OrbitNest / Docs

Reference

Changelog

Notable changes to OrbitNest Studio, the API, the SDKs, the CLI, and the MCP server, newest first.

Notable platform changes, SDK releases, and fixes, grouped by month with the newest first. Version numbers are package versions. The packages have been published to npm (@orbitneststudio/*) and pub.dev (orbitnest_studio_flutter) since June 2026.

October 2026

Released on 2026-10-12. This release is mostly security and correctness fixes across the API, the SDKs, the CLI, and the MCP server. The SDK, CLI, and MCP versions listed below are not on npm or pub.dev yet.

  • Plans: Storage, Realtime, and Background jobs are available on every plan, including Free. Basic SDK analytics (overview, events, and screens) is on every plan. Retention, funnels, performance, crashes, and web analytics need Starter or Pro.

  • Quotas: plan limits are now enforced. Going over the project, storage, database, functions-per-project, or monthly invocation limit returns 402 with code: "QUOTA_EXCEEDED" plus the quota, plan, limit, and usage. Reads and deletes keep working, so you can free up space. A workspace's plan is the highest plan held by one of its admins. See Plans & billing.

  • Billing: changing plans while you have an active subscription updates that subscription with proration. It no longer creates a second subscription.

  • Storage:

    • The anon key can no longer read private buckets. It gets 403.
    • In a private bucket, a signed-in user can read only their own files.
    • Uploading with a user token to a bucket that doesn't exist returns 404 instead of creating the bucket.
    • When you create a bucket you can set public. If you leave public out, an existing bucket keeps its visibility.
    • Downloads are sent with nosniff. Types that aren't safe to show inline, including SVG, download as attachments.
    • Image transforms have tighter resource limits.

    See Storage.

  • Edge functions:

    • Invoking a function needs a project key: send it in apikey, x-api-key, or Authorization: Bearer. To fill ctx.user, send the anon key in apikey and the user's access token as the Bearer token.
    • Memory must be 16–1024 MB. invoke and logs are reserved names.
    • Outbound fetch stops when the function times out.
    • Credential headers are redacted in execution logs.
    • Management endpoints return real 4xx errors.

    See Edge functions.

  • Background jobs: a run that died is cleared after 10 minutes so the job can run again. Cron expressions the scheduler can't run, such as L, ?, or @daily, are rejected with 400.

  • Realtime:

    • User tokens are verified. Signed-out sessions and banned users are refused.
    • Sockets that only have the anon key receive a row only if RLS lets anon see it.
    • DELETE events go only to service_role sockets.
    • The new presence.untrack message removes your presence without leaving the channel.

    See Realtime.

  • Database:

    • Filter values can contain :. An unknown operator or a malformed filter now returns 400 instead of being ignored.
    • Reads made with a user token apply RLS for that user.
    • service_role and Studio admins can run multi-statement SQL, including BEGIN; … COMMIT; migrations.
    • auth_* tables can't be dropped, truncated, altered, or bulk-deleted through SQL by any caller, and anon and user tokens can't read or write them.
    • Workspace members can browse tables and edit rows. Raw SQL, dropping tables, and RLS and policy changes remain limited to the project's creator.

    See Database.

  • API keys: regenerating a project's keys now revokes the old keys everywhere. ORBITNEST_ANON_KEY in your functions is updated for you. See API keys & JWT.

  • Auth for your app's users:

    • Changing a password or email needs current_password.
    • Adding or removing an MFA factor, or regenerating recovery codes, needs a current MFA code.
    • Signing out revokes access tokens right away.
    • Bans are enforced everywhere.
    • SMS codes are limited to 1 a minute and 5 an hour per phone number.
    • DELETE /auth/user deletes the account.
    • Recovery codes work at the MFA challenge.

    See Authentication.

  • Auth email without SMTP: projects without their own SMTP server now send sign-in, verification, password-reset, and welcome emails from a shared OrbitNest sender, as "Your App via OrbitNest", using the built-in templates. The shared sender is rate-limited. See Email.

  • Email:

    • Marketing broadcasts send in the background: the API returns 202 with a job you can poll. Jobs are stored in the database, so a deploy or restart resumes a broadcast without sending twice to anyone who already got it.
    • Every broadcast email has an unsubscribe link and one-click List-Unsubscribe headers. Unsubscribed addresses are skipped, and admins can view and remove them in Settings → Marketing. See Email marketing.
    • Broadcasts, template edits, and previews are admin-only.
    • SMTP hosts on private or internal addresses are rejected.
    • Template variables are HTML-escaped.

  • Team security:

    • Require 2FA is now enforced by the API.
    • Security settings (idle session timeout, login lockout, and minimum password length) apply per workspace, only admins can change them, and they are enforced.
    • Deactivating a member works.

    See Team & roles.

  • Logs and analytics:

    • Log filters work, and list responses include has_more.
    • Exports include up to 10,000 rows.
    • Analytics accepts a signed-in user's token.
    • Crashes are stored with the correct time and fields.

  • JavaScript SDK 0.7.0 and Node.js SDK 0.13.0:

    • Requests send the signed-in user's token, and tokens refresh before they expire.
    • In the browser SDK, sessions are per client when rendering on the server.
    • functions.invoke() returns the real status, headers, and body.
    • Errors carry the server's details in error.details, such as the quota and limit of a QUOTA_EXCEEDED error.
    • realtime untrack() uses the new presence.untrack message.
    • migrations.reset() keeps auth_* tables.
    • jobs, env, and logs are deprecated because they need a Studio admin token.

    See JavaScript SDK and Node.js SDK.

  • Flutter SDK 1.7.0:

    • The database API was rewritten so every query reaches the real endpoints.
    • Users are no longer signed out after a network error during token refresh.
    • Analytics works for signed-in users.
    • Filter values can contain :, and errors expose the server's error body.
    • Adds auth.deleteUser(), a currentPassword parameter on updateUser(), and code parameters on the MFA management methods.

    See Flutter SDK.

  • CLI 0.6.0 and MCP server 1.4.0:

    • The CLI and MCP server share a credentials lock, so running both no longer signs you out.
    • .orbitnest/config.json uses projectSlug.
    • db reset does a dry run first.
    • sync_memory reports each item that failed.

    See CLI and MCP server.

July 2026

  • Flutter SDK 1.6.3: a failing edge function call no longer causes other function calls running alongside it to fail too.
  • Auth: your app's users can sign up with plus-addressed emails such as name+tag@example.com. When signup verification fails, the error now includes a machine-readable code: OTP_INVALID, OTP_ALREADY_USED, OTP_RATE_LIMITED, SIGNUP_RESTART_REQUIRED, or ACCOUNT_REJECTED. A rejected address now returns 400 instead of a generic 500.
  • Studio 2FA: a broken or duplicate authenticator can no longer lock a Studio account out. If you have more than one authenticator, a code from any of them is accepted.

June 2026

  • Billing on Stripe: Studio billing moved from RevenueCat to Stripe. Upgrades go through Stripe Checkout, and payment methods, invoices, and cancellation are handled in the Stripe Customer Portal. Paid plans start with a 14-day free trial. See Plans & billing.

  • Starter and Pro plans: there are now two paid tiers, both billed monthly: Starter at $6.99/month (3 projects) and Pro at $14.99/month (unlimited projects).

  • Usage page: Settings → Usage shows projects, database size, storage, and monthly edge function invocations against your plan's quotas.

  • Plan limits: the number of edge functions per project now depends on your plan (20 on Free, 100 on Starter, unlimited on Pro). The background job limit went up from 10 to 15 per project.

  • Webhooks: database webhooks call your endpoint when rows are inserted, updated, or deleted. Manage them in project settings.

  • Auth: added SMS OTP sign-in through your own Twilio account, plus TOTP multi-factor authentication with recovery codes for your app's users. See Authentication.

  • Storage: public file URLs now support on-the-fly image transforms with width, height, format, quality, and fit.

  • Database: turn on pgvector from Project settings → Extensions. The SDK query builders add nearest() for vector similarity search and textSearch() for full-text search.

  • Studio account security: added authenticator-app (TOTP) two-factor authentication for Studio accounts, with:

    • recovery codes
    • a re-verification step before you disable 2FA or regenerate codes
    • a workspace-wide "require 2FA" policy
    • emails for security events

    2FA also applies when you sign in with Google, GitHub, or Apple.

  • Social sign-in: signing in to Studio with Google, GitHub, or Apple now links to an existing account that has the same verified email, instead of failing.

  • Team roles: workspace members are admins or developers, and you choose the role when you send an invite. The Admins page is now Members (/members). See Team & roles.

  • AI assistant: Studio has a built-in assistant, opened from the navigation bar. It answers questions about your projects and can make changes once you grant permission.

  • Connect: a Connect button on every project shows the project URL, the anon key, and quickstarts for Node.js, JavaScript, Flutter, REST, Postgres, the CLI, and MCP.

  • Migrations: the SQL editor has a new Migrations tab. See Migrations.

  • Support: you can open support tickets and follow them from the Support page in Studio.

  • Project Memory: a new Memory tab plus MCP tools keep a project's decisions, tasks, and session summaries so AI agents have that context across sessions.

  • Edge functions:

    • ORBITNEST_SERVICE_ROLE_KEY is no longer added to functions automatically. If a function needs privileged access, add the key as an environment variable. Projects that already had the variable keep it.
    • Invocation errors now keep their HTTP status. For example, a missing function returns 404 instead of 500.

  • Realtime: you can send the project API key in the WebSocket subprotocol or in a header instead of the URL.

  • Fixes: the SQL editor's safety check no longer flags keywords that appear inside string literals, and row edits now handle JSONB columns correctly.

  • Docs: the documentation now lives inside Studio at /docs.

  • Landing page: rebuilt the marketing landing page.

  • Published packages: the SDKs and tools are now on npm under the @orbitneststudio scope, and the Flutter SDK is on pub.dev as orbitnest_studio_flutter.

  • JavaScript SDK (new, 0.5.0–0.6.0 on npm): @orbitneststudio/js is a browser SDK with auth, a query builder, storage, realtime, and functions. It also supports full-text search, unwrap(), TOTP MFA, image transforms, nearest(), and SMS OTP. Version 0.6.0 adds MFA recovery codes.

  • Node.js SDK 0.7.0–0.12.0:

    • migration engine with rollback, generator, and seeding, plus type generation
    • textSearch() and unwrap() (0.7.0)
    • MFA and image transforms (0.8.0)
    • nearest() (0.9.0)
    • SMS OTP (0.10.0)
    • MFA recovery codes (0.11.0)
    • migrations.reset() (0.12.0)

  • CLI (new, 0.1.0–0.5.0): @orbitneststudio/cli covers sign-in, projects, link, migrations, type generation, and SQL. Later versions add:

    • db reset (0.2.0)
    • webhook and SMS commands (0.3.0)
    • 2FA sign-in (0.4.0)
    • db diff schema drift detection (0.5.0)

    See CLI.

  • MCP server 1.0.1–1.3.0:

    • security fixes, and refresh tokens are now persisted so sessions don't drop (1.0.1–1.0.2)
    • migration tools and tools for webhooks, SMS, and Postgres extensions (1.1.0)
    • 2FA sign-in (1.2.0)
    • a fix for credentials files from older versions (1.2.1)
    • Project Memory tools (1.3.0)

  • Flutter SDK 1.3.0–1.6.2:

    • TOTP MFA, SMS OTP sign-in, and vector search (1.3.0)
    • MFA recovery codes (1.4.0)
    • a storage client with image transforms (1.5.0, the first pub.dev release)
    • wider dependency support (1.5.1)
    • the MFA challenge is now returned at sign-in (1.6.0)
    • fixes for users being signed out after a cold restart (1.6.1, 1.6.2)

May 2026

  • Analytics: added SDK analytics (events, screens, and crashes) with an Analytics tab that updates live over WebSocket. A Web Analytics dashboard adds geographic breakdowns. Supported in the Node.js SDK (AnalyticsClient, analyticsToken), the Flutter SDK, and the MCP server.
  • Email marketing: send broadcast emails to segmented audiences.
  • Sign in with Apple: available for Studio accounts and as a provider for your project's users. You upload the .p8 key file in settings.
  • CORS: set allowed origins for each project under Project settings → App URLs.
  • Database: signed-in users can update and delete rows through the client API, subject to RLS.
  • Security: a security review led to these changes:
    • PKCE for OAuth flows
    • SSRF hardening for fetch in edge functions
    • an origin allow-list for WebSocket connections
    • stricter rate limits on auth endpoints
    • user verification is required when registering a passkey
  • Node.js SDK 0.5.0–0.6.1:
    • only apiKey is required, and the project slug is read from the key; adds a realtime WebSocket client (0.5.0)
    • $1/$2 parameter binding for raw SQL (0.6.0)
    • storage URL fixes (0.6.1)
  • Flutter SDK: fixed a deadlock when signing out during a token refresh, and fixed token refresh after an iOS app resumes.

April 2026

  • Background jobs: run cron jobs with IANA timezones, timeouts, and run history, and manage them in Studio.
  • Realtime: stream Postgres changes, broadcast messages, and track presence over WebSockets. Studio has a new Realtime tab.
  • Passkeys: WebAuthn sign-in and sign-up for Studio accounts and for your app's users.
  • Workspaces: added organizations, workspace onboarding, and invitation links for teammates.
  • Social login: added Google and GitHub sign-in for Studio accounts, and per-project Google and GitHub OAuth settings for your app's users.
  • Auth: added password recovery for your app's users. Verification codes are now 4 digits.
  • Email templates: customize each project's verification, password reset, and welcome emails with a WYSIWYG editor, starter designs, and a brand color.
  • Email API: send email from your backend using a service-role key.
  • Plans: introduced subscription plans, project limits, and upgrade prompts. Billing ran on RevenueCat until the June move to Stripe.
  • SQL editor: redesigned with auto-saved and pinnable queries and a fullscreen editor. Also new: Spotlight search (⌘K) and a horizontal navigation bar.
  • Tables: added a schema diagram (ERD) view and redesigned the table editor.
  • Projects: you can upload a PNG or SVG logo for each project.
  • Landing page: launched a new marketing landing page with a /docs section.
  • Security: API keys are now decrypted only on the server, and responses send an HSTS header.
  • Edge functions: fetch can now return binary responses.
  • SDKs:
    • The Node.js SDK adds passkeys (0.3.0–0.4.0), JobsClient, and RealtimeClient.
    • The Flutter SDK adds passkeys, background jobs, and realtime.
    • The MCP server adds background job and realtime tools, plus configurable function timeouts.

March 2026

  • Settings: new workspace settings page with SMTP, general, security, and account sections.
  • Edge functions: functions now run in an isolated V8 sandbox.
  • Database: the service_role key bypasses RLS, and SQL parameters are passed as bound values.
  • Storage: the anon key can read and download files, buckets are isolated per project, and service_role can create public buckets.
  • Auth: added a token verification endpoint and rate limiting on auth endpoints.
  • Flutter SDK: 1.0.10 reads the project slug from the anon key and fixes the Android emulator base URL. verifyToken() and decodeToken() are also new.

February 2026

  • MCP server 1.0.0: manage projects, tables, functions, and more from Claude and other MCP clients. See MCP server.
  • Auth: added token refresh, sign-out, and sign-out-everywhere endpoints, and profile updates with PUT /auth/user.
  • Edge functions: functions receive the calling user's JWT context.
  • Flutter SDK: 1.0.9 adds automatic token refresh and retries with exponential backoff. Configuration now needs only the anon key.

January 2026

  • Edge functions: console output is captured and shown in Studio.
  • SQL editor: replaced the editor with a lighter, faster one.

December 2025

  • Edge functions: rewrote the runtime. TypeScript is now compiled with the TypeScript compiler, functions have invoke endpoints, and ORBITNEST_ANON_KEY is added automatically. Studio adds an environment variables tab, a response viewer, and a log viewer.
  • Database: added a client-facing table API that authenticates with API keys, and filters for table data queries.
  • Storage: you can delete buckets, and uploads can be up to 50 MB.
  • Email: added SMTP settings for each project.

November 2025

  • Projects: each project is provisioned with its own PostgreSQL database and credentials, with encrypted API keys and isolation between projects.
  • Storage: added buckets and file management, with a Storage page in Studio.
  • SQL editor: run SQL against a project and see your SQL history.
  • Debug mode: added a per-project debug mode for testing auth flows.
  • Node.js SDK 0.1.0: first version, with database, auth, storage, logging, and environment variables.

August 2025

  • Flutter SDK 1.0.0–1.0.8: first versions, with auth (including OTP verification), database queries, and edge functions.

July 2025

  • First release: the first version of Studio and the API, with projects, Studio sign-in, project auth, API keys, edge functions, and environment variables.