Every change, in lockstep.

Git and shell commands run through execFile with argument arrays instead of interpolated shell strings, and the scaffolder reports its build-time version.

damat module add becomes safe by default: non-registry sources and lifecycle scripts require explicit opt-in flags, module ids and paths are validated before anything is written, and the CLI reports its real version.

Auth middleware fails closed: a route that declares an auth type with no registered handler now rejects the request with a structured 401 instead of warning and letting it through.

Links resolve against real tables and real primary keys: junction naming uses table names (not model keys), endpoint PKs come from the registry, pivot columns can be named explicitly, link creation is a race-safe upsert, and the graph API only serves entities that participate in registered links.

The add_module tool exposes the CLI's new security gates: allowUnverified and allowScripts inputs map to --allow-unverified / --allow-scripts, and the tool description explains the registry verification gate.

migrate:status passes the full module descriptor to the migration layer — status is tracked by module name, discovery by its resolve path.

Concurrent deploys serialize on a Postgres advisory lock, statements that can't run in a transaction (CREATE INDEX CONCURRENTLY, ALTER TYPE … ADD VALUE, …) execute outside one, and the status API is keyed by module name.

Timestamp columns become real timestamps: created_at/updated_at are now timestamp with time zone (they were date, silently dropping the time), and updated_at is non-nullable with a now() default.

ORDER BY inputs are validated against whitelists before they reach SQL — direction and nulls placement can no longer carry arbitrary strings into the query text.

Every hot path becomes atomic or non-blocking: SCAN-based pattern deletion, Lua-scripted rate limiting and dequeue, TTL applied only on a counter's first increment, and capped completed/failed queue sets.

Request-derived query options are sanitized end to end: only safe find options pass through, orderBy is whitelist-validated, pagination is bounded, reads filter soft-deleted rows by default, and update/updateOne stamp updated_at automatically.

Safer defaults for retries and locking: steps are presumed idempotent (and non-idempotent steps are never retried), locks auto-extend by default, and lock-backend failures surface as structured results instead of throws.

Non-Error throws (throw "boom", throw { code: 1 }) are no longer silently swallowed by the error middleware — they are stringified, logged, and surfaced in dev responses.

Per-module migration discovery now sorts numerically by timestamp (with the filename as tiebreaker), matching all-module discovery — the same migrations run in the same order no matter which entry point discovered them.

Repository lookups now fall back to the table name — cascade deletes work on snake_case tables whose registry key (the camelCase accessor) doesn't match the name the cascade walker carries.

resolveModel falls back to a table-name lookup, matching the same fix in @damatjs/orm-pg — cross-module cascade deletes now resolve snake_case child tables.

A module author can now apply and inspect a module's own migrations against a real database from the CLI — two new commands, damat module migration:run and damat module migration:status, complete the per-module migrate loop alongside the existing migration:create.

New tooling functions runModuleMigration and runModuleMigrationStatus apply and report a standalone module's own migrations against DATABASE_URL — no damat.config.ts, scoped to the single module. These back the new damat module migration:run / migration:status CLI commands.

A module can ship cross-module link files (real defineLinks); damat module add now splits them into src/links/<moduleId>/ the same way it splits routes and workflows. The migration stays on the backend, so a shipped link is dormant until activated — no drafts, no link-setup command.

Steps now return a StepResponse(output, compensateInput?) and compensation receives (compensateInput, ctx) — a typed, explicit way to carry rollback data that the old (input, output) signature couldn't express.

Subcommand argument parsing now understands --no-<flag> to negate a boolean option, matching how top-level commands already behave.

damat build now type-checks the whole app before bundling (and fails on any error), and a new damat module build does the same as a module's release gate.

The route validator middleware now hands its parsed + coerced result to the handler through a new getValidated helper, so handlers stop re-parsing the body and re-checking params/query the middleware already validated.

Adds an execution path for bulk upsert: PgRepository.upsertMany and PgModelClient.upsertMany. Additive — nothing existing changes.

Adds upsert/upsertMany, cascade delete, and row-returning updateOne / findById / findOne to the generated per-model accessor (ModelMethods). Additive — every existing call keeps its behaviour.

Cross-module link helpers are no longer part of the module authoring surface, and a non-binding pairsWith manifest hint is added. Module authoring also gets a stronger scaffold (cross-referenced below).

Adds a defaultCommand to the CLI framework, so a CLI can run its primary command without the user typing its name.

Codegen graduates from a types-only generator to the engine behind the **codegen-first** module workflow: it still emits row types + zod, and now also writes the typed registry.ts and scaffolds-once a full per-table CRUD slice (steps, workflows, and split api/routes).

--module now scaffolds a module **locally** via damat module init instead of cloning a remote starter, and create-damat-app <name> works without typing create.

damat module init now emits a root README.md and the full AGENTS.md authoring guide, and the codegen commands scaffold a per-table CRUD slice.

Documentation clarified: links are an app-only concern. No behavior change.

The reported server version now derives from package.json instead of a hand-maintained constant.

Adds the top-level links config field, wires cross-module link directories as a link module at boot, and re-exports the @damatjs/link authoring surface from the framework barrel.

First release: cross-module links — declare a relationship between two models in different modules, get an auto-generated junction table that migrates and type-generates through the existing pipelines, and create/dismiss/query the relationship at runtime.

Re-exports the @damatjs/link cross-module authoring surface from the single @damatjs/module import, and force-closes lingering connections so startModuleApp().stop() no longer hangs in dev/test teardown.

The damat-orm CLI now understands cross-module links: it discovers link:<owner> migration modules from damat.config.ts and weaves linked fields into the linked modules' generated types.

OrmModule gains an optional kind?: "module" | "link" field so the toolchain can tell a cross-module link directory apart from an ordinary module, as part of the cross-module links work.

Relation targets can now be a plain table-name string, with foreign keys inferred by convention — no model import, no circular-import dance, and cross-module references become possible.

First minor release: the stabilized declarative CLI framework that turns a single CliConfig object into a runnable command-line tool.

First stable minor release: a Bun-only create-damat-app scaffolder that bootstraps a Damat backend project or a standalone module from a single command.

First minor release of damat — the user-facing CLI for developing, building, and composing Damat backends and modules.

First published minor release: one place to pin and re-export every external runtime dependency shared across the Damat monorepo, exposed both as per-library subpaths and as a namespaced root entry.

First minor release: the stabilized Damat backend bootstrap that turns a damat.config.ts plus a folder of route files into a running HTTP server.

First published minor release: a tiny, zero-dependency .env loader that merges an environment-aware cascade of files into process.env without ever overwriting variables that already exist.

First published minor release: the stabilized, zero-dependency structured logger — ten levels, three formats, child/prefixed loggers, an opt-in dual-format file transport, a no-op logger, and a process-global singleton.

First release: a dependency-free Model Context Protocol server that lets an AI assistant discover Damat modules in a registry and install them into an app, by shelling out to the damat CLI.

First minor release: the whole Damat module system gathered into one package — author a module, run it as a live app, test it standalone against Postgres, and address/validate it for a registry, all from a single import.

First published minor release: the whole Damat ORM behind a single dependency and a stable set of subpath exports.

First minor release of damat-orm — the standalone, config-driven CLI for Damat ORM migrations and TypeScript type generation.

First published minor release: the standalone PostgreSQL connection/pool manager for the Damat ORM, stabilized for general use.

First published minor release: the database-agnostic runtime layer (ModelRegistry + QueryLogger) for the Damat ORM, stabilized for general use, with a relation-resolution correctness fix and a unit-test suite.

First published minor release: the module-based PostgreSQL migration runtime for the Damat ORM — discover, generate, run, and track migrations per module — stabilized for general use.

First published minor release: the fluent, type-safe schema-definition DSL for the Damat ORM, stabilized for general use.

First published minor release: the entity-manager layer is hardened — an optional models config, registry-derived transaction accessors, a transaction isolation-level allow-list, a rollback-error guard, and typed (unwrapped) repository reads.

First published minor release: the pure schema engine (snapshot, diff, SQL generation) stabilized for general use — and a correctness fix to how a *changed* index or foreign key is re-created.

First published minor release: the shared, dependency-free TypeScript type vocabulary that every other Damat ORM package speaks, stabilized for general use.

First published minor release: the function-first Redis toolkit for the Damat backend — client lifecycle plus caching, rate limiting, sessions, distributed locks, counters, and a job queue, stabilized for general use.

First published minor release: the service layer that turns a map of ORM models into a CRUD service class, with a shared process-wide pool and lazily-constructed, typed module instances.

First published minor release: the stable baseline of the zero-dependency AppError HTTP-error hierarchy and the legacy initFramework helper.

Stabilization minor: workflow-level step-config layering, AbortSignal cancellation, true per-attempt timeouts, a capped exponential backoff, compensationsFailed tracking, and retry exhaustion surfaced as MAX_RETRIES_EXCEEDED on the workflow result.

First published release: the pure string-generation core that turns a serialized ModuleSchema into TypeScript row types, mutation types, enum unions, relation fields, and matching Zod schemas.

First pre-alpha release: the PostgreSQL execution layer for Damat — a four-layer stack that turns a model definition plus a pg Pool into parameterised SQL, typed rows, and a JSON query descriptor.

First pre-alpha release: the saga-style, in-process workflow engine on Effect-TS — typed steps with compensation, retry/timeout, and Redis-backed distributed locking.

Baseline: the shared TypeScript compiler presets every Damat package extends.