Moltaro 0.0.65-beta

Release date: 2026-09-15

Teams can upload files directly into records, browse large file folders in pages, and keep working while collaboration content refreshes. Workflow authors gain an editable process designer with outcomes and interaction-node settings. File Protection adds an Owner recovery kit for restoring retained files without Moltaro services. Workspace UI improvements preserve form changes, table configuration and reference-selection context.

Highlights

• Upload attachments without a comment, and upload directly into File fields and table-row File fields independently of the optional file catalogue.
• Search and page through large folders in the file browser and catalogue selectors without loading every file into the browser.
• Design Workflow drafts with multiple outcomes, Delay, DevLog and User Input nodes, editable connections and saved layout. Process execution is not yet available.
• Prepare retained File Protection history for independent recovery, then export an Owner kit for the Windows or Linux Restore utility.
• Use more reliable form recalculation, stable table columns and a supported reference picker in Workspace UI projects.

Detailed changes

Files and collaboration

The Files view makes upload from the computer the primary action. A comment is optional, and sending files keeps the Files view selected. Record details and drawers share this behavior. File fields, including fields inside table rows, also accept direct uploads for existing records and new drafts. Preview opens above the edit form and preserves unsaved values when closed.

Direct field uploads support the configured S3, Database or LocalFileSystem storage provider. Record and field permissions, file inspection and upload limits still apply. Upload completion makes the file available; the ordinary record save assigns it to the field. Existing file references remain usable.

The file catalogue has its own switch in file-system settings. Disabling it hides catalogue entry points and prevents catalogue selection, while authorized direct attachments and field uploads remain available. Existing installations keep the catalogue enabled unless an existing module setting says otherwise.

The file browser and both catalogue selectors use server-side filename and description search with 50-file pages. The browser renders only visible rows or cards. Changing folder, search or page clears browser selection; batch actions apply to the current page. The existing folder-files array API remains available to integrations.

Background collaboration refreshes no longer flash loading indicators or disable reading controls. Temporary refresh failures preserve displayed content. Explicit refresh and navigation still show loading and errors; loss of access or removal of the resource clears content and reports the failure.

Workflow authoring

Workflow revisions now open in a fullscreen designer. Authors can edit Draft graphs, save incomplete work, undo or redo changes, navigate to nodes, and configure connection anchors, input points and route waypoints. Layout and viewport are saved with the revision. Automatic routing and explicit route editing support cycles and backward connections. Published revisions remain read-only; save conflicts preserve the local draft.

Each new Workflow Definition receives a protected completed outcome. Authors can add business outcomes classified as Success, Failed or Canceled and assign them explicitly to End nodes. Referenced outcomes cannot be deleted; first use locks an outcome key, and published use also locks its classification.

Delay nodes accept a duration. DevLog nodes support a message template and log level. User Input nodes support ordered choices and separate responsibility, inherited-permission or DSL admission settings. Validation distinguishes an unfinished Draft from a publishable graph and identifies the node or setting that needs attention. Publication requires complete settings, reachable nodes and a path to an End with a valid outcome.

Definition previews now link to the active revision, latest Draft and declared Entity or Board context. These features configure processes only: activation, durable waits, admission decisions for running processes, response acceptance and execution logging remain future work.

File Protection

An active Owner can register separate customer S3 credentials, prepare retained history and download a permanent recovery kit. The Restore utility can then discover and restore retained files directly from the bound S3 storage without the Moltaro API, Portal, Gateway, SSO or a license check. Existing temporary, revocable Gateway configurations remain supported for delegated restores.

The kit includes the recovery material needed to discover later Sources and backups while its credentials remain valid. It does not extend retention or recover versions already removed from storage. Credential replacement requires a newly downloaded kit. Preparation adds portable recovery metadata; it does not move or re-encrypt backup payloads.

An unused installation can import a kit’s recovery identity, or import its catalogue for recovery-only access. Catalogue import does not resume backup schedules or turn the destination into a writable replacement installation.

File Protection also distinguishes unconfigured schedules from disabled ones, labels the source computer and local configuration more clearly, and explains waiting budgets and empty history without suggesting that a completed run is still waiting.

Workspace UI and integrations

Table configuration saves preserve the identities of retained direct and projected columns. Both kinds use one author-defined order in native tables and lookups. The Constructor exposes incompatible renderers for explicit repair and preserves the repair draft after an error. Field deletion is blocked when the field participates in an Entity or table-surface sort, including an intermediate reference-path segment.

Forms and Association creation keep changed-field triggers until the matching evaluation succeeds. Rapid edits, cancelled requests and failed evaluations therefore do not lose the changes needed for recalculation. A successful retry clears the previous evaluation error while preserving other feedback. This does not establish a fix for the previously reported long-running requests and 504 responses, which were not reproduced under the recorded conditions.

Workspace UI projects can use MoltaroReferencePickerDialog from @moltaro/ui for scalar saved-Form Lookup and Generic selection. It uses native tables, search, filters, sorting and paging, resolves the selected value beyond the current page, and respects server eligibility and stale-context errors. List and LongList remain bounded controls: use Lookup to browse a larger catalogue. The public wrapper does not support multiple selection, inverse references, standalone Hierarchy inputs or table-filter contexts.

Attached nested controls retain their page context, and confirmation dialogs return keyboard focus to their opener. Custom grids can read structural sort state through getColumnState().

The installation’s agent-integration endpoint now reports ProductVersion, BuildId and an optional version-specific release-note link. Integrations can distinguish the installed runtime from the public documentation version. Unstamped source builds report null instead of guessing a release. Entity lifecycle and reference-candidate validation now identify invalid fields more precisely, including required reasons, page numbers and page sizes.

Database and upgrade impact

This release changes both Workspace and Portal databases and adds persisted File Protection recovery metadata and Workflow outcomes. It also updates upload-session storage support and preserves existing file-catalogue enablement. Existing files and backup payloads are not relocated by these automatic migrations.

Schedule a maintenance window for sequential Managed App replacement and database migration. Interruption depends on each installation’s size and readiness; no measured production downtime is available for this release. Verify database backups and the separately retained file bodies, protection storage and key material required by the installation’s recovery procedure. A database-only backup does not contain external file bodies.

Do not assume a runtime-only downgrade is safe after the upgrade. Older code cannot represent the new Workflow documents or Database/LocalFileSystem field upload sessions, and reversing the recovery schema removes recovery metadata. Use the verified pre-upgrade recovery procedure if rollback is required; keep independent recovery kits and retained storage available.

Upgrade issue requiring resolution: existing managed File Protection repositories have a migration initialization defect that can make subsequent repository validation and recovery-access setup fail. A corrected, validated source revision is required before promoting an affected installation. Existing Workflow definitions also require an inventory and an approved handling plan; their older process format and missing default outcomes are not automatically converted by this release.

Deployment and operator actions

• Workflow: ReplaceRuntime. Managed Apps receive a full replacement of WebApp, Api and Worker, rather than an update package. FromVersion is not applicable. The normal replacement workflow also delivers the matching Portal, signer, router, Runtime VM agent and packaged recovery tools.
• Resolve the File Protection upgrade issue and establish how any existing Workflow definitions will be handled before promotion. Preserve original revisions and recovery data. Product fixes require a new inventory boundary and regenerated notes.
• Verify backups, complete the normal all-application compatibility preflight, and check the final version, image identity, routes and service health for every intended Managed App.
• After delivery, run Check → Build → Activate for affected Workspace UI projects and fully reload the browser. Their host-contract fingerprint has changed even though the contract version remains 1. Existing custom code must explicitly adopt the new picker and attach overlays to its page target.
• Repair existing invalid renderers and sort references through supported configuration commands. Preserve the full original table configuration, review the repair and read it back after saving. Personal column order takes precedence over author order; reset the personal setting when checking the new author order. No automatic repair of earlier customer configurations is included.
• For permanent File Protection recovery, create distinct customer S3 access, have the Owner upload it, and retain the Recovery Preparation tool’s inventory, prepare and verify reports. Export the kit only with complete retained-history coverage. Store it securely with a compatible offline Restore utility. Keep credentials and kits out of diagnostic reports.
• Customer importer activation and any approved removal of legacy catalogue membership are separate operations. Finish old importer executions first. The prepared folder-detachment procedure is specific to its named customer; it is not a general migration or part of automatic runtime replacement.

Post-deploy customer scenarios

1. Under an ordinary authorized role, open a test record, upload an attachment from the computer without a comment, and confirm the Files view remains selected. In a new record draft, upload both a scalar File and a table-row File, preview one without losing another unsaved field, save and reopen the record, then download both files and compare their sizes and SHA-256 values. Repeat in an approved fixture with the catalogue disabled and at 375px. Check that background collaboration refresh preserves the displayed content and usable controls.
2. In a large authorized folder, search for a known file beyond the first page, select it in a catalogue picker, and verify paging and current-page batch selection. In an affected Workspace UI form, rapidly change a driver reference, retry a failed evaluation, and confirm the saved values match the latest draft. Verify picker eligibility and stale-context handling.
3. With Workflow configuration permissions, create a test Definition and Draft, configure Start → Delay → DevLog → User Input → End, assign an outcome and move a connection waypoint. Save incomplete work, observe the publication diagnostic, complete it and publish. Reopen the published revision read-only and confirm its content and layout. This checks authoring, not execution.
4. Select one retained file from a backup created before this release. Restore it with Temporary access through Gateway into a new local destination. Restore the same file with the Owner kit while the Permanent Restore process can reach only its S3 endpoint. Compare both outputs’ sizes, SHA-256 values and content. Keep production services running and preserve original backups. Complete coverage alone is not proof that this recovery scenario passed.

Compatibility and breaking changes

• Workflow Engine and Workflow SDK advance from 2.3.0 to 3.2.0, and process documents use YAML version 2 with explicit End outcomes. Format 1 is rejected; existing documents are not rewritten. The End-node constructor and authoring contracts have changed. Rebuild affected C# extensions against the delivered contracts and resolve existing-definition handling before upgrade.
• Rebuild and reactivate Workspace UI artifacts against the new fingerprint; a matching host-contract version alone is insufficient.
• The folder-files array response is preserved. The new paged endpoint uses Page, PageSize and Search; its page size is clamped to 1–100. Entity reference-candidate pages instead require 1–250 and reject invalid values.
• Entity archive, restore and permanent-delete commands retain their required trimmed reason of 1–1000 characters. Clients should handle the new specific validation codes and field paths, and the API error envelope on the selected malformed-body paths. Existing successful command shapes are preserved.
• IFileFieldService adds explicit field-upload support for hosted C# functions and Jobs. Uploads run outside an ambient package transaction and do not save the Entity field themselves. An exact retry reuses its identity; different content requires a new reference. Upload clients must allow a null FileBodyGenerationId for Database/LocalFileSystem field sessions.
• Existing Temporary Restore commands remain supported. Permanent recovery needs the compatible utility, an exported kit, valid separate S3 credentials and retained object versions. Replacing credentials does not automatically revoke an already distributed kit’s old provider access.
• The internal full /openapi/v1.json export has a recorded File Protection multipart-action failure. Use the installation’s documented Runtime and Configuration profiles; this release does not claim that the full internal export has been repaired.