[andrewzolotukhin]

Original request

Release Xpenser 1.0.0 from main and deploy it to production after the Framework 5.0.0 adoption PR was merged.

What changed

• Set the root and all seven workspace package versions to 1.0.0.
• Update internal workspace dependency ranges and matching lockfile metadata to 1.0.0.
• Report 1.0.0 in OpenAPI and MCP server metadata.
• Preserve all external dependency versions, including Cleverbrush Framework 5.0.0.

Reasoning

Keep the application release version consistent across workspace resolution and public protocol metadata. The release commit will be merged into main, deployed as coordinated API/web/bot images, and tagged v1.0.0 after production verification.

Production currently predates migrations 020 (durable jobs) and 021 (scan JSONB). Deployment includes a protected PostgreSQL backup, isolated migration rehearsal and coordinated cutover. This PR introduces no additional migration.

Blog post

Skipped: release metadata only. Existing feature posts describe the application changes being released.

Screenshots / preview evidence

Visual before/after screenshots are not applicable to this metadata update. Preview QA will verify login and the published OpenAPI version; the passing Playwright report provides stable browser regression evidence.

Validation

• Clean locked dependency installation: passed.
• Local lint, full workspace build and typecheck: passed. Unit tests: 125 files / 1,961 tests passed.
• PostgreSQL integration: 7 files / 61 tests passed in UTC and America/Los_Angeles.
• Required GitHub checks: all passed, including 40 Playwright tests. Workflow run.
• Manual preview: documented test-account login and dashboard passed; /api/openapi.json returns 1.0.0; no browser errors.
• Playwright report provides browser regression evidence.
• Preview SigNoz: API/web traces and API request metrics present. The single warning/error span is the passing e2e API-key validation scenario (HTTP 400), with correlated trace/log IDs; no unexpected errors. Web HTTP metrics are not configured.
• Protected production backup: migration rehearsal passed, preserving row counts across 23 business tables and semantic contents of 884 scan documents. Restoring the backup lets the retained old API start healthy.
• PR-ready notification: sent (HTTP 200).

Production release

• Merged main commit: 33249137ebb4318c8b2b7cdea17157cba3f025b7.
• Xpenser 1.0.0 release published with an annotated tag pointing to the deployed commit.
• API, web and Telegram bot run on Node.js 24.21.0 with 1.0.0 metadata and zero restarts.
• Public home/login, API health and OpenAPI smoke checks return HTTP 200; OpenAPI reports 1.0.0. Production QA used public/read-only checks without customer credentials.
• Migrations 020/021 applied successfully; all 23 business table row counts and semantic contents of 884 scan documents preserved. Original PostgreSQL container/volume retained. Protected final/rehearsal backups and previous images retained.
• Existing email scheduling settings restored; durable scheduler health has successful jobs and no queued definitions.
• Initial production telemetry: version-filtered API/web traces without error spans; API/bot information logs without warnings/errors; controlled read-only requests incremented the API request counter by four. API/bot runtime metrics present. Web HTTP metrics are not configured; no Telegram customer messages were sent during QA.