@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.362.0",
+  "version": "0.364.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -358,6 +358,10 @@
       "types": "./dist/shared/row-bound-grant.d.ts",
       "default": "./dist/shared/row-bound-grant.js"
     },
+    "./shared/mail-template-body": {
+      "types": "./dist/shared/mail-template-body.d.ts",
+      "default": "./dist/shared/mail-template-body.js"
+    },
     "./delivery": {
       "types": "./dist/delivery/index.d.ts",
       "default": "./dist/delivery/index.js"
@@ -394,10 +398,6 @@
       "types": "./dist/channel-telegram/index.d.ts",
       "default": "./dist/channel-telegram/index.js"
     },
-    "./renderer-simple": {
-      "types": "./dist/renderer-simple/index.d.ts",
-      "default": "./dist/renderer-simple/index.js"
-    },
     "./renderer-pdf": {
       "types": "./dist/renderer-pdf/index.d.ts",
       "default": "./dist/renderer-pdf/index.js"
@@ -458,6 +458,10 @@
       "types": "./dist/template-resolver/index.d.ts",
       "default": "./dist/template-resolver/index.js"
     },
+    "./template-resolver/document-schema": {
+      "types": "./dist/template-resolver/document-schema.d.ts",
+      "default": "./dist/template-resolver/document-schema.js"
+    },
     "./template-resolver/seeding": {
       "types": "./dist/template-resolver/seeding.d.ts",
       "default": "./dist/template-resolver/seeding.js"
@@ -520,17 +524,27 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.362.0",
-    "@cosmicdrift/kumiko-framework": "0.362.0",
-    "@cosmicdrift/kumiko-headless": "0.362.0",
-    "@cosmicdrift/kumiko-renderer": "0.362.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.362.0",
-    "@cosmicdrift/kumiko-types": "0.362.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.364.0",
+    "@cosmicdrift/kumiko-framework": "0.364.0",
+    "@cosmicdrift/kumiko-headless": "0.364.0",
+    "@cosmicdrift/kumiko-renderer": "0.364.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.364.0",
+    "@cosmicdrift/kumiko-types": "0.364.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
+    "@tiptap/core": "3.31.3",
+    "@tiptap/extension-link": "3.31.3",
+    "@tiptap/extension-list": "3.31.3",
+    "@tiptap/extension-table": "3.31.3",
+    "@tiptap/html": "3.31.3",
+    "@tiptap/extensions": "3.31.3",
+    "@tiptap/pm": "3.31.3",
+    "@tiptap/react": "3.31.3",
+    "@tiptap/starter-kit": "3.31.3",
     "@types/mailparser": "^3.4.6",
     "@types/qrcode": "^1.5.5",
     "clsx": "^2.1.1",
+    "happy-dom": "^20.11.2",
     "hono": "^4.13.1",
     "imapflow": "^1.7.8",
     "ioredis": "^5.10.1",
@@ -542,6 +556,7 @@
     "pdf-lib": "^1.17.1",
     "qrcode": "^1.5.4",
     "react": "^19.2.6",
+    "react-dom": "^19.2.6",
     "sharp": "^0.35.5",
     "stripe": "^22.6.2",
     "tailwind-merge": "^3.6.0",
@@ -889,6 +904,10 @@
         "types": "./dist/shared/row-bound-grant.d.ts",
         "default": "./dist/shared/row-bound-grant.js"
       },
+      "./shared/mail-template-body": {
+        "types": "./dist/shared/mail-template-body.d.ts",
+        "default": "./dist/shared/mail-template-body.js"
+      },
       "./delivery": {
         "types": "./dist/delivery/index.d.ts",
         "default": "./dist/delivery/index.js"
@@ -925,10 +944,6 @@
         "types": "./dist/channel-telegram/index.d.ts",
         "default": "./dist/channel-telegram/index.js"
       },
-      "./renderer-simple": {
-        "types": "./dist/renderer-simple/index.d.ts",
-        "default": "./dist/renderer-simple/index.js"
-      },
       "./renderer-pdf": {
         "types": "./dist/renderer-pdf/index.d.ts",
         "default": "./dist/renderer-pdf/index.js"
@@ -989,6 +1004,10 @@
         "types": "./dist/template-resolver/index.d.ts",
         "default": "./dist/template-resolver/index.js"
       },
+      "./template-resolver/document-schema": {
+        "types": "./dist/template-resolver/document-schema.d.ts",
+        "default": "./dist/template-resolver/document-schema.js"
+      },
       "./template-resolver/seeding": {
         "types": "./dist/template-resolver/seeding.d.ts",
         "default": "./dist/template-resolver/seeding.js"
@@ -1059,8 +1078,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.362.0",
-    "@cosmicdrift/kumiko-locale-es": "0.362.0",
+    "@cosmicdrift/kumiko-locale-de": "0.364.0",
+    "@cosmicdrift/kumiko-locale-es": "0.364.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.364.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/admin-shell/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "includeDocumentDesigner lists the template navs in the admin workspaces",
+    "detail": "With includeDocumentDesigner, the tenant workspace shows document-designer:nav:templates and the platform workspace document-designer:nav:platform-templates. The option requires the document-designer feature and defaults to false."
+  },
   {
     "version": "0.330.0",
     "type": "breaking",

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Audit list pages by id unless sorted by type",
+    "detail": "An explicit createdAt sort pages in id order so keyset pagination no longer skips rows."
+  },
   {
     "version": "0.361.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,55 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A loginUrl builder that throws no longer crashes the app tree",
+    "detail": "The auth gate resolves the login redirect once per location change and, when the builder returns an invalid URL or throws, logs the error and shows the built-in login screen instead of throwing during render."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "How to send an auth mail after the render*Email helpers were removed in 0.363.0",
+    "detail": "No runtime change. The 0.363.0 breaking entry lists renderActivationEmail, renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail and renderInviteEmail as removed but does not say how app code that rendered one of these mails itself now sends it. This entry adds that recipe.",
+    "migration": "App code that rendered an auth mail itself and passed the result as `data`, for example `notify(\"auth-email-password:signup-activation\", { route: { email }, data: renderActivationEmail({ url, expiresAt, locale, appName }), priority: \"critical\" })`, breaks twice since 0.363.0: the helper is gone and the notification type is now `auth-email-password:notify:signup-activation`. The stored template renders subject and body; the app only passes template variables.\nFor a signup activation link, call `issueSignupActivation({ redis, notify: ctx.notify, email, appUrl, appName, locale, timeZone, tokenTtlMinutes, onTokenStored })` from `@cosmicdrift/kumiko-bundled-features/auth-email-password` (only redis, notify, email and appUrl are required). It drops any live signup token for the email, stores a new one under the keys signup-confirm reads and sends the mail. `appUrl` is the bare activation page; a function `(locale) => url` picks the page per locale.\nIf the app stores the token itself and only needs the mail, call `ctx.notify(AuthMailNotificationTypes.signupActivation, { route: { email }, data: { appName, actionUrl, validFor, validUntil }, locale, priority: \"critical\" })`. `AuthMailNotificationTypes` comes from `@cosmicdrift/kumiko-bundled-features/auth-email-password`. All four variables are required strings: ctx.notify checks them against the declared template variables and throws an InternalError on a missing or invalid one, which fails the write. `actionUrl` is the page URL with `token=<encodeURIComponent(token)>` appended as a query parameter and must be an http, https or mailto URL. `validFor` and `validUntil` come from `tokenMailExpiry({ expiresAt, issuedAt, timeZone }, locale)` in `@cosmicdrift/kumiko-bundled-features/auth-email-password/email-templates`. Only send a `locale` that has a template for the type, because the renderer has no locale fallback and a locale without a template sends nothing: use `resolveMailLocale(locale)` when `hasMailTranslationKey(resolveMailLocale(locale), \"auth.mail.activation.subject\")` is true (both from `@cosmicdrift/kumiko-framework/i18n`), otherwise `\"en\"`. The other mails use the subject keys `auth.mail.reset.subject`, `auth.mail.unlock.subject`, `auth.mail.verify.subject` and `auth.mail.invite.subject`.\nThe other auth mails work the same way with `AuthMailNotificationTypes.passwordReset`, `.accountUnlock`, `.emailVerification` and `.invite`; the invite mail also needs a `role` variable."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "seedAdminGuarded rewrites the admin email only when its blind index is missing or stale",
+    "detail": "rewriteSeededUserEmail returns early when the stored email blind index already matches the expected value, so repeated boots no longer re-encrypt the email and grow the user event stream. The row version is now checked with a type guard instead of a cast."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Bootstrap reruns no longer rewrite encrypted config or restore dropped global roles",
+    "detail": "Declarative bootstrap compares encrypted and piiEncrypted config keys by their decrypted value, so a matching rerun writes nothing, and re-issues an invitation whose stored global roles are no longer in the plan. makeDispatchWriteAs is exported from the framework api."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Email payload buckets ignore plus-tags and case; auth requests are capped at 3 per 15 minutes",
+    "detail": "additionalRateLimits accepts normalize: email, which lowercases and strips the plus-tag before hashing, and bucket keys are scoped by tenant and handler. Signup and token requests (reset, unlock, verification) and the waitlist default use it with a 3-request, 900-second window."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Password change and logout work for members with only an app role or TenantAdmin",
+    "detail": "Both handlers required User, Admin or SystemAdmin and answered 403 access_denied for invited members holding a single custom role. They are now open to every signed-in user, like the other self-service handlers; anonymous callers are still rejected."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "AuthMailContent is removed",
+    "detail": "The sections-based content type only fed the retired renderer-simple. Auth mails are template notifications with variables, so nothing builds or consumes AuthMailContent anymore.",
+    "migration": "Drop AuthMailContent imports; the auth mail text lives in the seeded templates and is overridden per tenant in the template editor."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Auth mails are notifications with seeded templates, render*Email is gone",
+    "detail": "password-reset, account-unlock, email-verification, signup-activation and invite are declared as r.notification with a localized template and variables, seeded as system templates at boot and rendered by renderer-mail-html, so a tenant can override the text in the template editor. A locale without its own subject key falls back to en, because the renderer has no locale fallback. AuthMailNotificationTypes is exported for the qualified names.",
+    "migration": "The notification types are now `auth-email-password:notify:<name>` (before: the plain names). Update delivery preferences, preference rows and tests that reference the old names. renderResetPasswordEmail, renderUnlockAccountEmail, renderVerifyEmail, renderActivationEmail, renderInviteEmail, AuthMailSection, RenderTokenContentArgs and RenderInviteEmailArgs are removed; AuthMailContent stays. An app that mounts auth-email-password now needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html (composeRendererStack() from dev-server mounts all of them; with includeBundled, composeFeatures adds whichever is missing). Boot fails with a clear error otherwise, and apps without the template tables need a schema migration (`kumiko schema generate`). kumiko-schema-check counts the three as implicit features of every HAS_AUTH app, so its check fails until that migration exists. Tests that read the token from a mail use the text part (`mail.text`); the html part encodes `=` as `&#x3D;`."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/src/billing-foundation/changes.json

@@ -1,4 +1,47 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Stale subscription created events are ignored and manual-grant skips are logged",
+    "detail": "A created event for a subscription that is no longer current no longer replaces the active one while the current row blocks checkout, and the tier sync logs its own code when a manual grant keeps the tier."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Contract confirmation mail renders the terms' Markdown as formatting",
+    "detail": "The terms rows of the contract confirmation mail were plain text, so `**Right to cancel.**` reached the buyer with its asterisks (0.363.0) or lost its emphasis. Each row of `termsParagraphs` is now a richText value: bold, italic and http(s)/mailto/tel links render as HTML, headings become bold rows. Author HTML and images in the terms stay escaped text, and links outside those schemes stay \"label (url)\". Tenant overrides of the template keep working, the variable name and row structure are unchanged."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Terms in the contract confirmation mail no longer show raw Markdown",
+    "detail": "The terms Markdown is reduced to plain text rows: bold and italic markers are dropped, links become \"label (url)\", list items get their own row, and single line breaks inside a paragraph become spaces."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "The termination receipt rate limit keys Redis with a keyed, handler-bound digest instead of an unkeyed SHA-256 of the email",
+    "detail": "HandlerContext gains an optional rateLimitDigest(value), an HMAC bound to the running handler, so a handler can build rate-limit keys without plaintext identifiers and cannot reproduce the dispatcher's payload-bucket digests. normalizePayloadBucketValue is exported from the pipeline entry point. The receipt limit reuses it, and withholds the receipt mail (the declaration is still recorded) when no digest is wired. Payload-bucket normalization now applies Unicode NFKC first, so fullwidth lookalikes share a bucket. Existing receipt buckets restart empty; they expire after the 24 hour window."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Checkout validates the one-off order label and price lookup",
+    "detail": "An invalid oneOffItemLabel or a provider without retrievePrices fails with a configuration error before the provider is called."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Contract termination downgrades late withdrawals and caps receipt mails",
+    "detail": "A withdrawal declared after the 14-day period ends at period end (operator notice withdrawal_period_expired); the declaration is always accepted, receipt mails are capped at 3 per recipient per day and carry only enum fields, request id and time; purchaser roles come from the catalog."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Contract confirmation and termination mails use template variables",
+    "detail": "contract-confirmation, contract-termination-receipt and contract-termination-operator-notice are r.notification declarations with variables and localized templates (de, en). The notification types are qualified names now (billing-foundation:notify:<name>). The notify data is the template variable object (subject, details, contractLines, termsParagraphs, operatorEmail), not sections.",
+    "migration": "Update delivery preferences and tests that referenced the old type strings, and anything that listens to the notification data. An app that mounts it without includeBundled needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html at boot (composeRendererStack() from dev-server mounts all of them), plus a delivery with the channel-email feature; apps without the template tables need a schema migration (`kumiko schema generate`)."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/src/cap-counter/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "breaking",
+    "title": "CapExceededError carries resetAt and retryAfterSeconds, API sets Retry-After",
+    "migration": "Periodic caps no longer need RateLimitError({ windowSeconds: 0, ... }). Where you catch CapExceededError from enforceCap and rethrow it as RateLimitError, drop the catch and let CapExceededError pass: the response stays 429 with a correct Retry-After, error.code becomes cap_exceeded instead of rate_limited, and error.details carries resetAt and retryAfterSeconds. Keep a feature-specific message with enforceCap({ ..., i18nKey }) and pass a period end other than the calendar month with periodEndIso (e.g. a budget's resetsAtIso). Clients matching on rate_limited for these caps must also accept cap_exceeded. Any KumikoError with retryAfterSeconds (including RateLimitError thrown in a handler) now gets a Retry-After header from /api/write, /api/batch and /api/query."
+  },
   {
     "version": "0.361.0",
     "type": "improvement",

package/src/channel-email/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "A notification without a mail template fails on the email channel",
+    "detail": "The renderer option of createChannelEmailFeature is removed. A notification routed to the email channel without template + meta fails its delivery permanently with \"has no mail template, declare template + meta on r.notification\". r.notification declares no channels, so this is not checked at boot; an app's own mail tests over the inmemory transport catch it.",
+    "migration": "Drop the renderer option. Declare template + meta (or localizedTemplate) and variables on every r.notification that reaches the email channel, or accept that its email delivery fails. Run the app's notification tests after the bump: every email notification without a template now fails there."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Email channel sends rendered-pdf attachments",
+    "detail": "The channel resolves rendered-pdf entries from notify data next to file entries; without a locale the message locale is used. A render failure fails the send job, so the retry runs it again."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Email channel sends file attachments and inline cid images",
+    "detail": "EmailMessage.attachments is sent through the SMTP transport (inline images with Content-ID). notify data.attachments with kind file entries are resolved through the file store; the PII guard rejects ciphertext file names."
+  },
   {
     "version": "0.350.0",
     "type": "improvement",

package/src/config/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Config key validate() receives a db scoped to the written tenant",
+    "detail": "A SystemAdmin writing a config value for another tenant previously handed the validator a system-mode db that could read every tenant. `ConfigValidateContext.db` is now a `TenantDb` locked to the tenant the value is written for. The validator runs inside the write transaction, so a slow query there should set its own timeout."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "forget-subject keeps the user status flip and PAT revocation when the sweep fails",
+    "detail": "The user is set to Deleted and its personal access tokens are revoked right after the key erase, in their own transaction on the outside-transaction db. A failing blind-index or search sweep still makes the handler throw so the cleanup can be retried, but it no longer rolls the login door back. Without an outside-transaction db the previous in-transaction savepoint path is used. A failure while closing the login door of an existing user now fails the forget (retry is safe) instead of passing silently; subjects without a user row are skipped."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/src/custom-fields/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "update-tenant-field no longer hides `type` from the handler schema",
+    "detail": "The `type` field is part of the documented payload; the 422 check against changing the stored type remains the protection."
+  },
   {
     "version": "0.359.0",
     "type": "improvement",

package/src/data-retention/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "data-retention exports computeCutoff",
+    "detail": "computeCutoff(keepFor, now) and its Instant type are exported from @cosmicdrift/kumiko-bundled-features/data-retention, so apps that compute a retention cutoff themselves (for example a backfill) use the same keepFor parsing as the cleanup job instead of a copy."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,70 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A failed final delivery attempt frees the idempotency key",
+    "detail": "A soft send failure and any error thrown on the final render or send attempt release the idempotency key, so the caller's retry is not dropped as a duplicate."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A mail without a readable inline image is sent without it",
+    "detail": "An inline image whose bytes could not be read (for example a system template logo while the job context has no provider resolver) failed the whole mail send. The attachment reader now logs a warning with the fileRef id and skips the image."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Delivery exports the envelope-key filter for mail variables",
+    "detail": "withoutDeliveryEnvelopeKeys strips reserved delivery keys from template variables."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "NotificationRenderer and RendererInput removed, immediate notify renders with the tenant config",
+    "detail": "The inline (immediate, job-less) delivery path now gets the tenant config accessor like the delivery.render job, so the mail layout shows the tenant name in both paths. DeliveryServiceOptions and CreateDeliveryTestContextOptions accept tenantConfigFor; runProdApp wires it from the boot config resolver. The types NotificationRenderer and RendererInput are removed from the delivery exports because the legacy renderer path is gone.",
+    "migration": "Drop NotificationRenderer and RendererInput imports; render mails with template + meta on r.notification (see renderer-foundation)."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "ChannelContext.renderMail renders template notifications for the email channel",
+    "detail": "A notification that declares a template is rendered through the mail renderer plugin with the recipient locale and the notification variables; the email channel fails when renderMail is missing instead of falling back to the legacy renderer. The job path passes the tenant config accessor to the renderer, the inline path renders without one."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mails can attach a PDF that is rendered from a document template when the mail is sent",
+    "detail": "notify data.attachments accepts { kind: \"rendered-pdf\", templateSlug, variables, fileName, locale? }. The send job renders the PDF through the document-pdf renderer, so the job payload carries the variables (at most 64000 bytes as JSON), not the bytes. Variables are stored in the job payload, so keep personal data out of them or accept that retention."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "ChannelContext.readAttachment takes an attachment origin",
+    "detail": "readAttachment(ref, origin) with origin \"template\" (from the renderer) or \"message\" (default, from notify data). Only template attachments may fall back to the system tenant; file refs from notify data stay limited to the sending tenant."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "EMAIL_CHANNEL_NAME, createTemplateMailRenderer and createEmailAttachmentReader are exported",
+    "detail": "The email channel name is a shared constant instead of a string literal. The mail renderer and the inline-attachment reader that build the channel context are exported and accept a tenant-bound db, so a handler can send through the same path as a notification."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Notification messages carry attachments (file refs and inline cid images)",
+    "detail": "RenderedMessage and the send job payload accept attachments as references (kind file or inline), never bytes. ChannelContext.readAttachment resolves them tenant-scoped at send time; createDeliveryService takes a new filesForTenant option for the inline fallback path."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "NotifyFactory takes an optional fileProviderResolver, so immediate and bootstrap mails can read attachments too"
+  },
+  {
+    "version": "0.363.0",
+    "type": "fix",
+    "title": "Queued mails render with the tenant's config again",
+    "detail": "The delivery render and send jobs read the tenant config through ctx.configFor, which job contexts do not carry, so queued mails rendered without tenant name, locale, currency and branding. Both jobs now use ctx.config, which the job runner builds for the payload's tenant."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/src/file-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "readFileRefContent reads handed-over files; fileContextForTenant takes the context tenant",
+    "detail": "readFileRefContent, readTemplateResource and the public variant query read bytes through FileContext.refFromFileRef, so a fileRef moved by a tenant handover is readable again. fileContextForTenant gains a `contextTenantId` argument: without a provider resolver it returns undefined for any other tenant instead of the context's files, which are bound to a different key space."
+  },
   {
     "version": "0.292.0",
     "type": "improvement",

package/src/files-tenant-data/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tenant destroy hooks make progress even when the deadline already passed",
+    "detail": "The chunked migration takes a minBatches option and the file destroy hooks process one chunk per tick, so a slow list call no longer makes every run time out empty."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Watch supervisor skips and logs accounts whose address does not decrypt",
+    "detail": "Previously a single such account made the whole account snapshot throw."
+  },
   {
     "version": "0.340.0",
     "type": "improvement",

package/src/jobs/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "jobs list query caps the page size at 200",
+    "detail": "limit above 200 is rejected with a validation error."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Stale-run sweep uses the job-run retention window for queued runs",
+    "detail": "The sweep now only fails queued runs that are older than the configured retention days instead of every queued run past the stale cutoff, so freshly queued runs of a long backlog are no longer failed."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tenant-visible job runs no longer collide across tenants, jobs and lanes",
+    "detail": "store_tenant_job_runs was unique on bull_job_id alone, but BullMQ ids count per queue, so a job on the api lane and one on the worker lane (or two tenants after a Redis reset) shared an id and overwrote each other's row. The unique index now covers (tenant_id, job_name, bull_job_id), every write filters by all three, and an enqueue replaces a finished row left over under the same key. onJobDropped now receives { tenantId } as a third argument.",
+    "migration": "Run `kumiko-schema generate` in your app to add the migration that creates store_tenant_job_runs_tenant_job_bull_job_id_unique and drops store_tenant_job_runs_bull_job_id_unique (generated as a commented DROP INDEX; uncomment it). A custom onJobDropped callback passed to the job runner now gets a third argument { tenantId }."
+  },
   {
     "version": "0.360.0",
     "type": "fix",

package/src/ledger/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Document the duplicate check required before the (tenant_id, source_ref) unique index",
+    "detail": "The unique index on read_ledger_schedules (tenant_id, source_ref) is created in place and fails on existing duplicate pairs, and a projection rebuild over duplicate events fails the same way. Replay handling for duplicate events is not part of this change.",
+    "migration": "Before upgrading, check each database for duplicates and clean them up: SELECT tenant_id, source_ref, count(*) FROM read_ledger_schedules WHERE source_ref IS NOT NULL GROUP BY 1, 2 HAVING count(*) > 1; Any row returned makes the unique index migration abort."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Branding screen edits the logo file and readBranding returns logoFile",
+    "detail": "The branding settings screen has a logo upload for managed-pages:config:branding-logo-file, and readBranding and the branding query include logoFile next to logoUrl. The template resource errors template_resource_too_large and template_resource_unsupported_image have German and Spanish texts."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/renderer-foundation/changes.json

@@ -1,4 +1,43 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "document-pdf requests name a template, the response carries fileName",
+    "detail": "The document-pdf payload is { slug, locale, variables } instead of ready HTML in content. The response has a fileName, RendererContext gets an optional filesForTenant (file access per tenant) and RendererError has the new code unavailable for a renderer backend that cannot be reached.",
+    "migration": "Callers that sent `payload: { content }` switch to a document-pdf template and pass slug, locale and variables (money-horse credit-schedule-pdf follows in #621); renderer-pdf callers pass slug and locale too. The enterprise package @cosmicdriftgamestudio/kumiko-renderer-puppeteer-client no longer builds against these types and is replaced by @cosmicdrift/kumiko-renderer-puppeteer-client."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "renderer plugins can preview a document",
+    "detail": "RendererPlugin gets the optional capability previewDocument(req, ctx), which returns the filled-in body and layout regions without calling the print service. template-resolver:query:preview with kind document-pdf uses it, so the editor shows replaced placeholders and the resource and required-placeholder checks; without such a plugin the preview keeps returning the body and raw layout."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "PdfOptions has landscape",
+    "detail": "The document-pdf options gain landscape, which the puppeteer-service passes to Chromium."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "RenderRequest kind mail replaces mail-html",
+    "detail": "RenderRequest and RenderResponse use kind mail with a MailPayload ({ slug, locale, variables, unsubscribeUrl? }) and a response of { subject, html, text, previewText? }. The export MailHtmlPayload is removed; use MailPayload. The default plugin name for kind mail stays mail-html. RendererContext gains an optional config accessor that plugins use for tenant locale, currency and branding.",
+    "migration": "Replace kind mail-html with mail in createRendererForTenant and render calls, pass { slug, locale, variables } instead of content/contentFormat, and read the subject from the response instead of building it yourself. Pass ctx.config in the RendererContext to get tenant locale, currency and branding."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "renderer-simple, MailBranding and renderer kind \"notification\" are removed",
+    "detail": "Every mail is a stored template rendered by renderer-mail-html now. renderer-simple (createRendererSimpleFeature, simpleRenderer, createSimpleRenderer, RendererSimpleOptions, mail blocks with LocalizedText, MailBadge, MailChip, MailStage, MailStageState and MailTone), the MailBranding type, the renderer kind \"notification\" and AuthMailContent are gone. NotificationRenderer and RendererInput are removed from delivery, and createChannelEmailFeature no longer takes a renderer option. The type NotificationPayload is removed from renderer-foundation. The template-resolver keeps \"notification\" only as a stored kind so legacy rows stay readable; RENDER_KINDS is mail, document-pdf and image-snapshot.",
+    "migration": "Remove createRendererSimpleFeature() and any renderer or mailBranding option from your feature list and createChannelEmailFeature call. An r.notification that is sent by email needs template + meta (or localizedTemplate) and variables; the sections/header/footer data it carried is replaced by template variables. Branding (logo, footer) now comes from the tenant branding config and the mail layout of renderer-mail-html. Mount template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html (composeRendererStack() mounts all of them) and run seedNotificationTemplates at boot. Existing template rows with kind \"notification\" are no longer rendered; re-create them as kind \"mail\" or archive them."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "MailPayload.draft renders an unsaved mail template; RendererContext.db also accepts a TenantDb",
+    "detail": "MailDraft (content, meta, variableSchema) replaces the stored body and subject of the template with the payload's slug and keeps its stored images; a slug without a stored template renders as a tenant draft. The renderer sanitizes the draft body and validates its meta again, and the response carries no template provenance. RendererContext.db is widened from DbConnection to DbRunner | TenantDb."
+  },
   {
     "version": "0.306.0",
     "type": "breaking",

package/src/renderer-pdf/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "renderTablePdf rejects tables above 10000 rows, 30 columns or 5000 characters per cell",
+    "detail": "The table document schema now caps rows at 10000, columns at 30 and each cell string at 5000 characters. Larger input fails with invalid_payload instead of exhausting memory during layout."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "render-table-pdf validates input and paginates its intro",
+    "detail": "Table documents reject negative margins and unusable column widths, normalize CRLF and paginate the intro text and the first header row."
+  },
   {
     "version": "0.360.0",
     "type": "improvement",

package/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "improvement",
+    "title": "SecretsContext.withRunner(tx) runs secret access on a given transaction",
+    "detail": "The OAuth refresh now reads and writes the refresh token on its advisory-lock transaction, so a refresh holds one pool connection instead of two and parallel refreshes cannot starve the pool. Custom SecretsContext implementations need a `withRunner` method."
+  },
   {
     "version": "0.343.0",
     "type": "improvement",

package/src/shared/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "improvement",
+    "title": "Mail template body helpers exported as `./shared/mail-template-body`",
+    "detail": "Apps that register their own notification templates can build the body with the same helpers the framework uses: `mailParagraph`, `mailHeading`, `mailRepeatedRows`, `mailTextWithSlotsHtml`, plus the new `mailButton`, `mailParagraphWithLink` and `mailSubject`. The subpath only depends on kumiko-headless and is safe on the server. Apps that copied these helpers can import them instead."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A stale Stripe customer id no longer turns the customer portal into a 500",
+    "detail": "createPortalSession now maps Stripe's \"No such customer\" rejection (account switch, customer deleted in the dashboard) to an UnprocessableError with the i18n key billing-foundation.errors.providerCustomerUnknown, translated in German and Spanish, instead of letting the raw Stripe error surface as a server error."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",