Ironflow v0.47.0

Ironflow v0.47.0 adds deployments, capacity, debounce, definition history and executeSQL to the Go, Node and browser SDKs, and fixes a batch of SDK decoding bugs found by proving every readiness row end to end. It also closes a tenant-isolation hole: only the bootstrap organization’s admin can now list and provision tenants.

Breaking Changes

• Tenants: GET /api/v1/tenants and POST /api/v1/tenants/provision return 403 to an admin of any organization other than org_default. They need the instance-scoped platform:tenants:read / platform:tenants:manage. The bootstrap admin key and ironflow tenant provision keep working (#2945)
• Python SDK: debounce_delete_entries now base64url-encodes the key. Pass the raw key; if you encoded it yourself, stop, or it is encoded twice (#2948)
• Node SDK: getAuditTrail returns AuditTrailResult, getStepOutputAt returns TimeTravelStepOutputSnapshot, getRunStateAt returns TimeTravelRunStateSnapshot. The old types stay exported but are deprecated (#2942)
• Go SDK: Output, Error and OriginalOutput on time-travel step snapshots, and Input on the run-state snapshot, are now json.RawMessage instead of a base64 string (#2942)
• @ironflow/core: ConfigWatchEvent.data is now Record<string, unknown> | null, because config deletes send null (#2949)

Features

• Go and Node SDKs: register, get and list a function’s deployments, and read its execution routing (#2948)
• Go and Node SDKs: capacity views (lanes, queue, leases, buckets, sessions, credits, stats) and debounce list/cancel. Capacity needs an ifplatform_ key (#2948)
• Go, Node and browser SDKs: list and get archived projection and event schema definitions by revision (#2948, #409)
• Browser SDK: executeSQL(query, options?) runs a read-only query against projection tables (#2948)
• REST reference documents POST /cluster/rotate-token, the OpenAPI spec’s scope, and the KV and config watch streams (#2947, #2949)

Fixes

• Tenancy: every user can change their own password; PATCH /api/v1/users/{id}/password now costs users:password (admin, developer and viewer hold it). A custom role needs it granted (#2945)
• Go, Node and browser SDKs: CreateOrganization / orgs.create calls POST /api/v1/platform/orgs with a platform credential instead of the route that always returned 403 (#2945)
• Node users.* and tenants.list, and browser tenants.list, fill every field (#2945)
• Time travel finds a step by the name the code used (charge, not {runId}:charge:0); the full key still works (#2942)
• Go and browser SDKs: GetAuditTrail fills every event field and paging works. Node getAuditTrail no longer always returns [] (#2942)
• Browser SDK: time-travel output with non-ASCII text decodes correctly (#2942)
• Go, Node and browser SDKs: consumer group update works against a real server, and TestUpcast returns the version chain (#2943)
• Go SDK: an idle KV or config watch no longer panics after one quiet second (#2949)
• Node and browser SDKs: a KV watch reports the server’s error; Node config watch authenticates like KV watch (#2949)
• Go and Python SDKs: a KV watch delete has no value (nil / None) (#2949)
• Config updatedAt is UTC, and the browser config watch sees deletes (#2949)
• A dashboard_jwt_secret rotation reaches platform login and survives a restart (#2947)
• A circuit-breaker reset lets held runs start at once instead of waiting for the 30-second sweep (#2946)
• Dashboard and CLI: the Webhook Deliveries page and ironflow webhook deliveries --status drop the always-empty “deduplicated” filter (#2933)
• Node SDK: a streaming projection keeps the stream’s own error when the final save also fails
• @ironflow/langgraph: pending writes come back in LangGraph’s replay order
• @ironflow/agent: an installed agent no longer falls back to the project’s own .agents/skills
• Browser SDK: the offline queue logs why a drain failed

Improvements

• ironflow version says which skills are stale and against what version

Other

• Docker binary builds use -trimpath (#2953)
• Circuit breaker guide corrected against the code (#2961)