@cosmicdrift/kumiko-bundled-features 0.338.0 → 0.340.0

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -16,16 +16,19 @@
 //      otherwise (wait already wrote its effect; resume past it).
 //
 // The run's ORIGINAL trigger event (the one that started the whole run) is
-// always recovered from the run's own WORKFLOW_RUN_STARTED_TYPE event,
-// never from the pending row — that event always carries it (see
-// WorkflowRunStartedPayload in ./runner). The pending row's own
-// triggerEventType/triggerPayload columns are a DIFFERENT thing: for a
-// waitForEvent suspension they hold the AWAITED event the Phase 3b
+// always re-read from the event store via the triggerEventRef on the run's
+// own WORKFLOW_RUN_STARTED_TYPE event, never from the pending row (see
+// WorkflowRunStartedPayload in ./runner). Neither the run stream nor the
+// pending row holds a copy of a foreign payload, so an erased source event
+// shows up here in its shredded form, and an unloadable one (archived
+// stream) fails the run. The pending row's own
+// triggerEventType/triggerEventRef columns are a DIFFERENT thing: for a
+// waitForEvent suspension they point at the AWAITED event the Phase 3b
 // event-subscriber matched (NULL until then, and NULL forever on a
-// timeout-without-a-match). That payload becomes the resumed pipeline's
-// result for the skipped waitForEvent step itself (see resultKey on
-// steps/wait-for-event.ts) — pre-seeded into stepsAcc below so a
-// subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
+// timeout-without-a-match). That event's payload becomes the resumed
+// pipeline's result for the skipped waitForEvent step itself (see
+// resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
+// a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -113,40 +116,134 @@ function isRunAlreadySettled(runEvents, stepIndex, expectedRetryAttempt) {
         return resumed.stepIndex === stepIndex && resumed.retryAttempt === expectedRetryAttempt;
     });
 }
-function recoverTriggerEvent(runEvents, runId, user) {
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function isTriggerEventRef(value) {
+    return (isRecord(value) &&
+        typeof value["eventId"] === "string" &&
+        typeof value["aggregateId"] === "string" &&
+        typeof value["version"] === "number");
+}
+function readTriggerSource(startedPayload) {
+    if (!isRecord(startedPayload) || typeof startedPayload["triggerEventType"] !== "string") {
+        return null;
+    }
+    const eventType = startedPayload["triggerEventType"];
+    const ref = startedPayload["triggerEventRef"];
+    if (isTriggerEventRef(ref)) {
+        return { kind: "ref", eventType, ref };
+    }
+    if ("triggerPayload" in startedPayload) {
+        return { kind: "legacy-copy", eventType, payload: startedPayload["triggerPayload"] };
+    }
+    return null;
+}
+async function loadReferencedEvent(ctx, ref) {
+    const events = await ctx.loadAggregate(ref.aggregateId);
+    return events.find((e) => e.id === ref.eventId);
+}
+async function recoverTriggerEvent(ctx, runEvents, runId, user) {
     const started = runEvents.find((e) => e.type === WORKFLOW_RUN_STARTED_TYPE);
     if (!started) {
         throw new InternalError({
             message: `workflow-runner:write:resume-run: run ${runId} has no ${WORKFLOW_RUN_STARTED_TYPE} event — cannot recover its trigger event.`,
         });
     }
-    const startedPayload = started.payload; // @cast-boundary event-store-payload
-    const triggerEvent = {
-        type: startedPayload.triggerEventType,
-        payload: startedPayload.triggerPayload,
-        user,
+    const source = readTriggerSource(started.payload);
+    if (!source) {
+        throw new InternalError({
+            message: `workflow-runner:write:resume-run: run ${runId} has a malformed ${WORKFLOW_RUN_STARTED_TYPE} event — neither triggerEventRef nor a legacy triggerPayload.`,
+        });
+    }
+    if (source.kind === "legacy-copy") {
+        return {
+            event: { type: source.eventType, payload: source.payload, user },
+            unavailable: false,
+        };
+    }
+    const triggerEvent = await loadReferencedEvent(ctx, source.ref);
+    if (!triggerEvent) {
+        return { event: null, unavailable: true };
+    }
+    return {
+        event: { type: source.eventType, payload: triggerEvent.payload, user },
+        unavailable: false,
     };
-    return triggerEvent;
+}
+// NULL ref + NULL payload = timeout without a match: the step result stays
+// undefined, same as before. A matched row whose event can no longer be loaded
+// is NOT folded into that case: a later step could not tell "nothing arrived"
+// from "arrived but gone" and would run on missing data, so the run fails
+// instead. Rows matched before the reference existed still carry the copy.
+async function loadAwaitedPayload(ctx, pending) {
+    if (!isTriggerEventRef(pending.triggerEventRef)) {
+        return { unavailable: false, payload: pending.triggerPayload ?? undefined };
+    }
+    const awaited = await loadReferencedEvent(ctx, pending.triggerEventRef);
+    return awaited ? { unavailable: false, payload: awaited.payload } : { unavailable: true };
 }
 // The suspended waitForEvent step itself is skipped on resume
 // (resumeFrom = stepIndex + 1) — its run() never re-executes, so its
 // resultKey (args.event, see steps/wait-for-event.ts) never gets
-// populated by the normal runStepList loop. Seed it here from the
-// pending row's own triggerPayload so a subsequent step's resolver
-// sees the matched event via `ctx.steps[awaits.someKey]`, same as any
-// other step result. NULL on a timeout-without-a-match — a later
-// resolver reading it just sees `undefined`, no special-casing needed.
-function seedResumedStepResults(pending, steps, stepIndex) {
+// populated by the normal runStepList loop. Seed it here from the awaited
+// event's payload so a subsequent step's resolver sees the matched event via
+// `ctx.steps[awaits.someKey]`, same as any other step result.
+function seedResumedStepResults(suspensionEventType, awaitedPayload, steps, stepIndex) {
     const stepsAcc = {};
-    if (pending.suspensionEventType === WORKFLOW_WAITING_FOR_EVENT_TYPE) {
+    if (suspensionEventType === WORKFLOW_WAITING_FOR_EVENT_TYPE) {
         const suspendedStep = steps[stepIndex];
         const key = suspendedStep && getStep(suspendedStep.kind)?.resultKey?.(suspendedStep.args);
         if (key !== undefined) {
-            stepsAcc[key] = pending.triggerPayload;
+            stepsAcc[key] = awaitedPayload;
         }
     }
     return stepsAcc;
 }
+async function runResumedPipeline(ctx, input) {
+    const { workflow, workflowName, runId, stepIndex, resumeFrom, triggerEvent, awaitedPayload, pending, } = input;
+    try {
+        const steps = buildPipelineSteps(workflow.pipelineDef, triggerEvent);
+        const workflowCtx = {
+            runId,
+            workflowName,
+            stepIndex,
+            definitionFingerprint: pending.definitionFingerprint ?? undefined,
+            ...(pending.retryAttempt !== null && { retryAttempt: pending.retryAttempt + 1 }),
+        };
+        const stepsAcc = seedResumedStepResults(pending.suspensionEventType, awaitedPayload, steps, stepIndex);
+        const outcome = await runStepList(steps, triggerEvent, ctx, stepsAcc, {}, workflowCtx, resumeFrom);
+        if (outcome.kind === "suspended") {
+            if (!isResumableSuspension(steps, outcome.stepIndex)) {
+                throw new WorkflowSuspensionUnsupportedError(workflowName, outcome.stepIndex);
+            }
+            // Another suspension further down the pipeline — pending-projection.ts
+            // already materialised the new row; nothing more to do this pass.
+            return { isSuccess: true, data: { outcome: "suspended" } };
+        }
+        const completedPayload = {
+            workflowName,
+            stepIndex: steps.length,
+        };
+        await ctx.unsafeAppendEvent({
+            aggregateId: runId,
+            aggregateType: WORKFLOW_AGGREGATE_TYPE,
+            type: WORKFLOW_RUN_COMPLETED_TYPE,
+            payload: completedPayload,
+        });
+        return { isSuccess: true, data: { outcome: "completed" } };
+    }
+    catch (error) {
+        log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
+        const failedPayload = {
+            workflowName,
+            stepIndex,
+            error: describeWorkflowStepError(error),
+        };
+        await appendRunFailed(ctx, runId, failedPayload);
+        return { isSuccess: true, data: { outcome: "failed" } };
+    }
+}
 export const resumeRunHandler = {
     name: "resume-run",
     agent: { expose: false },
@@ -198,48 +295,39 @@ export const resumeRunHandler = {
             // pipeline; nothing left for this call to do.
             return { isSuccess: true, data: { outcome: "already-resumed" } };
         }
-        const triggerEvent = recoverTriggerEvent(runEvents, runId, event.user);
-        const resumeFrom = pending.suspensionEventType === WORKFLOW_RETRY_SCHEDULED_TYPE ? stepIndex : stepIndex + 1;
-        try {
-            const steps = buildPipelineSteps(workflow.pipelineDef, triggerEvent);
-            const workflowCtx = {
-                runId,
+        const recovered = await recoverTriggerEvent(ctx, runEvents, runId, event.user);
+        if (recovered.unavailable) {
+            await appendRunFailed(ctx, runId, {
                 workflowName,
                 stepIndex,
-                definitionFingerprint: pending.definitionFingerprint ?? undefined,
-                ...(pending.retryAttempt !== null && { retryAttempt: pending.retryAttempt + 1 }),
-            };
-            const stepsAcc = seedResumedStepResults(pending, steps, stepIndex);
-            const outcome = await runStepList(steps, triggerEvent, ctx, stepsAcc, {}, workflowCtx, resumeFrom);
-            if (outcome.kind === "suspended") {
-                if (!isResumableSuspension(steps, outcome.stepIndex)) {
-                    throw new WorkflowSuspensionUnsupportedError(workflowName, outcome.stepIndex);
-                }
-                // Another suspension further down the pipeline — pending-projection.ts
-                // already materialised the new row; nothing more to do this pass.
-                return { isSuccess: true, data: { outcome: "suspended" } };
-            }
-            const completedPayload = {
-                workflowName,
-                stepIndex: steps.length,
-            };
-            await ctx.unsafeAppendEvent({
-                aggregateId: runId,
-                aggregateType: WORKFLOW_AGGREGATE_TYPE,
-                type: WORKFLOW_RUN_COMPLETED_TYPE,
-                payload: completedPayload,
+                error: `Trigger event of run ${runId} is no longer available — cannot resume.`,
+                reason: "trigger_event_unavailable",
             });
-            return { isSuccess: true, data: { outcome: "completed" } };
+            return { isSuccess: true, data: { outcome: "failed" } };
         }
-        catch (error) {
-            log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
-            const failedPayload = {
+        const triggerEvent = recovered.event;
+        const awaited = pending.suspensionEventType === WORKFLOW_WAITING_FOR_EVENT_TYPE
+            ? await loadAwaitedPayload(ctx, pending)
+            : { unavailable: false, payload: undefined };
+        if (awaited.unavailable) {
+            await appendRunFailed(ctx, runId, {
                 workflowName,
                 stepIndex,
-                error: describeWorkflowStepError(error),
-            };
-            await appendRunFailed(ctx, runId, failedPayload);
+                error: `Awaited event of run ${runId} is no longer available — cannot resume.`,
+                reason: "awaited_event_unavailable",
+            });
             return { isSuccess: true, data: { outcome: "failed" } };
         }
+        const resumeFrom = pending.suspensionEventType === WORKFLOW_RETRY_SCHEDULED_TYPE ? stepIndex : stepIndex + 1;
+        return runResumedPipeline(ctx, {
+            workflow,
+            workflowName,
+            runId,
+            stepIndex,
+            resumeFrom,
+            triggerEvent,
+            awaitedPayload: awaited.payload,
+            pending,
+        });
     },
 };

package/dist/workflow-runner/pending-projection.js

@@ -27,6 +27,7 @@ async function upsertPending(tx, row) {
         // Phase 3's event-subscriber writes these when the awaited event
         // arrives — Phase 1 never touches them, insert or update.
         triggerEventType: null,
+        triggerEventRef: null,
         triggerPayload: null,
     }, { conflictKeys: ["tenantId", "runId", "stepIndex"] });
 }

package/dist/workflow-runner/runner.d.ts

@@ -1,9 +1,14 @@
 import type { HandlerContext, StepInstance, WorkflowDefinition, WriteEvent } from "@cosmicdrift/kumiko-framework/engine";
 export declare function isResumableSuspension(steps: readonly StepInstance[], stepIndex: number): boolean;
+export type TriggerEventRef = {
+    readonly eventId: string;
+    readonly aggregateId: string;
+    readonly version: number;
+};
 export type WorkflowRunStartedPayload = {
     readonly workflowName: string;
     readonly triggerEventType: string;
-    readonly triggerPayload: unknown;
+    readonly triggerEventRef: TriggerEventRef;
     readonly definitionFingerprint: string;
     readonly idempotencyKey?: string;
 };
@@ -35,6 +40,7 @@ export declare function startAndRunWorkflow(args: {
     readonly runId: string;
     readonly workflow: WorkflowDefinition;
     readonly triggerEvent: WriteEvent;
+    readonly triggerEventRef: TriggerEventRef;
     readonly idempotencyKey?: string;
     readonly handlerCtx: HandlerContext;
 }): Promise<{

package/dist/workflow-runner/runner.js

@@ -42,7 +42,7 @@ export async function startAndRunWorkflow(args) {
     const startedPayload = {
         workflowName: args.workflow.name,
         triggerEventType: args.triggerEvent.type,
-        triggerPayload: args.triggerEvent.payload,
+        triggerEventRef: args.triggerEventRef,
         definitionFingerprint: fingerprint,
         ...(args.idempotencyKey && { idempotencyKey: args.idempotencyKey }),
     };

package/dist/workflow-runner/tables.js

@@ -38,8 +38,14 @@ export const workflowRunPendingTable = pgTable("workflow_run_pending", {
     waitEventType: text("wait_event_type"),
     matchExpr: jsonb("match_expr"),
     // Written by the Phase 3 event-subscriber when the awaited event
-    // arrives — always NULL in Phase 1/2.
+    // arrives — always NULL in Phase 1/2. The row points at the awaited event
+    // ({ eventId, aggregateId, version }); resume-run re-reads it from the
+    // event store, so erasing the event also covers the workflow.
     triggerEventType: text("trigger_event_type"),
+    triggerEventRef: jsonb("trigger_event_ref"),
+    // Legacy copy of the awaited payload. No longer written; only rows
+    // matched before the reference existed still carry it, and resume-run
+    // falls back to it for those.
     triggerPayload: jsonb("trigger_payload"),
 }, (t) => [
     primaryKey({
@@ -65,6 +71,7 @@ export const workflowRunPendingTableMeta = defineUnmanagedTable({
         { name: "wait_event_type", pgType: "text", notNull: false },
         { name: "match_expr", pgType: "jsonb", notNull: false },
         { name: "trigger_event_type", pgType: "text", notNull: false },
+        { name: "trigger_event_ref", pgType: "jsonb", notNull: false },
         { name: "trigger_payload", pgType: "jsonb", notNull: false },
     ],
     indexes: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.338.0",
+  "version": "0.340.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -365,6 +365,22 @@
       "types": "./dist/channel-push/index.d.ts",
       "default": "./dist/channel-push/index.js"
     },
+    "./channel-slack": {
+      "types": "./dist/channel-slack/index.d.ts",
+      "default": "./dist/channel-slack/index.js"
+    },
+    "./channel-discord": {
+      "types": "./dist/channel-discord/index.d.ts",
+      "default": "./dist/channel-discord/index.js"
+    },
+    "./channel-teams": {
+      "types": "./dist/channel-teams/index.d.ts",
+      "default": "./dist/channel-teams/index.js"
+    },
+    "./channel-telegram": {
+      "types": "./dist/channel-telegram/index.d.ts",
+      "default": "./dist/channel-telegram/index.js"
+    },
     "./renderer-simple": {
       "types": "./dist/renderer-simple/index.d.ts",
       "default": "./dist/renderer-simple/index.js"
@@ -483,12 +499,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.338.0",
-    "@cosmicdrift/kumiko-framework": "0.338.0",
-    "@cosmicdrift/kumiko-headless": "0.338.0",
-    "@cosmicdrift/kumiko-renderer": "0.338.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.338.0",
-    "@cosmicdrift/kumiko-types": "0.338.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.340.0",
+    "@cosmicdrift/kumiko-framework": "0.340.0",
+    "@cosmicdrift/kumiko-headless": "0.340.0",
+    "@cosmicdrift/kumiko-renderer": "0.340.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.340.0",
+    "@cosmicdrift/kumiko-types": "0.340.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -859,6 +875,22 @@
         "types": "./dist/channel-push/index.d.ts",
         "default": "./dist/channel-push/index.js"
       },
+      "./channel-slack": {
+        "types": "./dist/channel-slack/index.d.ts",
+        "default": "./dist/channel-slack/index.js"
+      },
+      "./channel-discord": {
+        "types": "./dist/channel-discord/index.d.ts",
+        "default": "./dist/channel-discord/index.js"
+      },
+      "./channel-teams": {
+        "types": "./dist/channel-teams/index.d.ts",
+        "default": "./dist/channel-teams/index.js"
+      },
+      "./channel-telegram": {
+        "types": "./dist/channel-telegram/index.d.ts",
+        "default": "./dist/channel-telegram/index.js"
+      },
       "./renderer-simple": {
         "types": "./dist/renderer-simple/index.d.ts",
         "default": "./dist/renderer-simple/index.js"
@@ -985,8 +1017,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.338.0",
-    "@cosmicdrift/kumiko-locale-es": "0.338.0",
+    "@cosmicdrift/kumiko-locale-de": "0.340.0",
+    "@cosmicdrift/kumiko-locale-es": "0.340.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "emailPasswordClient({ loginUrl, postLogoutUrl }) sends unauthenticated visitors to an external login page with a same-origin next path and navigates there on logout",
+    "detail": "emailPasswordClient accepts loginUrl and postLogoutUrl for external login pages",
+    "migration": "No code change needed."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/billing-foundation/changes.json

@@ -1,4 +1,45 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Payment and subscription projections use typed bun-db helpers",
+    "detail": "`payment-received` inserts through `insertOnConflictDoNothing`, subscription events upsert through `upsertOnConflict`. The raw `db/queries/payment-projection.ts` and `subscription-projection.ts` modules are gone.",
+    "migration": "keine"
+  },
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Missing or unchecked checkout consent returns 422 consent_required",
+    "detail": "The consent payload is optional in the `start-plan-checkout` and `create-checkout-session` input schemas and its two flags are plain booleans. `prepareConsent` throws `UnprocessableError(\"consent_required\")` with `billing-foundation.errors.consentRequired` when consumer protection is on and the consent is missing or either flag is not true.",
+    "migration": "Clients that treated the previous `400` validation error for a missing consent as the signal must check for `422` with `reason: \"consent_required\"`."
+  },
+  {
+    "version": "0.339.0",
+    "type": "fix",
+    "title": "Contract confirmation, termination receipt and cancellation pages use \"du\"",
+    "detail": "The German contract confirmation mail, the termination and withdrawal receipt mail, the public cancellation pages and the subscription and payment submit messages address the customer with \"du\". The recorded consent statements are first-person and unchanged, so `consentTextVersion` stays the same."
+  },
+  {
+    "version": "0.339.0",
+    "type": "fix",
+    "title": "The § 312k confirm POST forwards the visitor's host to /api/write",
+    "detail": "The `/legal/kuendigen` and `/legal/cancel` pages re-enter `/api/write` through the app. The re-entry now carries `Host`, `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Tenant` and the `kumiko_tenant` cookie as the visitor sent them, so a host-based `tenantResolver` resolves the same tenant as for a direct call; before, it saw no host and every confirm failed with `400 tenant_required`. The session cookie, `Authorization` and `X-Forwarded-For` are not forwarded.",
+    "migration": "keine"
+  },
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "consumerProtection.terminationScope \"platform\" for hosts without a tenant",
+    "detail": "`consumerProtection.terminationScope` is `\"tenant-host\"` (default, unchanged) or `\"platform\"`. With `\"platform\"`, `request-contract-termination` is flagged `tenantlessAnonymous` and also runs on a host whose resolver returns no tenant: it finds the contract by the declarant's email as before, records on the matched tenant's subscription stream, and answers every outcome identically. An unknown option value fails at `createBillingFoundationFeature`.",
+    "migration": "Apps that serve the pages on a platform apex (publicstatus) set `consumerProtection.terminationScope: \"platform\"`. Other apps change nothing."
+  },
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Public termination declarations cancel at the provider in a job",
+    "detail": "For the public channel, `request-contract-termination` no longer calls the provider in the request. A matched request appends the PII-free `contract-termination-declared` event (`requestId`, `declarationType`, `terminationKind`, `receivedAtIso`, `locale`) via the system-only `declare-contract-termination`; the job `cancel-on-public-termination-declared` then runs `record-contract-termination`, which asks the provider for `cancel_at_period_end` and appends `contract-termination-requested` with the outcome. Matched and unmatched requests do the same work in the request, so the response time does not reveal whether the email is a customer. The job is idempotent per `requestId`. A provider without `cancelSubscription`, a provider error or a missing subscription now sends a separate operator notice with request id and tenant id but no name or email. A public withdrawal still makes no provider call. The account path (`terminate-contract`) stays synchronous.",
+    "migration": "Code that expected `contract-termination-requested` right after the public request must wait for the job (in tests: `drainJobs`)."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Slack, Discord, Microsoft Teams and Telegram delivery channels",
+    "detail": "`channel-slack`, `channel-discord`, `channel-teams` and `channel-telegram` register route-only delivery channels. Webhook URLs and the Telegram bot token live in the tenant's secrets; the send job reads them with an audit entry `<feature>:send`. `DeliveryChannel.resolve` is optional and `ChannelContext.secrets` is available on the send job path.",
+    "migration": "keine"
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "Inbound mail projections use typed bun-db helpers",
+    "detail": "Mail-account and mail-thread events upsert through `upsertOnConflict` (`connectedAt` is only written on insert), inbound messages insert through `insertOnConflictDoNothing`. The raw `db/queries/inbound-projections.ts` module is gone.",
+    "migration": "keine"
+  },
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "Inbound mail OAuth accounts refresh their access token",
+    "detail": "`createInboundMailSupervisor` obtains a valid access token via the new `createOAuthAccessTokenManager` before `plugin.fetch`/`plugin.watch` for accounts whose provider declares `oauth` and whose authMethod is `oauth`/`xoauth2`, and passes it as `opts.accessToken` (`fetch`) or `{ accessToken }` (`watch`, 4th argument). `refreshAccessToken` receives an optional 4th argument `{ signal }` (aborted after 30 s); providers must pass it to their token-endpoint fetch, since the foundation awaits the provider and never drops a late result. The foundation has no single construction point for routes and supervisor, so apps that want connect to prime the cache and write under the refresh lock create one manager with `createOAuthAccessTokenManager({ db, secrets })` and pass it to both `createInboundMailSupervisor({ oauthTokens })` and `createInboundMailConnectRoutes({ oauthTokens })`; without it the supervisor builds its own manager and the callback writes the secret without the lock. `InboundAuthError` from `refreshAccessToken` moves the account to `auth_error`; the generic sync-error log and the `token_exchange_failed` response body no longer contain provider error messages.",
+    "migration": "Apps with OAuth inbound accounts create one `createOAuthAccessTokenManager({ db, secrets })` and pass it as `oauthTokens` to both `createInboundMailSupervisor` and `createInboundMailConnectRoutes`. Provider plugins with a `refreshAccessToken` pass the `signal` from its fourth argument to their token-endpoint fetch."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/renderer-simple/changes.json

@@ -1 +1,9 @@
-[]
+[
+  {
+    "version": "0.339.0",
+    "type": "improvement",
+    "title": "createRendererSimpleFeature({ mailBranding }) brands every notification mail, including the auth mails, with product name or logo, primary color and footer text and links",
+    "detail": "renderer-simple accepts mailBranding for all framework notification mails",
+    "migration": "No code change needed."
+  }
+]

package/src/user/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "The last-SystemAdmin check uses jsonb containment through selectMany",
+    "detail": "Removing the SystemAdmin role still refuses to drop the last active SystemAdmin; the count now comes from `selectMany` with a roles containment filter instead of raw SQL.",
+    "migration": "keine"
+  },
   {
     "version": "0.271.0",
     "type": "improvement",
@@ -8,7 +15,7 @@
   {
     "version": "0.218.1",
     "type": "improvement",
-    "title": "user.email searchable \u2014 reindex required after upgrade",
+    "title": "user.email searchable — reindex required after upgrade",
     "detail": "email gained searchable for roster lookup. buildSearchDocument only runs on write; existing rows need reindexEntity(\"user\") (or the reindex job) plus Meili configure for the new attribute.",
     "migration": "After deploying, run reindexEntity(\"user\") (or the existing reindex job) so pre-upgrade user rows appear in roster search."
   },
@@ -16,28 +23,28 @@
     "version": "0.218.0",
     "type": "fix",
     "title": "user-list: system-scope search; membership roles on tenants; emailVerified sort",
-    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant \u2192 Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only \u2014 TenantAdmin/Admin live on membership (Team \u2192 Members)."
+    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant → Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only — TenantAdmin/Admin live on membership (Team → Members)."
   },
   {
     "version": "0.217.0",
     "type": "improvement",
     "title": "user-list: roles multiSelect + tenants column; roles editable as SystemAdmin (fw#2384 follow-up)",
-    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box \u2014 SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
+    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box — SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
+    "migration": "Run `kumiko-schema generate` and apply — migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
   },
   {
     "version": "0.167.1",
     "type": "breaking",
     "title": "user.locale no longer defaults to \"de\" (fw#1637).",
     "detail": "The entity-level default contradicted tenant-settings' own \"en\" default and silently overrode any app or tenant locale configuration for every new user. locale now stays unset until the client or a resolution chain provides one. Consumers that already fall back with `user.locale ?? \"en\"` are unaffected in shape but now see null instead of \"de\".",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain \u2014 the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
+    "migration": "Run `kumiko-schema generate` and apply — the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain — the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
   },
   {
     "version": "0.167.1",
     "type": "improvement",
     "title": "user.timezone field, wired into ctx.tz (fw#1636).",
     "detail": "The user entity gains a `timezone` field (createTzField, no default). buildHandlerContext passes it to ctx.tz.user; the fallback chain stays tenant.timezone, then \"UTC\". Before this, ctx.tz.tenant and ctx.tz.user both hardcoded \"UTC\" while the plumbing already accepted per-request values.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
+    "migration": "Run `kumiko-schema generate` and apply — the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
   },
   {
     "version": "0.165.3",

package/src/workflow-runner/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "The resume job reads due runs through the job's TenantDb",
+    "detail": "`selectDueWorkflowRunPending` takes a `TenantDb` and returns `{ runId, stepIndex }` rows, so the tenant filter comes from the TenantDb instead of a hand-written `WHERE tenant_id`.",
+    "migration": "keine"
+  },
+  {
+    "version": "0.339.0",
+    "type": "breaking",
+    "title": "workflow-run stream stores a reference to the trigger event instead of its payload",
+    "detail": "`workflow.run-started` now holds `triggerEventRef: { eventId, aggregateId, version }` and no `triggerPayload`; the wait, waitForEvent and retry step events no longer embed it either. `workflow_run_pending` gets a `trigger_event_ref` column and the event-subscriber stops writing `trigger_payload`. `resume-run` loads the trigger and the awaited event through `ctx.loadAggregate` and fails the run with `trigger_event_unavailable` or `awaited_event_unavailable` when one is gone.",
+    "migration": "Own code that reads `triggerPayload` from `workflow.run-started` must read `triggerEventRef` and load the event with `ctx.loadAggregate(ref.aggregateId)`. Apps generate the migration for the new `workflow_run_pending.trigger_event_ref` column with `kumiko schema generate`. The step events `workflow.step.waiting`, `workflow.step.waiting-for-event` and `workflow.retry.scheduled` no longer carry `triggerPayload`; a custom resume loop that read it must load the trigger event through the `triggerEventRef` on its own run-started event (see `samples/recipes/workflow-engine/src/postgres-resume-loop.ts`). Stored run-started events and pending rows keep their old copy; this release rewrites no events, and runs started before it resume from that copy."
+  },
   {
     "version": "0.337.0",
     "type": "fix",

package/dist/billing-foundation/db/queries/payment-projection.d.ts

@@ -1,2 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-export declare function insertPaymentProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>): Promise<void>;

package/dist/billing-foundation/db/queries/payment-projection.js

@@ -1,13 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-// INSERT-once, not UPSERT: unlike subscriptionsProjectionTable (one row per
-// tenant, state overwritten on every event), a payment row is an immutable
-// fact keyed by paymentRowId(tenantId, providerName, providerEventId) — ON
-// CONFLICT DO NOTHING makes a projection rebuild/replay idempotent without
-// ever mutating an existing row.
-export async function insertPaymentProjectionRow(tx, tableName, insertCols) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO NOTHING`;
-    // kumiko-lint-ignore raw-sql tableName + column keys are code-controlled, not user input: tableName is buildEntityTable()'s static table name and insertKeys come from applyPaymentReceived's hardcoded object-literal columns in projection.ts — only values flow through $1..$n
-    await asRawClient(tx).unsafe(sqlText, Object.values(insertCols));
-}

package/dist/billing-foundation/db/queries/subscription-projection.d.ts

@@ -1,2 +0,0 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-export declare function upsertSubscriptionProjectionRow(tx: DbRunner, tableName: string, insertCols: Record<string, unknown>, setClauses: readonly string[], params: readonly unknown[]): Promise<void>;

package/dist/billing-foundation/db/queries/subscription-projection.js

@@ -1,7 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-export async function upsertSubscriptionProjectionRow(tx, tableName, insertCols, setClauses, params) {
-    const insertKeys = Object.keys(insertCols);
-    const insertPlaceholders = insertKeys.map((_, i) => `$${i + 1}`);
-    const sqlText = `INSERT INTO "${tableName}" (${insertKeys.map((k) => `"${k}"`).join(", ")}) VALUES (${insertPlaceholders.join(", ")}) ON CONFLICT ("id") DO UPDATE SET ${setClauses.join(", ")}`;
-    await asRawClient(tx).unsafe(sqlText, params);
-}