@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.335.0

package/dist/user-data-rights/run-export-jobs.js

@@ -62,6 +62,10 @@ import { generateDownloadToken } from "./token-helpers.js";
 // No "_seconds"/"_total" suffix: validateMetricName rejects both on a gauge.
 // Unit lives in the r.metric() `unit: "seconds"` declaration instead.
 export const EXPORT_CLEANUP_BACKLOG_AGE_METRIC = "export_cleanup_backlog_age";
+// Unix seconds of the last storage-cleanup pass that ran to completion. A
+// gauge keeps its last value in-process (no TTL), so a dead cron does not make
+// the backlog gauge disappear — alert on `time() - this > interval + buffer`.
+export const EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC = "export_cleanup_last_run_timestamp";
 const crud = createEventStoreExecutor(exportJobsTable, exportJobEntity, {
     entityName: "export-job",
 });
@@ -429,54 +433,71 @@ async function storageCleanupPass(args) {
     // via selectMany (db/queries/export-jobs.ts).
     const candidates = await selectExportJobsForStorageCleanup(db, EXPORT_JOB_STATUS.Done, EXPORT_JOB_STATUS.Failed);
     const cleaned = [];
-    // Done-status candidates past expiresAt+grace, keyed by that due-instant —
-    // used below to report how far cleanup has fallen behind if a candidate
-    // is still standing (delete threw, or the version-checked null-out lost
-    // a race) once the pass is done. Failed-status jobs have no expiresAt
-    // (immediate cleanup, no TTL) so they're out of scope for this signal —
-    // see EXPORT_CLEANUP_BACKLOG_AGE_METRIC's r.metric() description.
+    // Candidates past their due-instant, keyed by that instant — used below to
+    // report how far cleanup has fallen behind if a candidate is still standing
+    // (delete threw, or the version-checked null-out lost a race) once the pass
+    // is done. Done jobs are due at expiresAt+grace; Failed jobs (orphaned ZIPs,
+    // no TTL) are due at completedAt ?? startedAt, i.e. from the first pass.
     const overdueDoneCleanupAfterMs = new Map();
-    for (const c of candidates) {
-        if (!c.downloadStorageKey)
-            continue;
-        // Done-Jobs brauchen expiresAt+grace-Check. Failed-Jobs gehen direkt
-        // durch (kein User-Pfad → sofort cleanup).
-        if (c.status === EXPORT_JOB_STATUS.Done) {
-            if (!c.expiresAt)
+    let passCompleted = false;
+    try {
+        for (const c of candidates) {
+            if (!c.downloadStorageKey)
                 continue;
-            const profile = await resolveProfileForTenant({
-                db,
-                tenantId: c.requestedFromTenantId,
-            });
-            const cleanupAfter = c.expiresAt.epochMilliseconds +
-                profile.profile.userRights.exportStorageCleanupGraceHours * 60 * 60 * 1000;
-            if (now.epochMilliseconds < cleanupAfter)
+            // Done jobs need the expiresAt+grace check. Failed jobs pass straight
+            // through (no user path, so clean up immediately).
+            if (c.status === EXPORT_JOB_STATUS.Done) {
+                if (!c.expiresAt)
+                    continue;
+                // Count the candidate as overdue (lower bound, grace unknown) before the
+                // throwing profile lookup, so a failing pass still shows a backlog.
+                overdueDoneCleanupAfterMs.set(c.id, c.expiresAt.epochMilliseconds);
+                const profile = await resolveProfileForTenant({
+                    db,
+                    tenantId: c.requestedFromTenantId,
+                });
+                const cleanupAfter = c.expiresAt.epochMilliseconds +
+                    profile.profile.userRights.exportStorageCleanupGraceHours * 60 * 60 * 1000;
+                if (now.epochMilliseconds < cleanupAfter) {
+                    overdueDoneCleanupAfterMs.delete(c.id);
+                    continue;
+                }
+                overdueDoneCleanupAfterMs.set(c.id, cleanupAfter);
+            }
+            // Failed-job branch: no TTL check, clean up immediately.
+            else {
+                const failedAt = c.completedAt ?? c.startedAt;
+                if (failedAt)
+                    overdueDoneCleanupAfterMs.set(c.id, failedAt.epochMilliseconds);
+            }
+            // Delete the storage file and null the DB column.
+            try {
+                const provider = await buildStorageProvider(c.requestedFromTenantId);
+                await provider.delete(c.downloadStorageKey);
+            }
+            catch {
+                // best-effort; if the storage delete fails, retry on the next pass
                 continue;
-            overdueDoneCleanupAfterMs.set(c.id, cleanupAfter);
-        }
-        // Failed-Job-Branch: kein TTL-Check, sofort cleanup.
-        // Storage-Datei loeschen + DB-Spalte nullen.
-        try {
-            const provider = await buildStorageProvider(c.requestedFromTenantId);
-            await provider.delete(c.downloadStorageKey);
-        }
-        catch {
-            // best-effort; wenn Storage-Delete failed, retry beim naechsten Pass
-            continue;
+            }
+            const result = await crud.update({
+                id: c.id,
+                version: c.version,
+                changes: { downloadStorageKey: null },
+            }, createSystemUser(c.requestedFromTenantId), systemTenantDb(db, c.requestedFromTenantId));
+            if (result.isSuccess)
+                cleaned.push(c.id);
         }
-        const result = await crud.update({
-            id: c.id,
-            version: c.version,
-            changes: { downloadStorageKey: null },
-        }, createSystemUser(c.requestedFromTenantId), systemTenantDb(db, c.requestedFromTenantId));
-        if (result.isSuccess)
-            cleaned.push(c.id);
+        passCompleted = true;
+    }
+    finally {
+        reportOldestOverdueAge(metrics, overdueDoneCleanupAfterMs, cleaned, now);
+        if (passCompleted)
+            reportCleanupLastRun(metrics, now);
     }
-    reportOldestOverdueAge(metrics, overdueDoneCleanupAfterMs, cleaned, now);
     return cleaned;
 }
-// Seconds since the longest-overdue Done-status bundle should have been
-// deleted (expiresAt+grace passed) but still isn't — 0 when the pass
+// Seconds since the longest-overdue bundle (Done: expiresAt+grace passed;
+// Failed: completedAt ?? startedAt) should have been deleted but still isn't — 0 when the pass
 // cleaned everything that was due, or nothing was due.
 function oldestOverdueAgeSeconds(overdueDoneCleanupAfterMs, cleanedIds, now) {
     const cleaned = new Set(cleanedIds);
@@ -505,6 +526,18 @@ function reportOldestOverdueAge(metrics, overdueDoneCleanupAfterMs, cleanedIds,
         console.warn(`[user-data-rights:run-export-jobs] metrics.set(${EXPORT_CLEANUP_BACKLOG_AGE_METRIC}) failed err=${err instanceof Error ? err.message : String(err)}`);
     }
 }
+function reportCleanupLastRun(metrics, now) {
+    // skip: no meter configured means there is nothing to report.
+    if (!metrics)
+        return;
+    try {
+        metrics.set(EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC, now.epochMilliseconds / 1000);
+    }
+    catch (err) {
+        // biome-ignore lint/suspicious/noConsole: operator-visibility for observability-emit-failure
+        console.warn(`[user-data-rights:run-export-jobs] metrics.set(${EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC}) failed err=${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 // Wrapper: crud.update braucht TenantDb. ExportJob ist tenant-agnostisch
 // (1 Job pro userId), aber der event-store-Stream-Lookup erwartet einen
 // Tenant-Context. system-mode TenantDb bypassed den auto-tenant-filter

package/dist/user-data-rights/run-forget-cleanup.js

@@ -35,7 +35,7 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createTenantDb, entityEventName, executeRawQuery, nullBlindIndexesForSubject, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, EXT_USER_DATA_ORDER, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
-import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
 import { resolveRetentionPolicyForTenant, resolveTenantRetentionPreset, } from "../data-retention/index.js";
 import { decryptStoredPii, runInSubTransaction } from "../shared/index.js";
@@ -47,7 +47,7 @@ function buildHookDb(db, tenantId, entry, args) {
     const report = createEscapeHatchReporter({
         handler: `${EXT_USER_DATA}:${entry.entityName}`,
         tenantId,
-        actor: args.actor ?? "system",
+        actor: args.actor ?? UNATTRIBUTED_ACTOR,
         sink: args.escapeHatchAuditSink,
     });
     return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {

package/dist/user-data-rights/run-user-export.js

@@ -23,14 +23,14 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
 import { collectEncryptedFieldNames, configuredEntityFieldEncryption, createTenantDb, decryptEntityFieldValues, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, extensionUsageEscapeHatchReason, maskWriteOnlyFields, } from "@cosmicdrift/kumiko-framework/engine";
-import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { tenantMembershipsTable } from "../tenant/index.js";
 import { buildFileRefZipPath } from "./zip-path.js";
 function buildHookDb(db, tenantId, entry, args) {
     const report = createEscapeHatchReporter({
         handler: `${EXT_USER_DATA}:${entry.entityName}`,
         tenantId,
-        actor: args.actor ?? "system",
+        actor: args.actor ?? UNATTRIBUTED_ACTOR,
         sink: args.escapeHatchAuditSink,
     });
     return createTenantDb(db, tenantId, "tenant", undefined, undefined, undefined, {

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -1,6 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { assertErased } from "../../shared/index.js";
 const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
@@ -222,7 +223,9 @@ export const fileRefDeleteHook = async (ctx, strategy) => {
     if (storageProvider) {
         const failedKeys = await deleteBinaries(personalRows, storageProvider);
         if (failedKeys.length > 0) {
-            throw new Error(`[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`);
+            throw new InternalError({
+                message: `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
+            });
         }
     }
     else {

package/dist/user-profile/feature.js

@@ -42,6 +42,9 @@ export function createUserProfileFeature() {
                 "profile.email.title": { en: "Email address" },
                 "profile.password.title": { en: "Password" },
                 "profile.danger.title": { en: "Delete account" },
+                "profile.danger.explainer": {
+                    en: "Your account will be permanently deleted after a grace period. Until then you can cancel the deletion at any time.",
+                },
                 "profile.danger.gracePeriodEnd": { en: "Deletion date" },
                 "profile.danger.delete": { en: "Delete account" },
                 "profile.danger.dialogDescription": {
@@ -94,7 +97,7 @@ export function createUserProfileFeature() {
                     },
                     {
                         title: i18nKey("profile.danger.title"),
-                        description: "profile.danger.explainer",
+                        description: i18nKey("profile.danger.explainer"),
                         // gracePeriodEnd is only meaningful once a deletion is actually
                         // pending — hide it instead of showing an empty date when status
                         // isn't deletionRequested (same rule as privacy-center).
@@ -123,6 +126,8 @@ export function createUserProfileFeature() {
                     handler: UserDataRightsHandlers.cancelDeletion,
                     visible: { field: "status", eq: "deletionRequested" },
                     style: "secondary",
+                    // Declared: the id's last segment ("deletion") would otherwise resolve to the destructive trash icon.
+                    icon: "x",
                 },
             ],
         });

package/dist/user-profile/handlers/change-email.write.js

@@ -33,6 +33,8 @@ export const changeEmailWrite = defineWriteHandler({
             "email uniqueness the same way, and writes the new email via ctx.writeAs(SYSTEM, " +
             "user:update) — field-access on passwordHash/email is privileged-only.",
     },
+    // Payload carries the current password.
+    agent: { expose: false },
     description: "Replaces the signed-in caller's own email address after re-checking their current password, refusing an unchanged or already-taken address and clearing the verified flag so the app can re-run email verification.",
     handler: async (event, ctx) => {
         const systemUser = createSystemUser(event.user.tenantId);

package/dist/workflow-runner/db/queries/due-runs.js

@@ -1,12 +1,9 @@
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-// Standalone statement (no db.begin) — FOR UPDATE SKIP LOCKED only
-// needs to survive this one SELECT to reduce redundant dispatches
-// under true concurrency; it auto-commits and releases the row locks
-// immediately after. The real correctness guarantee is resume-run's
-// VersionConflictError-checked claim (ctx.tryAppendEvent on
-// WORKFLOW_RESUMED) — a second dispatch for the same row just loses
-// that race and no-ops, same as the sample this was adapted from.
+// Dedup happens solely via resume-run's VersionConflictError-checked claim
+// (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
+// row loses that race and no-ops. No row locks: in an autocommit statement
+// they would be released right after the SELECT and guard nothing.
 export async function selectDueWorkflowRunPending(db, tenantId) {
-    // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup with FOR UPDATE SKIP LOCKED
-    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now() FOR UPDATE SKIP LOCKED`, [tenantId]));
+    // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup
+    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now()`, [tenantId]));
 }

package/dist/workflow-runner/event-subscriber.js

@@ -25,21 +25,41 @@
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { evaluateEventMatch } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { workflowRunPendingTable } from "./tables.js";
+const log = createFallbackLogger("workflow-runner");
+// A row whose persisted matchExpr cannot be evaluated (unknown version from a
+// rolling deploy, corrupt AST) must not abort the whole projection: that would
+// block every other waiting run of this event type on the same event forever.
+function rowMatchesEvent(row, eventType, payload) {
+    if (!row.matchExpr)
+        return true;
+    try {
+        return evaluateEventMatch(
+        // @cast-boundary engine-payload — matchExpr round-trips through
+        // jsonb as the EventMatch AST waitForEvent's `match` resolver
+        // persisted (see steps/wait-for-event.ts); evaluateEventMatch
+        // rejects a malformed shape itself.
+        row.matchExpr, payload);
+    }
+    catch (error) {
+        log.error("workflow wakeup skipped a pending row with an unevaluable matchExpr", {
+            runId: row.runId,
+            stepIndex: row.stepIndex,
+            eventType,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return false;
+    }
+}
 const wakeupApply = async (event, tx) => {
     const rows = await selectMany(tx, workflowRunPendingTable, {
         tenantId: event.tenantId,
         waitEventType: event.type,
     });
     for (const row of rows) {
-        const matches = row.matchExpr
-            ? evaluateEventMatch(
-            // @cast-boundary engine-payload — matchExpr round-trips through
-            // jsonb as the EventMatch AST waitForEvent's `match` resolver
-            // persisted (see steps/wait-for-event.ts); never an unchecked
-            // external value.
-            row.matchExpr, event.payload)
-            : true;
+        const matches = rowMatchesEvent(row, event.type, event.payload);
         // skip: this row's matchExpr rejected the event — not this row's
         // resume, leave wakeAt/triggerEventType untouched.
         if (!matches)
@@ -47,7 +67,7 @@ const wakeupApply = async (event, tx) => {
         await updateMany(tx, workflowRunPendingTable, {
             triggerEventType: event.type,
             triggerPayload: event.payload,
-            wakeAt: Temporal.Now.instant().toString(),
+            wakeAt: getTemporal().Now.instant().toString(),
         }, { tenantId: row.tenantId, runId: row.runId, stepIndex: row.stepIndex });
     }
 };

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -36,7 +36,7 @@ import { workflowRunPendingTable } from "../tables.js";
 import { getWorkflow } from "../workflow-registry.js";
 const log = createFallbackLogger("workflow-runner");
 const resumeRunSchema = z.object({
-    runId: z.string().min(1),
+    runId: z.string().uuid(),
     stepIndex: z.number().int().nonnegative(),
 });
 async function appendRunFailed(ctx, runId, failedPayload) {
@@ -170,16 +170,19 @@ export const resumeRunHandler = {
             return { isSuccess: true, data: { outcome: "already-resumed" } };
         }
         const { workflowName } = pending;
+        const runEvents = await ctx.loadAggregate(runId);
+        // Before the workflow resolution: a racing tick on an already-settled run
+        // must not append run-failed after run-completed when the definition has
+        // since changed or been removed.
+        if (isRunAlreadySettled(runEvents, stepIndex, pending.retryAttempt ?? undefined)) {
+            return { isSuccess: true, data: { outcome: "already-resumed" } };
+        }
         const resolved = resolveRunnableWorkflow(workflowName, runId, stepIndex, pending.definitionFingerprint);
         if (resolved.failure !== null) {
             await appendRunFailed(ctx, runId, resolved.failure);
             return { isSuccess: true, data: { outcome: "failed" } };
         }
         const workflow = resolved.workflow;
-        const runEvents = await ctx.loadAggregate(runId);
-        if (isRunAlreadySettled(runEvents, stepIndex, pending.retryAttempt ?? undefined)) {
-            return { isSuccess: true, data: { outcome: "already-resumed" } };
-        }
         const claim = await ctx.tryAppendEvent({
             aggregateId: runId,
             aggregateType: WORKFLOW_AGGREGATE_TYPE,

package/dist/workflow-runner/pending-projection.js

@@ -11,10 +11,17 @@
 // No resume logic here — framework#2513 Phase 2 owns the job that reads
 // this table and dispatches the actual resume. This projection only writes
 // the rows.
-import { deleteMany, upsertOnConflict } from "@cosmicdrift/kumiko-framework/bun-db";
+import { deleteMany, fetchOne, upsertOnConflict } from "@cosmicdrift/kumiko-framework/bun-db";
 import { WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WORKFLOW_WAITING_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
 import { workflowRunPendingTable } from "./tables.js";
 async function upsertPending(tx, row) {
+    // At-least-once redelivery of a suspension event after the event-subscriber
+    // already matched a trigger onto this row must not reset wakeAt/trigger —
+    // the run would sleep until timeout and lose the matched payload.
+    const existing = await fetchOne(tx, workflowRunPendingTable, { tenantId: row.tenantId, runId: row.runId, stepIndex: row.stepIndex });
+    // skip: row already carries a trigger event type, keep it on redelivery
+    if (existing?.triggerEventType != null)
+        return;
     await upsertOnConflict(tx, workflowRunPendingTable, {
         ...row,
         // Phase 3's event-subscriber writes these when the awaited event

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.334.0",
+  "version": "0.335.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,18 +483,20 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.334.0",
-    "@cosmicdrift/kumiko-framework": "0.334.0",
-    "@cosmicdrift/kumiko-headless": "0.334.0",
-    "@cosmicdrift/kumiko-renderer": "0.334.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.334.0",
-    "@cosmicdrift/kumiko-types": "0.334.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.335.0",
+    "@cosmicdrift/kumiko-framework": "0.335.0",
+    "@cosmicdrift/kumiko-headless": "0.335.0",
+    "@cosmicdrift/kumiko-renderer": "0.335.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.335.0",
+    "@cosmicdrift/kumiko-types": "0.335.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
+    "hono": "^4.13.1",
     "imapflow": "^1.7.8",
+    "ioredis": "^5.10.1",
     "jose": "^6.2.3",
     "lucide-react": "^1.14.0",
     "mailparser": "^3.9.32",
@@ -983,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.334.0",
-    "@cosmicdrift/kumiko-locale-es": "0.334.0",
+    "@cosmicdrift/kumiko-locale-de": "0.335.0",
+    "@cosmicdrift/kumiko-locale-es": "0.335.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/agent-tools/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Manifest rejects unknown denyQns, drops navs under hidden parents; doc lint flags blank and exposed-undescribed handlers",
+    "detail": "Agent tools: `buildAgentManifest` now throws when `denyQns` names a handler that is not registered, so a typo can no longer leave a handler exposed. Navs whose parent is hidden from the role are dropped from the manifest, and screens reachable only through them are no longer listed. The agent doc lint reports handlers that are exposed without a description and treats a blank description as a gap.",
+    "migration": "`buildAgentManifest` now throws when `denyQns` names a handler that is not registered; remove stale or misspelled entries from your `denyQns` lists."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Agent doc lint reports exposed handlers with a non-convertible input schema"
+  },
   {
     "version": "0.313.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Credential-carrying auth handlers are hidden from the agent catalog; additionalAssignableRoles rejects framework-ranked roles",
+    "detail": "The credential-carrying handlers `auth-email-password:login`, `change-password`, `user-profile:change-email`, `auth-mfa:verify` and `auth-mfa:enable-confirm-preauth` are now opted out of the agent tool catalog with `agent: { expose: false }`, so passwords, TOTP codes and setup tokens no longer reach an LLM transcript. `invite.additionalAssignableRoles` now throws at construction when it lists a framework-ranked role such as `TenantAdmin`, instead of silently disabling the elevation guard for it."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Invite accept handles MFA responses, bootstrap error screen offers Sign out",
+    "detail": "`InviteAcceptScreen` no longer redirects to a tenant URL when the accept route answers with an MFA challenge or setup requirement (no session cookie was minted); it sends the user to `loginHref` instead. `SessionBootstrapErrorScreen` accepts an optional `onSignOut` and the auth gate wires it, so a permanent bootstrap failure no longer traps the user behind \"Try again\" (new i18n key `auth.sessionBootstrap.signOut`). Cap bookings back off with a small random delay between version-conflict retries."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Ended session leads back to the login screen",
+    "detail": "When the server ends a session (revoked, expired), the app now shows the login screen with a short hint instead of a raw error banner. After signing in again the user lands on the same screen as before."
+  },
   {
     "version": "0.328.1",
     "type": "fix",

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "MFA web client shares the login response mapper",
+    "detail": "The MFA web client reuses the shared `toLoginResponse` helper (now exported from the auth-email-password web barrel) for `landingPath` handling, so login, MFA verify and MFA setup confirm map the response identically."
+  },
   {
     "version": "0.329.0",
     "type": "improvement",

package/src/billing-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Unregistered catalog.providerName fails unconfigured; switch-plan checks provider mismatch before lookup",
+    "detail": "`billing-plans` now fails with an `unconfigured` error when `catalog.providerName` names a provider that is not registered, instead of rendering billing as disabled. Billing renders as disabled only when no `providerName` is set and no provider is mounted. `switch-plan` answers a subscription on an unmounted provider with the `providerMismatch` conflict instead of a 500.",
+    "migration": "If `catalog.providerName` names a provider that is not mounted, billing-plans now fails with `unconfigured` instead of rendering billing as disabled; mount the provider or remove `providerName`."
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Cap helpers validate periodStartIso and amount, surface failed soft-warn writes; German column labels",
+    "detail": "`bookCapUsage` and `markCapSoftWarned` now reject a `periodStartIso` that is not an ISO instant with a validation error instead of silently forking a counter row or throwing a `RangeError`. `enforceCap` rejects a non-integer or non-positive `amount` instead of letting it bypass the cap. `enforceCapAndMaybeNotify` surfaces a failed soft-warn write instead of re-sending the notification on the next call. The cap-counter list now has German column labels.",
+    "migration": "`bookCapUsage` and `markCapSoftWarned` now reject a `periodStartIso` that is not a full ISO instant, including date-only strings like `2026-10-01`; pass e.g. `2026-10-01T00:00:00.000Z`."
+  },
   {
     "version": "0.317.0",
     "type": "fix",

package/src/cap-overview/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "tenant-caps:list validates cursor and filters, parallel usage reads; cap-counter list not searchable",
+    "detail": "`tenant-caps:list` now rejects a malformed pagination cursor and unsupported or repeated filters with a validation error instead of returning a wrong page or silently ignoring the filter, and loads per-tenant usage in parallel. The `cap-counter` operator list is no longer searchable, because search resolved against the caller's own tenant instead of all tenants."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Unlimited caps show a labelled usage count",
+    "detail": "The cap usage bar labels an unlimited cap as \"<used> · unlimited\" through the new `cap-overview.unlimited` key instead of a bare number. The German and Spanish catalogs ship the translation."
+  },
   {
     "version": "0.332.0",
     "type": "fix",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Explicit List-Unsubscribe headers replace the automatic pair case-insensitively",
+    "detail": "The email channel now matches explicit `data.headers` case-insensitively against the automatic unsubscribe headers. Overriding `List-Unsubscribe` or `List-Unsubscribe-Post` in any spelling drops the whole automatic pair, so a mail client no longer sends a one-click POST to a URL that cannot handle it."
+  },
   {
     "version": "0.321.0",
     "type": "improvement",

package/src/config/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "config:write:set masks the echoed value for encrypted-at-rest keys; validation errors no longer include the value",
+    "migration": "A caller that reads `data.value` from a `config:write:set` result for a key with `encrypted: true` or `backing: \"secrets\"` now gets the mask. Use the value it sent instead. Tests that match the `value` param of a validation error on such a key need to drop that expectation."
+  },
   {
     "version": "0.326.0",
     "type": "breaking",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "forget-denied audit events record the specific tenant-gate denial reason",
+    "detail": "The `forget-denied` audit event now records the specific tenant-gate reason (for example `target_tenant_not_admin_tenant`) instead of the generic `access_denied`. The framework exports `requireEntityTableMeta` from `bun-db`."
+  },
   {
     "version": "0.332.0",
     "type": "fix",

package/src/data-retention/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Retention hardDelete keeps cross-entity shared files and isolates storage errors per row",
+    "detail": "Retention hardDelete no longer deletes a fileRef that a live row of another entity type still references in a file/image field (relevant for unbound uploads). A storage error while deleting a row's files (for example a missing list permission) now skips only that row with `file_delete_failed` instead of aborting the whole tenant's cleanup run."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Retention hardDelete pages past stuck file rows and blockDelete reports personal fields without anonymize",
+    "detail": "Retention hardDelete on entities with file fields now pages by id, so rows stuck on a storage failure or a missing file storage no longer starve the rows behind them. A `blockDelete` entity with a personal field but no `anonymize` function is reported as `missing_anonymize_fields` again after the hold expires; only entities without any anonymizable subject field stay silent. The framework exports `entityHasAnonymizableSubjectField` for this check."
+  },
   {
     "version": "0.330.1",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Channel plugin guard validates mode and render",
+    "detail": "Stricter input guards. A delivery channel plugin must declare `mode` as `inline` or `queued` and a function `render`, otherwise boot fails instead of silently dispatching inline. The derivatives-sharp overlay rejects a non-finite `marginPct` before it reaches sharp. A document-ingest provider can no longer register under the reserved name `unknown`, which marks upcast legacy ingest events. The unsubscribe POST route also accepts a JSON body.",
+    "migration": "A delivery channel plugin must now declare `mode` as `\"inline\"` or `\"queued\"` and a function `render`; boot fails otherwise instead of dispatching inline."
+  },
   {
     "version": "0.330.0",
     "type": "improvement",

package/src/derivatives-sharp/changes.json

@@ -1,4 +1,15 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Overlay and blur intermediates are lossless and QR overlays render crisp at their final size",
+    "detail": "The sharp renderer buffers intermediates losslessly before overlays and blur regions, so a JPEG source no longer gains an extra compression generation. QR overlays are generated at their final size and checked against the smaller of output width and height before generation, so a flat output can no longer cache an unscannable QR."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Overlay marginPct must be finite"
+  },
   {
     "version": "0.287.0",
     "type": "improvement",

package/src/document-ingest-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Writing a document extract is idempotent per fileRef",
+    "detail": "`writeDocumentExtractForLiveFileRef` now returns `{ kind: \"skipped\", reason: \"already_extracted\" }` when the fileRef already has a documentExtract, so a redelivered `documentIngest.requested` or a delete-restore race no longer creates a second extract. Providers need no existence check of their own; code that switches exhaustively on `reason` must handle the new value."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Provider name \"unknown\" is reserved for upcast legacy events",
+    "migration": "Registering a document-ingest provider under the name `unknown` now throws; rename any provider that uses it."
+  },
   {
     "version": "0.312.0",
     "type": "breaking",