feat(authup): track authup 1.0.0-beta.67

.agents/references/authup.md

@@ -1,31 +1,39 @@
 # authup application mapping
 
 Repository: https://github.com/authup/authup. A local checkout commonly exists
-at `/opt/projects/authup/authup`. This mapping is pinned to v1.0.0-beta.66, the
+at `/opt/projects/authup/authup`. This mapping is pinned to v1.0.0-beta.67, the
 chart `appVersion`.
 
-beta.65 to beta.66 changed no image entrypoint, CLI role, port or
-environment-variable contract: `Dockerfile` and `entrypoint.sh` are unchanged,
-`packages/server-config/src` gained no field, and `apps/authup/src/module.ts`
-only adds operator-side commands (`login`, `logout`, `whoami`, `api <entity>`,
-a CLI that signs itself in through the device grant) beside the unchanged
-`start` tree. Three deployment-facing facts, none of which needs a chart value:
-
-- The device authorization grant (RFC 8628, #3587) adds `/device_authorization`
-  and the hosted `/device` page. Both sit outside `/console`, so they ride the
-  server catch-all, and the `/device` redirect target `/console/auth/device`
-  rides the auth console's `/console/auth` prefix
-  (`docs/src/guide/deployment/console-replicas.md`). The grant is opt-in per
-  client through the provisioning field `grantTypes`; an omitted `grantTypes`
-  does not enable it.
-- The `@authup/client-auth-console` render contract is version 5 (was 3). A
-  bundle substituted through `AUTH_CONSOLE_PATH` and built against an older
-  contract is refused at boot and must be rebuilt
-  (`docs/src/guide/deployment/theming.md`).
-- Console permission gating, token client narrowing, realm-gated entity reads
-  and the new `permission_check` permission are API and provisioning behavior.
-  They change which grants an operator hands out, not what the chart renders
-  (`docs/src/guide/deployment/upgrading.md`).
+beta.66 to beta.67 changed no image entrypoint, CLI role, port or
+environment-variable contract the chart owns: `Dockerfile`, `entrypoint.sh`
+and `packages/client-auth-console` are unchanged, and `apps/authup/src` only
+adds `authup api <entity> stats` beside the unchanged `start` tree.
+Deployment-facing facts, none of which needs a chart value
+(`docs/src/guide/deployment/upgrading.md`):
+
+- Migration `1789930726252-PathsAndEventAggregates` (folders for users and
+  clients, daily event rollups) runs on PostgreSQL and MySQL. The pre-upgrade
+  migration Job or a server boot with `MIGRATION_ENABLED` applies it.
+- Boot-time migrations now take a database lock, so replicas starting together
+  with `MIGRATION_ENABLED` on no longer race. A waiting replica fails its boot
+  after 60 seconds and is restarted. The chart's migration Job ownership is
+  unchanged.
+- Database sessions are pinned to UTC (`TimeZone` on PostgreSQL, `time_zone`
+  on MySQL). The built-in PostgreSQL and MySQL images run in UTC and the chart
+  sets no driver timezone option. A driver option that contradicts the pin (a
+  MySQL `timezone` other than UTC, `dateStrings`, `typeCast`, a PostgreSQL
+  `TimeZone` in the startup `options`) or a MySQL replication setup, passed
+  through `server.config`, now stops the boot.
+- The new config field `eventLogAggregateRetentionDays`
+  (`EVENT_LOG_AGGREGATE_RETENTION_DAYS`, default 0 = forever,
+  `packages/server-config/src/sections/core/schema.ts`) is reachable through
+  the long tail (`server.config.core.eventLogAggregateRetentionDays`). The
+  rollup task runs wherever the worker sweeps run: the `start` process, or
+  the `start worker` Deployment when `worker.enabled=true`.
+- Earlier deployment facts still hold: the device authorization grant rides
+  the server catch-all and the `/console/auth` prefix (beta.66), and a bundle
+  substituted through `AUTH_CONSOLE_PATH` must match auth console render
+  contract version 5.
 
 ## Image and CLI
 

charts/authup/Chart.yaml

@@ -5,7 +5,7 @@ description: Authup is an authentication & authorization system. This chart
   built-in PostgreSQL, MySQL and Valkey instances.
 type: application
 version: 0.4.2
-appVersion: "1.0.0-beta.66"
+appVersion: "1.0.0-beta.67"
 kubeVersion: ">=1.25.0-0"
 home: https://authup.org
 icon: https://raw.githubusercontent.com/authup/helm/master/assets/icon.svg
@@ -32,8 +32,8 @@ annotations:
       url: https://github.com/authup/helm
   artifacthub.io/changes: |
     - kind: changed
-      description: Track Authup v1.0.0-beta.66; no image entrypoint, CLI or environment-variable contract changes
-    - kind: added
-      description: The device authorization grant endpoints and the hosted /device page route through the existing server catch-all and auth console prefix; no new routing values
+      description: Track Authup v1.0.0-beta.67; no image entrypoint, CLI or environment-variable contract changes
     - kind: changed
-      description: A console bundle substituted through AUTH_CONSOLE_PATH must be rebuilt against auth console render contract version 5
+      description: Authup v1.0.0-beta.67 ships migration 1789930726252-PathsAndEventAggregates, applied by the migration Job or the server boot
+    - kind: changed
+      description: Authup now pins database sessions to UTC; a database that ran in local time needs its historical timestamps converted once (see the Authup upgrading guide)

charts/authup/README.md

@@ -7,9 +7,9 @@
 # authup
 
 ![Version](https://img.shields.io/badge/Version-0.4.2?style=flat-square&color=informational) <!-- x-release-please-version -->
-![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0-beta.66](https://img.shields.io/badge/AppVersion-1.0.0--beta.66-informational?style=flat-square)
+![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0-beta.67](https://img.shields.io/badge/AppVersion-1.0.0--beta.67-informational?style=flat-square)
 
-Authup is an authentication & authorization system. This chart deploys its combined or split API, console and worker roles, with optional built-in PostgreSQL, MySQL and Valkey instances. It runs Authup v1.0.0-beta.66's
+Authup is an authentication & authorization system. This chart deploys its combined or split API, console and worker roles, with optional built-in PostgreSQL, MySQL and Valkey instances. It runs Authup v1.0.0-beta.67's
 role-based CLI topology:
 
 - one combined API and console workload by default (`start`)