@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.335.0

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Poll cursor is persisted with the account's tenantId",
+    "detail": "Several bundled-feature fixes. The inbound-mail watch supervisor now stamps `tenantId` when it first saves a poll cursor, so cursors persist instead of failing on the NOT NULL column. The anonymous queries of managed-pages, template-resolver, seo, compliance-profiles and auth-email-password rate-limit per IP and handler, so one handler no longer drains the bucket of the others. The personal-access-token list loads up to the maximum page size without a pager that could not page. Serial host ids beyond int4 are denied as not found, and the notes forget hook resolves the tenant retention preset once."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "OAuth callback fails before creating an account when no secrets context is wired",
+    "detail": "The inbound-mail OAuth callback now checks for a configured secrets context before exchanging the authorization code and creating the mail account. Without secrets the callback answers 500 `secrets_context_missing` and no orphan account is left behind. `form-draft:get` now logs a warning when a stored draft blob fails its schema instead of dropping it silently."
+  },
   {
     "version": "0.306.0",
     "type": "fix",

package/src/jobs/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Tenant failure subject filter shares one serializer with the job runner",
+    "detail": "The framework `jobs` entry now exports `serializeJobSubject`, the single source of the tenant-visible failure subject string. The job runner and `jobs:query:failures` both use it, so the subject filter cannot drift from what the runner stored."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Job runner keeps retry budget on sequential lock conflicts, names the error without a db, fails loudly on bad tenantVisibleFailure subjects, stamps the raw feature name; jobs list filters multi-status",
+    "detail": "Job runner hardening. A job run now stamps its event `metadata.feature` with the feature's raw name, the same value write-handlers stamp (previously the kebab-case form for camelCase features). On a runner built without a db, touching `ctx.db` in a job throws a named error instead of a `TypeError`. A non-primitive `tenantVisibleFailure.subjectFields` value now fails the run visibly (run row, `onJobFailed`) and is not retried. A failing last-success metric no longer fails a successful run, and the runner registers the standard metrics on its meter itself. A sequential job whose retry attempt hits a held lock keeps its remaining retry budget instead of getting a fresh one. `stop()` waits at most 1 second for queue readiness. A custom `tenant:query:active-tenant-ids` handler returning anything but `string[]` is rejected. `Registry` gains `getJobFeature`.\nIn the jobs feature, a failing tenant-failure record write no longer blocks the run-row update or fails a completed run, `jobs:query:list` honours multi-value status filters and rejects filters on unknown fields, and `jobs:write:retry` answers 422 for a payload that is still ciphertext because no KMS is configured.",
+    "migration": "Events written by a job of a camelCase feature now carry metadata.feature with the raw feature name (for example \"pubSubOrders\") instead of the kebab-case form; update any audit or metrics filter that matched the kebab-case value. Custom Registry implementations must add getJobFeature(qualifiedJobName). A jobs:query:list call with filters on a field other than status is now rejected."
+  },
   {
     "version": "0.330.0",
     "type": "improvement",

package/src/legal-pages/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Legal pages fail fast on custom routes without required blocks; seed race honours skip",
+    "detail": "`createLegalPagesFeature` now throws when custom `routes` cover no default required block and `requiredBlocks` is omitted, instead of failing the production boot check later. The text-block and system-template seed race loser now honours `ifExists: \"skip\"` and the no-op comparison. `SegmentedSelect` keeps the first segment tabbable when the stored value matches no option. The `subscribePathname` option documents that the `popstate` default misses `pushState` navigation."
+  }
+]

package/src/managed-pages/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Anonymous queries rate-limit per IP and handler instead of sharing one bucket"
+  },
   {
     "version": "0.147.3",
     "type": "fix",

package/src/metrics/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Metric queries reject offset time zones",
+    "detail": "Metric queries now reject offset time zones such as `+01:00` with a validation error. Postgres reads them with the opposite sign, so day buckets came back empty. Use IANA names like `Europe/Berlin`."
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/rate-limiting/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Rate-limiting error keys have de/en translations"
+  },
   {
     "version": "0.291.0",
     "type": "breaking",

package/src/secrets/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "createSecretsFeature rejects access and roles together",
+    "detail": "`createSecretsFeature` throws at mount when both `access` and `roles` are passed; `access` used to silently discard `roles`. The personal-access-token mint form builds its i18n keys from the shared key helpers, and `ACTION_FORM_ENTITY` is now exported from `@cosmicdrift/kumiko-framework/ui-types`. The rate-limiting feature registers de/en copy for its error keys.",
+    "migration": "Remove `roles` from the `createSecretsFeature` options when `access` is set (or drop `access` and keep `roles`). Before, `roles` was silently ignored next to `access`."
+  },
   {
     "version": "0.275.0",
     "type": "breaking",

package/src/sessions/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Session list loads one max-size page and renders no pager"
+  },
   {
     "version": "0.330.0",
     "type": "improvement",

package/src/shared/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Row-bound grant redemption logs a failing anchor lookup instead of swallowing it silently",
+    "detail": "`redeemRowBoundGrant` now logs a warning (error name and code only, never the token or subject) when the anchor lookup throws, so a database outage no longer looks like an expired link. The result is still the same bare rejection."
+  },
   {
     "version": "0.287.0",
     "type": "improvement",

package/src/step-dispatcher/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Webhook auth secret lookup failures become dispatch-failed events"
+  },
   {
     "version": "0.327.0",
     "type": "breaking",

package/src/subscription-mollie/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Mollie one-off prices no longer need an interval; a subscription price without one is rejected",
+    "detail": "`MolliePriceConfig.interval` is now optional so one-off prices (credit top-ups, `mode: \"payment\"`) no longer need a dummy interval. A price without `interval` booked as a subscription now fails at checkout creation, and a paid first payment for such a price creates no Mollie subscription (a warning is logged). The \"checkout url is null\" error no longer blames first-payment mandates for one-off payments.",
+    "migration": "Mollie checkout creation now throws for a subscription price without `interval`; set `interval` on every subscription price (one-off `mode: \"payment\"` prices need none)."
+  },
   {
     "version": "0.318.0",
     "type": "fix",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,15 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "One-off payment checkouts create a customer when none is passed"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Stripe unknown price intervals stay consistent, plan-switch errors keep their cause, dropped paid sessions are logged",
+    "detail": "Stripe prices with an interval Stripe added after this release now report `intervalCount: null` alongside `interval: null`, and log one warning per price. A `billingPortal.sessions.create` failure during a plan switch is no longer reported as `plan_tiers_share_product`, so the real Stripe error surfaces; only portal-configuration errors map to it. A paid one-off checkout session that is dropped for missing tenant, price or customer data now logs a warning with event and session id."
+  },
   {
     "version": "0.332.0",
     "type": "fix",

package/src/template-resolver/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "TemplateResource and text-block/collection query outputs expose modifiedAt instead of updatedAt",
+    "detail": "Review round 2 fixes across the feature AST, codemods, the template-resolver and the renderer router.\n- feature-ast: handler lookup falls back to the header when the body carries no match, a `zod` namespace import (`import * as z`) is recognised, and patch edits no longer overlap.\n- Codemods: the PII heuristic matches segment-aligned names, the open-to-all codemod sets its exit code, and `failUnprocessable` calls are migrated.\n- template-resolver: the row types and the public output now use the real base columns. `by-slug`, `by-tenant`, `list`, `find-by-id` and the `TemplateResource` API return `modifiedAt` (null until the first edit) instead of `updatedAt`, which was always undefined at runtime. The user-content export reads `modifiedAt` too.\n- renderer: `formatPath` and `parsePath` encode and decode every path segment, so an entity id like `foo/bar` or `ä b` survives a round trip. A malformed percent-escape in the URL resolves to no route.",
+    "migration": "Rename reads of `updatedAt` to `modifiedAt` on TemplateResource, the by-slug, by-tenant, list, find-by-id and collection queries, and the template-resolver web BlockSummary. The old field was never populated at runtime; the new one is an ISO timestamp, or null for a row that was never edited."
+  },
   {
     "version": "0.195.0",
     "type": "breaking",

package/src/tenant/changes.json

@@ -1,4 +1,33 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "remove-member no longer fails with an internal error when removing a TenantAdmin",
+    "detail": "Several bundled-feature fixes. `tenant:remove-member` no longer fails with an internal error when it removes a TenantAdmin: the last-admin check now runs on the raw runner like `update-member-roles`, and the last admin is refused with a conflict. The `member-directory` query accepts `search` so the `user:user` reference combobox finds members beyond the first page. One-off Stripe payment checkouts without a known customer create one, so the paid payment is no longer ignored by the webhook. A throwing secrets lookup in the webhook step now becomes a `dispatch-failed` event instead of dead-lettering the step-dispatcher consumer. The row-bound grant validates an `unsafeSkip` reason before verifying the token. The session list loads one maximum-size page without a pager that could not page. The public user-data-rights handlers rate-limit per IP and handler."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "member-directory supports search for the user reference combobox"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Tenant directory search, canonical user locale, last-admin remove message and destroy-hook boot check",
+    "detail": "Several review fixes in bundled features. The tenant reference combobox now searches tenants by name through `tenant:query:tenant-directory`, so tenants beyond the first page can be picked. Removing the last tenant admin reports \"cannot remove\" instead of \"cannot demote\". `user:write:create` and `user:write:update` store the locale tag in canonical form (`DE-AT` becomes `de-AT`). Tenant-lifecycle rejects `tenantData`, `storageProvider`, `searchAdapter`, `externalResource` and `infraResource` registrations without a destroy function at boot instead of during tenant destruction. The convention `tier-assignment:create`/`update` and `tenant:entity:list`/`update` handlers are hidden from the agent in favour of their canonical counterparts."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Saving member roles keeps roles the editor cannot grant",
+    "detail": "Admin, TenantAdmin and SystemAdmin saves keep DataProtectionOfficer, TenantOwner, undeclared and higher-tier app roles; the system user still replaces the list. The roles column translates TenantOwner and DataProtectionOfficer. New exports: canActorAssignRole, mergeAssignedRoles, assignableAppRolesOf. Apps translate their roles via tenant:entity:__action-form__:field:roles:option:<Role> (and role:option: for the invite)."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Editing your own roles no longer ends your own session",
+    "detail": "Saving your own roles in the members screen keeps the current session and its live streams; the new roles apply on the next request. Your other sessions are still revoked, and editing someone else's roles still revokes all of theirs. The team list now shows the real creation time of members and invitations instead of the query time."
+  },
   {
     "version": "0.333.0",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,26 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Public deletion and download handlers rate-limit per IP and handler"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Export cleanup reports a last-run timestamp gauge and still reports backlog age when the pass throws",
+    "detail": "The export storage-cleanup pass now also reports an `export_cleanup_last_run_timestamp` gauge (Unix seconds, set only when a pass completes) so a stalled cron can be alerted on with `time() - metric > interval + buffer`; the backlog gauge keeps its last value when the cron stops, so `absent()` never fires. The backlog gauge is now reported even when the pass throws. The workflow-runner event wakeup uses the framework `getTemporal()` instead of the global `Temporal`, and a redelivered `workflow.waiting-for-event` no longer resets an already matched trigger."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Backlog gauge covers failed export orphans, explainer labels translated, unattributed escape-hatch actor constant",
+    "detail": "`OWNER_INVITE_ROLE_OPTIONS` is now exported from the tenant barrel so apps can compose it into custom invite screens. The privacy-center and profile deletion explainer descriptions are registered as `i18nKey()` labels with server-side English translations. The export storage-cleanup backlog gauge now also covers failed jobs with an orphaned ZIP. Escape-hatch audit events from the forget-cleanup, user-export and tenant-lifecycle runners use the exported `UNATTRIBUTED_ACTOR` constant (value `\"system\"`, unchanged) when no actor is passed. Deletion requests no longer query the tenant compliance profile for users that are not active."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "cancel-deletion actions declare the x icon instead of resolving to the destructive trash icon"
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/workflow-runner/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "resume-run no longer appends run-failed to an already settled run",
+    "detail": "The workflow-runner's resume-run handler now checks whether a run is already settled before resolving the workflow definition. A second resume tick racing a finished run no longer appends a `run-failed` event after `run-completed` when the definition changed or was removed meanwhile. The `runId` payload is validated as a UUID, and the due-runs SELECT drops its ineffective `FOR UPDATE SKIP LOCKED`."
+  },
   {
     "version": "0.327.0",
     "type": "breaking",