Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Changelog

For the full project changelog, see the repository file:

Current Highlights (v2.0.0)

  • JOIN array membership parity: is_array_unnest expands to the same EXISTS/unnest SQL in the PostgreSQL wire encoder and the core transpiler; unsupported JOIN pattern operators fail closed.
  • Aggregate qualifier validation: GROUP BY and DISTINCT ON qualifiers are checked against the active relation scope, including alias hiding and CTE visibility rules, before application code can ship invalid SQL.
  • Qualified RLS injection: tenant/owner predicates name their primary relation, avoiding PostgreSQL 42702 ambiguity on joined queries; schema-qualified CROSS joins retain every registered relation’s predicate.
  • Fail-closed payload de-duplication: identical repeated assignments collapse, while conflicting tenant/owner stamps remain an encoder error instead of overriding the value injected by with_rls().
  • RLS scope hardening: with_rls() fails closed on registered tables, scope registries are declared once at the application boundary (init_scope_registries / declare_policy_only_isolation), owner (owner <column>) scoping joins tenant scoping, and ON CONFLICT DO UPDATE carries the scope predicate via OnConflict.where_conditions.
  • 1.x compatibility surfaces removed: the qail-encoder C ABI, SQLite/DynamoDB/MongoDB transpilers, the agent identity plane (app.current_agent_id), the function-pointer GSS callback, the JWT user_id alias, auth_mode=compat, deprecated SDK aliases, and the io_uring feature alias. See the repository CHANGELOG [2.0.0-rc.1] section for per-item migration notes.
  • Release line: Rust workspace crates and install snippets are bumped to 2.0.0; qail-workflow, qail-workflow-postgres and qail-gateway are in the crates.io publish set.

v1.4.0 Highlights

  • Views can declare security_invoker: view <name> security_invoker $$ … $$ parses, renders, compiles to CREATE VIEW … WITH (security_invoker = true), and survives qail pull by being read back from pg_class.reloptions. Without it, a view over an RLS-protected table evaluates that table’s policies as the view owner and silently bypasses them. Owner-rights stays the default, matching PostgreSQL.
  • qail pull introspects grants: relacl is parsed into schema.grants, so a relation missing a grant to the application role is now visible in schema.qail instead of failing at runtime as [42501] permission denied with nothing to diff. Recovered 229 grants on a live 217-table database that previously showed zero. Privileges with no schema.qail spelling are reported on stderr rather than dropped.
  • rls::tenant::scoping_applies(): callers and audits can assert that tenant scoping actually applied — in 1.4, with_rls failed open on unregistered relations (2.0 fails closed).
  • Release line: Rust workspace crates and install snippets were bumped to 1.4.0.

v1.3.6 Highlights

  • PostgreSQL dependency correctness: cmov 0.5.4 fixes incorrect AArch64 constant-time selection results in the dependency path used by PostgreSQL SCRAM authentication.
  • Gateway dependency safety: crossbeam-epoch 0.9.20 resolves RUSTSEC-2026-0204 in the metrics and cache dependency paths.
  • Extension build tooling: VSCE 3.9.2 resolves the form-data and markdown-it advisories without changing the shipped extension runtime.
  • PostgreSQL io_uring opt-in security: Linux io_uring plain-TCP transport no longer auto-enables on kernel support; enable it explicitly with [postgres].io_uring = true, ?io_uring=true, driver/pool options, or QAIL_PG_IO_BACKEND=io_uring.
  • Tokio remains the safe default: building with the qail-pg/io_uring feature only makes the backend available; TLS, mTLS, and GSSENC paths continue to use Tokio transport.
  • Workflow payment hardening: charge side effects now default to stable workflow idempotency keys, support order-origin metadata, and store redacted payment display payloads for chat/notification use.
  • Release line: Rust workspace crates and install snippets are bumped to 1.3.6.

v1.3.0 Highlights

  • Detailed changelog: QAIL.rs v1.3.0: Native Vertical Policy and the Audit Pass Behind It
  • Native vertical access policy: qail_core::access adds deny-by-default table policies, role/scope requirements, operation permissions, and read/write/returning column rules before AST execution.
  • Gateway policy integration: [access] in qail.toml loads TOML/JSON policies so gateway REST, QAIL text/binary/batch, transaction, RPC, nested, expanded, and live-query paths can enforce vertical table and column boundaries alongside PostgreSQL RLS.
  • PostgreSQL statement cache safety: hot prepared statements are promoted, evicted, reparsed, and retained only in states that match the real backend statement lifecycle.
  • Migration verification: composite foreign-key options now survive parse/diff/apply and strict post-apply checks verify table constraints against the live database.
  • Gateway hardening: precise numerics, oversized integers, Qdrant JSON integer drift, transaction subqueries, branch replay, and tenant guard exemptions are handled on explicit fail-closed paths.
  • Workflow and encoder fixes: workflow guards, charge amounts, branch cursors, null bind params, zero-parameter binds, and Qdrant vector byte order were tightened.
  • SDK path safety: TypeScript, Kotlin, and Swift SDK builders encode table and ID path segments before constructing REST routes.
  • Real database validation: PostgreSQL lab coverage passed for strict migrations, MERGE, access-checked execution, seeded RLS, and gateway native access policy behavior.

v1.2.1 Highlights

  • Schema parser compatibility: pulled PostgreSQL schemas now accept table-level enable_rls and force_rls directives.
  • PostgreSQL type parsing: multi-word types such as DOUBLE PRECISION and TIMESTAMP WITH TIME ZONE parse correctly from pulled schemas.
  • Comment parsing: schema comments containing quoted examples no longer break parsing.

v1.2.0 Highlights

  • PostgreSQL protocol safety: COPY, LISTEN/NOTIFY, replication, pooled fetch, driver fetch, query, and pipeline paths now fail closed and desynchronize bad connections on malformed backend state.
  • NUL and UTF-8 hardening: savepoints, SQL rendering, AST SQL buffers, gateway explain SQL, COPY text rows, backend wire strings, and PostgreSQL URL decoding now reject invalid input instead of silently mutating it.
  • Real database validation: PostgreSQL 18 lab coverage passed for MERGE, set operations, recursive CTEs, cursor cleanup, COPY callback recovery, LISTEN/NOTIFY payloads, savepoint rejection, and NUL query rejection.

v1.1.1 Highlights

  • Live migration introspection: schema pulls and shadow verification now account for generated columns, identity defaults, expression indexes, enum extensions, and composite foreign-key drift.
  • Migration replay safety: post-apply checks compare constraints, defaults, generated expressions, indexes, and extension dependencies against the real database state.
  • Branch overlay coverage: live PostgreSQL audit paths verify merge, set-operation, recursive-CTE behavior, and bad overlay replay failure modes.

v1.1.0 Highlights

  • Workflow engine hardening: fixed nested loop context preservation, wait-event resume validation, timeout fallbacks, and transition checkpointing.
  • Gateway security hardening: tightened tenant guards, RLS policy injection, write-side column policies, idempotency, transaction paths, branch overlays, and REST mutation/event semantics.
  • Qdrant tenant safety: tenant-scoped vector upserts now namespace point IDs while preserving the caller-facing original ID.
  • Branch overlay correctness: branch reads and merges now use deterministic chronological ordering with post-policy filtering and projection.
  • Durable events: webhook delivery now has an outbox-backed path and stricter old/new payload handling.
  • Runtime surface cleanup: the supported stable runtime is centered on PostgreSQL and Qdrant; legacy SQLite/DynamoDB/MongoDB transpiler symbols remain compatibility-only for 1.x consumers, and obsolete PostgreSQL examples were removed.

v1.0.0 Highlights

  • Promoted QAIL to 1.0.0 Stable, declaring the API complete and production-grade.
  • gRPC Connection State Machine: Implemented concurrent reconnection protection using a connection generation counter in the Qdrant engine.
  • Webhook Scaling: Scaled webhook concurrency limit to 512 paired with safe timeouts.
  • Connection Pool Locking: Replaced async-wait locks with standard library unwrap synchronization under heavy concurrent loads.
  • Workspace Crates: All workspace crates, internal path dependencies, and VSCode LSP extension bumped to 1.0.0.
  • API Cleanup Carried Into 1.0: try_with_rls() and try_join_on() compatibility aliases are gone; call with_rls(&ctx)? and join_on(...)? on the fallible path.
  • Raw SQL Runtime Surface: Qail::raw_sql(...), Qail::is_raw_sql(), Qail::raw_where(...), and Qail::nextval(...) are not part of the stable public runtime path.
  • Cancel-Key API: legacy i32 cancel-key wrappers are gone; use bytes-native cancel-key APIs.
  • Error Conversion: broad From<QailBuildError> for String compatibility conversion was removed so callers keep structured build errors.