[Changed] Auth: documented the two OTP verification paths for messageId — the data.verifyOtp callback from signInWithOtp / signUp does not need messageId (SDK caches it); standalone auth.verifyOtp (including after getVerification) requires messageId
[Changed] Auth: client missing-param errors now use missing_required_param (errorCode 4000), with call-site and param path in error.message, e.g. auth.verifyOtp(params): missing required param 'messageId'; distinguished from server invalid_argument and unconfigured channel (unimplemented)
[Changed] Auth: type definitions / JSDoc now state the messageId required-ness difference for the paired APIs (optional on the callback, required on standalone verifyOtp)
[Fixed] Auth: wrapping an error in AuthError no longer drops the original error code, so it is not mixed up with gRPC invalid_argument
[Fixed] Document database GATEWAY adapter: strip EJSON number markers ($numberInt) from order / projection, and send gateway-required [{field,direction}] plus plain JSON numbers, fixing Invalid order format
[Fixed] Document database: single-document query detection now covers bare _id / $eq / $oid; _id equality uses GET /documents/:docId; single-document update/delete go through the batch endpoint; doc.set with merge:false maps to replaceMode:true
[Added] Document database: added modifyAndReturnDoc — updateAndReturn uses the single-document returnDoc endpoint for _id equality, and falls back to batch update otherwise
[Changed] Document database: low-level handler inputs are normalized so query / data / projection accept both objects and EJSON strings
[Added] Node.js side now aligns with the v4 / node-sdk shape: added a unified throw switch config.throw (throwOnCode is accepted only as an init alias and is canonicalized away; default true). Supports instance-level app.setThrowOnCode(value) and the top-level free function. Server-side business errors and local validation in functions / storage / database all read this switch; when throw=false, they return {code, message, requestId}
[Added] Added CloudbaseError (extends Error): code / message / requestId are directly accessible, matching the Gateway business-error plain-object shape (e.code no longer requires JSON.parse)
[Changed] Document database now adapts to Gateway 2.0 engine API names (getDocument / insertDocument / modifyDocument, etc.) and EJSON parameter formats; send() supports per-request timeout
[Changed] BREAKING Local validation errors changed from a JSON-string Error to CloudbaseError (message is plain text; e.code is directly accessible)
[Changed] BREAKING Internal structure of db.RegExp() changed from $regex / $options to $regularExpression ({pattern, options})
[Changed] BREAKING Node-side error code INVALID_PARAMS renamed to INVALID_PARAM (aligned with v3 node-sdk)
[Changed] @cloudbase/database upgraded to 1.5.0; bson dependency downgraded from 7 to 6
[Fixed] MySQL/RDB: in Mini Program and similar environments, request.fetch returns headers as a plain object without standard Headers.get(), which caused the PostgREST client to throw when parsing the response; headers are now normalized
[Changed] Engineering: the monorepo has been migrated to Yarn 2 (Berry 4.18.0), and internal package dependencies now use the workspace:* protocol, which is automatically resolved to specific versions at publish time
[Changed] The release process has been switched to Lerna independent versioning mode, supporting incremental publishing per package (changes to @cloudbase/oauth automatically trigger the release of @cloudbase/auth and @cloudbase/js-sdk); all sub-packages are now public and can be published individually
[Fixed] Removed leftover debug console.log statements in @cloudbase/oauth (the CloudbaseOAuth constructor) and @cloudbase/mysql (getEntity)
[Fixed] Added missing getSecretInfo-related type assertions in the @cloudbase/app Node.js adapter
[Changed] Auth module: the usage value of the verification code API getVerification is now consistently narrowed to the VerificationUsage enum (EMAIL / RECOVERY / REAUTHENTICATION). Scenarios such as signUp, signInWithOtp, resetPasswordForEmail, updateUser, reauthenticate, and resend no longer use string literals, preventing incorrect values from being passed
[Changed] @cloudbase/oauth now additionally exports the VerificationUsage enum
[Changed] The type of the internal data.usage field in resend has been narrowed from string to VerificationUsage
[Fixed] Fundamentally resolved the Module not found: Can't resolve 'xxx' errors caused by optional Node.js dependencies (jsonwebtoken, @cloudbase/signature-nodejs, ws) when consumers bundle for the browser or SSR (Next.js, Nuxt, etc.): these dependencies are now loaded on demand at runtime by an internal optionalRequire, where the module name is assembled from fragments at runtime and require is obtained from the host runtime, so bundlers cannot recognize them during static analysis and therefore will not try to resolve them. Consumers no longer need to configure serverExternalPackages in next.config.js or add webpack fallbacks
[Changed] The wsClass of the Node.js adapter has been changed to a lazily-loaded getter: ws is loaded only when realtime capabilities (realtime / database) actually access this property, so Node.js scenarios that do not use realtime capabilities will not load ws; a duplicate-guard flag has also been added to avoid repeatedly executing the load and repeatedly printing the installation hint when ws is not installed
[Fixed] Fixed an issue where the private key passed by users via init({ env, auth: { credentials } }) could not be read by createTicket in custom login scenarios: getSecretInfo() previously only read from the top-level config.credentials, and now supports both config.auth.credentials (js-sdk style) and top-level credentials (node-sdk style)
[Fixed] Fixed an issue where dealNodeAdapterConfig() overwrote config.auth.credentials with an empty value when backfilling; it now preserves the credentials explicitly passed by the user, and corrects its fallback value type (an ICredentialsInfo object, undefined when there is no valid value, no longer an empty string)
[Changed] timeout default value now varies by runtime environment: Node.js environments (Cloud Functions/CloudBase Run/self-hosted servers) default to no timeout (unlimited) to accommodate long-running server-side requests; Web and other non-Node.js environments still default to 15000ms. Explicitly passing timeout takes precedence
[Changed] NodeRequest no longer applies timeout interruption when timeout is not set (download and createAbortController enable timeout on demand), only enabled when timeout is explicitly passed
[Changed] Auth updateUser no longer supports password changes: passing password / new_password parameters will throw an error. Use resetPasswordForOld (change with old password), resetPasswordForEmail (reset via verification code), or reauthenticate (change after re-authentication) instead
[Changed] UpdateUserReq type removes password / new_password fields from base request (marked as never)
[Fixed] In getSecretInfo(), when using top-level secretId/secretKey, sessionToken was incorrectly read from environment variable TENCENTCLOUD_SESSIONTOKEN, corrected to read from top-level sessionToken field in config
[Fixed] In getSecretInfo(), when using config.auth, sessionToken was incorrectly read from environment variable, corrected to read from config.auth.sessionToken
[Fixed] NodeRequest V3 signing now correctly resolves secretId/secretKey/sessionToken from both top-level config and config.auth (config.auth takes higher priority)
[Fixed] AI module: prioritize native Web Streams API (Node.js >= 18 / modern browsers) to avoid compatibility issues with web-streams-polyfill in higher version environments
[Fixed] Fixed the issue where webpack.DefinePlugin replaces process.env entirely with a static object during Node.js server build, causing runtime inability to read environment variables such as TENCENTCLOUD_SECRETID, TENCENTCLOUD_SECRETKEY, SCF_NAMESPACE
[Fixed] getSecretInfo() now reads from getCloudbaseContext() uniformly (instead of directly from getEnv()), ensuring correct priority of environment variables in context
[Fixed] getCloudbaseContext() adds collection of CLOUDBASE_APIKEY environment variable
[Fixed] AI module: in Node.js adapter non-streaming scenarios, when responseData is already a JSON object, skip ReadableStream parsing and return the result directly
[Fixed] Fixed the issue where getWxDefaultAdapter returns an empty object during initialization in Node.js ESM environment, causing useAdapters to throw TypeError: i is not a function when calling isMatch()
[Fixed] Fixed the issue where document database collection query in GATEWAY mode fails because backend response lacks the list field, causing formatResDocumentData to throw TypeError: Cannot read properties of undefined (reading 'map')
[Added] App instance adds registerHost(host, protocol?) method to set all endpoints (CLOUD_API / GATEWAY) at once, only requires the host address and automatically appends paths
[Fixed] Fixed the issue where CloudbaseRequest.fetch fails due to missing oauthInstance in Node.js server-side (secretId/secretKey authentication) scenario, enabling modules like RDB to correctly obtain access_token automatically through the underlying NodeRequest V3 signature
[Changed] app.storage.from() without arguments still returns ClassicStorageFileApi (behavior unchanged); passing bucketId returns the Neo object storage client
[Deprecated] Legacy top-level cloud storage APIs (uploadFile / downloadFile / deleteFile, etc.) are marked as deprecated, recommend using the new app.storage.from(bucketId) API instead
[Changed] getUser/getCurrentUser supports isRefresh parameter to control whether to fetch the latest user information via API request, defaults to fetching latest data each time