@cosmicdrift/kumiko-bundled-features 0.348.0 → 0.348.1

package/dist/channel-email/email-channel.js

@@ -1,4 +1,6 @@
+import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import { DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, DELIVERY_UNSUBSCRIBE_PATH, } from "../delivery/index.js";
+import { decryptStoredPii } from "../shared/index.js";
 import { guardEmailMessage } from "./pii-guard.js";
 // Envelope (From / Reply-To / threading headers) rides on the channel data —
 // the notification's email template echoes it out of the notify() call, since
@@ -87,8 +89,13 @@ export function createEmailChannel(options) {
     return {
         name: "email",
         mode: "queued",
+        // resolveEmail typically returns the raw stored user.email, which is ciphertext under an active KMS.
         async resolve(userId, ctx) {
-            return resolveEmail(userId, ctx);
+            const stored = await resolveEmail(userId, ctx);
+            if (stored === null)
+                return null;
+            const address = await decryptStoredPii(stored, "email", "channel-email:resolve");
+            return address === PII_ERASED_SENTINEL ? null : address;
         },
         render(message, _ctx) {
             return renderMessage(message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.348.0",
+  "version": "0.348.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -503,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.348.0",
-    "@cosmicdrift/kumiko-framework": "0.348.0",
-    "@cosmicdrift/kumiko-headless": "0.348.0",
-    "@cosmicdrift/kumiko-renderer": "0.348.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.348.0",
-    "@cosmicdrift/kumiko-types": "0.348.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.348.1",
+    "@cosmicdrift/kumiko-framework": "0.348.1",
+    "@cosmicdrift/kumiko-headless": "0.348.1",
+    "@cosmicdrift/kumiko-renderer": "0.348.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.348.1",
+    "@cosmicdrift/kumiko-types": "0.348.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1025,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.348.0",
-    "@cosmicdrift/kumiko-locale-es": "0.348.0",
+    "@cosmicdrift/kumiko-locale-de": "0.348.1",
+    "@cosmicdrift/kumiko-locale-es": "0.348.1",
     "jsqr": "^1.4.0"
   }
 }

package/src/channel-email/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.348.1",
+    "type": "fix",
+    "title": "Email channel decrypts the resolved recipient address so notify to users and tenants works with an active KMS",
+    "detail": "Email notifications to resolved users reach the plaintext address under an active KMS\nWith an active PII KMS, an app's `resolveEmail` that reads the stored `user.email` returns ciphertext, and the PII guard rightly refused to send it (`recipient address is a PII ciphertext`). That broke every `notify` target that resolves an address from a user id: a single user, a list of users and `{ tenant }`. The email channel now decrypts the resolved address (`decryptStoredPii`, a no-op without KMS or for plaintext) before it is used for delivery, opt-out checks and the attempt log. The guard is unchanged.",
+    "migration": "No action needed. Apps whose resolveEmail returns the raw stored user.email now send to the plaintext address instead of failing with \"recipient address is a PII ciphertext\"."
+  },
   {
     "version": "0.342.0",
     "type": "improvement",