@cosmicdrift/kumiko-bundled-features 0.352.0 → 0.354.0

package/dist/waitlist/entity.d.ts

@@ -4,6 +4,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -25,6 +26,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -46,6 +48,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -67,6 +70,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -104,6 +108,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -133,13 +138,14 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly invited?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly rejected?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly invited?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly rejected?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"invited" | "pending" | "rejected">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -177,6 +183,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -198,6 +205,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -221,6 +229,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -242,6 +251,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -263,6 +273,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -284,6 +295,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -321,6 +333,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -350,13 +363,14 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
-            readonly invited?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
-            readonly rejected?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly invited?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly rejected?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"invited" | "pending" | "rejected">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -394,6 +408,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -415,6 +430,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
+        readonly minLength?: number;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/workflow-runner/event-trigger.d.ts

@@ -1,2 +1,3 @@
 import type { FeatureRegistrar, WorkflowDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export declare function assertEventTriggerStepsSupported(workflow: WorkflowDefinition): void;
 export declare function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefinition): void;

package/dist/workflow-runner/event-trigger.js

@@ -8,13 +8,62 @@
 // wiring uses the unbound pool), so `workflow.run-started` and the rest of
 // the pipeline are not atomic. A throw from startAndRunWorkflow is recorded
 // as `workflow.run-failed` and swallowed, so the dispatcher moves on.
-import { describeWorkflowStepError, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RUN_FAILED_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
+import { buildPipelineSteps, createSystemUser, describeWorkflowStepError, getStep, SYSTEM_TENANT_ID, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RUN_FAILED_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { workflowRunAggregateId } from "./aggregate-id.js";
 import { registerEventWakeup } from "./event-subscriber.js";
-import { startAndRunWorkflow } from "./runner.js";
+import { startAndRunWorkflow, WorkflowSuspensionUnsupportedError, } from "./runner.js";
 import { registerWorkflow } from "./workflow-registry.js";
 const log = createFallbackLogger("workflow-runner");
+// The MSP apply context only offers unsafeAppendEvent/loadAggregate; these steps reach for
+// ctx.db/write/writeAs and would crash on the first run instead of at registration.
+const STEP_KINDS_NEEDING_HANDLER_CONTEXT = new Set([
+    "aggregate.create",
+    "aggregate.update",
+    "callFeature",
+    "read.findOne",
+    "read.findMany",
+    "unsafeProjectionUpsert",
+    "unsafeProjectionDelete",
+]);
+function* walkStepInstances(steps) {
+    for (const step of steps) {
+        yield step;
+        const { args } = step;
+        if (typeof args !== "object" || args === null)
+            continue;
+        for (const path of getStep(step.kind)?.subPaths ?? []) {
+            const nested = path in args ? Reflect.get(args, path) : undefined;
+            if (Array.isArray(nested))
+                yield* walkStepInstances(nested);
+        }
+    }
+}
+export function assertEventTriggerStepsSupported(workflow) {
+    let steps;
+    try {
+        // Same contract as the boot validator for handler pipelines: the closure must build its
+        // step list from the step builder alone, so an empty event is enough to enumerate kinds.
+        steps = buildPipelineSteps(workflow.pipelineDef, {
+            type: "workflow-registration-probe",
+            payload: {},
+            user: createSystemUser(SYSTEM_TENANT_ID),
+        });
+    }
+    catch (error) {
+        throw new Error(`Workflow "${workflow.name}" pipeline closure threw at registration: ${String(error)}. ` +
+            "Build the step list without reading event payload fields; read them inside step resolvers.", { cause: error });
+    }
+    for (const step of walkStepInstances(steps)) {
+        if (getStep(step.kind) === undefined) {
+            throw new Error(`Workflow "${workflow.name}" uses unknown step kind "${step.kind}"`);
+        }
+        if (STEP_KINDS_NEEDING_HANDLER_CONTEXT.has(step.kind)) {
+            throw new Error(`Workflow "${workflow.name}" is event-triggered but uses step "${step.kind}", which needs a ` +
+                "handler context (db/write) the event-trigger projection does not provide.");
+        }
+    }
+}
 export function registerEventTrigger(r, workflow) {
     // Populate the workflow-registry unconditionally, before the event-trigger
     // guard below — resume-run (framework#2513 Phase 2) looks workflows up by
@@ -28,6 +77,7 @@ export function registerEventTrigger(r, workflow) {
     // need a scheduler, not an MSP, so there is nothing to register here.
     if (workflow.trigger.kind !== "event")
         return;
+    assertEventTriggerStepsSupported(workflow);
     const eventType = workflow.trigger.eventType;
     r.multiStreamProjection({
         name: `workflow-${workflow.name}`,
@@ -41,19 +91,16 @@ export function registerEventTrigger(r, workflow) {
                 // `trigger.filter` below typed without a cast.
                 if (workflow.trigger.kind !== "event")
                     return;
-                if (workflow.trigger.filter) {
-                    const matches = workflow.trigger.filter(event);
-                    // skip: the workflow's own trigger filter rejected this event — not
-                    // this run's concern, so no run is started and nothing is recorded.
-                    if (!matches)
-                        return;
-                }
                 // @cast-boundary msp-to-write-event — the MSP delivers a StoredEvent
                 // (event-store shape); the workflow runner expects a WriteEvent
                 // (handler shape). The fields workflow steps read (type, payload)
                 // overlap exactly — the missing `.user` field is acceptable because
                 // workflow triggers run system-level, not user-scoped.
                 const triggerEvent = event;
+                // skip: the workflow's own trigger filter rejected this event — not this run's
+                // concern, so no run is started and nothing is recorded.
+                if (workflow.trigger.filter && !workflow.trigger.filter(triggerEvent))
+                    return;
                 let idempotencyKey;
                 if (typeof workflow.idempotencyKey === "function") {
                     idempotencyKey = workflow.idempotencyKey(triggerEvent);
@@ -75,23 +122,24 @@ export function registerEventTrigger(r, workflow) {
                             version: event.version,
                         },
                         ...(idempotencyKey && { idempotencyKey }),
-                        // @cast-boundary msp-to-handler-ctx — MultiStreamApplyContext only
-                        // exposes unsafeAppendEvent/loadAggregate, a subset of
-                        // HandlerContext. The step vocabulary this runner drives (wait,
-                        // compute, return) only ever calls unsafeAppendEvent on it.
                         handlerCtx: ctx,
                     });
                 }
                 catch (error) {
+                    // Failures outside the step loop (run-started append) have no step yet, so 0.
+                    const stepIndex = error instanceof WorkflowStepError ||
+                        error instanceof WorkflowSuspensionUnsupportedError
+                        ? error.stepIndex
+                        : 0;
                     log.warn("workflow run failed", {
                         runId,
                         workflowName: workflow.name,
-                        stepIndex: 0,
+                        stepIndex,
                         error: String(error),
                     });
                     const failedPayload = {
                         workflowName: workflow.name,
-                        stepIndex: 0,
+                        stepIndex,
                         error: describeWorkflowStepError(error),
                     };
                     await ctx.unsafeAppendEvent({

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -30,7 +30,7 @@
 // resultKey on steps/wait-for-event.ts) — pre-seeded into stepsAcc below so
 // a subsequent step's resolver can read `ctx.steps[awaits.someKey]`.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, } from "@cosmicdrift/kumiko-framework/engine";
+import { buildPipelineSteps, computeDefinitionFingerprint, describeWorkflowStepError, getStep, runStepList, SYSTEM_ROLE, WORKFLOW_AGGREGATE_TYPE, WORKFLOW_RESUMED_TYPE, WORKFLOW_RETRY_SCHEDULED_TYPE, WORKFLOW_RUN_COMPLETED_TYPE, WORKFLOW_RUN_FAILED_TYPE, WORKFLOW_RUN_STARTED_TYPE, WORKFLOW_WAITING_FOR_EVENT_TYPE, WorkflowStepError, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
@@ -52,6 +52,9 @@ async function appendRunFailed(ctx, runId, failedPayload) {
 }
 function checkQ7Fingerprint(workflow, workflowName, runId, stepIndex, storedFingerprint) {
     const currentFingerprint = computeDefinitionFingerprint(workflow);
+    if (storedFingerprint === null) {
+        log.warn(`Run ${runId} of workflow "${workflowName}" has no stored definition fingerprint — resuming against the current definition unchecked.`);
+    }
     const fingerprintChanged = storedFingerprint !== null && currentFingerprint !== storedFingerprint;
     if (!fingerprintChanged) {
         return null;
@@ -235,9 +238,12 @@ async function runResumedPipeline(ctx, input) {
     }
     catch (error) {
         log.warn("workflow run failed", { runId, workflowName, stepIndex, error: String(error) });
+        // The input stepIndex is the suspended step; the failure happened at the step the resumed pass reached.
         const failedPayload = {
             workflowName,
-            stepIndex,
+            stepIndex: error instanceof WorkflowStepError || error instanceof WorkflowSuspensionUnsupportedError
+                ? error.stepIndex
+                : stepIndex,
             error: describeWorkflowStepError(error),
         };
         await appendRunFailed(ctx, runId, failedPayload);

package/dist/workflow-runner/runner.d.ts

@@ -22,6 +22,7 @@ export type WorkflowRunFailedPayload = {
     readonly error: string;
     readonly reason?: string;
 };
+export type WorkflowRunContext = Pick<HandlerContext, "unsafeAppendEvent">;
 export declare class WorkflowSuspensionUnsupportedError extends Error {
     readonly workflowName: string;
     readonly stepIndex: number;
@@ -42,7 +43,7 @@ export declare function startAndRunWorkflow(args: {
     readonly triggerEvent: WriteEvent;
     readonly triggerEventRef: TriggerEventRef;
     readonly idempotencyKey?: string;
-    readonly handlerCtx: HandlerContext;
+    readonly handlerCtx: WorkflowRunContext;
 }): Promise<{
     readonly outcome: "completed" | "suspended";
 }>;

package/dist/workflow-runner/runner.js

@@ -53,7 +53,11 @@ export async function startAndRunWorkflow(args) {
         payload: startedPayload,
     });
     const steps = buildPipelineSteps(args.workflow.pipelineDef, args.triggerEvent);
-    const outcome = await runStepList(steps, args.triggerEvent, args.handlerCtx, {}, {}, {
+    // @cast-boundary msp-to-handler-ctx — event-trigger hands over the narrower
+    // MultiStreamApplyContext (no query/write/writeAs). The step vocabulary this
+    // runner drives (wait, compute, return) only ever calls unsafeAppendEvent.
+    const stepCtx = args.handlerCtx;
+    const outcome = await runStepList(steps, args.triggerEvent, stepCtx, {}, {}, {
         runId: args.runId,
         workflowName: args.workflow.name,
         stepIndex: 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.352.0",
+  "version": "0.354.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -17,7 +17,8 @@
   "kumiko": {
     "runtime": "runtime",
     "bunOnlyExports": [
-      "./template-resolver/testing"
+      "./template-resolver/testing",
+      "./tenant-lifecycle/testing"
     ]
   },
   "exports": {
@@ -257,6 +258,10 @@
       "types": "./dist/user-data-rights/index.d.ts",
       "default": "./dist/user-data-rights/index.js"
     },
+    "./user-data-rights/email-templates": {
+      "types": "./dist/user-data-rights/email-templates.d.ts",
+      "default": "./dist/user-data-rights/email-templates.js"
+    },
     "./user-data-rights/web": {
       "types": "./dist/user-data-rights/web/index.d.ts",
       "default": "./dist/user-data-rights/web/index.js"
@@ -285,6 +290,10 @@
       "types": "./dist/tenant-lifecycle/index.d.ts",
       "default": "./dist/tenant-lifecycle/index.js"
     },
+    "./tenant-lifecycle/testing": {
+      "types": "./dist/tenant-lifecycle/testing.d.ts",
+      "default": "./dist/tenant-lifecycle/testing.js"
+    },
     "./tenant-handover": {
       "types": "./dist/tenant-handover/index.d.ts",
       "default": "./dist/tenant-handover/index.js"
@@ -317,6 +326,10 @@
       "types": "./dist/auth-email-password/index.d.ts",
       "default": "./dist/auth-email-password/index.js"
     },
+    "./auth-email-password/email-templates": {
+      "types": "./dist/auth-email-password/email-templates.d.ts",
+      "default": "./dist/auth-email-password/email-templates.js"
+    },
     "./auth-email-password/constants": {
       "types": "./dist/auth-email-password/constants.d.ts",
       "default": "./dist/auth-email-password/constants.js"
@@ -503,12 +516,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.352.0",
-    "@cosmicdrift/kumiko-framework": "0.352.0",
-    "@cosmicdrift/kumiko-headless": "0.352.0",
-    "@cosmicdrift/kumiko-renderer": "0.352.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.352.0",
-    "@cosmicdrift/kumiko-types": "0.352.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.354.0",
+    "@cosmicdrift/kumiko-framework": "0.354.0",
+    "@cosmicdrift/kumiko-headless": "0.354.0",
+    "@cosmicdrift/kumiko-renderer": "0.354.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.354.0",
+    "@cosmicdrift/kumiko-types": "0.354.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -771,6 +784,10 @@
         "types": "./dist/user-data-rights/index.d.ts",
         "default": "./dist/user-data-rights/index.js"
       },
+      "./user-data-rights/email-templates": {
+        "types": "./dist/user-data-rights/email-templates.d.ts",
+        "default": "./dist/user-data-rights/email-templates.js"
+      },
       "./user-data-rights/web": {
         "types": "./dist/user-data-rights/web/index.d.ts",
         "default": "./dist/user-data-rights/web/index.js"
@@ -799,6 +816,10 @@
         "types": "./dist/tenant-lifecycle/index.d.ts",
         "default": "./dist/tenant-lifecycle/index.js"
       },
+      "./tenant-lifecycle/testing": {
+        "types": "./dist/tenant-lifecycle/testing.d.ts",
+        "default": "./dist/tenant-lifecycle/testing.js"
+      },
       "./tenant-handover": {
         "types": "./dist/tenant-handover/index.d.ts",
         "default": "./dist/tenant-handover/index.js"
@@ -831,6 +852,10 @@
         "types": "./dist/auth-email-password/index.d.ts",
         "default": "./dist/auth-email-password/index.js"
       },
+      "./auth-email-password/email-templates": {
+        "types": "./dist/auth-email-password/email-templates.d.ts",
+        "default": "./dist/auth-email-password/email-templates.js"
+      },
       "./auth-email-password/constants": {
         "types": "./dist/auth-email-password/constants.d.ts",
         "default": "./dist/auth-email-password/constants.js"
@@ -1025,8 +1050,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.352.0",
-    "@cosmicdrift/kumiko-locale-es": "0.352.0",
+    "@cosmicdrift/kumiko-locale-de": "0.354.0",
+    "@cosmicdrift/kumiko-locale-es": "0.354.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/agent-tools/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "buildToolCatalog throws when the manifest was built with denyQns the catalog options lack",
+    "migration": "Pass the same denyQns list to buildAgentManifest and buildToolCatalog."
+  },
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Agent manifest screen titles resolve per feature instead of by mount order",
+    "detail": "Agent manifest screen titles no longer depend on feature mount order\nTwo features with a screen of the same short id used to get the title of whichever feature was mounted first. The manifest now looks up the screen's own feature-prefixed title key first and falls back to the unprefixed key."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Audit list paging no longer repeats rows with ascending sort",
+    "detail": "Audit list pages forward without repeats when sorted ascending\n`audit:query:list` with `sortDirection: \"asc\"` returned the same rows again on the next page because the cursor always meant \"older than\". The cursor now follows the sort direction, and ties are broken by event id. Sorting by `type` returns a single page without `nextCursor`, since an event id cannot resume a type-ordered listing."
+  },
   {
     "version": "0.346.0",
     "type": "improvement",

package/src/auth-email-password/changes.json

@@ -1,4 +1,28 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "Invitations pin the invitee's membership version; superseded accept no longer relies on timestamps",
+    "migration": "New nullable column read_tenant_invitations.membership_version: run `kumiko schema generate` and apply the migration before deploying. Invitations issued before the migration keep the timestamp comparison."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Login, MFA verify and MFA preauth setup follow the server landingPath when no valid next parameter is present",
+    "detail": "AuthGate onSuccess receives the landing path. A validated next parameter still wins; a landing path equal to the current path is not followed, so the screen does not reload itself."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Signup-confirm and invite-signup-complete store the request locale on the new user and in the session"
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "INITIAL_SIGNUP_ROLES stays [\"TenantAdmin\", \"Admin\"] as a transition",
+    "detail": "New self-signup owners hold TenantAdmin plus the legacy Admin literal, because handlers that gate on the Admin literal would otherwise lock them out. Both roles show in Team, Members until those handlers gate on access.admin. This supersedes the earlier note that the owner role is only TenantAdmin.",
+    "migration": "Move your own handlers that gate on the Admin literal to access.admin; after that the Admin entry can be dropped from the constant."
+  },
   {
     "version": "0.348.0",
     "type": "fix",

package/src/auth-mfa/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "auth-mfa declares the master-key env slots, so composeEnvSchema requires KUMIKO_SECRETS_MASTER_KEY_V1 when auth-mfa is mounted",
+    "detail": "Review batch H1: framework parts of consumer-app findings.\n- `auth-email-password` exports `issueSignupActivation` (invalidate, mint, store and mail an activation link; the signup-request handler now runs on it), `SIGNUP_ACTIVATION_NOTIFICATION_TYPE`, `storeSignupToken`, `invalidateExistingSignupToken`, `normalizeEmail` and `SIGNUP_TOKEN_KEY_PREFIXES`.\n- `auth-mfa` declares the master-key env slots (`KUMIKO_SECRETS_MASTER_KEY_V1`, `_CURRENT_VERSION`, the `_CIPHERTEXT` twin) as a shared fragment with `secrets`, so a rotated `V<n>` slot is unpacked even without `secrets` mounted.\n- `user-data-rights` exports `TENANT_MODEL_CONFIG_KEY`; `createTemplateResolverApi` takes a `DbRunner`.\n- The user menu's logout item carries `data-testid=\"user-menu-logout\"`.\n- renderer-web: a `Field` description is linked to its text input via `aria-describedby`; the facet filter dropdown is capped to the available viewport height and scrolls; `createBrowserLocaleResolver` takes `normalizeLocale` and the default storage key is exported as `BROWSER_LOCALE_STORAGE_KEY`.\n- testing: `loginViaApi(request, credentials, { bucketKey })`, `CLIENT_IP_HEADER` from `@cosmicdrift/kumiko-testing/e2e`, and a Playwright-free `@cosmicdrift/kumiko-testing/e2e/constants` subpath (`KUMIKO_SECRETS_MASTER_KEY_V1`).",
+    "migration": "Apps that bring their own masterKey provider instead of the env KEK add \"auth-mfa\" to composeEnvSchema's optionalFeatures, like they already do for \"secrets\". Required wins as soon as auth-mfa is not in optionalFeatures, even when `secrets` is listed there."
+  },
   {
     "version": "0.341.0",
     "type": "breaking",

package/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "BillingInfo.prices and getBillingPrices are keyed by the tier union",
+    "migration": "A getBillingPrices that returns keys outside your tier union no longer compiles; remove or rename those keys."
+  },
   {
     "version": "0.346.0",
     "type": "fix",

package/src/channel-in-app/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "in_app_messages gets a tenant, user, created_at index",
+    "migration": "Run `kumiko schema generate`; it emits an in-place CREATE INDEX with no DROP and no rebuild."
+  }
+]

package/src/crypto-shredding/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "forget-subject: the SUBJECT_FORGOTTEN audit now commits before the handler tx does and records cleanupError when a derived-data sweep fails",
+    "detail": "The SUBJECT_FORGOTTEN audit event is appended through the outside-transaction db, so it commits before the handler transaction does and survives a later rollback. If the blind-index sweep or search purge fails, the event carries cleanupError (error code or name, never the message) and the handler then fails; retry to finish the cleanup. The user-lifecycle step runs in a savepoint and no longer aborts the handler transaction."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Writing a personal field of an erased data subject answers 409 subject_erased instead of 500",
+    "detail": "Writing PII to an erased data subject answers 409 `subject_erased`, rebinding a hook's unsafeRaw grant no longer inherits db.global() writes, jobs wait for boot gates before consuming\nA write that has to encrypt a personal field for a subject whose key was erased (crypto-shredding) now fails with a `ConflictError` (409, reason `subject_erased`, i18n in en and de) instead of a 500, on the executor write path and in `encryptForDirectWrite`. A hook's own `unsafeRaw` grant (`withUnsafeRawGrant`) no longer carries the handler's `globalWrites` grant. The job runner starts its BullMQ worker only after the boot gates passed, so a job queued by a previous run cannot execute against an unmet boot precondition. `buildServer` warns at boot when `r.systemScope()` features exist but no RateLimitResolver is configured. The auth, MFA, PAT, change-email and request-deletion handlers declare only the escape-hatch grants they use."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "POST /resubscribe requires the undo token from the POST /unsubscribe response",
+    "migration": "Clients that called the resubscribe route with the unsubscribe token must send the undo token instead: read it from the hidden token field of the page POST /unsubscribe returns (aud kumiko:resubscribe, valid for 1 hour). The unsubscribe token is rejected on /resubscribe with 400, and the undo token is rejected on /unsubscribe."
+  },
   {
     "version": "0.352.0",
     "type": "breaking",

package/src/files/changes.json

@@ -1,4 +1,28 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "FileHandle.derive throws for suffixes outside <name>-<16 hex>",
+    "detail": "Final review batch D.\n- `FileHandle.derive(suffix)` now throws unless the suffix is `<name>-<16 hex>` (build it with `variantSuffix(name, spec)`). Free-form suffixes such as `derive(\"thumb\")` wrote keys the forget/tenant-destroy sweep could not recognize, so those binaries survived erasure. Callers passing a bare name must switch to `variantSuffix`.\n- `resolveKmsWiring` / `requireKmsWiring` throw when a `*_CIPHERTEXT` slot is set without its plaintext, pointing at the async entry points, instead of a misleading \"trio required\" error or a silent plaintext-PII fallback.\n- Event-PII owner/`whenAbsent` resolution now also runs without a configured KMS, so a missing owner fails in dev like in prod.\n- PII event backfill queues rebuilds under a per-run migration id, so a peer replica's re-queue is no longer cleared by another run.\n- `seedAdminGuarded` re-writes the canonical admin's email so the blind index is repaired, and skips undecryptable foreign user rows instead of aborting the boot seed.\n- A tenant-bound `FileContext.list` refuses prefixes outside the tenant's key space.\n- An entityList whose create screen was dropped for the caller's roles now carries `createUnavailable`, so the renderer no longer falls back to a generic create form.\n- Boot validation rejects an object-form `redirect` with `idFrom` whose same-feature target screen carries no id.\n- `defineFeature` throws when `dedupeOptions` holds a nested object (it can never compare equal across two mounts).\n- `FileContext.ref` and `list` (tenant-bound) refuse keys outside `${tenantId}/`; list columns accept `virtual: true`; `httpRoute` session-only routes now pass the global IP rate limit; tenant timezone cache TTL is 30 s; text fields without a personal stance warn at boot; the orphan-derivative sweep keeps derivatives whose original still exists; `piiFields` owner fields that can never yield a string throw unless `whenAbsent` is set.",
+    "migration": "Build the suffix with variantSuffix(name, spec) instead of passing a free-form string."
+  },
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "A tenant-bound FileContext.list throws for prefixes outside the tenant's key space",
+    "migration": "Pass a prefix that starts with `${tenantId}/`."
+  },
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "A tenant-bound FileContext.ref throws for keys outside the tenant's key space",
+    "migration": "Use keys that start with `${tenantId}/`."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "The signed download URL carries a neutral file name instead of the personal fileName"
+  },
   {
     "version": "0.341.0",
     "type": "improvement",

package/src/files-tenant-data/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "The orphan-derivative sweep keeps derivatives whose original still exists in storage"
+  },
   {
     "version": "0.275.0",
     "type": "breaking",

package/src/folders/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "folder:delete removes assignments whose host entity is gone instead of refusing forever",
+    "detail": "An assignment pointing at a hard-deleted, soft-deleted or unregistered host blocked folder:delete permanently with folder_has_assignments, because clear-folder needs a visible host and could not remove it. folder:delete now removes such assignments through the event-store executor (normal delete events) before the check, without the caller's read gate. Assignments of live hosts, including ones the caller cannot see, still block with folder_has_assignments. A refused delete removes nothing. The cleanup runs lazily at folder:delete, not in a host-delete hook, so restoring a soft-deleted host before then keeps its folder."
+  },
   {
     "version": "0.246.0",
     "type": "improvement",