@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/user-data-rights/schema/export-job.d.ts

@@ -23,6 +23,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -43,6 +44,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -71,7 +73,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
             readonly running?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -130,6 +132,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -195,6 +198,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -215,6 +219,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -243,7 +248,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
             readonly running?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
         } | undefined;
         readonly optionsQuery?: string;
-        readonly optionsQueryPayload?: Readonly<Record<string, string | number | boolean>>;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -302,6 +307,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -1,6 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { assertErased } from "../../shared/index.js";
 const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
@@ -222,7 +223,9 @@ export const fileRefDeleteHook = async (ctx, strategy) => {
     if (storageProvider) {
         const failedKeys = await deleteBinaries(personalRows, storageProvider);
         if (failedKeys.length > 0) {
-            throw new Error(`[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`);
+            throw new InternalError({
+                message: `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
+            });
         }
     }
     else {

package/dist/user-profile/feature.js

@@ -42,6 +42,9 @@ export function createUserProfileFeature() {
                 "profile.email.title": { en: "Email address" },
                 "profile.password.title": { en: "Password" },
                 "profile.danger.title": { en: "Delete account" },
+                "profile.danger.explainer": {
+                    en: "Your account will be permanently deleted after a grace period. Until then you can cancel the deletion at any time.",
+                },
                 "profile.danger.gracePeriodEnd": { en: "Deletion date" },
                 "profile.danger.delete": { en: "Delete account" },
                 "profile.danger.dialogDescription": {
@@ -94,7 +97,7 @@ export function createUserProfileFeature() {
                     },
                     {
                         title: i18nKey("profile.danger.title"),
-                        description: "profile.danger.explainer",
+                        description: i18nKey("profile.danger.explainer"),
                         // gracePeriodEnd is only meaningful once a deletion is actually
                         // pending — hide it instead of showing an empty date when status
                         // isn't deletionRequested (same rule as privacy-center).
@@ -123,6 +126,8 @@ export function createUserProfileFeature() {
                     handler: UserDataRightsHandlers.cancelDeletion,
                     visible: { field: "status", eq: "deletionRequested" },
                     style: "secondary",
+                    // Declared: the id's last segment ("deletion") would otherwise resolve to the destructive trash icon.
+                    icon: "x",
                 },
             ],
         });

package/dist/user-profile/handlers/change-email.write.js

@@ -33,6 +33,8 @@ export const changeEmailWrite = defineWriteHandler({
             "email uniqueness the same way, and writes the new email via ctx.writeAs(SYSTEM, " +
             "user:update) — field-access on passwordHash/email is privileged-only.",
     },
+    // Payload carries the current password.
+    agent: { expose: false },
     description: "Replaces the signed-in caller's own email address after re-checking their current password, refusing an unchanged or already-taken address and clearing the verified flag so the app can re-run email verification.",
     handler: async (event, ctx) => {
         const systemUser = createSystemUser(event.user.tenantId);

package/dist/workflow-runner/db/queries/due-runs.js

@@ -1,12 +1,9 @@
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-// Standalone statement (no db.begin) — FOR UPDATE SKIP LOCKED only
-// needs to survive this one SELECT to reduce redundant dispatches
-// under true concurrency; it auto-commits and releases the row locks
-// immediately after. The real correctness guarantee is resume-run's
-// VersionConflictError-checked claim (ctx.tryAppendEvent on
-// WORKFLOW_RESUMED) — a second dispatch for the same row just loses
-// that race and no-ops, same as the sample this was adapted from.
+// Dedup happens solely via resume-run's VersionConflictError-checked claim
+// (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
+// row loses that race and no-ops. No row locks: in an autocommit statement
+// they would be released right after the SELECT and guard nothing.
 export async function selectDueWorkflowRunPending(db, tenantId) {
-    // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup with FOR UPDATE SKIP LOCKED
-    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now() FOR UPDATE SKIP LOCKED`, [tenantId]));
+    // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup
+    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now()`, [tenantId]));
 }

package/dist/workflow-runner/event-subscriber.js

@@ -25,21 +25,41 @@
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { evaluateEventMatch } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { workflowRunPendingTable } from "./tables.js";
+const log = createFallbackLogger("workflow-runner");
+// A row whose persisted matchExpr cannot be evaluated (unknown version from a
+// rolling deploy, corrupt AST) must not abort the whole projection: that would
+// block every other waiting run of this event type on the same event forever.
+function rowMatchesEvent(row, eventType, payload) {
+    if (!row.matchExpr)
+        return true;
+    try {
+        return evaluateEventMatch(
+        // @cast-boundary engine-payload — matchExpr round-trips through
+        // jsonb as the EventMatch AST waitForEvent's `match` resolver
+        // persisted (see steps/wait-for-event.ts); evaluateEventMatch
+        // rejects a malformed shape itself.
+        row.matchExpr, payload);
+    }
+    catch (error) {
+        log.error("workflow wakeup skipped a pending row with an unevaluable matchExpr", {
+            runId: row.runId,
+            stepIndex: row.stepIndex,
+            eventType,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return false;
+    }
+}
 const wakeupApply = async (event, tx) => {
     const rows = await selectMany(tx, workflowRunPendingTable, {
         tenantId: event.tenantId,
         waitEventType: event.type,
     });
     for (const row of rows) {
-        const matches = row.matchExpr
-            ? evaluateEventMatch(
-            // @cast-boundary engine-payload — matchExpr round-trips through
-            // jsonb as the EventMatch AST waitForEvent's `match` resolver
-            // persisted (see steps/wait-for-event.ts); never an unchecked
-            // external value.
-            row.matchExpr, event.payload)
-            : true;
+        const matches = rowMatchesEvent(row, event.type, event.payload);
         // skip: this row's matchExpr rejected the event — not this row's
         // resume, leave wakeAt/triggerEventType untouched.
         if (!matches)
@@ -47,7 +67,7 @@ const wakeupApply = async (event, tx) => {
         await updateMany(tx, workflowRunPendingTable, {
             triggerEventType: event.type,
             triggerPayload: event.payload,
-            wakeAt: Temporal.Now.instant().toString(),
+            wakeAt: getTemporal().Now.instant().toString(),
         }, { tenantId: row.tenantId, runId: row.runId, stepIndex: row.stepIndex });
     }
 };

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -36,7 +36,7 @@ import { workflowRunPendingTable } from "../tables.js";
 import { getWorkflow } from "../workflow-registry.js";
 const log = createFallbackLogger("workflow-runner");
 const resumeRunSchema = z.object({
-    runId: z.string().min(1),
+    runId: z.string().uuid(),
     stepIndex: z.number().int().nonnegative(),
 });
 async function appendRunFailed(ctx, runId, failedPayload) {
@@ -170,16 +170,19 @@ export const resumeRunHandler = {
             return { isSuccess: true, data: { outcome: "already-resumed" } };
         }
         const { workflowName } = pending;
+        const runEvents = await ctx.loadAggregate(runId);
+        // Before the workflow resolution: a racing tick on an already-settled run
+        // must not append run-failed after run-completed when the definition has
+        // since changed or been removed.
+        if (isRunAlreadySettled(runEvents, stepIndex, pending.retryAttempt ?? undefined)) {
+            return { isSuccess: true, data: { outcome: "already-resumed" } };
+        }
         const resolved = resolveRunnableWorkflow(workflowName, runId, stepIndex, pending.definitionFingerprint);
         if (resolved.failure !== null) {
             await appendRunFailed(ctx, runId, resolved.failure);
             return { isSuccess: true, data: { outcome: "failed" } };
         }
         const workflow = resolved.workflow;
-        const runEvents = await ctx.loadAggregate(runId);
-        if (isRunAlreadySettled(runEvents, stepIndex, pending.retryAttempt ?? undefined)) {
-            return { isSuccess: true, data: { outcome: "already-resumed" } };
-        }
         const claim = await ctx.tryAppendEvent({
             aggregateId: runId,
             aggregateType: WORKFLOW_AGGREGATE_TYPE,

package/dist/workflow-runner/pending-projection.js

@@ -11,10 +11,17 @@
 // No resume logic here — framework#2513 Phase 2 owns the job that reads
 // this table and dispatches the actual resume. This projection only writes
 // the rows.
-import { deleteMany, upsertOnConflict } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/bun-db";
 import { WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WORKFLOW_WAITING_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
 import { workflowRunPendingTable } from "./tables.js";
 async function upsertPending(tx, row) {
+    // At-least-once redelivery of a suspension event after the event-subscriber
+    // already matched a trigger onto this row must not reset wakeAt/trigger —
+    // the run would sleep until timeout and lose the matched payload.
+    const existing = await fetchOne(tx, workflowRunPendingTable, { tenantId: row.tenantId, runId: row.runId, stepIndex: row.stepIndex });
+    // skip: row already carries a trigger event type, keep it on redelivery
+    if (existing?.triggerEventType != null)
+        return;
     await upsertOnConflict(tx, workflowRunPendingTable, {
         ...row,
         // Phase 3's event-subscriber writes these when the awaited event

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.333.0",
+  "version": "0.335.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,18 +483,20 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.333.0",
-    "@cosmicdrift/kumiko-framework": "0.333.0",
-    "@cosmicdrift/kumiko-headless": "0.333.0",
-    "@cosmicdrift/kumiko-renderer": "0.333.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.333.0",
-    "@cosmicdrift/kumiko-types": "0.333.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.335.0",
+    "@cosmicdrift/kumiko-framework": "0.335.0",
+    "@cosmicdrift/kumiko-headless": "0.335.0",
+    "@cosmicdrift/kumiko-renderer": "0.335.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.335.0",
+    "@cosmicdrift/kumiko-types": "0.335.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
+    "hono": "^4.13.1",
     "imapflow": "^1.7.8",
+    "ioredis": "^5.10.1",
     "jose": "^6.2.3",
     "lucide-react": "^1.14.0",
     "mailparser": "^3.9.32",
@@ -983,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.333.0",
-    "@cosmicdrift/kumiko-locale-es": "0.333.0",
+    "@cosmicdrift/kumiko-locale-de": "0.335.0",
+    "@cosmicdrift/kumiko-locale-es": "0.335.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/agent-tools/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Manifest rejects unknown denyQns, drops navs under hidden parents; doc lint flags blank and exposed-undescribed handlers",
+    "detail": "Agent tools: `buildAgentManifest` now throws when `denyQns` names a handler that is not registered, so a typo can no longer leave a handler exposed. Navs whose parent is hidden from the role are dropped from the manifest, and screens reachable only through them are no longer listed. The agent doc lint reports handlers that are exposed without a description and treats a blank description as a gap.",
+    "migration": "`buildAgentManifest` now throws when `denyQns` names a handler that is not registered; remove stale or misspelled entries from your `denyQns` lists."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Agent doc lint reports exposed handlers with a non-convertible input schema"
+  },
   {
     "version": "0.313.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Credential-carrying auth handlers are hidden from the agent catalog; additionalAssignableRoles rejects framework-ranked roles",
+    "detail": "The credential-carrying handlers `auth-email-password:login`, `change-password`, `user-profile:change-email`, `auth-mfa:verify` and `auth-mfa:enable-confirm-preauth` are now opted out of the agent tool catalog with `agent: { expose: false }`, so passwords, TOTP codes and setup tokens no longer reach an LLM transcript. `invite.additionalAssignableRoles` now throws at construction when it lists a framework-ranked role such as `TenantAdmin`, instead of silently disabling the elevation guard for it."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Invite accept handles MFA responses, bootstrap error screen offers Sign out",
+    "detail": "`InviteAcceptScreen` no longer redirects to a tenant URL when the accept route answers with an MFA challenge or setup requirement (no session cookie was minted); it sends the user to `loginHref` instead. `SessionBootstrapErrorScreen` accepts an optional `onSignOut` and the auth gate wires it, so a permanent bootstrap failure no longer traps the user behind \"Try again\" (new i18n key `auth.sessionBootstrap.signOut`). Cap bookings back off with a small random delay between version-conflict retries."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Ended session leads back to the login screen",
+    "detail": "When the server ends a session (revoked, expired), the app now shows the login screen with a short hint instead of a raw error banner. After signing in again the user lands on the same screen as before."
+  },
   {
     "version": "0.328.1",
     "type": "fix",

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "MFA web client shares the login response mapper",
+    "detail": "The MFA web client reuses the shared `toLoginResponse` helper (now exported from the auth-email-password web barrel) for `landingPath` handling, so login, MFA verify and MFA setup confirm map the response identically."
+  },
   {
     "version": "0.329.0",
     "type": "improvement",

package/src/billing-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Unregistered catalog.providerName fails unconfigured; switch-plan checks provider mismatch before lookup",
+    "detail": "`billing-plans` now fails with an `unconfigured` error when `catalog.providerName` names a provider that is not registered, instead of rendering billing as disabled. Billing renders as disabled only when no `providerName` is set and no provider is mounted. `switch-plan` answers a subscription on an unmounted provider with the `providerMismatch` conflict instead of a 500.",
+    "migration": "If `catalog.providerName` names a provider that is not mounted, billing-plans now fails with `unconfigured` instead of rendering billing as disabled; mount the provider or remove `providerName`."
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Cap helpers validate periodStartIso and amount, surface failed soft-warn writes; German column labels",
+    "detail": "`bookCapUsage` and `markCapSoftWarned` now reject a `periodStartIso` that is not an ISO instant with a validation error instead of silently forking a counter row or throwing a `RangeError`. `enforceCap` rejects a non-integer or non-positive `amount` instead of letting it bypass the cap. `enforceCapAndMaybeNotify` surfaces a failed soft-warn write instead of re-sending the notification on the next call. The cap-counter list now has German column labels.",
+    "migration": "`bookCapUsage` and `markCapSoftWarned` now reject a `periodStartIso` that is not a full ISO instant, including date-only strings like `2026-10-01`; pass e.g. `2026-10-01T00:00:00.000Z`."
+  },
   {
     "version": "0.317.0",
     "type": "fix",

package/src/cap-overview/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "tenant-caps:list validates cursor and filters, parallel usage reads; cap-counter list not searchable",
+    "detail": "`tenant-caps:list` now rejects a malformed pagination cursor and unsupported or repeated filters with a validation error instead of returning a wrong page or silently ignoring the filter, and loads per-tenant usage in parallel. The `cap-counter` operator list is no longer searchable, because search resolved against the caller's own tenant instead of all tenants."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Unlimited caps show a labelled usage count",
+    "detail": "The cap usage bar labels an unlimited cap as \"<used> · unlimited\" through the new `cap-overview.unlimited` key instead of a bare number. The German and Spanish catalogs ship the translation."
+  },
   {
     "version": "0.332.0",
     "type": "fix",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Explicit List-Unsubscribe headers replace the automatic pair case-insensitively",
+    "detail": "The email channel now matches explicit `data.headers` case-insensitively against the automatic unsubscribe headers. Overriding `List-Unsubscribe` or `List-Unsubscribe-Post` in any spelling drops the whole automatic pair, so a mail client no longer sends a one-click POST to a URL that cannot handle it."
+  },
   {
     "version": "0.321.0",
     "type": "improvement",

package/src/config/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "config:write:set masks the echoed value for encrypted-at-rest keys; validation errors no longer include the value",
+    "migration": "A caller that reads `data.value` from a `config:write:set` result for a key with `encrypted: true` or `backing: \"secrets\"` now gets the mask. Use the value it sent instead. Tests that match the `value` param of a validation error on such a key need to drop that expectation."
+  },
   {
     "version": "0.326.0",
     "type": "breaking",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "forget-denied audit events record the specific tenant-gate denial reason",
+    "detail": "The `forget-denied` audit event now records the specific tenant-gate reason (for example `target_tenant_not_admin_tenant`) instead of the generic `access_denied`. The framework exports `requireEntityTableMeta` from `bun-db`."
+  },
   {
     "version": "0.332.0",
     "type": "fix",

package/src/data-retention/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Retention hardDelete keeps cross-entity shared files and isolates storage errors per row",
+    "detail": "Retention hardDelete no longer deletes a fileRef that a live row of another entity type still references in a file/image field (relevant for unbound uploads). A storage error while deleting a row's files (for example a missing list permission) now skips only that row with `file_delete_failed` instead of aborting the whole tenant's cleanup run."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Retention hardDelete pages past stuck file rows and blockDelete reports personal fields without anonymize",
+    "detail": "Retention hardDelete on entities with file fields now pages by id, so rows stuck on a storage failure or a missing file storage no longer starve the rows behind them. A `blockDelete` entity with a personal field but no `anonymize` function is reported as `missing_anonymize_fields` again after the hold expires; only entities without any anonymizable subject field stay silent. The framework exports `entityHasAnonymizableSubjectField` for this check."
+  },
   {
     "version": "0.330.1",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Channel plugin guard validates mode and render",
+    "detail": "Stricter input guards. A delivery channel plugin must declare `mode` as `inline` or `queued` and a function `render`, otherwise boot fails instead of silently dispatching inline. The derivatives-sharp overlay rejects a non-finite `marginPct` before it reaches sharp. A document-ingest provider can no longer register under the reserved name `unknown`, which marks upcast legacy ingest events. The unsubscribe POST route also accepts a JSON body.",
+    "migration": "A delivery channel plugin must now declare `mode` as `\"inline\"` or `\"queued\"` and a function `render`; boot fails otherwise instead of dispatching inline."
+  },
   {
     "version": "0.330.0",
     "type": "improvement",

package/src/derivatives-sharp/changes.json

@@ -1,4 +1,15 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Overlay and blur intermediates are lossless and QR overlays render crisp at their final size",
+    "detail": "The sharp renderer buffers intermediates losslessly before overlays and blur regions, so a JPEG source no longer gains an extra compression generation. QR overlays are generated at their final size and checked against the smaller of output width and height before generation, so a flat output can no longer cache an unscannable QR."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Overlay marginPct must be finite"
+  },
   {
     "version": "0.287.0",
     "type": "improvement",

package/src/document-ingest-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Writing a document extract is idempotent per fileRef",
+    "detail": "`writeDocumentExtractForLiveFileRef` now returns `{ kind: \"skipped\", reason: \"already_extracted\" }` when the fileRef already has a documentExtract, so a redelivered `documentIngest.requested` or a delete-restore race no longer creates a second extract. Providers need no existence check of their own; code that switches exhaustively on `reason` must handle the new value."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Provider name \"unknown\" is reserved for upcast legacy events",
+    "migration": "Registering a document-ingest provider under the name `unknown` now throws; rename any provider that uses it."
+  },
   {
     "version": "0.312.0",
     "type": "breaking",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Poll cursor is persisted with the account's tenantId",
+    "detail": "Several bundled-feature fixes. The inbound-mail watch supervisor now stamps `tenantId` when it first saves a poll cursor, so cursors persist instead of failing on the NOT NULL column. The anonymous queries of managed-pages, template-resolver, seo, compliance-profiles and auth-email-password rate-limit per IP and handler, so one handler no longer drains the bucket of the others. The personal-access-token list loads up to the maximum page size without a pager that could not page. Serial host ids beyond int4 are denied as not found, and the notes forget hook resolves the tenant retention preset once."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "OAuth callback fails before creating an account when no secrets context is wired",
+    "detail": "The inbound-mail OAuth callback now checks for a configured secrets context before exchanging the authorization code and creating the mail account. Without secrets the callback answers 500 `secrets_context_missing` and no orphan account is left behind. `form-draft:get` now logs a warning when a stored draft blob fails its schema instead of dropping it silently."
+  },
   {
     "version": "0.306.0",
     "type": "fix",

package/src/jobs/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Tenant failure subject filter shares one serializer with the job runner",
+    "detail": "The framework `jobs` entry now exports `serializeJobSubject`, the single source of the tenant-visible failure subject string. The job runner and `jobs:query:failures` both use it, so the subject filter cannot drift from what the runner stored."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Job runner keeps retry budget on sequential lock conflicts, names the error without a db, fails loudly on bad tenantVisibleFailure subjects, stamps the raw feature name; jobs list filters multi-status",
+    "detail": "Job runner hardening. A job run now stamps its event `metadata.feature` with the feature's raw name, the same value write-handlers stamp (previously the kebab-case form for camelCase features). On a runner built without a db, touching `ctx.db` in a job throws a named error instead of a `TypeError`. A non-primitive `tenantVisibleFailure.subjectFields` value now fails the run visibly (run row, `onJobFailed`) and is not retried. A failing last-success metric no longer fails a successful run, and the runner registers the standard metrics on its meter itself. A sequential job whose retry attempt hits a held lock keeps its remaining retry budget instead of getting a fresh one. `stop()` waits at most 1 second for queue readiness. A custom `tenant:query:active-tenant-ids` handler returning anything but `string[]` is rejected. `Registry` gains `getJobFeature`.\nIn the jobs feature, a failing tenant-failure record write no longer blocks the run-row update or fails a completed run, `jobs:query:list` honours multi-value status filters and rejects filters on unknown fields, and `jobs:write:retry` answers 422 for a payload that is still ciphertext because no KMS is configured.",
+    "migration": "Events written by a job of a camelCase feature now carry metadata.feature with the raw feature name (for example \"pubSubOrders\") instead of the kebab-case form; update any audit or metrics filter that matched the kebab-case value. Custom Registry implementations must add getJobFeature(qualifiedJobName). A jobs:query:list call with filters on a field other than status is now rejected."
+  },
   {
     "version": "0.330.0",
     "type": "improvement",

package/src/legal-pages/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Legal pages fail fast on custom routes without required blocks; seed race honours skip",
+    "detail": "`createLegalPagesFeature` now throws when custom `routes` cover no default required block and `requiredBlocks` is omitted, instead of failing the production boot check later. The text-block and system-template seed race loser now honours `ifExists: \"skip\"` and the no-op comparison. `SegmentedSelect` keeps the first segment tabbable when the stored value matches no option. The `subscribePathname` option documents that the `popstate` default misses `pushState` navigation."
+  }
+]

package/src/managed-pages/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Anonymous queries rate-limit per IP and handler instead of sharing one bucket"
+  },
   {
     "version": "0.147.3",
     "type": "fix",

package/src/metrics/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Metric queries reject offset time zones",
+    "detail": "Metric queries now reject offset time zones such as `+01:00` with a validation error. Postgres reads them with the opposite sign, so day buckets came back empty. Use IANA names like `Europe/Berlin`."
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/rate-limiting/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Rate-limiting error keys have de/en translations"
+  },
   {
     "version": "0.291.0",
     "type": "breaking",

package/src/secrets/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "createSecretsFeature rejects access and roles together",
+    "detail": "`createSecretsFeature` throws at mount when both `access` and `roles` are passed; `access` used to silently discard `roles`. The personal-access-token mint form builds its i18n keys from the shared key helpers, and `ACTION_FORM_ENTITY` is now exported from `@cosmicdrift/kumiko-framework/ui-types`. The rate-limiting feature registers de/en copy for its error keys.",
+    "migration": "Remove `roles` from the `createSecretsFeature` options when `access` is set (or drop `access` and keep `roles`). Before, `roles` was silently ignored next to `access`."
+  },
   {
     "version": "0.275.0",
     "type": "breaking",

package/src/sessions/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Session list loads one max-size page and renders no pager"
+  },
   {
     "version": "0.330.0",
     "type": "improvement",

package/src/shared/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Row-bound grant redemption logs a failing anchor lookup instead of swallowing it silently",
+    "detail": "`redeemRowBoundGrant` now logs a warning (error name and code only, never the token or subject) when the anchor lookup throws, so a database outage no longer looks like an expired link. The result is still the same bare rejection."
+  },
   {
     "version": "0.287.0",
     "type": "improvement",