@cosmicdrift/kumiko-bundled-features 0.362.0 → 0.364.0

package/src/template-resolver/changes.json

@@ -1,4 +1,190 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "PDF collections show Page break instead of Button, and placeholder links no longer insert {{name}} text",
+    "detail": "The content editor for a `document-pdf` collection now offers the PDF block set (including Page break) instead of the mail set, chosen from the collection's kind. A link to a placeholder href such as `{{invoice.url}}` without a selection now links a variable node instead of inserting the placeholder as plain text."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Document sanitizer rejects prototype-style placeholder hrefs",
+    "detail": "`{{__proto__}}` and `{{constructor.prototype}}` are no longer accepted as link or button placeholder hrefs; only valid reference names pass."
+  },
+  {
+    "version": "0.364.0",
+    "type": "breaking",
+    "title": "DocumentRepeatRow is removed, use DocumentTableRow",
+    "detail": "Removed the DocumentRepeatRow alias",
+    "migration": "Replace `DocumentRepeatRow` with `DocumentTableRow` (identical shape)."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "export-bundle for a system template with resources returns a validation error outside the system tenant",
+    "detail": "A TenantAdmin, or a SystemAdmin outside the system tenant, exporting a system template that links resource files now gets the `system_resources_need_system_tenant` validation error, the same code import-bundle-system uses, instead of a NotFound for the resource file."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "send-test logs failed test mails with error class and tenant",
+    "detail": "A transport that throws or reports not sent is logged with the error class/code and tenant id (no address, no provider body) and still answers `template_test_mail_failed`."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "copy-locale ignores archived tenant sources and duplicates linked files of system sources; export-bundle refuses locales with differing format",
+    "detail": "copy-locale no longer copies from an archived tenant template, and copying a system template duplicates its linked resource files into the target tenant. export-bundle rejects a bundle whose locales differ in content format or variable schema with `bundleLocalesDiffer`."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Template preview counts encoding overhead and reports missing attachments",
+    "detail": "The mail size estimate counts base64 size plus a fixed per-part overhead, an attachment whose file reference is missing fails the resources_resolved check, and the document draft scope is derived once per request."
+  },
+  {
+    "version": "0.364.0",
+    "type": "breaking",
+    "title": "A draft no longer replaces the active template",
+    "detail": "Saving a draft (upsert-tenant default, copy-locale, import-bundle with status draft) over an active template stores it beside the active version in the new column draft instead of overwriting content, meta and status; resolveTemplate, resolveLayout, preview without content and sends keep using the active version. publish and publish-system promote an open draft (the publish gate checks the draft) and record activeVersion and activeSince; the new handlers discard-draft and discard-draft-system drop it and refuse with no_draft when none is open. find-by-id and layout-source return the working version (the open draft with status draft, else the stored one) plus active { version, since }, null when nothing is served. overview keeps status and version of the served version and adds draftVersion and activeSince. A draft over a row that is not active (new, draft or archived) behaves as before. A tenant never sees system draft content: find-by-id, layout-source, overview, copy-locale and diff-to-system apply a system draft only for a SystemAdmin and hide system rows that were never served; list leaves those rows out too. Version numbers shown for an active row are the served version (activeVersion): resolveTemplate / resolveLayout results, tenant-overrides rows and the override diff no longer show the save counter that drafts raise.",
+    "migration": "Run kumiko schema generate and apply the migration before deploying: it adds the nullable columns draft, active_version and active_since to read_template_resources. No rebuild needed."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "template-resolver:query:overview accepts layoutSlug to list only the mails and PDFs using that layout",
+    "detail": "The optional layoutSlug payload field keeps only documents whose layout slug matches; total counts the filtered rows. Without it the response is unchanged."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Layout usage follows the effective template per notification and locale",
+    "detail": "Mail layout usage counts a notification only when it declares a template and resolves the effective row per notification and locale, so tenant overrides are reflected."
+  },
+  {
+    "version": "0.364.0",
+    "type": "improvement",
+    "title": "templateVariable.richText for notification variables that carry formatted HTML",
+    "detail": "Notification variables are escaped, so a value holding HTML (for example a document written in a rich text editor) showed up as literal tags in the mail. A variable declared with templateVariable.richText({ required }) is run through the document sanitizer at render time and inserted as HTML; bold, italic, lists and safe links stay, script, event handlers and javascript links are not emitted as markup. If the sanitizer rejects a value, it is rendered as escaped text and a warning with the violation codes is logged. All other variable types stay escaped."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Overview and layout-source queries for the template designer",
+    "detail": "template-resolver:query:overview lists the mail, PDF and layout templates of the caller's tenant grouped by slug and kind (effective origin, locales, status, versions, layout slug, last change and the notifications that use it) and template-resolver:query:layout-source returns the header, signature and footer regions of a mail or PDF layout plus the locale a save has to use; a SystemAdmin also receives the MJML source of the system layout. The usage lookup is the exported collectTemplateUsage."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "contentFormat \"document\" with a toolbar editor for mail and PDF templates",
+    "detail": "ContentEditorFormat gains \"document\". template-resolver registers DocumentContentEditor for it (tiptap, lazy-loaded) and stores the body as html. The toolbar offers paragraph style, bold, italic, lists, links, placeholders and the blocks image, table, button, divider, repeat and page break; the blocks prop picks them (MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS). Placeholders are inserted only as variable nodes (data-variable), never as {{name}} text. ContentPreview does not substitute example values for \"document\" content, because substituting a button or link href would make the schema drop that node. New exports from template-resolver/web: DocumentContentEditor, DocumentEditorProps, DocumentToolbarBlock, MAIL_DOCUMENT_BLOCKS, PDF_DOCUMENT_BLOCKS."
+  },
+  {
+    "version": "0.363.0",
+    "type": "fix",
+    "title": "Preview uses the examples of a stored or draft variable schema",
+    "detail": "A template's variableSchema kept only type and required, label and example were dropped, so the preview showed [name] instead of the declared example. The schema now keeps label and example, for mail and document previews."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "PDF meta gets orientation, printBackground and layoutHeaderFooter; paragraphs and headings get data-align",
+    "detail": "The document-pdf meta accepts orientation (portrait or landscape), printBackground (default true) and layoutHeaderFooter (false prints without the layout header and footer). Paragraphs and headings carry textAlign (left, center, right, justify), serialized as data-align and kept by the sanitizer only with these four values. New exports are evaluateDocumentDraft, localeSchema, DOCUMENT_TEXT_ALIGNMENTS and DocumentTextAlign; compileDocumentBodyToHandlebars accepts alignmentAsInlineStyle."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "document-pdf templates require contentFormat html, and html bodies are sanitized on write",
+    "detail": "upsertSystem, upsertTenant, the collection-set handlers and seedSystemTemplate rebuild html bodies of kind mail-html and document-pdf through the new document schema (template-resolver/document-schema). Script elements, inline event handlers, embedded content (iframe, frame, object, embed, applet, portal), links and url attributes (svg href, xlink:href, form action, base) outside https/http/mailto/tel/{{placeholder}}, external image sources, alt text containing < or >, and invalid or prototype-chain variable names are rejected with a validation_error (or a thrown Error in seedSystemTemplate); anything the schema cannot express is dropped silently, and links keep only href (no target, rel, class or title). New exports: documentExtensions, DocumentLink and the other Document* nodes, isAllowedDocumentLinkHref, isDocumentReferenceName, isDocumentResourceKey, isDocumentPlaceholderHref, sanitizeDocumentHtml, sanitizeTemplateBody. kind document-pdf with another contentFormat is rejected with document_requires_html_format.",
+    "migration": "Store document-pdf bodies as html and reference images via data-resource instead of src. mail-html with markdown or mjml is unchanged."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mail templates carry file attachments (PDF, PNG, JPEG)",
+    "detail": "linkedResources stays image only; file attachments of a mail template are listed in the optional TemplateResource.fileAttachments (kind file, fileRefId, fileName), sorted by key. template-resolver:write:resource-upload takes purpose \"attachment\" with a fileName; it checks the file by content (PDF, PNG, JPEG), keeps the original bytes, allows at most 10 per mail template and stores the entry next to the inline images. resource-remove, copy-locale and the bundle export/import carry attachments (bundle resource entries get purpose \"attachment\"). The preview lists attachments with kind \"inline\" or \"file\" (PreviewAttachment is now a union), send-test sends them, and the mail renderer attaches them after the inline images within the delivery attachment limit."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "copy-locale can copy system templates (scope \"system\", system admins only)",
+    "detail": "template-resolver:write:copy-locale takes scope \"tenant\" (default) or \"system\". With \"system\" a system admin copies a system template to another locale as a draft; other callers get access denied."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mail preview returns displayHtml for the editor",
+    "detail": "The preview of a mail template carries displayHtml, the body with cid images replaced by data URIs (png, jpeg, gif, webp, 5 MiB budget in total) so an editor can show it without cid support. The sent mail is unchanged."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Document editor gets variable labels, a handle, resource previews, canvas chrome, underline and PlaceholderLineEditor",
+    "detail": "DocumentContentEditor accepts variableLabels, systemVariables, resourcePreviews, chrome (\"default\" or \"canvas\") and onEditorReady (handle with insertPlaceholder, insertResource, focus). The new PlaceholderLineEditor edits plain text with {{name}} placeholders as chips on one line. Underline (u) is part of the document schema and survives the sanitizer."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Mail templates link a PDF rendered from a document template (resource-link-pdf)",
+    "detail": "New write template-resolver:write:resource-link-pdf takes templateId, key, templateSlug and fileName and stores a linkedResources entry { kind \"rendered-pdf\", templateSlug, fileName } in a mail template; nothing is uploaded. fileName is a one-line pattern that may use the mail's {{placeholders}} and must end with .pdf (no / \\ \" ; or ..). The document-pdf template must exist for the tenant or the system, otherwise the write fails with template_attachment_pdf_template_missing; an invalid pattern or slug fails with template_attachment_invalid. Uploaded files and linked PDFs share the limit of 10 attachments per template. resource-remove, copy-locale and the bundle export/import carry the entry (the bundle gets an optional pdfAttachments map of key to { templateSlug, fileName }; import does not check that the document template exists). TemplateResource gains pdfAttachmentLinks, LinkedResourceEntry gains the TemplatePdfAttachmentLink variant."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Preview and test mail use the images and attachments of the edited row, also while it is a draft",
+    "detail": "When preview or send-test get content and the caller has a row for (slug, kind, locale), that row supplies linkedResources whatever its status (also when it has none, so nothing is borrowed from the system template), so a tenant whose customization is saved as a draft sees its logo and attachments. MailDraft has an optional linkedResources; without it the stored active template's resources are used as before. PreviewAttachment gains the variant { kind \"rendered-pdf\", name, templateSlug } without sizeBytes, because the PDF is not rendered in the preview; size_under_cap does not count it."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Preview query and send-test write for mail and PDF templates",
+    "detail": "template-resolver:query:preview renders a draft, or the stored template when no content is given, with sample values from the declared variable examples (list variables get two rows). The draft passes the same write gates as a save and a mail goes through the real mail renderer, so subject, html, plain text and inline images match a real send. The response carries checks (images resolved, plain text present, size under 10 MiB, required placeholders used); a PDF template returns its sanitized body and the layout regions. template-resolver:write:send-test mails the rendered mail to the calling user's own address only, subject prefixed with [TEST], limited to 10 per user and hour. It needs delivery, channel-email and renderer-mail-html."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "DocumentEditorProps toolbar option for an icon-only toolbar",
+    "detail": "DocumentEditorProps gains toolbar (\"full\" or \"compact\", default \"full\"). Compact renders the placeholder and block buttons icon-only with a tooltip and a narrower paragraph select, for narrow columns such as the layout editor regions. The formatting buttons now carry a tooltip with their label in every mode."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "kind mail-html is replaced by mail, mail-layout and pdf-layout; templates carry meta",
+    "detail": "The kind mail-html is removed; the new non-render kind snippet holds collection content (reply snippets, signatures; any contentFormat, html is sanitized like a mail body). Mail bodies are kind mail (contentFormat html only, rebuilt through the document schema, meta.subject required), mail frames are kind mail-layout (contentFormat mjml), and pdf-layout (html) is new. The table gains a nullable meta column (JSON per kind, validated by parseTemplateMeta: mail takes subject, previewText, layoutSlug, category, sender; layouts take none; other kinds take no meta) and the template-resource entity moves to eventVersion 2 with an upcaster that reads stored mail-html events as mail. upsertSystem, upsertTenant (active), publish and seedSystemTemplate reject unknown placeholders and, for the same writes, bodies that miss a required variable of the notification with the same qualified name; a tenant draft may be incomplete and returns validation. Slugs must be kebab segments joined by a colon. seedSystemTemplate now validates the slug (templateSlugSchema) and the per-kind meta for every kind. A content collection of kind mail, mail-layout or pdf-layout is refused on collection-set (field issue on kind, templateResolver.errors.collection.kindNotAllowed), because such a tenant row would shadow the system template without the meta and placeholder gates. TemplateResource gains meta. New exports: parseTemplateMeta, isMailTemplateMeta, templateSlugSchema, validateTemplatePlaceholders, resolveTemplateVariables, compileDocumentBodyToHandlebars, MAIL_CATEGORIES and their types; seedNotificationTemplates and hasNotificationTemplates on template-resolver/seeding, which applyBootSeeds now calls. RENDER_KINDS contains mail instead of mail-html.",
+    "migration": "Rename kind mail-html to mail in app code, collections and seeds; mail bodies must be contentFormat html (markdown or mjml mail bodies are rejected) and carry meta.subject, mail layouts use kind mail-layout with contentFormat mjml and slug default. Slugs of every kind must now be kebab segments joined by a colon (upsert handlers and seedSystemTemplate reject dotted, underscored or camelCase slugs). Collections that used kind mail-html move to the new kind snippet (stored mail-html rows are upcast to mail, which collections refuse, so re-create those entries under snippet); collection-set refuses mail, mail-layout and pdf-layout collections. seedSystemTemplate callers must pass a kebab slug and valid meta for every kind, not only mail. Generate and apply the migration that adds the nullable meta column to read_template_resources; it ships a rebuild marker for read_template_resources so existing mail-html rows are read as mail after the rebuild."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "resolveLayout finds a layout in any locale",
+    "detail": "TemplateResolverApi gains resolveLayout({ tenantId, slug, kind, locale }) for mail-layout and pdf-layout. It looks at the tenant first (requested locale, then the fallback locale, then any active locale) and then at the system layouts the same way, ignoring draft and archived rows. A layout saved by the layout editor under one locale is therefore found for every locale. The template preview uses it for the PDF layout."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "PDF template meta, render provenance, system template lifecycle and override queries",
+    "detail": "kind document-pdf takes a strict meta (layoutSlug, pageFormat A4/Letter, margins in mm, fileName without / \\ \" ; or .., metadata title/author); new exports PDF_PAGE_FORMATS, PdfPageFormat, PdfTemplateMeta, readPdfTemplateMeta, DEFAULT_MAIL_LAYOUT_SLUG. RenderResponse (renderer-foundation) gains optional template and layout refs ({ templateId, templateVersion, scope }, new types RenderedTemplateRef and RenderProvenance); renderer-mail-html fills them. New handlers template-resolver:write:publish-system and archive-system (SystemAdmin), reset-to-system (TenantAdmin, SystemAdmin), queries usage, tenant-overrides (SystemAdmin, counts only) and diff-to-system. publish and archive answer not_found for rows outside the caller's tenant instead of a version_conflict; find-by-id also returns meta."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "linkedResources is no longer a payload field of upsertSystem/upsertTenant; resourceUpload and resourceRemove manage it",
+    "detail": "Two steps - upload the image with POST /api/files (multipart, no entityType), then call template-resolver:write:resource-upload with { sourceFileRefId, templateId?, key? }. The handler re-encodes the caller's own unclaimed upload into a new file ref (width at most 1200 px) and links it into the template; resource-remove unlinks a key. upsertSystem and upsertTenant no longer accept linkedResources and leave the stored value untouched on update. The size cap is the system config key resource-max-bytes (default 2 MiB); a cap above the files route's maxUploadSize has no effect because the upload is rejected first. The source upload stays as an unclaimed file.",
+    "migration": "Whoever sent linkedResources with upsertSystem or upsertTenant now uploads the image via POST /api/files (multipart, no entityType) and links it with template-resolver:write:resource-upload { sourceFileRefId, templateId, key }. Server-side seeding (seedSystemTemplate linkedResources) stays."
+  },
+  {
+    "version": "0.363.0",
+    "type": "improvement",
+    "title": "Bundle import re-encodes its images like resource-upload; re-seeding keeps uploaded system resources",
+    "detail": "importBundle and importBundleSystem store each bundle resource through the same normalization as resource-upload (decoded format decides the content type, SVG and non-images are rejected, width at most 1200 px, resource-max-bytes applies), so an exported bundle carries the re-encoded bytes. seedSystemTemplate without linkedResources no longer resets the links of an existing row, so images a system admin uploaded survive the next boot. storeTemplateResource from the template-resolver barrel is the normalizing store; the raw byte variant is gone."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Tenant mail-layouts are structured html, pdf-layout and document-pdf are placeholder-validated",
+    "detail": "A new validate query dry-runs the write pipeline (used, unknown and missing placeholders, canSave, canPublish). document-pdf, pdf-layout and mail-layout now go through the same placeholder gate as mail; document-pdf and pdf-layout know the system placeholders page and pages. A tenant mail-layout is html with a data-content slot plus header, signature and footer regions that renderer-mail-html wraps in a fixed MJML frame; raw mjml (with {{{content}}} exactly once) is system-only. New handlers export-bundle, import-bundle, import-bundle-system and copy-locale move a template with its resource files between tenants and locales. r.notification accepts a record mapping from an entity row to the declared variables, validated at boot. publish and archive no longer touch system rows through a tenant-scoped SystemAdmin.",
+    "migration": "Tenant mail-layout rows stored as mjml are ignored by the renderer, which falls back to the system layout; re-create them as html with a data-content slot. upsert-system answers with an extra validation field. seedSystemTemplate errors now read `<label> rejected: <code> (<detail>); ...`. Layout bodies without the content slot are rejected on write. `set` now runs the same gate for mail, document-pdf, pdf-layout and mail-layout rows and rejects unsanitized markup or publish issues, since saving publishes; the mail renderer also re-sanitizes stored tenant html layouts and falls back to the system layout when they fail. upsert-system and upsert-tenant no longer accept linkedResources (resources go through the resource upload; bundle import and copy-locale attach them). Unknown data-resource keys are a validate warning (resource_not_uploaded), not a write error."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tier cache: stale single reload cannot overwrite a newer full resync",
+    "detail": "A single-tenant reload that started before a full resync and resolved after it could restore an outdated tier. The resync now advances the per-tenant ticket for deleted and adopted tenants too, and assignment changes are published remote-only."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "resolveUserDisplayNames no longer swallows decrypt errors",
+    "detail": "A misconfigured or unavailable KMS made the delivery log silently show addresses or ids instead of names. Decrypt errors now propagate like in the member directory; users that are missing or have no display name are still left out."
+  },
   {
     "version": "0.361.0",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Regression tests prove that forget also shreds the previous email in user.updated events",
+    "detail": "No runtime change. Integration tests with a configured subject KMS show that after an email change followed by forget, the old and new email in user.updated changes and previous decrypt only to the erased sentinel and the subject key is gone. Without a configured KMS, event payloads stay plaintext by design."
+  },
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "GDPR default mails are r.notification declarations, render*Email is gone",
+    "detail": "export-ready, export-failed, deletion-requested and deletion-executed are declared as trigger-less notifications (user-data-rights:notify:<name>) with variables and localized templates built from the GDPR translations, so a tenant can override the text. The default export-ready, export-failed and deletion-requested mails send through ctx.notify to the user (export mails with immediate so the plain magic-link token never lands in a job payload). deletion-executed renders the seeded template through the mail renderer and sends over the tenant mail transport without a delivery log, because the user is already gone. App-provided send*Email callbacks still win. The defaults now need delivery with channel-email; a boot warning is logged once when mail-foundation and a mail transport are mounted without them. New exports are GdprMailNotificationTypes, gdprMailLocalizedTemplate, gdprMailTemplateLocale, registerGdprMails and formatGdprMailTimestamp.",
+    "migration": "renderExportReadyEmail, renderExportFailedEmail, renderDeletionRequestedEmail, renderDeletionExecutedEmail and RenderedEmail are removed from user-data-rights/email-templates; the translations stay. An app that mounts it without includeBundled needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html at boot (composeRendererStack() from dev-server mounts all of them), plus a delivery with the channel-email feature; apps without the template tables need a schema migration (`kumiko schema generate`). Delivery preferences that referenced the mails use the new user-data-rights:notify:<name> types."
+  },
   {
     "version": "0.362.0",
     "type": "fix",

package/src/user-profile/changes.json

@@ -16,7 +16,7 @@
     "type": "breaking",
     "title": "user-profile now registers its own profile screen (id user-profile:screen:profile); app-side profile screen registrations must be removed (fw#2312).",
     "detail": "`profile` is now a declarative `projectionDetail` screen bound to `user:query:user:me` instead of a custom React component: change-password and change-email stay `EditExtensionSection` components (re-auth flows a declarative action can't express), account deletion (request/cancel via `user-data-rights`, grace period) is now fully declarative fields + `actions: RowAction[]`, preserving the original confirm dialog and `visible: {field, eq/ne}` toggle 1:1. `userProfileClient()` now registers the two extension-section components via `extensionSectionComponents` instead of exposing a `ProfileScreen` component for apps to place in a `components` map. `ProfileScreen` is a dead export. New exports: `ChangeEmailSection`, `ChangePasswordSection` (the two surviving extension components, importable for tests but not meant to be placed manually). Known UI regression, accepted for this pass (same trade-off as `privacy-center`): the deletion confirm-dialog title is now always the action's `label`; the dynamically composed grace-period banner sentence is gone, replaced by a plain `gracePeriodEnd` date field; there is no cancel-deletion success toast.",
-    "migration": "The bundled feature now registers the `profile` screen itself (id `user-profile:screen:profile`) — an app's own `profile` custom-screen registration collides on boot with a duplicate short-id error. Delete the app-side registration entirely: `r.screen({ id: \"profile\", type: \"custom\", renderer: { react: { __component: \"UserProfileScreen\" } }, access: { openToAll: true } })` has no replacement to write, just remove the call. If you have an `r.nav({ screen: \"profile\" })` (or any other reference to the app-local `profile` screen id), repoint it at `\"user-profile:screen:profile\"`. Also remove `components: { UserProfileScreen: ProfileScreen }` from your renderer/client setup and the now-unused `ProfileScreen` import — the client no longer exposes that component. Known affected consumers (not modified here, out of this PR's scope): `money-horse` (`src/features/money-horse/feature.ts:286-292`) and `offlot-app` (`src/features/account/feature.ts:24-30`) both currently register their own `profile` custom screen this way."
+    "migration": "The bundled feature now registers the `profile` screen itself (id `user-profile:screen:profile`) — an app's own `profile` custom-screen registration collides on boot with a duplicate short-id error. Delete the app-side registration entirely: `r.screen({ id: \"profile\", type: \"custom\", renderer: { react: { __component: \"UserProfileScreen\" } }, access: { openToAll: true } })` has no replacement to write, just remove the call. If you have an `r.nav({ screen: \"profile\" })` (or any other reference to the app-local `profile` screen id), repoint it at `\"user-profile:screen:profile\"`. Also remove `components: { UserProfileScreen: ProfileScreen }` from your renderer/client setup and the now-unused `ProfileScreen` import — the client no longer exposes that component. Known affected consumers (not modified here, out of this PR's scope): `money-horse` and `offlot-app` both currently register their own `profile` custom screen this way."
   },
   {
     "version": "0.123.2",

package/src/waitlist/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.363.0",
+    "type": "breaking",
+    "title": "Waitlist confirmation and admin notice use template variables",
+    "detail": "The confirmation and admin-notice mails are r.notification declarations (waitlist:notify:confirmation, waitlist:notify:admin-notice) with variables and localized templates. The notify data is the variable object; the confirmation wording is computed in code and passed as variables. The admin notice subject is the submitter name.",
+    "migration": "Update delivery preferences and tests that referenced the old types or read the sections data. An app that mounts it without includeBundled needs template-resolver, renderer-foundation and @cosmicdrift/kumiko-renderer-mail-html at boot (composeRendererStack() from dev-server mounts all of them), plus a delivery with the channel-email feature; apps without the template tables need a schema migration (`kumiko schema generate`)."
+  },
   {
     "version": "0.342.0",
     "type": "improvement",

package/src/workflow-runner/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Workflow run-failed and retry logs carry the original cause",
+    "detail": "The ops log used to print the generic `workflow step N failed` wrapper. It now prints the underlying error, while the persisted event still carries the error class only."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/dist/renderer-simple/feature.d.ts

@@ -1,10 +0,0 @@
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import type { NotificationRenderer } from "../delivery/index.js";
-import { type RendererContext, type RenderRequest, type RenderResponse } from "../renderer-foundation/index.js";
-import { type MailBranding } from "./simple-renderer.js";
-export declare function adaptToFoundation(req: RenderRequest, ctx: RendererContext, renderer?: NotificationRenderer): Promise<RenderResponse>;
-export type RendererSimpleOptions = {
-    /** Branding applied to every notification mail, including the framework auth mails. */
-    readonly mailBranding?: MailBranding;
-};
-export declare function createRendererSimpleFeature(options?: RendererSimpleOptions): FeatureDefinition;

package/dist/renderer-simple/feature.js

@@ -1,42 +0,0 @@
-import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
-import { RENDERER_EXTENSION, RendererError, } from "../renderer-foundation/index.js";
-import { resolveNotificationVariables } from "./resolve-variables.js";
-import { createSimpleRenderer, simpleRenderer } from "./simple-renderer.js";
-// Adapter: simpleRenderer.render hat `Promise<string>`-Signatur (Legacy
-// NotificationRenderer-Contract), renderer-foundation erwartet
-// `Promise<RenderResponse>` mit discriminated union. Mapper bewahrt
-// die simpleRenderer-Implementierung (Template-Strings → HTML mit
-// Inline-CSS) und packt sie in den RendererPlugin-Contract.
-//
-// Exported damit der Adapter-Pfad direkt testbar ist (unit-test).
-export async function adaptToFoundation(req, ctx, renderer = simpleRenderer) {
-    if (req.kind !== "notification") {
-        // Defensiver Guard — Foundation wählt Plugins nur für matching kinds,
-        // dieser Pfad sollte unter normalen Umständen nie erreicht werden.
-        throw new RendererError(`renderer-simple supports only kind="notification", got "${req.kind}"`, "invalid_payload");
-    }
-    const variables = await resolveNotificationVariables(req, ctx);
-    const input = { template: req.payload.template ?? "", variables, locale: req.payload.locale };
-    const html = await renderer.render(input);
-    const text = renderer.renderText ? await renderer.renderText(input) : undefined;
-    return text === undefined ? { kind: "notification", html } : { kind: "notification", html, text };
-}
-export function createRendererSimpleFeature(options) {
-    const renderer = options?.mailBranding
-        ? createSimpleRenderer(options.mailBranding)
-        : simpleRenderer;
-    return defineFeature("renderer-simple", (r) => {
-        r.describe('Default renderer plugin for `kind="notification"`: takes a structured `EmailTemplateData` variable map (with `header`, `sections[]` of text/button objects, and optional `footer`; falls back to `title`/`body` if no structured fields are present) and returns rendered HTML with inline CSS. Requires `renderer-foundation`; sufficient for plain notification emails \u2014 swap it for `renderer-mail-html` if you need MJML/Markdown layouts.');
-        r.uiHints({
-            displayLabel: "Renderer \u00b7 Simple",
-            category: "notifications",
-            recommended: false,
-        });
-        r.requires("renderer-foundation");
-        r.optionalRequires("template-resolver");
-        r.useExtension(RENDERER_EXTENSION, "simple", {
-            kinds: ["notification"],
-            render: (req, ctx) => adaptToFoundation(req, ctx, renderer),
-        });
-    });
-}

package/dist/renderer-simple/index.d.ts

@@ -1,3 +0,0 @@
-export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
-export type { MailBadge, MailChip, MailStage, MailStageState, MailTone } from "./mail-blocks.js";
-export { createSimpleRenderer, type LocalizedText, type MailBranding, simpleRenderer, } from "./simple-renderer.js";

package/dist/renderer-simple/index.js

@@ -1,2 +0,0 @@
-export { createRendererSimpleFeature } from "./feature.js";
-export { createSimpleRenderer, simpleRenderer, } from "./simple-renderer.js";

package/dist/renderer-simple/mail-blocks.d.ts

@@ -1,21 +0,0 @@
-export type MailTone = "neutral" | "info" | "success" | "warning" | "danger";
-export type MailStageState = "done" | "current" | "upcoming";
-export type MailBadge = {
-    readonly label: string;
-    readonly tone?: MailTone;
-};
-export type MailStage = {
-    readonly label: string;
-    readonly state: MailStageState;
-};
-export type MailChip = {
-    readonly label: string;
-    readonly tone?: MailTone;
-};
-export declare function parseBadge(value: unknown): MailBadge | undefined;
-export declare function renderBadge(badge: MailBadge): string;
-export declare function renderChips(chips: unknown): string;
-export declare function renderStages(stages: unknown, primaryColor: string): string;
-export declare function badgeText(badge: MailBadge): string;
-export declare function stagesText(stages: unknown): string;
-export declare function chipsText(chips: unknown): string;

package/dist/renderer-simple/mail-blocks.js

@@ -1,107 +0,0 @@
-import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
-// Literal types (as const) keep the colors compile-time known, so they can go into style
-// attributes without escaping.
-const TONE_COLORS = {
-    neutral: { bg: "#f3f4f6", fg: "#374151" },
-    info: { bg: "#dbeafe", fg: "#1e40af" },
-    success: { bg: "#dcfce7", fg: "#166534" },
-    warning: { bg: "#fef3c7", fg: "#92400e" },
-    danger: { bg: "#fee2e2", fg: "#991b1b" },
-};
-const STAGE_STATES = ["done", "current", "upcoming"];
-const STAGE_DONE_COLOR = "#16a34a";
-const STAGE_UPCOMING_BG = "#e5e7eb";
-const STAGE_UPCOMING_FG = "#9ca3af";
-function isRecord(value) {
-    return typeof value === "object" && value !== null;
-}
-function isMailTone(value) {
-    return typeof value === "string" && Object.hasOwn(TONE_COLORS, value);
-}
-function toneColors(tone) {
-    return TONE_COLORS[isMailTone(tone) ? tone : "neutral"];
-}
-function isStageState(value) {
-    return STAGE_STATES.some((state) => state === value);
-}
-// Template data is runtime data (variables of a stored template): entries that do not match are
-// skipped instead of failing the whole mail.
-function isStage(value) {
-    return isRecord(value) && typeof value["label"] === "string" && isStageState(value["state"]);
-}
-function isChip(value) {
-    return isRecord(value) && typeof value["label"] === "string";
-}
-export function parseBadge(value) {
-    return isChip(value) && value.label !== "" ? value : undefined;
-}
-function validStages(value) {
-    return Array.isArray(value) ? value.filter(isStage) : [];
-}
-function validChips(value) {
-    return Array.isArray(value) ? value.filter(isChip) : [];
-}
-function pill(chip, margin) {
-    const { bg, fg } = toneColors(chip.tone);
-    return `<span style="display:inline-block;margin:${margin};padding:2px 10px;border-radius:999px;background:${bg};color:${fg};font-size:12px;font-weight:600;line-height:18px">${escapeHtml(chip.label)}</span>`;
-}
-export function renderBadge(badge) {
-    return `<p style="margin:0 0 12px">${pill(badge, "0")}</p>`;
-}
-export function renderChips(chips) {
-    const valid = validChips(chips);
-    if (valid.length === 0)
-        return "";
-    return `<p style="margin:0 0 16px">${valid.map((chip) => pill(chip, "0 6px 6px 0")).join("")}</p>`;
-}
-function stageMarker(stage, position, primaryColor) {
-    const base = "display:inline-block;width:24px;height:24px;line-height:24px;border-radius:12px;text-align:center;font-size:12px;font-weight:700";
-    const primary = escapeHtmlAttr(primaryColor);
-    if (stage.state === "done") {
-        return `<span style="${base};background:${STAGE_DONE_COLOR};color:#fff">&#10003;</span>`;
-    }
-    if (stage.state === "current") {
-        return `<span style="${base};background:#fff;border:2px solid ${primary};line-height:20px;width:20px;height:20px;color:${primary}">${position}</span>`;
-    }
-    return `<span style="${base};background:${STAGE_UPCOMING_BG};color:${STAGE_UPCOMING_FG}">${position}</span>`;
-}
-function stageCell(stage, position, primaryColor) {
-    const labelColor = stage.state === "upcoming" ? STAGE_UPCOMING_FG : "#111";
-    const weight = stage.state === "current" ? 700 : 400;
-    return `<td align="center" valign="top" style="padding:0 4px;font-family:sans-serif">${stageMarker(stage, position, primaryColor)}<div style="margin:4px 0 0;font-size:12px;font-weight:${weight};color:${labelColor}">${escapeHtml(stage.label)}</div></td>`;
-}
-function stageConnector(previous) {
-    const color = previous.state === "done" ? STAGE_DONE_COLOR : STAGE_UPCOMING_BG;
-    return `<td valign="top" style="padding:11px 0 0"><div style="width:24px;height:2px;line-height:2px;font-size:2px;background:${color}">&nbsp;</div></td>`;
-}
-export function renderStages(stages, primaryColor) {
-    const valid = validStages(stages);
-    if (valid.length === 0)
-        return "";
-    const cellsHtml = valid
-        .map((stage, index) => {
-        const previous = valid[index - 1];
-        const connector = previous ? stageConnector(previous) : "";
-        return `${connector}${stageCell(stage, index + 1, primaryColor)}`;
-    })
-        .join("");
-    return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 0 16px"><tr>${cellsHtml}</tr></table>`;
-}
-const STAGE_TEXT_MARKER = {
-    done: "✓",
-    current: "▶",
-    upcoming: "○",
-};
-export function badgeText(badge) {
-    return `[${badge.label}]`;
-}
-export function stagesText(stages) {
-    return validStages(stages)
-        .map((stage) => `${STAGE_TEXT_MARKER[stage.state]} ${stage.label}`)
-        .join(" → ");
-}
-export function chipsText(chips) {
-    return validChips(chips)
-        .map((chip) => chip.label)
-        .join(" · ");
-}

package/dist/renderer-simple/resolve-variables.d.ts

@@ -1,7 +0,0 @@
-import type { RendererContext, RenderRequest } from "../renderer-foundation/index.js";
-type NotificationRequest = Extract<RenderRequest, {
-    kind: "notification";
-}>;
-/** Merge template-resolver content (plain JSON EmailTemplateData) with runtime variables. */
-export declare function resolveNotificationVariables(req: NotificationRequest, ctx: RendererContext): Promise<Readonly<Record<string, unknown>>>;
-export {};

package/dist/renderer-simple/resolve-variables.js

@@ -1,47 +0,0 @@
-import { createTemplateResolverApi, FALLBACK_LOCALE, TemplateNotFoundError, } from "../template-resolver/index.js";
-/** Merge template-resolver content (plain JSON EmailTemplateData) with runtime variables. */
-export async function resolveNotificationVariables(req, ctx) {
-    const variables = req.payload.variables ?? {};
-    const slug = req.payload.template?.trim();
-    if (!slug || req.payload.content || !ctx.db || !ctx.registry.features.has("template-resolver")) {
-        return variables;
-    }
-    try {
-        const api = createTemplateResolverApi(ctx.db);
-        const locale = req.payload.locale ?? FALLBACK_LOCALE;
-        const resolved = await api.resolveTemplate({
-            tenantId: ctx.tenantId,
-            slug,
-            kind: "notification",
-            locale,
-        });
-        if (resolved.contentFormat === "plain") {
-            const base = parsePlainTemplateContent(resolved.content);
-            return { ...base, ...variables };
-        }
-        // body always wins from the resolved template for rendered formats — a runtime
-        // "variables.body" override would clobber the actual rendered content.
-        return { ...variables, body: resolved.content };
-    }
-    catch (err) {
-        if (err instanceof TemplateNotFoundError) {
-            return variables;
-        }
-        throw err;
-    }
-}
-function parsePlainTemplateContent(content) {
-    const trimmed = content.trim();
-    if (!trimmed)
-        return {};
-    try {
-        const parsed = JSON.parse(trimmed);
-        if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-            return parsed;
-        }
-    }
-    catch {
-        // ponytail: non-JSON plain content becomes a single body section downstream
-    }
-    return { body: content };
-}

package/dist/renderer-simple/simple-renderer.d.ts

@@ -1,24 +0,0 @@
-import type { NotificationRenderer } from "../delivery/index.js";
-export type MailBranding = {
-    /** Shown as text when there is no logo, and as the logo alt text. */
-    readonly productName?: string;
-    /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
-    readonly primaryColor?: string;
-    /** Absolute http(s) URL; anything else is dropped. Mutually exclusive with `logoPath`. */
-    readonly logoUrl?: string;
-    /** Absolute path on `baseUrl` (e.g. "/logo.png"); use PNG/JPEG, mail clients block SVG. */
-    readonly logoPath?: string;
-    /** Absolute http(s) origin that `logoPath` is resolved against; same base as `auth.mail.baseUrl`. */
-    readonly baseUrl?: string;
-    /** Locale tried after the exact and language-part match when a localized field has no entry. */
-    readonly defaultLocale?: string;
-    readonly footerText?: LocalizedText;
-    /** Absolute http(s) URLs only; string URLs that are not are dropped, localized ones fail at boot. */
-    readonly footerLinks?: readonly {
-        readonly label: LocalizedText;
-        readonly url: LocalizedText;
-    }[];
-};
-export type LocalizedText = string | Readonly<Record<string, string>>;
-export declare function createSimpleRenderer(branding?: MailBranding): NotificationRenderer;
-export declare const simpleRenderer: NotificationRenderer;