Versioned Schemas, Versioned Plans, and Faster Functions

Data

Data Gateway schemas become versioned, auditable, and safe to roll back.

• Schema version history and rollback: Every published schema change is now kept as a version you can review and roll back to, so a bad edit is a one-click revert instead of a manual rebuild.

• Only published, validated snapshots go live: The gateway now serves only schema snapshots that have been published and validated, so a work-in-progress edit can no longer reach live traffic.

• Every pod stays on the latest schema: A schema publish is now announced across all Data Gateway pods over Redis, so a multi-pod deployment can't keep serving a stale schema after you change it.

• Reworked schema editor: The schema structure editor was rebuilt, with nested rule groups in the rule-set editor, enum editors that auto-focus, a unified style for field flags, and a principal selector with inline chips.

• Analytics date range and bucket size: The graph analytics page gains a date-range picker and a bucket-size control, so you can scope the window and resolution of your charts.

• Mobile layout: The schema header and playground now lay out correctly on small screens.

Workflow

Functions get faster, safer, and able to act as the caller.

• Caller token on demand: A function can now request a caller-scoped access token at run time with await ctx.blocks.getAccessToken(), so it calls Blocks services as whoever invoked it instead of holding a static credential.

• Faster functions: Warm calls are quicker, cold starts get a start-up CPU boost, and a function re-warms automatically after a restart. Deployment and invocation add artifact support and sandbox reuse.

• Credentials stay out of functions and logs: Functions refuse literal credentials, revoke their run grants when they finish, clean up leftover envelopes, and support force-delete. Secrets are never written to notifier, notification, scheduler, or workflow logs.

• Clearer editing: Workflow details show the workflow name in the breadcrumb with an actions menu, the output panel shows mock data with an indicator you can remove, and the HTTP node gains a None authentication option.

• More predictable runs: A step with any failed item now fails, so the run ends Failed rather than reporting a success it didn't earn.

Utilities

Subscriptions gain versioned plans and a full billing-email story.

• Versioned plans: A plan can now be versioned so it stays editable while subscribers are live on it, and existing subscribers keep the version they bought.

• One trial per plan: Each plan's trial is limited to one per subscriber, closing repeated-trial sign-ups.

• Emails in the recipient's language: Subscription notification emails are now sent in the recipient's language. Members are emailed when they are given or lose a seat, and billing contacts are notified on seat, plan, and cancellation changes.

• Edit capture delay in the portal: A payment provider's capture delay is now editable from the portal, so Adyen auto-capture settles on your schedule.

• Payment reliability: Stored-card charges now send the provider store, settlement reservations no longer block a cancellation, webhooks for references Blocks did not issue are acknowledged rather than erroring, and a recurring charge fails cleanly on a configuration error instead of hanging.

• Leaner reconciliation: The subscription sweep now runs only for tenants that have subscribed and skips tenants with no database, so background work scales with real usage.

• In-process PDF rendering: Template-engine PDFs now render in-process.

Identity

• One password prompt, not two: An existing active user who redeems a signup link now confirms their password and arrives already signed in, instead of being sent to the sign-in page to type it again.

• Email preferences: Admins can opt out of activation and organization-membership emails.

• Safer redirects: Redirect targets are validated before a full-page navigation, so a crafted target cannot send a user off-site.

• Console consolidated into OS: The admin and console pages that moved to Blocks OS have been removed from Identity, leaving one place to administer them.

Platform hardening

• Configurable Content-Security-Policy: Data Gateway and Observability now build their CSP from configuration instead of hard-coded values, and the OS app uses a per-browser style nonce in place of unsafe-inline, tightening the browser security posture without hand-editing headers per service.

Deployment & Observability

• Repo details: Deployment hides the Tracing and Logs buttons on the repo-details page, and Observability refines the SCA severity tiles and repo-detail styling.

Localization

• Import migration fix: An issue in the localization import migration has been fixed, so bringing localization data across lands correctly.

CLI

@seliseblocks/cli-os 0.9.0 is on npm, with 0.9.1 rolling out.

• GeoJson schema indexes (0.9.0): blocks data schema indexes list|create|delete manages Data Gateway indexes. A non-array GeoJson field gets a MongoDB 2dsphere index automatically and is reported separately as a read-only system index, and create builds custom indexes with --fields, --name, and --unique.

• Case-sensitive field types caught locally (0.9.0): data validate, data schema push, and data schema fields now reject a miscased scalar such as string or geojson and name the right spelling (String, GeoJson) before the server does.

• Safer previews and project targeting (0.9.1): new web --dry-run is now read-only and writes nothing, project selection is pinned per workspace so two terminals in different directories can't retarget each other, and a project token issued for the wrong tenant is detected and discarded instead of silently answering from the wrong tenant's data.