: 1 }`), matching core, and `findBatchSiblings` answers the
  lone child of a single start so the activity can read its output.

## 0.22.1

### Patch Changes

- [#195](https://github.com/tech4humans-brasil/framework/pull/195) [`44e3a32`](https://github.com/tech4humans-brasil/framework/commit/44e3a32d8d65ac24e4eb2059a1708215199c5b0d) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The dev codec now encodes `Ref` and `RefCollection` of `@t4h.framework/orm`
  (kinds `orm:ref` and `orm:ref-collection`, the same as the runtime), so a ref
  handed to `startWorkflow` or `startWorkflowMany` reaches the child run as a ref
  instead of a plain object.

## 0.22.0

### Minor Changes

- [#193](https://github.com/tech4humans-brasil/framework/pull/193) [`a0a1003`](https://github.com/tech4humans-brasil/framework/commit/a0a1003b719d54c727b211c07699fa4e3162f208) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - `orm.delete(entity, { where })` deletes every row matching the filter in a
  single durable step and returns how many rows were deleted.

  It is backed by the new `ORMDeleteActivity`, which calls the new abstract
  `ORMClaim.delete(input: SerializableDeleteInput)`. Runtimes that
  implement `ORMClaim` must add it; the dev claim already does. `where` takes the
  same operators as `find`, and an empty `{}` matches every row.

- [#190](https://github.com/tech4humans-brasil/framework/pull/190) [`910047b`](https://github.com/tech4humans-brasil/framework/commit/910047bf61dc0dd08ff02a1fb897b3629f264abc) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds `WorkflowBatchCollectionRef`, a serializable batch handle (`id`, `count`) that can be narrowed with `filter({ status, where })`. Filters are immutable and compose (statuses intersect, wheres are `$and`ed); `join` from `@t4h.framework/fs` applies them on top of its own `status`/`where`. `WorkflowBatchRef` remains as a deprecated alias of the same class, so existing `new WorkflowBatchRef(...)`, `instanceof` checks and `split`/`join` calls keep working, and a join over an unfiltered ref records the same history input as before. The dev codec serializes the ref as the `workflow:batch-collection-ref` kind.

  Adds `size()`, `take(limit)` and `toArray()` to `WorkflowBatchCollectionRef`, each recorded as a single sync activity (`WorkflowBatchSizeActivity`, `WorkflowBatchTakeActivity`, `WorkflowBatchToArrayActivity`) built on the existing `WorkflowBatchClaim.outputs`. Runtimes that register activities explicitly must register the three new activities. The `where` operators and their validation moved to core as `WorkflowBatchQuery` (core now depends on `sift`), and `filter()` rejects a non-serializable `where` immediately.

  The dev server now rejects an activity whose serialized output is above 1 MiB (`ActivityOutputTooLargeException`), matching the runtime's limit on the size of an activity output.

## 0.21.1

## 0.21.0

### Minor Changes

- [#181](https://github.com/tech4humans-brasil/framework/pull/181) [`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - A credential is a `Secret`, never a string. An env entry declared with
  `type: Secret` hands the workflow the name of the variable; the host binds the
  value where the activity runs, so no input, output or history record holds it.

  **Breaking**: every field that carries a credential now accepts only a
  `Secret`. Declare the entry with `type: Secret` in your `EnvDesign` and pass it
  whole; `tsc` points at each remaining string.

  **core**: `Secret` (a `SerializableClass` whose `toString`, `valueOf` and
  `toJSON` throw), `Secret.resolve` and `Secret.read` for hosts, `Secret.FORMAT`
  for the manifest. `EnvDesign` accepts `type: Secret`, refuses a `defaultValue`
  on a secret entry and throws when a `String` entry receives a secret.
  `AsyncActivityCallbackAuth` carries a `Secret` in `secret`, `password`, `token`
  and `value`.

  **http**: `auth` accepts `{ username, password }`, `{ bearer }` or
  `{ header, value }` besides an `HttpAuth`, all with a `Secret`, and the
  activity writes the header on the host. `clientSecret` and `password` of the
  OAuth2 grants are a `Secret`.

  **smtp**, **sftp**, **orm**: `connectionString` is a `Secret`. The
  `SftpConnectionString` and `ORMConnectionString` aliases are gone.

  **hmac**: the callback authorizer reads the secret through `Secret.read`.

  **dev**: the codec writes a `Secret` by name and binds the env value only where
  an activity runs, reading the input back from the database as the runtime does.
  The SFTP and SMTP claims read the value on connect.

  **webhook**: documents the `Secret` in `auth`.

### Patch Changes

- [#181](https://github.com/tech4humans-brasil/framework/pull/181) [`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds an optional `identity` to `Binary`: a key naming these exact bytes, so a
  consumer that materializes a binary can reuse what it already read. Two
  binaries with the same identity must be interchangeable; a subclass that
  cannot promise that leaves it `undefined` and is read every time.

  **dev**: `DevFileBinary` names a file by path, size and mtime, so an edited
  file gets a new identity and a missing one has none.

- Updated dependencies [[`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535), [`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535), [`9449e4e`](https://github.com/tech4humans-brasil/framework/commit/9449e4e9889f42dea1d52418140f47d25dff0535)]:
  - @t4h.framework/core@0.15.0
  - @t4h.framework/fs@0.10.0
  - @t4h.framework/http@0.7.0
  - @t4h.framework/smtp@0.7.0
  - @t4h.framework/sftp@0.8.0
  - @t4h.framework/orm@0.8.0
  - @t4h.framework/hmac@0.3.2
  - @t4h.framework/webhook@0.2.2
  - @t4h.framework/cache@0.6.5
  - @t4h.framework/jwks@0.7.1
  - @t4h.framework/oidc@0.6.5

## 0.20.2

### Patch Changes

- [#172](https://github.com/tech4humans-brasil/framework/pull/172) [`934d7cf`](https://github.com/tech4humans-brasil/framework/commit/934d7cf97bf6961086c5e89c07ca04a834015d22) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Rejects a `Binary` the dev server cannot address instead of trying to serialize
  it.

  A `Binary` implemented in the App matched no codec kind and fell through to the
  generic object branch, which walks a `Buffer` one property per byte — around
  100 MB of heap and 8 MB of JSON for a 760 KB file, on every serialization. It
  surfaced as an out-of-memory crash with nothing pointing at the cause, and only
  in development: a published project fails on the same value with a clear error.

  It now fails the same way, with `Unsupported binary instance`, so the mistake
  shows up while you are writing the workflow. Always take a `Binary` from the
  framework — a response body, `sftp.get`, `read`, `write`, `join`, `asset` — and
  never implement the class yourself.

- [#173](https://github.com/tech4humans-brasil/framework/pull/173) [`4e3e687`](https://github.com/tech4humans-brasil/framework/commit/4e3e6879620a057ffc588163936434800590bdfe) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Caps how many workflow runs the dev server advances at the same time.

  Every child run was scheduled on its own, so a `split` over thousands of blocks
  started every child at once and exhausted the heap before any of them finished
  — a workflow that fans out over a large file could not be tried locally at all.

  Runs now go through a FIFO queue bounded by
  `WORKFLOW_RUN_NEXT_TICK_CONCURRENCY`. Children still run in parallel, just not
  all at once, which also makes local behaviour closer to what a bounded worker
  pool does when the project is published.

- [#174](https://github.com/tech4humans-brasil/framework/pull/174) [`7cd75e4`](https://github.com/tech4humans-brasil/framework/commit/7cd75e4f557d9f5fbe3e486d5a3981186fa38797) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds `asset(path)`, which reads a file shipped with the project.

  Fonts a PDF embeds, images a template draws, a fixed lookup table: they belong
  to the project, not to a run. Reading them with `readFileSync` appears to work
  and then costs dearly, because every primitive persists its input — a value
  holding a `Buffer` is serialized whole, once per activity that receives it, so
  a 1.5 MB font used by a workflow that runs per record is written into the
  history per record. `asset` returns a `Binary`, which travels as a reference
  and is read only where the bytes are needed.

  Declare the files in `framework.config.ts` under `build.assets` (renamed from
  `build.additionalFiles`, with no fallback — rename the key to keep shipping
  files). `build` now records the copied paths and `publish` sends them, so a
  runtime knows which entries of the artifact are assets. `AssetClaim` is the
  contract each runtime implements.

- [#175](https://github.com/tech4humans-brasil/framework/pull/175) [`6e6d3de`](https://github.com/tech4humans-brasil/framework/commit/6e6d3de20895bae1b6faf1bdc32aa4f7c136ef0f) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds `HttpBodyRef`, a value in a JSON body resolved when the request is made,
  and a raw `{ binary }` request body.

  The body of a request is the activity's input, and inputs are persisted. That
  makes two common attachment shapes traps. An encoded file writes the whole file
  into the history, once per request. And a pre-signed URL expires: between
  persisting the input and the request going out there is a queue with no bound
  on how long it holds a message, so a URL minted beforehand can arrive expired.

  `HttpBodyRef` keeps both out of the history — what is persisted is what the
  subclass serializes, the recipe rather than the result. It is the body
  counterpart of `HttpAuth`, which for the same reason stores how to get a token
  and never the token. `HttpBodyUpload` is the ready-made case: it asks an
  endpoint for a signed destination, uploads the `Binary`, and resolves to the
  URL, configured by data so one class covers any mint-then-upload flow.

  A `{ binary }` body streams from storage to the wire instead of being buffered.

- Updated dependencies [[`7cd75e4`](https://github.com/tech4humans-brasil/framework/commit/7cd75e4f557d9f5fbe3e486d5a3981186fa38797), [`6e6d3de`](https://github.com/tech4humans-brasil/framework/commit/6e6d3de20895bae1b6faf1bdc32aa4f7c136ef0f)]:
  - @t4h.framework/fs@0.9.5
  - @t4h.framework/http@0.6.4

## 0.20.1

### Patch Changes

- [#170](https://github.com/tech4humans-brasil/framework/pull/170) [`aa72268`](https://github.com/tech4humans-brasil/framework/commit/aa72268d040a743743cac31cc14e26b8620b0e3f) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds the `jwks` callback auth: a detached signature over the callback body,
  verified with the public key the `kid` resolves to at a JWKS URL — the way Amber
  signs its webhooks.

  **core**: `AsyncActivityCallbackAuthJwks` joins `AsyncActivityCallbackAuth`
  (`jwksUri`, `header`, `kid`/`kidHeader`, `algorithm`/`algorithmHeader`,
  `signatureFormat`/`signatureFormatHeader`, `timestampHeader`,
  `toleranceInSeconds`, `signedPayload` as a template over `{timestamp}` and
  `{body}`).

  **jwks**: `jwksCallback` (default of `@t4h.framework/jwks/callback`) now serves
  both `jwt` and `jwks`. Hosts pass it as `{ jwt: jwksCallback, jwks: jwksCallback }`.

  **dev**: loads `@t4h.framework/jwks` for the `jwks` type as well.

  **webhook**: documents the new type.

- Updated dependencies [[`aa72268`](https://github.com/tech4humans-brasil/framework/commit/aa72268d040a743743cac31cc14e26b8620b0e3f)]:
  - @t4h.framework/core@0.14.0
  - @t4h.framework/jwks@0.7.0
  - @t4h.framework/webhook@0.2.1
  - @t4h.framework/cache@0.6.4
  - @t4h.framework/fs@0.9.4
  - @t4h.framework/hmac@0.3.1
  - @t4h.framework/http@0.6.3
  - @t4h.framework/oidc@0.6.4
  - @t4h.framework/orm@0.7.5
  - @t4h.framework/sftp@0.7.4
  - @t4h.framework/smtp@0.6.4

## 0.20.0

### Minor Changes

- [#167](https://github.com/tech4humans-brasil/framework/pull/167) [`1b1509f`](https://github.com/tech4humans-brasil/framework/commit/1b1509f9b6d2554dfab1f7633c3d022249e4fa01) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Lets a third party that emits to a fixed URL advance a waiting async activity,
  without the callback URL the activity would otherwise hand out.

  **core**: `pending({ correlationKey })` declares the key a wait answers to, and
  the optional `toCorrelationKey(event)` on `AsyncActivity` maps an incoming event
  (`AsyncActivityCallback.Event`: method, flattened headers, parsed body, raw body)
  to that key, or `undefined` when the event is not for the activity. It runs on a
  bare instance, outside any run. `AsyncActivityCallback.toEvent(request)` builds
  the event for hosts.

  **dev**: new public route `POST /projects/:projectId/workflows/:workflowId/events`.
  Every registered activity implementing `toCorrelationKey` is asked for a key;
  the pending of that type waiting on the key inside the workflow has its `auth`
  verified and receives the event as a callback, through the same path as the
  callback URL route. Answers `202 { id, activity }` with the stored callback,
  `202` with an empty body when no activity claims the event or nothing is
  waiting, `401` when the matched pending refused the auth, and `409` when the key
  matches more than one pending, since a correlation key must identify one wait.

- [#167](https://github.com/tech4humans-brasil/framework/pull/167) [`1b1509f`](https://github.com/tech4humans-brasil/framework/commit/1b1509f9b6d2554dfab1f7633c3d022249e4fa01) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Moves the callbacks route helpers from `@t4h.framework/webhook` to
  `@t4h.framework/core`. The route advances any pending async activity, not only
  `webhook()`, and the core already owned its contract (`AsyncActivityCallbackAuth`,
  `GetActivityCallbackUrlClaim`, `AsyncActivityAdvanceContext`).

  **core**: new `AsyncActivityCallback` namespace with `deriveToken`, `isTokenValid`,
  `parseBody`, `getHeader`, `getBearerToken`, `flattenHeaders`, `authorize` and
  the types `AsyncActivityCallback.Delivery`, `AsyncActivityCallback.Headers`, `AsyncActivityCallback.Json`,
  `AsyncActivityCallback.AuthType`, `AsyncActivityCallback.Authorizer`, `AsyncActivityCallback.Authorizers`.
  `AsyncActivityCallback.authorize(auth, request, authorizers?)` ships `basic`, `header` and
  `bearer`; `hmac` and `jwt` are authorizers the host passes in, so the core does not
  depend on `@t4h.framework/hmac` or `@t4h.framework/jwks`. A declared type without
  a authorizer throws `AsyncActivityCallbackAuthorizerMissingException`; an unknown type throws
  `AsyncActivityCallbackAuthUnsupportedException`.

  **hmac**: new `@t4h.framework/hmac/callback` entry whose default export is the
  `hmac` callback authorizer, `hmacCallback`.

  **jwks**: new `@t4h.framework/jwks/callback` entry whose default export is the
  `jwt` callback authorizer, `jwksCallback`.

  **webhook**: no longer exports `deriveCallbackToken`, `isCallbackTokenValid`,
  `verifyCallbackAuth`, `parseCallbackBody`, `getHeader`, `flattenHeaders` nor
  `CallbackRequest`/`CallbackHeaders`, and no longer depends on `hmac` and `jwks`;
  `WebhookJson` is now an alias of the core `AsyncActivityCallback.Json`. Hosts import the
  helpers from the core `AsyncActivityCallback` namespace and the authorizers from the two entries.

  **dev**: `@t4h.framework/webhook` becomes an optional peer like the other
  integrations. Only `@t4h.framework/core` is required again, which fixes
  `ERR_MODULE_NOT_FOUND: Cannot find package '@t4h.framework/webhook'` on
  projects that never call `webhook()`. `hmac` and `jwt` callback authorizers are
  loaded from the project when `@t4h.framework/hmac` / `@t4h.framework/jwks` are
  installed; a callback whose declared `auth` needs a missing package answers 500
  naming the package to install.

### Patch Changes

- Updated dependencies [[`1b1509f`](https://github.com/tech4humans-brasil/framework/commit/1b1509f9b6d2554dfab1f7633c3d022249e4fa01), [`1b1509f`](https://github.com/tech4humans-brasil/framework/commit/1b1509f9b6d2554dfab1f7633c3d022249e4fa01), [`2efe608`](https://github.com/tech4humans-brasil/framework/commit/2efe60810d5e1dc2538d9ddd95c23be72140e969)]:
  - @t4h.framework/core@0.13.0
  - @t4h.framework/hmac@0.3.0
  - @t4h.framework/jwks@0.6.0
  - @t4h.framework/webhook@0.2.0
  - @t4h.framework/vite-panel-plugin@0.3.1
  - @t4h.framework/cache@0.6.3
  - @t4h.framework/fs@0.9.3
  - @t4h.framework/http@0.6.2
  - @t4h.framework/oidc@0.6.3
  - @t4h.framework/orm@0.7.4
  - @t4h.framework/sftp@0.7.3
  - @t4h.framework/smtp@0.6.3

## 0.19.1

### Patch Changes

- [#165](https://github.com/tech4humans-brasil/framework/pull/165) [`72e08ff`](https://github.com/tech4humans-brasil/framework/commit/72e08ff86e0ce735ef73ccdf33b0dc01cdb8b6f5) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Revert deterministic time, randomness and timers in workflow code ([#155](https://github.com/tech4humans-brasil/framework/issues/155)).
  - `Date`, `Math.random`, `crypto.randomUUID` and the timer functions are no longer patched. Workflow code must not call `Date.now()` / `Math.random()`; wait with `@t4h.framework/sleep`.
  - `TimerNotAllowedException` is removed.
  - **Hosts:** `Internals.runWorkflow` no longer takes `id` / `createdAt`, and `HistoryItem` no longer carries `createdAt` / `settledAt`.
  - Testing: `runWorkflow` no longer accepts or returns `seed` / `createdAt`; `TestClock` patches `Date` itself again.

- Updated dependencies [[`72e08ff`](https://github.com/tech4humans-brasil/framework/commit/72e08ff86e0ce735ef73ccdf33b0dc01cdb8b6f5)]:
  - @t4h.framework/core@0.12.0
  - @t4h.framework/cache@0.6.2
  - @t4h.framework/fs@0.9.2
  - @t4h.framework/hmac@0.2.2
  - @t4h.framework/http@0.6.1
  - @t4h.framework/jwks@0.5.2
  - @t4h.framework/oidc@0.6.2
  - @t4h.framework/orm@0.7.3
  - @t4h.framework/sftp@0.7.2
  - @t4h.framework/smtp@0.6.2
  - @t4h.framework/webhook@0.1.1

## 0.19.0

### Minor Changes

- [#161](https://github.com/tech4humans-brasil/framework/pull/161) [`9f6138f`](https://github.com/tech4humans-brasil/framework/commit/9f6138fa4f03f8a1b269e5c7153868bdfccd78c1) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Resolve the framework packages from the consuming project instead of installing
  copies under the dev server.

  Claims are matched by constructor identity (`claim.provide === constructor`), so
  a project whose `@t4h.framework/http` resolved to a different version than the
  one nested under `@t4h.framework/dev` ended up with two distinct
  `HttpClientRequestClaim` classes and failed with
  `No provider for "HttpClientRequestClaim" found for claim key "http"`. The same
  applied to `cache`, `fs`, `orm`, `sftp`, `smtp` and `runtime-claims`.

  Those packages are now optional peer dependencies, loaded through
  `src/integrations`: each one contributes its claim providers and codec kinds
  from a single module, imported dynamically and skipped when the project does not
  have the package — a claim whose class the project cannot import could never be
  requested anyway. Only `@t4h.framework/core` and `@t4h.framework/webhook` are
  required, and `@t4h.framework/hmac`, `@t4h.framework/jwks` and
  `@t4h.framework/oidc` stay optional as before.

  `claims` and `jsonCodec` became `getClaims()` and `getJsonCodec()`; both are
  internal to the package.

  Also declares `ajv` and `typebox`, which were only resolving through
  `@t4h.framework/core`, and moves `typescript` to a peer dependency: the dev
  server type-checks the project with its own tsconfig, so it has to run the
  compiler the project declares rather than a second copy of its own.

### Patch Changes

- [#164](https://github.com/tech4humans-brasil/framework/pull/164) [`711344b`](https://github.com/tech4humans-brasil/framework/commit/711344b6218c3d750f3595b6037c0ac2df127e4c) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Fix `orm.find(Entity)` returning no rows when called without a `where`.

  `SerializableFindInput.where` is declared required, but `ORM.find` passed
  `options?.where as SerializableWhere` — a cast that handed `undefined` to every
  claim implementation. The dev server feeds that straight to sift, and
  `sift(undefined)` matches nothing, so a find with no filter came back empty
  instead of returning every row. `ORM.find` now sends an empty query.

  `DevORMClaim` also read `limit: 0` as no limit and returned every row, where SQL
  `LIMIT 0` returns none.

  The ORM README documented a `unique` property option and an
  `assertUniqueConstraint` pipeline step that do not exist — `@Property({ unique:
true })` is a type error, and `assert-constraints` only checks types and
  non-nullable properties. The entity examples also did not compile: `id` and any
  property with a `default` have to be optional and `nullable`, since
  `EntityInsertData` requires every declared key and a missing non-nullable
  property fails validation.

- Updated dependencies [[`711344b`](https://github.com/tech4humans-brasil/framework/commit/711344b6218c3d750f3595b6037c0ac2df127e4c)]:
  - @t4h.framework/orm@0.7.2

## 0.18.0

### Minor Changes

- [#158](https://github.com/tech4humans-brasil/framework/pull/158) [`8e8ffb2`](https://github.com/tech4humans-brasil/framework/commit/8e8ffb2ac0739e2f2a1f0af2ed9ebeffe2964776) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds `@t4h.framework/webhook` and unifies the external advance of a pending
  activity behind one callback route.

  **webhook**: `webhook()` sends an outbound request (with `<<callbackUrl>>`
  replaced by the activity callback URL, 60s timeout) through
  `HttpClientRequestClaim` and suspends the workflow until the third party posts
  to that URL. The partner's answer is kept as `callback.dispatch`; the callback
  body is validated against `schema`; `{ wait: false }` returns a handle to wait
  on later. Ships `deriveCallbackToken`/`isCallbackTokenValid` and
  `verifyCallbackAuth` for hosts.

  **core**: `AsyncActivityCallbackAuth` (hmac, basic, header, bearer, jwt),
  `pending({ auth })`, `advance(payload, bootstrap, context?)` receiving the
  callback method and headers, and the `GetActivityCallbackUrlClaim` hosts must
  provide.

  **http**: `timeoutInMs` on `HttpClientRequestClaimInput`.

  **dev**: `POST /projects/:project/workflows/:workflow/runs/:run/activities/:activity/callbacks?token=…`
  replaces the `PATCH …/activities/:id` advance route. Each delivery is stored
  as a pending callback (method + request); the token is derived from the
  activity id, the declared `auth` is verified before the workflow advances.

  **vite-panel-plugin**: the Inbox advance route follows the new callbacks
  endpoint, with the token in the curl.

### Patch Changes

- Updated dependencies [[`8e8ffb2`](https://github.com/tech4humans-brasil/framework/commit/8e8ffb2ac0739e2f2a1f0af2ed9ebeffe2964776)]:
  - @t4h.framework/webhook@0.1.0
  - @t4h.framework/core@0.11.0
  - @t4h.framework/http@0.6.0
  - @t4h.framework/vite-panel-plugin@0.3.0
  - @t4h.framework/cache@0.6.1
  - @t4h.framework/fs@0.9.1
  - @t4h.framework/hmac@0.2.1
  - @t4h.framework/jwks@0.5.1
  - @t4h.framework/oidc@0.6.1
  - @t4h.framework/orm@0.7.1
  - @t4h.framework/sftp@0.7.1
  - @t4h.framework/smtp@0.6.1

## 0.17.0

### Minor Changes

- [#155](https://github.com/tech4humans-brasil/framework/pull/155) [`8098041`](https://github.com/tech4humans-brasil/framework/commit/80980419d59a987378b7c94372ee2f7b7dcc00f5) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Deterministic workflow replay: time, randomness and timers.
  - `Date.now()`, `new Date()`, `Math.random()` and `crypto.randomUUID()` are
    deterministic inside workflow code. The clock follows the history
    (`createdAt` of the run, then `createdAt`/`settledAt` of each item) and
    randomness derives from the run id, so nothing new is stored.
  - `setTimeout`/`setInterval` inside a workflow throw
    `TimerNotAllowedException`. Use an activity (`@t4h.framework/sleep`) to wait.
  - New export: `TimerNotAllowedException`.
  - **Breaking for hosts:** `Internals.runWorkflow` now requires `id` and
    `createdAt`, `HistoryItem` requires `createdAt`, and async items accept
    `settledAt`.
  - Testing: `runWorkflow` accepts and returns `seed`/`createdAt`; `TestClock`
    feeds the host clock instead of patching `Date` itself.

- Updated dependencies [[`8098041`](https://github.com/tech4humans-brasil/framework/commit/80980419d59a987378b7c94372ee2f7b7dcc00f5)]:
  - @t4h.framework/core@0.10.0
  - @t4h.framework/cache@0.6.0
  - @t4h.framework/fs@0.9.0
  - @t4h.framework/hmac@0.2.0
  - @t4h.framework/http@0.5.0
  - @t4h.framework/jwks@0.5.0
  - @t4h.framework/oidc@0.6.0
  - @t4h.framework/orm@0.7.0
  - @t4h.framework/sftp@0.7.0
  - @t4h.framework/smtp@0.6.0

## 0.16.0

### Minor Changes

- [#151](https://github.com/tech4humans-brasil/framework/pull/151) [`d44eb5e`](https://github.com/tech4humans-brasil/framework/commit/d44eb5e1797f523612c9e2f560b0bb583ab8688f) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - host owns panel config and run rejection lives in output

### Patch Changes

- Updated dependencies [[`d44eb5e`](https://github.com/tech4humans-brasil/framework/commit/d44eb5e1797f523612c9e2f560b0bb583ab8688f)]:
  - @t4h.framework/vite-panel-plugin@0.2.0

## 0.15.0

### Minor Changes

- [#145](https://github.com/tech4humans-brasil/framework/pull/145) [`09724c3`](https://github.com/tech4humans-brasil/framework/commit/09724c3f0bb573d55b94495835362e7b66bc570e) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Replaces the interactive REPL of `framework dev` with an HTTP dev server: Hono routes workflow (`POST /projects/:projectId/workflows/:workflowId/runs` answers `201 { id }`, `PATCH .../runs/:runId/activities/:activityId` advances a pending async activity), mandatory workflow authorization resolved from the app/workflow `Authorization` manifest, `/_dev` routes for tooling (manifest, runs, waiting activities, env, SSE events) and Vite in middleware mode for a UI. Workflow runs now live in an in-memory SQLite database inside the app process, the ORM dev claim stores its rows in `db.sqlite` instead of rewriting `db.json` on every change, child workflows run in parallel, and `framework dev` gains `--port` (`PORT`) and `--host`. `DevServer` and `isWorkflowWaiting` are gone; use `Server`.

### Patch Changes

- Updated dependencies [[`a3696b4`](https://github.com/tech4humans-brasil/framework/commit/a3696b48b48598eda9e51c53538a6086abe36018), [`a3696b4`](https://github.com/tech4humans-brasil/framework/commit/a3696b48b48598eda9e51c53538a6086abe36018), [`45182d4`](https://github.com/tech4humans-brasil/framework/commit/45182d4a27c86353747646aa9b70a39bc4c56610)]:
  - @t4h.framework/vite-panel-plugin@0.1.0
  - @t4h.framework/http@0.4.4
  - @t4h.framework/oidc@0.5.0

## 0.14.2

### Patch Changes

- [#143](https://github.com/tech4humans-brasil/framework/pull/143) [`00563fd`](https://github.com/tech4humans-brasil/framework/commit/00563fd9f30cf007a1e5ec8372085cf392d839f4) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Fix start workflow many interruptions

## 0.14.1

### Patch Changes

- [`298806e`](https://github.com/tech4humans-brasil/framework/commit/298806ec8f05fecd7d03465627b45236c5d4f8f1) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Points the `@t4h.framework/http` dependency back to the `0.x` line (`^0.4.3`). `0.14.0` was published depending on the accidental `http@1.0.0`.

## 0.14.0

### Minor Changes

- [`8c56f76`](https://github.com/tech4humans-brasil/framework/commit/8c56f7697390a1ea966d1e91ff5f35ce5751a0d7) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - feat: write in-memory content to durable storage from a workflow

  There was no supported way to turn a string or a Buffer into a `Binary` inside
  a workflow — every `Binary` came from an existing file (`http` response,
  `sftp.get`, `split`, `join`). Anyone needing to upload computed content had to
  implement `Binary` by hand, and such an instance can never be persisted, so the
  activity carrying it failed to serialize.

  `write(content, options?)` covers that gap: it pushes an activity that stores
  the content through the `FileSystemClaim` and returns a `Binary` that survives
  replay.

  ```ts
  const file = await write(JSON.stringify(data), {
    contentType: 'application/json',
  })

  await sftp.put('/out/data.json', file)
  ```

  `FileSystemClaim.write` takes an optional `contentType` — until now the content
  type was always inferred from the file extension.

  The dev codec no longer diverges from the runtime one: its binary kind used to
  match only `DevFileBinary`, so a hand-written `Binary` was silently serialized
  as a plain object locally and blew up once deployed. It now matches any
  `Binary` and spools unknown ones to disk, the same way the runtime spools them
  to the file storage.

- [`8c56f76`](https://github.com/tech4humans-brasil/framework/commit/8c56f7697390a1ea966d1e91ff5f35ce5751a0d7) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds FS write activity

### Patch Changes

- Updated dependencies [[`8c56f76`](https://github.com/tech4humans-brasil/framework/commit/8c56f7697390a1ea966d1e91ff5f35ce5751a0d7), [`8c56f76`](https://github.com/tech4humans-brasil/framework/commit/8c56f7697390a1ea966d1e91ff5f35ce5751a0d7)]:
  - @t4h.framework/fs@0.8.0
  - @t4h.framework/http@0.5.0

## 0.13.2

### Patch Changes

- [#135](https://github.com/tech4humans-brasil/framework/pull/135) [`c238dbe`](https://github.com/tech4humans-brasil/framework/commit/c238dbea4199169c935c714442d9e316abd74e20) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Fix start workflow activity

- Updated dependencies [[`c238dbe`](https://github.com/tech4humans-brasil/framework/commit/c238dbea4199169c935c714442d9e316abd74e20)]:
  - @t4h.framework/core@0.9.1

## 0.13.1

### Patch Changes

- [`095c3a9`](https://github.com/tech4humans-brasil/framework/commit/095c3a91191b9f541519447f212a8e9509065569) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Republish with resolved dependency versions. The previous release leaked the `workspace:^` protocol into the published manifests, breaking installs outside the monorepo.

## 0.13.0

### Minor Changes

- [`9171168`](https://github.com/tech4humans-brasil/framework/commit/917116807182d28de7b368e8648560efca9e5559) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Adds framework.config option

- [`9171168`](https://github.com/tech4humans-brasil/framework/commit/917116807182d28de7b368e8648560efca9e5559) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Remove support to private key in SFTP connection string

## 0.12.0

### Minor Changes

- Adds support to ilike and like operation in in memory database ([#111](https://github.com/tech4humans-brasil/framework/pull/111))

### Patch Changes

- Slice file binary ([#112](https://github.com/tech4humans-brasil/framework/pull/112))

## 0.10.0

### Minor Changes

- Adds startMany on WorkflowClaim ([#108](https://github.com/tech4humans-brasil/framework/pull/108))
- Adds activity to split and join binary ([#100](https://github.com/tech4humans-brasil/framework/pull/100))

### Patch Changes

- Forward parallel flag through startWorkflow to the reconciler ([#105](https://github.com/tech4humans-brasil/framework/pull/105))

## 0.9.0

### Patch Changes

- Create path if not exists in fs claim write ([`9a38b24`](https://github.com/tech4humans-brasil/framework/commit/9a38b24c94dd791f9d7e9a5fb645bb46ed86c6a0))
- Update skills ([`6d7e7bc`](https://github.com/tech4humans-brasil/framework/commit/6d7e7bca0c780a9c53a0c9e5aa0a865c5af67959))

## 0.3.1

### Minor Changes

- Update history to satisfies core contract ([`30b3d38`](https://github.com/tech4humans-brasil/framework/commit/30b3d38bfd631990e4c4f740344910d5958ddfb9))

## 0.3.0

### Minor Changes

- Use sftp binary on claim ([#95](https://github.com/tech4humans-brasil/framework/pull/95))

## 0.2.1

### Patch Changes

- Get environment variables ([`f47a1e9`](https://github.com/tech4humans-brasil/framework/commit/f47a1e9cc41c7da06d788be6498dc5a992ac18e4))
- Resolve start workflow result ([`b698cd9`](https://github.com/tech4humans-brasil/framework/commit/b698cd93af7f8194064c284dba3475d33fa10dda))

## 0.2.0

### Patch Changes

- Internal dependency updates

## 0.1.1

### Patch Changes

- Adds env run context in up app process ([#86](https://github.com/tech4humans-brasil/framework/pull/86))

## 0.1.0

### Minor Changes

- Adds .ai/skills in packages ([#88](https://github.com/tech4humans-brasil/framework/pull/88))

### Patch Changes

- Move dev server to its own package ([#83](https://github.com/tech4humans-brasil/framework/pull/83))
- Update dependencies ([`b19fa15`](https://github.com/tech4humans-brasil/framework/commit/b19fa15ae8578a6f646d46d15eeff5315ffc9281))