@cosmicdrift/kumiko-bundled-features 0.365.0 → 0.366.0

package/dist/tier-engine/feature.js

@@ -126,9 +126,9 @@ export function createTierEngineFeature(opts = {}) {
             category: "billing",
             recommended: false,
         });
-        r.requires("config");
-        r.requires("tenant");
-        r.entity("tier-assignment", tierAssignmentEntity);
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["tenant"] });
+        r.entity({ name: "tier-assignment", ...tierAssignmentEntity });
         // Standard-CRUD via Helper.
         r.writeHandler(defineEntityCreateHandler("tier-assignment", tierAssignmentEntity, {
             ...writeAccess,
@@ -265,27 +265,35 @@ export function createTierEngineFeature(opts = {}) {
         };
         onTierAssigned.fn = applyAssignment;
         // Invalidation: tier-assignment CRUD events (e.g. the billing webhook) update the cache.
-        r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
-            // result.data has tenantId + tier (after entity-update merge)
-            const data = result.data; // @cast-boundary engine-payload
-            // skip: defensive type-guard auf payload-shape. Bei korrekt gerenderten
-            // entity-events sind beide fields immer strings; ein malformed-payload
-            // (custom-handler-bug) würde hier silent zum cache-skip führen statt
-            // throwing — der lifecycle-pipeline darf nicht durch hook-fehler
-            // blocken (afterCommit-pattern, side-effect-best-effort).
-            if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
-                return;
-            applyAssignment(data.tenantId, data.tier);
+        r.hook({
+            type: "postSave",
+            target: { allOf: "tier-assignment" },
+            handler: async (result) => {
+                // result.data has tenantId + tier (after entity-update merge)
+                const data = result.data; // @cast-boundary engine-payload
+                // skip: defensive guard on the payload shape. Correct entity events
+                // always carry both fields as strings; a malformed payload (a custom
+                // handler bug) skips the cache update instead of throwing, because a
+                // hook error must not block the lifecycle pipeline (afterCommit,
+                // best-effort side effect).
+                if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
+                    return;
+                applyAssignment(data.tenantId, data.tier);
+            },
         });
-        r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
-            const data = payload.data; // @cast-boundary engine-payload
-            // skip: gleiche type-guard semantik wie postSave-hook oben.
-            if (typeof data.tenantId !== "string")
-                return;
-            const tenantId = data.tenantId;
-            takeTicket(tenantId);
-            cache.delete(tenantId);
-            publishAssignmentChange(tenantId);
+        r.hook({
+            type: "postDelete",
+            target: { allOf: "tier-assignment" },
+            handler: async (payload) => {
+                const data = payload.data; // @cast-boundary engine-payload
+                // skip: gleiche type-guard semantik wie postSave-hook oben.
+                if (typeof data.tenantId !== "string")
+                    return;
+                const tenantId = data.tenantId;
+                takeTicket(tenantId);
+                cache.delete(tenantId);
+                publishAssignmentChange(tenantId);
+            },
         });
         // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
         // mit tenant-create rollback), schreibt tier-assignment via Direct-
@@ -302,55 +310,61 @@ export function createTierEngineFeature(opts = {}) {
         if (opts.defaultTier !== undefined) {
             const defaultTier = opts.defaultTier;
             const autoDefaultTierHookReason = "seeds the default tier-assignment stream of the tenant just created";
-            r.hook("postSave", { allOf: "tenant" }, async (result, ctx) => {
-                // result-shape: kumiko-framework's SaveContext mit isNew + data
-                const saveResult = result; // @cast-boundary engine-payload
-                // skip: nur bei tenant-create (initial) — tenant-updates feuern
-                // auch postSave aber wir wollen kein neues tier-assignment bei
-                // re-keying oder name-update.
-                if (saveResult.isNew !== true)
-                    return;
-                const data = saveResult.data; // @cast-boundary engine-payload
-                // skip: defensive type-guard. Tenant-entity hat id zwingend, aber
-                // CrudExecutor's payload-shape ist runtime-unknown.
-                if (typeof data.id !== "string")
-                    return;
-                const newTenantId = data.id; // @cast-boundary engine-payload
-                const aggregateId = tierAssignmentAggregateId(newTenantId);
-                // tenant is an r.systemScope() feature, so this cross-feature hook gets a
-                // fail-closed ctx.db — reach for ctx.systemDb instead (see entity-handlers.ts).
-                // Event-store paths need the raw DbConnection — TenantDb only exposes
-                // select/insert/update/delete, not execute (db.execute(sql`SELECT pg_notify(...)`) would TypeError).
-                const rawDb = ctx.systemDb
-                    ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
-                    : ctx.db && "unsafeRaw" in ctx.db
-                        ? ctx.db.unsafeRaw()
-                        : undefined;
-                // skip: defensive — inTransaction phase always sets db, but AppContext's
-                // type makes it optional. Throwing would be overreach (lifecycle
-                // blocking), silent-skip is defensive-soft.
-                if (!rawDb)
-                    return;
-                // Idempotency: stream-existence-check vor create. Pattern aus
-                // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
-                const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
-                // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
-                if (streamVersion > 0)
-                    return;
-                // SystemUser für den NEUEN tenant — der Hook wird vom signup-
-                // user (anderer tenant, oder SystemAdmin) ausgelöst, aber das
-                // tier-assignment muss im stream des neu-erzeugten tenants
-                // landen (= aggregate-id deterministic auf newTenantId). Memory
-                // `feedback_event_store_tenant_consistency`: by.tenantId muss =
-                // ziel-tenant.
-                const systemUser = {
-                    id: "00000000-0000-4000-8000-000000000001",
-                    tenantId: newTenantId,
-                    roles: ["SystemAdmin"],
-                };
-                const tdb = createTenantDb(rawDb, newTenantId, "system");
-                await tierAssignmentExecutor.create({ id: aggregateId, tier: defaultTier, source: TierAssignmentSources.default }, systemUser, tdb);
-            }, { phase: HookPhases.inTransaction, escapeHatch: { reason: autoDefaultTierHookReason } });
+            r.hook({
+                type: "postSave",
+                target: { allOf: "tenant" },
+                handler: async (result, ctx) => {
+                    // result-shape: kumiko-framework's SaveContext mit isNew + data
+                    const saveResult = result; // @cast-boundary engine-payload
+                    // skip: nur bei tenant-create (initial) — tenant-updates feuern
+                    // auch postSave aber wir wollen kein neues tier-assignment bei
+                    // re-keying oder name-update.
+                    if (saveResult.isNew !== true)
+                        return;
+                    const data = saveResult.data; // @cast-boundary engine-payload
+                    // skip: defensive type-guard. Tenant-entity hat id zwingend, aber
+                    // CrudExecutor's payload-shape ist runtime-unknown.
+                    if (typeof data.id !== "string")
+                        return;
+                    const newTenantId = data.id; // @cast-boundary engine-payload
+                    const aggregateId = tierAssignmentAggregateId(newTenantId);
+                    // tenant is an r.systemScope() feature, so this cross-feature hook gets a
+                    // fail-closed ctx.db — reach for ctx.systemDb instead (see entity-handlers.ts).
+                    // Event-store paths need the raw DbConnection — TenantDb only exposes
+                    // select/insert/update/delete, not execute (db.execute(sql`SELECT pg_notify(...)`) would TypeError).
+                    const rawDb = ctx.systemDb
+                        ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
+                        : ctx.db && "unsafeRaw" in ctx.db
+                            ? ctx.db.unsafeRaw()
+                            : undefined;
+                    // skip: defensive — inTransaction phase always sets db, but AppContext's
+                    // type makes it optional. Throwing would be overreach (lifecycle
+                    // blocking), silent-skip is defensive-soft.
+                    if (!rawDb)
+                        return;
+                    // Idempotency: stream-existence-check vor create. Pattern aus
+                    // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
+                    const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
+                    // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
+                    if (streamVersion > 0)
+                        return;
+                    // SystemUser für den NEUEN tenant — der Hook wird vom signup-
+                    // user (anderer tenant, oder SystemAdmin) ausgelöst, aber das
+                    // tier-assignment muss im stream des neu-erzeugten tenants
+                    // landen (= aggregate-id deterministic auf newTenantId). Memory
+                    // `feedback_event_store_tenant_consistency`: by.tenantId muss =
+                    // ziel-tenant.
+                    const systemUser = {
+                        id: "00000000-0000-4000-8000-000000000001",
+                        tenantId: newTenantId,
+                        roles: ["SystemAdmin"],
+                    };
+                    const tdb = createTenantDb(rawDb, newTenantId, "system");
+                    await tierAssignmentExecutor.create({ id: aggregateId, tier: defaultTier, source: TierAssignmentSources.default }, systemUser, tdb);
+                },
+                phase: HookPhases.inTransaction,
+                escapeHatch: { reason: autoDefaultTierHookReason },
+            });
         }
         // Extension-point declaration + self-registration. Pattern analog
         // mail-foundation/file-foundation: das feature deklariert den

package/dist/user/feature.js

@@ -21,7 +21,7 @@ export function createUserFeature() {
             recommended: true,
         });
         r.systemScope();
-        r.entity("user", userEntity);
+        r.entity({ name: "user", ...userEntity });
         // Self-extension: `user` declares AND fulfils principalStatus (precedent:
         // tier-engine/feature.ts) — wires the blocked-principal check into every stack that mounts `user`.
         r.extendsRegistrar(EXT_PRINCIPAL_STATUS, {});

package/dist/user-data-rights/feature.js

@@ -56,7 +56,7 @@ export function createUserDataRightsFeature(opts = {}) {
             category: "compliance",
             recommended: false,
         });
-        r.requires("user", "data-retention", "compliance-profiles", "sessions");
+        r.requires({ features: ["user", "data-retention", "compliance-profiles", "sessions"] });
         r.usesApi("compliance.forTenant");
         r.usesApi("retention.policyFor");
         // S2.U6 — restrict-account ruft sessions.revokeAllForUser cross-feature.
@@ -92,13 +92,13 @@ export function createUserDataRightsFeature(opts = {}) {
             env: "TENANT_MODEL",
         }));
         // S2.U3 Atom 1b — ExportJob-Lifecycle-Entity.
-        r.entity("export-job", exportJobEntity);
+        r.entity({ name: "export-job", ...exportJobEntity });
         // S2.U3 Atom 4a — Download-Token-Entity. Worker generiert Token beim
         // Flip auf done (siehe run-export-jobs.ts). Hash in DB, plain im
         // RunExportJobsResult fuer Atom 5 (Notification per Email).
-        r.entity("export-download-token", exportDownloadTokenEntity);
+        r.entity({ name: "export-download-token", ...exportDownloadTokenEntity });
         // S2.U7 — Audit-Trail invalid Download-Attempts (DPO Brute-Force-Detection).
-        r.entity("download-attempt", downloadAttemptEntity);
+        r.entity({ name: "download-attempt", ...downloadAttemptEntity });
         // S2.U6 — DSGVO Art. 18 Account-Freeze (Verarbeitungs-Pause).
         // Endpoints fuer Restrict + Lift. Login-Block fuer Restricted Users
         // lebt in auth-email-password/login.write.ts.

package/dist/user-data-rights-defaults/feature.js

@@ -14,7 +14,7 @@ import { userSessionDeleteHook, userSessionExportHook, } from "./hooks/user-sess
 // `user` (S2.H1) und `fileRef` (S2.H2).
 //
 // Architektur-Entscheidung (S2.H1+H2): user-data-rights selbst kann
-// nicht r.requires("user", "files") + r.useExtension(EXT_USER_DATA, ...)
+// nicht r.requires({ features: ["user", "files"] }) + r.useExtension(EXT_USER_DATA, ...)
 // machen weil es selbst Provider von EXT_USER_DATA ist (Boot-Validator
 // lehnt self-extension ab). Lösung: drittes optional-mountbares Feature
 // das requires beide Sources + die useExtension-Calls macht.
@@ -40,7 +40,7 @@ export function createUserDataRightsDefaultsFeature() {
             category: "compliance",
             recommended: false,
         });
-        r.requires("user", "files", "user-data-rights");
+        r.requires({ features: ["user", "files", "user-data-rights"] });
         // Optional sources: hooks are registered unconditionally but each one
         // no-ops at runtime when its source feature isn't mounted (see
         // hooks/feature-mounted.ts) — the export runner has no per-hook

package/dist/user-profile/feature.js

@@ -22,10 +22,10 @@ export function createUserProfileFeature(options) {
             category: "identity",
             recommended: true,
         });
-        r.requires("user");
-        r.requires("auth-email-password");
-        r.requires("user-data-rights");
-        r.requires("user-data-rights-defaults");
+        r.requires({ features: ["user"] });
+        r.requires({ features: ["auth-email-password"] });
+        r.requires({ features: ["user-data-rights"] });
+        r.requires({ features: ["user-data-rights-defaults"] });
         const handlers = allowEmailChange ? { changeEmail: r.writeHandler(changeEmailWrite) } : {};
         // Boot-validator requires a "screen:<id>.title" key per r.screen(), plus
         // one entry per i18nKey()-marked dot-form label below — kept inline (not

package/dist/waitlist/feature.js

@@ -15,7 +15,7 @@ export function createWaitlistFeature(opts = {}) {
         r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
         r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
         r.systemScope();
-        r.requires("tenant", "auth-email-password", "user-data-rights");
+        r.requires({ features: ["tenant", "auth-email-password", "user-data-rights"] });
         r.translations({ keys: WAITLIST_I18N });
         r.notification("confirmation", {
             variables: WAITLIST_CONFIRMATION_VARIABLES,
@@ -26,7 +26,7 @@ export function createWaitlistFeature(opts = {}) {
             record: WAITLIST_ADMIN_NOTICE_RECORD,
             localizedTemplate: waitlistAdminNoticeTemplate,
         });
-        r.entity("waitlistEntry", waitlistEntryEntity);
+        r.entity({ name: "waitlistEntry", ...waitlistEntryEntity });
         r.writeHandler(createSubmitHandler(opts));
         r.writeHandler(createInviteHandler(opts.invite));
         r.writeHandler(rejectHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.365.0",
+  "version": "0.366.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -524,12 +524,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.365.0",
-    "@cosmicdrift/kumiko-framework": "0.365.0",
-    "@cosmicdrift/kumiko-headless": "0.365.0",
-    "@cosmicdrift/kumiko-renderer": "0.365.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.365.0",
-    "@cosmicdrift/kumiko-types": "0.365.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.366.0",
+    "@cosmicdrift/kumiko-framework": "0.366.0",
+    "@cosmicdrift/kumiko-headless": "0.366.0",
+    "@cosmicdrift/kumiko-renderer": "0.366.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.366.0",
+    "@cosmicdrift/kumiko-types": "0.366.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1078,9 +1078,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.365.0",
-    "@cosmicdrift/kumiko-locale-es": "0.365.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.365.0",
+    "@cosmicdrift/kumiko-locale-de": "0.366.0",
+    "@cosmicdrift/kumiko-locale-es": "0.366.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.366.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Agent tool failures are classified instead of passing raw messages through",
+    "detail": "dispatchToolCall now adds a code to failed tool results. Client errors keep their message, rate limits also set retryable and retryAfterSeconds. Server errors and unknown throws are logged with their cause and returned to the model as \"Tool failed unexpectedly\", so internal details such as database messages no longer reach the model. ToolCallRequest accepts an optional log."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "Removed unused AuthHandlers.inviteCancel constant",
+    "detail": "AuthHandlers.inviteCancel pointed at auth-email-password:write:invite-cancel, a handler that never existed. The constant is removed.",
+    "migration": "If you referenced AuthHandlers.inviteCancel, use tenant:write:cancel-invitation."
+  },
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "invite-create is no longer exposed to agents",
+    "detail": "The admin invite-create handler is now opted out of the agent tool catalog with agent: { expose: false }, like the other invite handlers, because it mails an accept link to an arbitrary address."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "cap-counter calendar settle is idempotent",
+    "detail": "Settling a calendar cap reservation now keeps the row as a tombstone (new column store_cap_reservations.settled_at, retained for 24 hours) instead of deleting it. A repeated settle with the same reservation id is a no-op, and confirm, give-back and expiry sweep ignore settled rows. The sweep deletes expired tombstones.",
+    "migration": "Apps with cap-counter generate a migration for the new column store_cap_reservations.settled_at (kumiko migrate generate)."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "forget-subject is covered for users stored before the KMS and users without an event stream",
+    "detail": "Tests now cover forget-subject for users stored as plaintext before the KMS was configured and for users without an event stream. Both succeed since the KMS tombstone fix, close the login door and write the audit event."
+  },
+  {
+    "version": "0.365.1",
+    "type": "fix",
+    "title": "eraseKey leaves a tombstone for subjects that never had a key",
+    "detail": "eraseKey now records an erased entry even when the subject has no key (pre-KMS plaintext). A later createKey or write for that subject fails with subject_erased instead of minting a fresh key and re-encrypting the plaintext. Erase flows must write with writePurpose erasure after eraseKey. kumiko_subject_keys now gets one tombstone row per forgotten record subject and per step dispatch. The tenant destruction stage tenant-row now fails loudly when marking the tenant destroyed does not succeed.",
+    "migration": "Run backfill-pii before erasing Pre-KMS data, otherwise untouched plaintext stays readable after eraseKey."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Renaming a notification type keeps user preferences and address opt-outs",
+    "detail": "r.notification accepts renamedFrom, a list of former qualified names. Preferences and address opt-outs stored under a former name keep applying to the renamed notification, and a stored choice under the current name wins over one under a former name. New writes via setPreference and the unsubscribe and resubscribe handlers are stored under the current name, resubscribeAddress also lifts opt-outs under former names. Boot fails if an alias is a current notification name, is the wildcard, or is claimed by two notifications."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Inbound mail fetch can skip already-seen message ids",
+    "detail": "InboundMailProviderPlugin.fetch receives an optional filterUnknownMessageIds(providerMessageIds) hook. The watch supervisor implements it with a tenant- and account-scoped lookup of already-seen provider message ids and returns the ids not seen yet, so a plugin can avoid downloading messages it has already processed."
+  },
+  {
+    "version": "0.366.0",
+    "type": "breaking",
+    "title": "InboundMailContext exposes metricsFor to provider plugins",
+    "detail": "InboundMailContext gains an optional metricsFor(featureName) returning a MetricsHandle. runProdApp, the worker app and the dev server wire it from the observability meter, so provider plugins can emit their own metrics through the same pipeline.",
+    "migration": "Code that builds SystemWireDeps itself adds metricsFor (createMetricsForFactory(meter))."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/step-dispatcher/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.365.1",
+    "type": "fix",
+    "title": "step-dispatcher delivers each dispatch as a retried job, so a slow receiver no longer delays other tenants",
+    "detail": "The step-dispatcher projection now only enqueues one `step-dispatcher:job:deliver` job per dispatch request, and the job performs the webhook or mail delivery. Redis holds only the dispatch stream id and the tenant, never the request payload. Transient failures (network error, timeout, 5xx, 408, 429, any mail adapter failure) are retried 3 times with exponential backoff; the outcome event and the payload key erase follow after the final attempt. Permanent failures (invalid url, blocked host, other 4xx, unavailable auth secret) are recorded at once. At most 2 deliveries per tenant run at the same time, so one tenant's slow receivers cannot hold up the others. This corrects the 0.346.0 note that a hanging receiver no longer stalls the dispatcher for every tenant: the shared consumer still delivered one request at a time.",
+    "migration": "step-dispatcher now needs a job runner (Redis) and a worker consuming the default worker lane. Without a job runner the projection throws instead of delivering. Test stacks must pass `jobs` to setupTestStack and call `drainJobs()` after the event dispatcher ran. `r.job` accepts `maxPerTenant: { limit, onLimit: \"defer\", deferMs? }`; a plain number still drops excess enqueues. A `webhook.send` request that gets a retryable status (5xx, 408, 429) is now sent up to 4 times under the same Idempotency-Key. Worker pods must know the deliver job before the projection enqueues it, so deploy worker and API together or the worker first. A dev server only consumes jobs when the app mounts `createJobsFeature()`."
+  },
   {
     "version": "0.347.0",
     "type": "fix",
@@ -21,7 +28,7 @@
     "version": "0.346.0",
     "type": "fix",
     "title": "Webhook requests time out after 10 seconds instead of blocking the dispatcher",
-    "detail": "Webhook requests time out after 10 seconds\nA hanging receiver now ends as `step.dispatch-failed` and no longer stalls the step-dispatcher for every tenant."
+    "detail": "Webhook requests time out after 10 seconds\nA hanging receiver now ends as `step.dispatch-failed` after the timeout instead of waiting indefinitely. Until the step-dispatcher delivered through jobs, the shared consumer still processed requests one at a time, so a slow receiver of one tenant delayed the others."
   },
   {
     "version": "0.346.0",