sdk/v2.23.0

## 🌟 Highlights

- The `twenty-client-sdk` core and metadata modules are now served at content-addressed URLs, letting browsers cache them indefinitely and eliminating a full re-fetch on every render. ([#22981](https://github.com/twentyhq/twenty/pull/22981))
- Non-admin developers can now claim ownership of their published npm apps and submit them for marketplace review directly from the Developer tab using GitHub OAuth. ([#22621](https://github.com/twentyhq/twenty/pull/22621))
- Two new `ViewType` enum values — `KANBAN_WIDGET` and `CALENDAR_WIDGET` — are now available alongside `TABLE_WIDGET` for dashboard view widgets. ([#22963](https://github.com/twentyhq/twenty/pull/22963))
- A new `twenty-sdk` environment variable lets you disable the provenance check, unblocking local development and CI workflows without npm provenance metadata. ([#23155](https://github.com/twentyhq/twenty/pull/23155))

## ✨ New features

- Non-admin developers can claim an unclaimed npm app from the Developer tab via GitHub OAuth against npm provenance, then submit it for marketplace review by a server admin. ([#22621](https://github.com/twentyhq/twenty/pull/22621)) by @martmull
- Two new `ViewType` values — `KANBAN_WIDGET` and `CALENDAR_WIDGET` — are available for dashboard view widgets alongside the existing `TABLE_WIDGET`. ([#22963](https://github.com/twentyhq/twenty/pull/22963)) by @FelixMalfait

## 💅 Improvements & UX

- Default relations (`timelineActivities`, `attachments`, `noteTargets`, `taskTargets`) are now owned by the metadata engine — the SDK manifest builder no longer provisions them, ensuring consistent behavior across all callers. ([#22882](https://github.com/twentyhq/twenty/pull/22882)) by @prastoin

## 🐛 Bug fixes

- Users with the API keys & webhooks permission but not Roles can now create API keys — a new `getApiKeyRoles` query returns only the roles they may assign, fixing a previously unsavable form. ([#23102](https://github.com/twentyhq/twenty/pull/23102)) by @ijreilly

## ⚡ Performance

- `twenty-client-sdk` module URLs now embed a SHA-256 checksum, making them content-addressed; browsers cache them as immutable resources and skip the network on subsequent renders. ([#22981](https://github.com/twentyhq/twenty/pull/22981)) by @prastoin

## 🔧 Developer & API

- SDK app builds now copy logic-function and front-component source files into the build output alongside compiled artifacts; the install path uses the same file list, with optional source files skipped gracefully. ([#22991](https://github.com/twentyhq/twenty/pull/22991)) by @Weiko
- A new environment variable in `twenty-sdk` disables the provenance check, useful for local builds or CI pipelines where npm provenance metadata is absent. ([#23155](https://github.com/twentyhq/twenty/pull/23155)) by @prastoin

<details>
<summary>🏗️ Internal changes (4)</summary>

- Add mostly-empty field hints to data model settings ([#22962](https://github.com/twentyhq/twenty/pull/22962)) by @FelixMalfait
- Add auto-upgrade-in-apps ([#23001](https://github.com/twentyhq/twenty/pull/23001)) by @martmull
- feat(email-group): communications UX, per-record DNS status ([#23002](https://github.com/twentyhq/twenty/pull/23002)) by @neo773
- chore: bump npm packages to 2.23.0-alpha.1 ([#23084](https://github.com/twentyhq/twenty/pull/23084)) by @prastoin

</details>

## 🎉 New contributors

- @admin-laicadev made their first contribution in https://github.com/twentyhq/twenty/pull/22880
- @nicoko93 made their first contribution in https://github.com/twentyhq/twenty/pull/22877
- @Gautam5514 made their first contribution in https://github.com/twentyhq/twenty/pull/22496
- @winklemad made their first contribution in https://github.com/twentyhq/twenty/pull/23010

<details>
<summary>Full changelog (12 PRs)</summary>

- feat(app): allow non-admin developers to claim and list marketplace apps ([#22621](https://github.com/twentyhq/twenty/pull/22621)) by @martmull
- System side effect relations ([#22882](https://github.com/twentyhq/twenty/pull/22882)) by @prastoin
- Add mostly-empty field hints to data model settings ([#22962](https://github.com/twentyhq/twenty/pull/22962)) by @FelixMalfait
- feat: kanban, calendar and group-by table layouts for dashboard view widgets ([#22963](https://github.com/twentyhq/twenty/pull/22963)) by @FelixMalfait
- chore: bump version to 2.23.0 ([#22975](https://github.com/twentyhq/twenty/pull/22975)) by @twenty-pr
- Cache twenty-client-sdk modules host-side via content-addressed URLs ([#22981](https://github.com/twentyhq/twenty/pull/22981)) by @prastoin
- Copy application source files during build and install ([#22991](https://github.com/twentyhq/twenty/pull/22991)) by @Weiko
- Add auto-upgrade-in-apps ([#23001](https://github.com/twentyhq/twenty/pull/23001)) by @martmull
- feat(email-group): communications UX, per-record DNS status ([#23002](https://github.com/twentyhq/twenty/pull/23002)) by @neo773
- chore: bump npm packages to 2.23.0-alpha.1 ([#23084](https://github.com/twentyhq/twenty/pull/23084)) by @prastoin
- Fix: allow API key creation without Roles permission ([#23102](https://github.com/twentyhq/twenty/pull/23102)) by @ijreilly
- twenty-sdk env var to disable prov check ([#23155](https://github.com/twentyhq/twenty/pull/23155)) by @prastoin

</details>

**Full Changelog**: https://github.com/twentyhq/twenty/compare/sdk/v2.22.0...sdk/v2.23.0