@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/src/step-dispatcher/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Webhook auth secret lookup failures become dispatch-failed events"
+  },
   {
     "version": "0.327.0",
     "type": "breaking",

package/src/subscription-mollie/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Mollie one-off prices no longer need an interval; a subscription price without one is rejected",
+    "detail": "`MolliePriceConfig.interval` is now optional so one-off prices (credit top-ups, `mode: \"payment\"`) no longer need a dummy interval. A price without `interval` booked as a subscription now fails at checkout creation, and a paid first payment for such a price creates no Mollie subscription (a warning is logged). The \"checkout url is null\" error no longer blames first-payment mandates for one-off payments.",
+    "migration": "Mollie checkout creation now throws for a subscription price without `interval`; set `interval` on every subscription price (one-off `mode: \"payment\"` prices need none)."
+  },
   {
     "version": "0.318.0",
     "type": "fix",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,15 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "One-off payment checkouts create a customer when none is passed"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Stripe unknown price intervals stay consistent, plan-switch errors keep their cause, dropped paid sessions are logged",
+    "detail": "Stripe prices with an interval Stripe added after this release now report `intervalCount: null` alongside `interval: null`, and log one warning per price. A `billingPortal.sessions.create` failure during a plan switch is no longer reported as `plan_tiers_share_product`, so the real Stripe error surfaces; only portal-configuration errors map to it. A paid one-off checkout session that is dropped for missing tenant, price or customer data now logs a warning with event and session id."
+  },
   {
     "version": "0.332.0",
     "type": "fix",

package/src/template-resolver/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "TemplateResource and text-block/collection query outputs expose modifiedAt instead of updatedAt",
+    "detail": "Review round 2 fixes across the feature AST, codemods, the template-resolver and the renderer router.\n- feature-ast: handler lookup falls back to the header when the body carries no match, a `zod` namespace import (`import * as z`) is recognised, and patch edits no longer overlap.\n- Codemods: the PII heuristic matches segment-aligned names, the open-to-all codemod sets its exit code, and `failUnprocessable` calls are migrated.\n- template-resolver: the row types and the public output now use the real base columns. `by-slug`, `by-tenant`, `list`, `find-by-id` and the `TemplateResource` API return `modifiedAt` (null until the first edit) instead of `updatedAt`, which was always undefined at runtime. The user-content export reads `modifiedAt` too.\n- renderer: `formatPath` and `parsePath` encode and decode every path segment, so an entity id like `foo/bar` or `ä b` survives a round trip. A malformed percent-escape in the URL resolves to no route.",
+    "migration": "Rename reads of `updatedAt` to `modifiedAt` on TemplateResource, the by-slug, by-tenant, list, find-by-id and collection queries, and the template-resolver web BlockSummary. The old field was never populated at runtime; the new one is an ISO timestamp, or null for a row that was never edited."
+  },
   {
     "version": "0.195.0",
     "type": "breaking",

package/src/tenant/changes.json

@@ -1,4 +1,33 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "remove-member no longer fails with an internal error when removing a TenantAdmin",
+    "detail": "Several bundled-feature fixes. `tenant:remove-member` no longer fails with an internal error when it removes a TenantAdmin: the last-admin check now runs on the raw runner like `update-member-roles`, and the last admin is refused with a conflict. The `member-directory` query accepts `search` so the `user:user` reference combobox finds members beyond the first page. One-off Stripe payment checkouts without a known customer create one, so the paid payment is no longer ignored by the webhook. A throwing secrets lookup in the webhook step now becomes a `dispatch-failed` event instead of dead-lettering the step-dispatcher consumer. The row-bound grant validates an `unsafeSkip` reason before verifying the token. The session list loads one maximum-size page without a pager that could not page. The public user-data-rights handlers rate-limit per IP and handler."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "member-directory supports search for the user reference combobox"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Tenant directory search, canonical user locale, last-admin remove message and destroy-hook boot check",
+    "detail": "Several review fixes in bundled features. The tenant reference combobox now searches tenants by name through `tenant:query:tenant-directory`, so tenants beyond the first page can be picked. Removing the last tenant admin reports \"cannot remove\" instead of \"cannot demote\". `user:write:create` and `user:write:update` store the locale tag in canonical form (`DE-AT` becomes `de-AT`). Tenant-lifecycle rejects `tenantData`, `storageProvider`, `searchAdapter`, `externalResource` and `infraResource` registrations without a destroy function at boot instead of during tenant destruction. The convention `tier-assignment:create`/`update` and `tenant:entity:list`/`update` handlers are hidden from the agent in favour of their canonical counterparts."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Saving member roles keeps roles the editor cannot grant",
+    "detail": "Admin, TenantAdmin and SystemAdmin saves keep DataProtectionOfficer, TenantOwner, undeclared and higher-tier app roles; the system user still replaces the list. The roles column translates TenantOwner and DataProtectionOfficer. New exports: canActorAssignRole, mergeAssignedRoles, assignableAppRolesOf. Apps translate their roles via tenant:entity:__action-form__:field:roles:option:<Role> (and role:option: for the invite)."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Editing your own roles no longer ends your own session",
+    "detail": "Saving your own roles in the members screen keeps the current session and its live streams; the new roles apply on the next request. Your other sessions are still revoked, and editing someone else's roles still revokes all of theirs. The team list now shows the real creation time of members and invitations instead of the query time."
+  },
   {
     "version": "0.333.0",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,26 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Public deletion and download handlers rate-limit per IP and handler"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Export cleanup reports a last-run timestamp gauge and still reports backlog age when the pass throws",
+    "detail": "The export storage-cleanup pass now also reports an `export_cleanup_last_run_timestamp` gauge (Unix seconds, set only when a pass completes) so a stalled cron can be alerted on with `time() - metric > interval + buffer`; the backlog gauge keeps its last value when the cron stops, so `absent()` never fires. The backlog gauge is now reported even when the pass throws. The workflow-runner event wakeup uses the framework `getTemporal()` instead of the global `Temporal`, and a redelivered `workflow.waiting-for-event` no longer resets an already matched trigger."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Backlog gauge covers failed export orphans, explainer labels translated, unattributed escape-hatch actor constant",
+    "detail": "`OWNER_INVITE_ROLE_OPTIONS` is now exported from the tenant barrel so apps can compose it into custom invite screens. The privacy-center and profile deletion explainer descriptions are registered as `i18nKey()` labels with server-side English translations. The export storage-cleanup backlog gauge now also covers failed jobs with an orphaned ZIP. Escape-hatch audit events from the forget-cleanup, user-export and tenant-lifecycle runners use the exported `UNATTRIBUTED_ACTOR` constant (value `\"system\"`, unchanged) when no actor is passed. Deletion requests no longer query the tenant compliance profile for users that are not active."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "cancel-deletion actions declare the x icon instead of resolving to the destructive trash icon"
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/workflow-runner/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "resume-run no longer appends run-failed to an already settled run",
+    "detail": "The workflow-runner's resume-run handler now checks whether a run is already settled before resolving the workflow definition. A second resume tick racing a finished run no longer appends a `run-failed` event after `run-completed` when the definition changed or was removed meanwhile. The `runId` payload is validated as a UUID, and the due-runs SELECT drops its ineffective `FOR UPDATE SKIP LOCKED`."
+  },
   {
     "version": "0.327.0",
     "type": "breaking",