Adopt Cleverbrush Framework v5.0.0

apps/api/Dockerfile

@@ -17,7 +17,9 @@ RUN npm ci --ignore-scripts && mkdir -p apps/api/node_modules
 COPY apps/api ./apps/api
 COPY packages ./packages
 
-RUN npm run build -w @xpenser/contracts && \
+# TypeScript 7 uses Go; cap its heap growth on small deployment hosts.
+RUN export GOMEMLIMIT=1536MiB && \
+    npm run build -w @xpenser/contracts && \
     npm run build -w @xpenser/client && \
     npm run build -w @xpenser/timezone && \
     npm run build -w @xpenser/api

apps/api/package.json

@@ -8,27 +8,27 @@
     "scripts": {
         "dev": "tsx watch --env-file=.env --import @opentelemetry/instrumentation/hook.mjs src/index.ts",
         "start": "node --import @opentelemetry/instrumentation/hook.mjs --import ./dist/telemetry.js dist/index.js",
-        "build": "tsup && tsc --noEmit -p tsconfig.json",
+        "build": "tsup && tsc --noEmit -p tsconfig.json --checkers 1",
         "typecheck": "tsc --noEmit -p tsconfig.json",
         "clean": "rm -rf dist tsconfig.tsbuildinfo",
         "db:run": "tsx --env-file=.env src/db/run.ts",
         "db:validate": "cb-orm validate --config src/db/orm.config.ts"
     },
     "dependencies": {
-        "@cleverbrush/auth": "0.0.0-beta-20261004165009",
-        "@cleverbrush/di": "0.0.0-beta-20261004165009",
-        "@cleverbrush/env": "0.0.0-beta-20261004165009",
-        "@cleverbrush/log": "0.0.0-beta-20261004165009",
-        "@cleverbrush/knex-schema": "0.0.0-beta-20261004165009",
-        "@cleverbrush/mapper": "0.0.0-beta-20261004165009",
-        "@cleverbrush/orm": "0.0.0-beta-20261004165009",
-        "@cleverbrush/otel": "0.0.0-beta-20261004165009",
-        "@cleverbrush/schema": "0.0.0-beta-20261004165009",
-        "@cleverbrush/schema-json": "0.0.0-beta-20261004165009",
-        "@cleverbrush/scheduler": "0.0.0-beta-20261004165009",
-        "@cleverbrush/scheduler-postgres": "0.0.0-beta-20261004165009",
-        "@cleverbrush/server": "0.0.0-beta-20261004165009",
-        "@cleverbrush/server-openapi": "0.0.0-beta-20261004165009",
+        "@cleverbrush/auth": "5.0.0",
+        "@cleverbrush/di": "5.0.0",
+        "@cleverbrush/env": "5.0.0",
+        "@cleverbrush/log": "5.0.0",
+        "@cleverbrush/knex-schema": "5.0.0",
+        "@cleverbrush/mapper": "5.0.0",
+        "@cleverbrush/orm": "5.0.0",
+        "@cleverbrush/otel": "5.0.0",
+        "@cleverbrush/schema": "5.0.0",
+        "@cleverbrush/schema-json": "5.0.0",
+        "@cleverbrush/scheduler": "5.0.0",
+        "@cleverbrush/scheduler-postgres": "5.0.0",
+        "@cleverbrush/server": "5.0.0",
+        "@cleverbrush/server-openapi": "5.0.0",
         "@modelcontextprotocol/sdk": "^1.29.0",
         "@opentelemetry/instrumentation-http": "0.222.0",
         "@opentelemetry/instrumentation-runtime-node": "0.28.0",
@@ -40,8 +40,8 @@
         "sharp": "0.34.5"
     },
     "devDependencies": {
-        "@cleverbrush/orm-cli": "0.0.0-beta-20261004165009",
-        "@types/node": "22.15.3",
+        "@cleverbrush/orm-cli": "5.0.0",
+        "@types/node": "24.19.2",
         "@types/pg": "8.23.1",
         "@xpenser/client": "0.1.0",
         "tsup": "8.5.1",

apps/telegram-bot/package.json

@@ -13,12 +13,12 @@
         "clean": "rm -rf dist tsconfig.tsbuildinfo"
     },
     "dependencies": {
-        "@cleverbrush/env": "0.0.0-beta-20261004165009",
-        "@cleverbrush/log": "0.0.0-beta-20261004165009",
-        "@cleverbrush/otel": "0.0.0-beta-20261004165009",
-        "@cleverbrush/schema": "0.0.0-beta-20261004165009",
+        "@cleverbrush/env": "5.0.0",
+        "@cleverbrush/log": "5.0.0",
+        "@cleverbrush/otel": "5.0.0",
+        "@cleverbrush/schema": "5.0.0",
         "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/instrumentation": "0.215.0",
+        "@opentelemetry/instrumentation": "0.222.0",
         "@opentelemetry/instrumentation-http": "0.222.0",
         "@opentelemetry/instrumentation-runtime-node": "0.28.0",
         "@opentelemetry/instrumentation-undici": "0.25.0",

apps/telegram-bot/tsup.config.ts

@@ -7,7 +7,7 @@ export default defineConfig({
     minify: false,
     sourcemap: true,
     clean: true,
-    target: 'node22',
+    target: 'node24',
     noExternal: [/@xpenser\//],
     external: ['ws', /^@opentelemetry\//, '@fastify/busboy']
 });

apps/web/package.json

@@ -11,11 +11,11 @@
         "clean": "rm -rf .next tsconfig.tsbuildinfo"
     },
     "dependencies": {
-        "@cleverbrush/env": "0.0.0-beta-20261004165009",
-        "@cleverbrush/log": "0.0.0-beta-20261004165009",
-        "@cleverbrush/otel": "0.0.0-beta-20261004165009",
-        "@cleverbrush/react-form": "0.0.0-beta-20261004165009",
-        "@cleverbrush/schema": "0.0.0-beta-20261004165009",
+        "@cleverbrush/env": "5.0.0",
+        "@cleverbrush/log": "5.0.0",
+        "@cleverbrush/otel": "5.0.0",
+        "@cleverbrush/react-form": "5.0.0",
+        "@cleverbrush/schema": "5.0.0",
         "@keystatic/core": "^0.5.50",
         "@keystatic/next": "^5.0.4",
         "@xpenser/client": "0.1.0",

docs/cleverbrush-reference.md

@@ -7,10 +7,26 @@ worth copying and the checks that keep those patterns from drifting.
 Framework source: [cleverbrush/framework](https://github.com/cleverbrush/framework).
 
 All directly used Framework packages are pinned to
-`0.0.0-beta-20261004165009`. See [database reads](./database-reads.md) for
+`5.0.0`. See [database reads](./database-reads.md) for
 compiled query behavior and [image uploads](./image-uploads.md) for typed
 uploads, JSONB scan storage, and coordinated rollout.
 
+## Stable v5 adoption
+
+The [v5 migration guide](https://github.com/cleverbrush/framework/blob/v5.0.0/docs/MIGRATION-v5.md)
+covers the coordinated package upgrade. Xpenser already adopted immutable queries,
+compiled reads, durable jobs, typed uploads, schema forms and scoped transaction
+replay in the October betas; the stable release retains those integrations.
+
+Compared with the October 4 beta, v5 fixes default-only database migration changes
+so they preserve column types, nullability and stored data; closes WebSocket
+subscriptions rejected by middleware; honors a zero subscription-history limit;
+and corrects shared HashObject behavior. The scheduler table schemas and migrations
+are unchanged, so this upgrade adds no database migration or job-definition version.
+All Framework packages, including transitive packages, must resolve to 5.0.0 with
+one shared schema installation. Keep the feature-owned unit, PostgreSQL and browser
+suites as the executable checks for existing behavior.
+
 ## Cross-origin requests
 
 `useCors()` allows the serialized origin of `APP_URL`, preserves the existing
@@ -230,7 +246,7 @@ projections, page/count agreement, and bounded enrichment query counts.
 - Keep endpoint-specific cache namespaces in the shared contract. A vendor list
   and vendor detail have different response shapes and therefore use `vendors`
   and `vendor`; a write invalidates every affected namespace.
-- Let Framework encode parameterized cache keys. The beta distinguishes Date
+- Let Framework encode parameterized cache keys. Framework distinguishes Date
   values down to milliseconds and avoids separator collisions. Do not build a
   second encoder in Xpenser.
 - `createXpenserClient()` creates its own in-memory cache middleware. Preserve
@@ -325,8 +341,9 @@ reuse a key only with the same input; Framework does not compare request bodies.
 API restarts, expiry and independent replicas lose or lack replay state. This
 is not a durable exactly-once guarantee.
 
-Framework's October 4 beta requires Node.js 24. Docker stages, CI, .nvmrc and
-the root engine constraint match it; HTTP instrumentation uses 0.222.0 alongside
+Framework v5 requires Node.js 24. Docker stages, CI, .nvmrc, the root engine
+constraint, Node type declarations and the bot build target match it. HTTP
+instrumentation and the bot's instrumentation hook use 0.222.0 alongside
 Framework telemetry.
 
 HTTP instrumentation 0.222 emits stable-semantic-convention duration metrics: