@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.339.0

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Inbound mail OAuth accounts refresh their access token",
+    "detail": "`createInboundMailSupervisor` obtains a valid access token via the new `createOAuthAccessTokenManager` before `plugin.fetch`/`plugin.watch` for accounts whose provider declares `oauth` and whose authMethod is `oauth`/`xoauth2`, and passes it as `opts.accessToken` (`fetch`) or `{ accessToken }` (`watch`, 4th argument). `refreshAccessToken` receives an optional 4th argument `{ signal }` (aborted after 30 s); providers must pass it to their token-endpoint fetch, since the foundation awaits the provider and never drops a late result. The foundation has no single construction point for routes and supervisor, so apps that want connect to prime the cache and write under the refresh lock create one manager with `createOAuthAccessTokenManager({ db, secrets })` and pass it to both `createInboundMailSupervisor({ oauthTokens })` and `createInboundMailConnectRoutes({ oauthTokens })`; without it the supervisor builds its own manager and the callback writes the secret without the lock. `InboundAuthError` from `refreshAccessToken` moves the account to `auth_error`; the generic sync-error log and the `token_exchange_failed` response body no longer contain provider error messages.",
+    "migration": "Apps with OAuth inbound accounts create one `createOAuthAccessTokenManager({ db, secrets })` and pass it as `oauthTokens` to both `createInboundMailSupervisor` and `createInboundMailConnectRoutes`. Provider plugins with a `refreshAccessToken` pass the `signal` from its fourth argument to their token-endpoint fetch."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/notes-history/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "add-note rejects mentions of non-members; mention export lists mentioning notes",
+    "detail": "notes-history: `add-note` now rejects `mentions` of users who are not members of the current tenant, because their forget run only visits tenants they belong to and would never reach such a note. The notes-history user-data export hook now lists the notes that mention the exporting user.",
+    "migration": "No action needed unless a client mentions user ids that are not members of the tenant; those writes now fail validation."
+  },
   {
     "version": "0.308.0",
     "type": "breaking",

package/src/renderer-simple/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "createRendererSimpleFeature({ mailBranding }) brands every notification mail, including the auth mails, with product name or logo, primary color and footer text and links",
+    "detail": "renderer-simple accepts mailBranding for all framework notification mails",
+    "migration": "No code change needed."
+  }
+]

package/src/subscription-mollie/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "Mollie checkout carries consentId through payment and subscription metadata",
+    "detail": "`consentId` from the checkout options is stored in the first payment's metadata, copied onto the subscription created from it, and returned as `SubscriptionEvent.consentId` when valid. `cancelSubscription` stays unimplemented for Mollie.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Mollie webhooks no longer archive the subscription and payment objects",
+    "detail": "Subscription events parsed from Mollie webhooks no longer include the serialized subscription and trigger payment, which can carry consumer name and account data."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "Stripe checkout sets submit_type, locale, submit text and consentId; cancel can run to period end",
+    "detail": "Checkout sessions in both modes set `submit_type: \"pay\"`. `locale` maps to a Stripe checkout locale (exact match, else the language part such as `de-AT` to `de`, else `\"auto\"`), and `submitMessage` becomes `custom_text.submit.message` (capped at Stripe's 1200 characters). `consentId` is written to `subscription_data.metadata` or `payment_intent_data.metadata` next to `tenantId` and read back from the same place on the webhook. `cancelSubscription` with `when: \"period-end\"` sets `cancel_at_period_end`; `\"immediately\"` cancels the subscription.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Stripe webhooks no longer archive the full provider event",
+    "detail": "Subscription and one-off-payment events parsed from Stripe webhooks, and the snapshot returned by sync-subscriptions, no longer include the serialized Stripe event, so customer details never land in the event store."
+  },
   {
     "version": "0.337.0",
     "type": "fix",

package/src/tags/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "breaking",
+    "title": "ownership.write applies to assign-tag, remove-tag and add-note",
+    "detail": "tags and notes-history: `ownership.write` is now enforced by `assign-tag`, `remove-tag` and `add-note`. Each feature instance builds its write executor from the entity it registers; before, the handlers used a module-level executor without the mount's ownership, so a `from()` write rule never applied to them. The `delete-tag` cascade stays ungated.",
+    "migration": "Mounts that set `ownership.write` now see ownership_denied for callers the rule does not cover. Make sure the rule covers every role that tags or notes, or leave it unset."
+  },
   {
     "version": "0.246.0",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Forget cleanup covers tenants the user already left",
+    "detail": "`runForgetCleanup` builds the per-user tenant list from live memberships plus the user's `tenant-membership.created` history (read from the event payload, so cross-tenant SystemAdmin adds count too), deduplicated. Delete hooks, such as the notes-history mention shred, therefore also run in tenants the user left before the request. The `tenantIdsBeforeDelete` list passed to the deletion-executed mail still contains only the live memberships. Mentions written before notes recorded structured mention rows for non-members are not covered."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/workflow-runner/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "breaking",
+    "title": "workflow-run stream stores a reference to the trigger event instead of its payload",
+    "detail": "`workflow.run-started` now holds `triggerEventRef: { eventId, aggregateId, version }` and no `triggerPayload`; the wait, waitForEvent and retry step events no longer embed it either. `workflow_run_pending` gets a `trigger_event_ref` column and the event-subscriber stops writing `trigger_payload`. `resume-run` loads the trigger and the awaited event through `ctx.loadAggregate` and fails the run with `trigger_event_unavailable` or `awaited_event_unavailable` when one is gone.",
+    "migration": "Own code that reads `triggerPayload` from `workflow.run-started` must read `triggerEventRef` and load the event with `ctx.loadAggregate(ref.aggregateId)`. Apps generate the migration for the new `workflow_run_pending.trigger_event_ref` column with `kumiko schema generate`. The step events `workflow.step.waiting`, `workflow.step.waiting-for-event` and `workflow.retry.scheduled` no longer carry `triggerPayload`; a custom resume loop that read it must load the trigger event through the `triggerEventRef` on its own run-started event (see `samples/recipes/workflow-engine/src/postgres-resume-loop.ts`). Stored run-started events and pending rows keep their old copy; this release rewrites no events, and runs started before it resume from that copy."
+  },
   {
     "version": "0.337.0",
     "type": "fix",