@cosmicdrift/kumiko-bundled-features 0.338.0 → 0.339.0

package/dist/user-data-rights/handlers/request-export.write.js

@@ -58,7 +58,7 @@ export const requestExportWrite = defineWriteHandler({
         const userId = event.user.id;
         const T = getTemporal();
         const now = T.Now.instant();
-        const exportJobRunner = ctx.db.unsafeRaw(REQUEST_EXPORT_REASON);
+        const exportJobRunner = ctx.db.unsafeRaw();
         // Pre-Check: exportJobRunner bypasses the TenantDb-Filter — the
         // TenantDb-Wrapper would hide cross-tenant jobs.
         const existing = await findActiveJob(exportJobRunner, userId);

package/dist/user-data-rights/handlers/restrict-account.write.js

@@ -59,7 +59,7 @@ export const restrictAccountWrite = defineWriteHandler({
                     details: { reason: "admin_required_for_other_user" },
                 }));
             }
-            const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw("checks the target user's membership in the admin's tenant via the DbRunner helper"), event.user, targetUserId);
+            const outside = await denyIfTargetOutsideAdminTenant(ctx.db.unsafeRaw(), event.user, targetUserId);
             if (outside)
                 return outside;
         }
@@ -82,7 +82,7 @@ export const restrictAccountWrite = defineWriteHandler({
                 details: { currentStatus },
             }));
         }
-        await updateUserLifecycle(ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), targetUserId, { status: USER_STATUS.Restricted });
+        await updateUserLifecycle(ctx.db.unsafeRaw(), targetUserId, { status: USER_STATUS.Restricted });
         // Cross-Feature: alle live sessions revoken — sonst koennte der User
         // mit existierendem JWT bis zur Token-Expiry weiter schreiben.
         // ctx.writeAs(systemUser, ...) damit der privileged-Handler die

package/dist/user-data-rights/handlers/run-forget-cleanup.write.js

@@ -36,7 +36,7 @@ export function createRunForgetCleanupHandler(opts = {}) {
                 }));
             }
             const T = getTemporal();
-            const runner = ctx.db.unsafeRaw(RUN_FORGET_CLEANUP_REASON);
+            const runner = ctx.db.unsafeRaw();
             // Operator-triggered forget must also erase binaries, not just rows —
             // it flips users to Deleted, after which the cron never re-processes
             // them, so a row-only delete here would permanently leak the binaries.

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -18,7 +18,7 @@ import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
 // NICHT `event.user.tenantId` (das ist der aktive Tenant zur Lifecycle-Zeit und
 // kann abweichen).
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
-// `conn` is ctx.db.unsafeRaw(reason) (regular handlers) or the open tx
+// `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
 // (forget-cleanup sub-tx) — keeps the event append atomic with the write.
 //
 // Returns `{ applied: false }` instead of throwing only when `options.expect`

package/dist/workflow-runner/event-subscriber.js

@@ -20,7 +20,7 @@
 // This subscriber never resumes a run itself (D3, workflow-resume-loop.md):
 // the MultiStreamApplyContext it runs in has no callFeature/runStepList
 // access, only unsafeAppendEvent/loadAggregate. It writes triggerEventType
-// + triggerPayload + wakeAt=now() onto the matching pending row(s); the
+// + triggerEventRef + wakeAt=now() onto the matching pending row(s); the
 // existing resume-due-runs job (Phase 2) picks the row up on its next
 // cron tick — the one resume path stays exactly the one Phase 2 built.
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -66,7 +66,11 @@ const wakeupApply = async (event, tx) => {
             continue;
         await updateMany(tx, workflowRunPendingTable, {
             triggerEventType: event.type,
-            triggerPayload: event.payload,
+            triggerEventRef: {
+                eventId: event.id,
+                aggregateId: event.aggregateId,
+                version: event.version,
+            },
             wakeAt: getTemporal().Now.instant().toString(),
         }, { tenantId: row.tenantId, runId: row.runId, stepIndex: row.stepIndex });
     }

package/dist/workflow-runner/event-trigger.js

@@ -69,6 +69,11 @@ export function registerEventTrigger(r, workflow) {
                         runId,
                         workflow,
                         triggerEvent,
+                        triggerEventRef: {
+                            eventId: event.id,
+                            aggregateId: event.aggregateId,
+                            version: event.version,
+                        },
                         ...(idempotencyKey && { idempotencyKey }),
                         // @cast-boundary msp-to-handler-ctx — MultiStreamApplyContext only
                         // exposes unsafeAppendEvent/loadAggregate, a subset of

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -16,16 +16,19 @@
 //      otherwise (wait already wrote its effect; resume past it).
 //
 // The run's ORIGINAL trigger event (the one that started the whole run) is
-// always recovered from the run's own WORKFLOW_RUN_STARTED_TYPE event,
-// never from the pending row — that event always carries it (see
-// WorkflowRunStartedPayload in ./runner). The pending row's own
-// triggerEventType/triggerPayload columns are a DIFFERENT thing: for a
-// waitForEvent suspension they hold the AWAITED event the Phase 3b
+// always re-read from the event store via the triggerEventRef on the run's
+// own WORKFLOW_RUN_STARTED_TYPE event, never from the pending row (see
+// WorkflowRunStartedPayload in ./runner). Neither the run stream nor the
+// pending row holds a copy of a foreign payload, so an erased source event
+// shows up here in its shredded form, and an unloadable one (archived
+// stream) fails the run. The pending row's own
+// triggerEventType/triggerEventRef columns are a DIFFERENT thing: for a
+// waitForEvent suspension they point at the AWAITED event the Phase 3b
 // event-subscriber matched (NULL until then, and NULL forever on a
-// timeout-without-a-match). That payload becomes the resumed pipeline's
-// result for the skipped waitForEvent step itself (see resultKey on
-// steps/wait-for-event.ts) — pre-seeded into stepsAcc below so a
-// subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
+// timeout-without-a-match). That event's payload becomes the resumed
+// pipeline's result for the skipped waitForEvent step itself (see
+// resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
+// a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -113,40 +116,134 @@ function isRunAlreadySettled(runEvents, stepIndex, expectedRetryAttempt) {
         return resumed.stepIndex === stepIndex && resumed.retryAttempt === expectedRetryAttempt;
     });
 }
-function recoverTriggerEvent(runEvents, runId, user) {
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function isTriggerEventRef(value) {
+    return (isRecord(value) &&
+        typeof value["eventId"] === "string" &&
+        typeof value["aggregateId"] === "string" &&
+        typeof value["version"] === "number");
+}
+function readTriggerSource(startedPayload) {
+    if (!isRecord(startedPayload) || typeof startedPayload["triggerEventType"] !== "string") {
+        return null;
+    }
+    const eventType = startedPayload["triggerEventType"];
+    const ref = startedPayload["triggerEventRef"];
+    if (isTriggerEventRef(ref)) {
+        return { kind: "ref", eventType, ref };
+    }
+    if ("triggerPayload" in startedPayload) {
+        return { kind: "legacy-copy", eventType, payload: startedPayload["triggerPayload"] };
+    }
+    return null;
+}
+async function loadReferencedEvent(ctx, ref) {
+    const events = await ctx.loadAggregate(ref.aggregateId);
+    return events.find((e) => e.id === ref.eventId);
+}
+async function recoverTriggerEvent(ctx, runEvents, runId, user) {
     const started = runEvents.find((e) => e.type === WORKFLOW_RUN_STARTED_TYPE);
     if (!started) {
         throw new InternalError({
             message: `workflow-runner:write:resume-run: run ${runId} has no ${WORKFLOW_RUN_STARTED_TYPE} event — cannot recover its trigger event.`,
         });
     }
-    const startedPayload = started.payload; // @cast-boundary event-store-payload
-    const triggerEvent = {
-        type: startedPayload.triggerEventType,
-        payload: startedPayload.triggerPayload,
-        user,
+    const source = readTriggerSource(started.payload);
+    if (!source) {
+        throw new InternalError({
+            message: `workflow-runner:write:resume-run: run ${runId} has a malformed ${WORKFLOW_RUN_STARTED_TYPE} event — neither triggerEventRef nor a legacy triggerPayload.`,
+        });
+    }
+    if (source.kind === "legacy-copy") {
+        return {
+            event: { type: source.eventType, payload: source.payload, user },
+            unavailable: false,
+        };
+    }
+    const triggerEvent = await loadReferencedEvent(ctx, source.ref);
+    if (!triggerEvent) {
+        return { event: null, unavailable: true };
+    }
+    return {
+        event: { type: source.eventType, payload: triggerEvent.payload, user },
+        unavailable: false,
     };
-    return triggerEvent;
+}
+// NULL ref + NULL payload = timeout without a match: the step result stays
+// undefined, same as before. A matched row whose event can no longer be loaded
+// is NOT folded into that case: a later step could not tell "nothing arrived"
+// from "arrived but gone" and would run on missing data, so the run fails
+// instead. Rows matched before the reference existed still carry the copy.
+async function loadAwaitedPayload(ctx, pending) {
+    if (!isTriggerEventRef(pending.triggerEventRef)) {
+        return { unavailable: false, payload: pending.triggerPayload ?? undefined };
+    }
+    const awaited = await loadReferencedEvent(ctx, pending.triggerEventRef);
+    return awaited ? { unavailable: false, payload: awaited.payload } : { unavailable: true };
 }
 // The suspended waitForEvent step itself is skipped on resume
 // (resumeFrom = stepIndex + 1) — its run() never re-executes, so its
 // resultKey (args.event, see steps/wait-for-event.ts) never gets
-// populated by the normal runStepList loop. Seed it here from the
-// pending row's own triggerPayload so a subsequent step's resolver
-// sees the matched event via `ctx.steps[awaits.someKey]`, same as any
-// other step result. NULL on a timeout-without-a-match — a later
-// resolver reading it just sees `undefined`, no special-casing needed.
-function seedResumedStepResults(pending, steps, stepIndex) {
+// populated by the normal runStepList loop. Seed it here from the awaited
+// event's payload so a subsequent step's resolver sees the matched event via
+// `ctx.steps[awaits.someKey]`, same as any other step result.
+function seedResumedStepResults(suspensionEventType, awaitedPayload, steps, stepIndex) {
     const stepsAcc = {};
-    if (pending.suspensionEventType === WORKFLOW_WAITING_FOR_EVENT_TYPE) {
+    if (suspensionEventType === WORKFLOW_WAITING_FOR_EVENT_TYPE) {
         const suspendedStep = steps[stepIndex];
         const key = suspendedStep && getStep(suspendedStep.kind)?.resultKey?.(suspendedStep.args);
         if (key !== undefined) {
-            stepsAcc[key] = pending.triggerPayload;
+            stepsAcc[key] = awaitedPayload;
         }
     }
     return stepsAcc;
 }
+async function runResumedPipeline(ctx, input) {
+    const { workflow, workflowName, runId, stepIndex, resumeFrom, triggerEvent, awaitedPayload, pending, } = input;
+    try {
+        const steps = buildPipelineSteps(workflow.pipelineDef, triggerEvent);
+        const workflowCtx = {
+            runId,
+            workflowName,
+            stepIndex,
+            definitionFingerprint: pending.definitionFingerprint ?? undefined,
+            ...(pending.retryAttempt !== null && { retryAttempt: pending.retryAttempt + 1 }),
+        };
+        const stepsAcc = seedResumedStepResults(pending.suspensionEventType, awaitedPayload, steps, stepIndex);
+        const outcome = await runStepList(steps, triggerEvent, ctx, stepsAcc, {}, workflowCtx, resumeFrom);
+        if (outcome.kind === "suspended") {
+            if (!isResumableSuspension(steps, outcome.stepIndex)) {
+                throw new WorkflowSuspensionUnsupportedError(workflowName, outcome.stepIndex);
+            }
+            // Another suspension further down the pipeline — pending-projection.ts
+            // already materialised the new row; nothing more to do this pass.
+            return { isSuccess: true, data: { outcome: "suspended" } };
+        }
+        const completedPayload = {
+            workflowName,
+            stepIndex: steps.length,
+        };
+        await ctx.unsafeAppendEvent({
+            aggregateId: runId,
+            aggregateType: WORKFLOW_AGGREGATE_TYPE,
+            type: WORKFLOW_RUN_COMPLETED_TYPE,
+            payload: completedPayload,
+        });
+        return { isSuccess: true, data: { outcome: "completed" } };
+    }
+    catch (error) {
+        log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
+        const failedPayload = {
+            workflowName,
+            stepIndex,
+            error: describeWorkflowStepError(error),
+        };
+        await appendRunFailed(ctx, runId, failedPayload);
+        return { isSuccess: true, data: { outcome: "failed" } };
+    }
+}
 export const resumeRunHandler = {
     name: "resume-run",
     agent: { expose: false },
@@ -198,48 +295,39 @@ export const resumeRunHandler = {
             // pipeline; nothing left for this call to do.
             return { isSuccess: true, data: { outcome: "already-resumed" } };
         }
-        const triggerEvent = recoverTriggerEvent(runEvents, runId, event.user);
-        const resumeFrom = pending.suspensionEventType === WORKFLOW_RETRY_SCHEDULED_TYPE ? stepIndex : stepIndex + 1;
-        try {
-            const steps = buildPipelineSteps(workflow.pipelineDef, triggerEvent);
-            const workflowCtx = {
-                runId,
+        const recovered = await recoverTriggerEvent(ctx, runEvents, runId, event.user);
+        if (recovered.unavailable) {
+            await appendRunFailed(ctx, runId, {
                 workflowName,
                 stepIndex,
-                definitionFingerprint: pending.definitionFingerprint ?? undefined,
-                ...(pending.retryAttempt !== null && { retryAttempt: pending.retryAttempt + 1 }),
-            };
-            const stepsAcc = seedResumedStepResults(pending, steps, stepIndex);
-            const outcome = await runStepList(steps, triggerEvent, ctx, stepsAcc, {}, workflowCtx, resumeFrom);
-            if (outcome.kind === "suspended") {
-                if (!isResumableSuspension(steps, outcome.stepIndex)) {
-                    throw new WorkflowSuspensionUnsupportedError(workflowName, outcome.stepIndex);
-                }
-                // Another suspension further down the pipeline — pending-projection.ts
-                // already materialised the new row; nothing more to do this pass.
-                return { isSuccess: true, data: { outcome: "suspended" } };
-            }
-            const completedPayload = {
-                workflowName,
-                stepIndex: steps.length,
-            };
-            await ctx.unsafeAppendEvent({
-                aggregateId: runId,
-                aggregateType: WORKFLOW_AGGREGATE_TYPE,
-                type: WORKFLOW_RUN_COMPLETED_TYPE,
-                payload: completedPayload,
+                error: `Trigger event of run ${runId} is no longer available — cannot resume.`,
+                reason: "trigger_event_unavailable",
             });
-            return { isSuccess: true, data: { outcome: "completed" } };
+            return { isSuccess: true, data: { outcome: "failed" } };
         }
-        catch (error) {
-            log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
-            const failedPayload = {
+        const triggerEvent = recovered.event;
+        const awaited = pending.suspensionEventType === WORKFLOW_WAITING_FOR_EVENT_TYPE
+            ? await loadAwaitedPayload(ctx, pending)
+            : { unavailable: false, payload: undefined };
+        if (awaited.unavailable) {
+            await appendRunFailed(ctx, runId, {
                 workflowName,
                 stepIndex,
-                error: describeWorkflowStepError(error),
-            };
-            await appendRunFailed(ctx, runId, failedPayload);
+                error: `Awaited event of run ${runId} is no longer available — cannot resume.`,
+                reason: "awaited_event_unavailable",
+            });
             return { isSuccess: true, data: { outcome: "failed" } };
         }
+        const resumeFrom = pending.suspensionEventType === WORKFLOW_RETRY_SCHEDULED_TYPE ? stepIndex : stepIndex + 1;
+        return runResumedPipeline(ctx, {
+            workflow,
+            workflowName,
+            runId,
+            stepIndex,
+            resumeFrom,
+            triggerEvent,
+            awaitedPayload: awaited.payload,
+            pending,
+        });
     },
 };

package/dist/workflow-runner/pending-projection.js

@@ -27,6 +27,7 @@ async function upsertPending(tx, row) {
         // Phase 3's event-subscriber writes these when the awaited event
         // arrives — Phase 1 never touches them, insert or update.
         triggerEventType: null,
+        triggerEventRef: null,
         triggerPayload: null,
     }, { conflictKeys: ["tenantId", "runId", "stepIndex"] });
 }

package/dist/workflow-runner/runner.d.ts

@@ -1,9 +1,14 @@
 import type { HandlerContext, StepInstance, WorkflowDefinition, WriteEvent } from "@cosmicdrift/kumiko-framework/engine";
 export declare function isResumableSuspension(steps: readonly StepInstance[], stepIndex: number): boolean;
+export type TriggerEventRef = {
+    readonly eventId: string;
+    readonly aggregateId: string;
+    readonly version: number;
+};
 export type WorkflowRunStartedPayload = {
     readonly workflowName: string;
     readonly triggerEventType: string;
-    readonly triggerPayload: unknown;
+    readonly triggerEventRef: TriggerEventRef;
     readonly definitionFingerprint: string;
     readonly idempotencyKey?: string;
 };
@@ -35,6 +40,7 @@ export declare function startAndRunWorkflow(args: {
     readonly runId: string;
     readonly workflow: WorkflowDefinition;
     readonly triggerEvent: WriteEvent;
+    readonly triggerEventRef: TriggerEventRef;
     readonly idempotencyKey?: string;
     readonly handlerCtx: HandlerContext;
 }): Promise<{

package/dist/workflow-runner/runner.js

@@ -42,7 +42,7 @@ export async function startAndRunWorkflow(args) {
     const startedPayload = {
         workflowName: args.workflow.name,
         triggerEventType: args.triggerEvent.type,
-        triggerPayload: args.triggerEvent.payload,
+        triggerEventRef: args.triggerEventRef,
         definitionFingerprint: fingerprint,
         ...(args.idempotencyKey && { idempotencyKey: args.idempotencyKey }),
     };

package/dist/workflow-runner/tables.js

@@ -38,8 +38,14 @@ export const workflowRunPendingTable = pgTable("workflow_run_pending", {
     waitEventType: text("wait_event_type"),
     matchExpr: jsonb("match_expr"),
     // Written by the Phase 3 event-subscriber when the awaited event
-    // arrives — always NULL in Phase 1/2.
+    // arrives — always NULL in Phase 1/2. The row points at the awaited event
+    // ({ eventId, aggregateId, version }); resume-run re-reads it from the
+    // event store, so erasing the event also covers the workflow.
     triggerEventType: text("trigger_event_type"),
+    triggerEventRef: jsonb("trigger_event_ref"),
+    // Legacy copy of the awaited payload. No longer written; only rows
+    // matched before the reference existed still carry it, and resume-run
+    // falls back to it for those.
     triggerPayload: jsonb("trigger_payload"),
 }, (t) => [
     primaryKey({
@@ -65,6 +71,7 @@ export const workflowRunPendingTableMeta = defineUnmanagedTable({
         { name: "wait_event_type", pgType: "text", notNull: false },
         { name: "match_expr", pgType: "jsonb", notNull: false },
         { name: "trigger_event_type", pgType: "text", notNull: false },
+        { name: "trigger_event_ref", pgType: "jsonb", notNull: false },
         { name: "trigger_payload", pgType: "jsonb", notNull: false },
     ],
     indexes: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.338.0",
+  "version": "0.339.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -365,6 +365,22 @@
       "types": "./dist/channel-push/index.d.ts",
       "default": "./dist/channel-push/index.js"
     },
+    "./channel-slack": {
+      "types": "./dist/channel-slack/index.d.ts",
+      "default": "./dist/channel-slack/index.js"
+    },
+    "./channel-discord": {
+      "types": "./dist/channel-discord/index.d.ts",
+      "default": "./dist/channel-discord/index.js"
+    },
+    "./channel-teams": {
+      "types": "./dist/channel-teams/index.d.ts",
+      "default": "./dist/channel-teams/index.js"
+    },
+    "./channel-telegram": {
+      "types": "./dist/channel-telegram/index.d.ts",
+      "default": "./dist/channel-telegram/index.js"
+    },
     "./renderer-simple": {
       "types": "./dist/renderer-simple/index.d.ts",
       "default": "./dist/renderer-simple/index.js"
@@ -483,12 +499,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.338.0",
-    "@cosmicdrift/kumiko-framework": "0.338.0",
-    "@cosmicdrift/kumiko-headless": "0.338.0",
-    "@cosmicdrift/kumiko-renderer": "0.338.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.338.0",
-    "@cosmicdrift/kumiko-types": "0.338.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.339.0",
+    "@cosmicdrift/kumiko-framework": "0.339.0",
+    "@cosmicdrift/kumiko-headless": "0.339.0",
+    "@cosmicdrift/kumiko-renderer": "0.339.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.339.0",
+    "@cosmicdrift/kumiko-types": "0.339.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -859,6 +875,22 @@
         "types": "./dist/channel-push/index.d.ts",
         "default": "./dist/channel-push/index.js"
       },
+      "./channel-slack": {
+        "types": "./dist/channel-slack/index.d.ts",
+        "default": "./dist/channel-slack/index.js"
+      },
+      "./channel-discord": {
+        "types": "./dist/channel-discord/index.d.ts",
+        "default": "./dist/channel-discord/index.js"
+      },
+      "./channel-teams": {
+        "types": "./dist/channel-teams/index.d.ts",
+        "default": "./dist/channel-teams/index.js"
+      },
+      "./channel-telegram": {
+        "types": "./dist/channel-telegram/index.d.ts",
+        "default": "./dist/channel-telegram/index.js"
+      },
       "./renderer-simple": {
         "types": "./dist/renderer-simple/index.d.ts",
         "default": "./dist/renderer-simple/index.js"
@@ -985,8 +1017,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.338.0",
-    "@cosmicdrift/kumiko-locale-es": "0.338.0",
+    "@cosmicdrift/kumiko-locale-de": "0.339.0",
+    "@cosmicdrift/kumiko-locale-es": "0.339.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "emailPasswordClient({ loginUrl, postLogoutUrl }) sends unauthenticated visitors to an external login page with a same-origin next path and navigates there on logout",
+    "detail": "emailPasswordClient accepts loginUrl and postLogoutUrl for external login pages",
+    "migration": "No code change needed."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/billing-foundation/changes.json

@@ -1,4 +1,38 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Missing or unchecked checkout consent returns 422 consent_required",
+    "detail": "The consent payload is optional in the `start-plan-checkout` and `create-checkout-session` input schemas and its two flags are plain booleans. `prepareConsent` throws `UnprocessableError(\"consent_required\")` with `billing-foundation.errors.consentRequired` when consumer protection is on and the consent is missing or either flag is not true.",
+    "migration": "Clients that treated the previous `400` validation error for a missing consent as the signal must check for `422` with `reason: \"consent_required\"`."
+  },
+  {
+    "version": "0.339.0",
+    "type": "fix",
+    "title": "Contract confirmation, termination receipt and cancellation pages use \"du\"",
+    "detail": "The German contract confirmation mail, the termination and withdrawal receipt mail, the public cancellation pages and the subscription and payment submit messages address the customer with \"du\". The recorded consent statements are first-person and unchanged, so `consentTextVersion` stays the same."
+  },
+  {
+    "version": "0.339.0",
+    "type": "fix",
+    "title": "The § 312k confirm POST forwards the visitor's host to /api/write",
+    "detail": "The `/legal/kuendigen` and `/legal/cancel` pages re-enter `/api/write` through the app. The re-entry now carries `Host`, `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Tenant` and the `kumiko_tenant` cookie as the visitor sent them, so a host-based `tenantResolver` resolves the same tenant as for a direct call; before, it saw no host and every confirm failed with `400 tenant_required`. The session cookie, `Authorization` and `X-Forwarded-For` are not forwarded.",
+    "migration": "keine"
+  },
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "consumerProtection.terminationScope \"platform\" for hosts without a tenant",
+    "detail": "`consumerProtection.terminationScope` is `\"tenant-host\"` (default, unchanged) or `\"platform\"`. With `\"platform\"`, `request-contract-termination` is flagged `tenantlessAnonymous` and also runs on a host whose resolver returns no tenant: it finds the contract by the declarant's email as before, records on the matched tenant's subscription stream, and answers every outcome identically. An unknown option value fails at `createBillingFoundationFeature`.",
+    "migration": "Apps that serve the pages on a platform apex (publicstatus) set `consumerProtection.terminationScope: \"platform\"`. Other apps change nothing."
+  },
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Public termination declarations cancel at the provider in a job",
+    "detail": "For the public channel, `request-contract-termination` no longer calls the provider in the request. A matched request appends the PII-free `contract-termination-declared` event (`requestId`, `declarationType`, `terminationKind`, `receivedAtIso`, `locale`) via the system-only `declare-contract-termination`; the job `cancel-on-public-termination-declared` then runs `record-contract-termination`, which asks the provider for `cancel_at_period_end` and appends `contract-termination-requested` with the outcome. Matched and unmatched requests do the same work in the request, so the response time does not reveal whether the email is a customer. The job is idempotent per `requestId`. A provider without `cancelSubscription`, a provider error or a missing subscription now sends a separate operator notice with request id and tenant id but no name or email. A public withdrawal still makes no provider call. The account path (`terminate-contract`) stays synchronous.",
+    "migration": "Code that expected `contract-termination-requested` right after the public request must wait for the job (in tests: `drainJobs`)."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Slack, Discord, Microsoft Teams and Telegram delivery channels",
+    "detail": "`channel-slack`, `channel-discord`, `channel-teams` and `channel-telegram` register route-only delivery channels. Webhook URLs and the Telegram bot token live in the tenant's secrets; the send job reads them with an audit entry `<feature>:send`. `DeliveryChannel.resolve` is optional and `ChannelContext.secrets` is available on the send job path.",
+    "migration": "keine"
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Inbound mail OAuth accounts refresh their access token",
+    "detail": "`createInboundMailSupervisor` obtains a valid access token via the new `createOAuthAccessTokenManager` before `plugin.fetch`/`plugin.watch` for accounts whose provider declares `oauth` and whose authMethod is `oauth`/`xoauth2`, and passes it as `opts.accessToken` (`fetch`) or `{ accessToken }` (`watch`, 4th argument). `refreshAccessToken` receives an optional 4th argument `{ signal }` (aborted after 30 s); providers must pass it to their token-endpoint fetch, since the foundation awaits the provider and never drops a late result. The foundation has no single construction point for routes and supervisor, so apps that want connect to prime the cache and write under the refresh lock create one manager with `createOAuthAccessTokenManager({ db, secrets })` and pass it to both `createInboundMailSupervisor({ oauthTokens })` and `createInboundMailConnectRoutes({ oauthTokens })`; without it the supervisor builds its own manager and the callback writes the secret without the lock. `InboundAuthError` from `refreshAccessToken` moves the account to `auth_error`; the generic sync-error log and the `token_exchange_failed` response body no longer contain provider error messages.",
+    "migration": "Apps with OAuth inbound accounts create one `createOAuthAccessTokenManager({ db, secrets })` and pass it as `oauthTokens` to both `createInboundMailSupervisor` and `createInboundMailConnectRoutes`. Provider plugins with a `refreshAccessToken` pass the `signal` from its fourth argument to their token-endpoint fetch."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/renderer-simple/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "createRendererSimpleFeature({ mailBranding }) brands every notification mail, including the auth mails, with product name or logo, primary color and footer text and links",
+    "detail": "renderer-simple accepts mailBranding for all framework notification mails",
+    "migration": "No code change needed."
+  }
+]

package/src/workflow-runner/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "breaking",
+    "title": "workflow-run stream stores a reference to the trigger event instead of its payload",
+    "detail": "`workflow.run-started` now holds `triggerEventRef: { eventId, aggregateId, version }` and no `triggerPayload`; the wait, waitForEvent and retry step events no longer embed it either. `workflow_run_pending` gets a `trigger_event_ref` column and the event-subscriber stops writing `trigger_payload`. `resume-run` loads the trigger and the awaited event through `ctx.loadAggregate` and fails the run with `trigger_event_unavailable` or `awaited_event_unavailable` when one is gone.",
+    "migration": "Own code that reads `triggerPayload` from `workflow.run-started` must read `triggerEventRef` and load the event with `ctx.loadAggregate(ref.aggregateId)`. Apps generate the migration for the new `workflow_run_pending.trigger_event_ref` column with `kumiko schema generate`. The step events `workflow.step.waiting`, `workflow.step.waiting-for-event` and `workflow.retry.scheduled` no longer carry `triggerPayload`; a custom resume loop that read it must load the trigger event through the `triggerEventRef` on its own run-started event (see `samples/recipes/workflow-engine/src/postgres-resume-loop.ts`). Stored run-started events and pending rows keep their old copy; this release rewrites no events, and runs started before it resume from that copy."
+  },
   {
     "version": "0.337.0",
     "type": "fix",