@cosmicdrift/kumiko-bundled-features 0.365.1 → 0.367.0

package/dist/tier-engine/feature.js

@@ -126,9 +126,9 @@ export function createTierEngineFeature(opts = {}) {
             category: "billing",
             recommended: false,
         });
-        r.requires("config");
-        r.requires("tenant");
-        r.entity("tier-assignment", tierAssignmentEntity);
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["tenant"] });
+        r.entity({ name: "tier-assignment", ...tierAssignmentEntity });
         // Standard-CRUD via Helper.
         r.writeHandler(defineEntityCreateHandler("tier-assignment", tierAssignmentEntity, {
             ...writeAccess,
@@ -265,27 +265,35 @@ export function createTierEngineFeature(opts = {}) {
         };
         onTierAssigned.fn = applyAssignment;
         // Invalidation: tier-assignment CRUD events (e.g. the billing webhook) update the cache.
-        r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
-            // result.data has tenantId + tier (after entity-update merge)
-            const data = result.data; // @cast-boundary engine-payload
-            // skip: defensive type-guard auf payload-shape. Bei korrekt gerenderten
-            // entity-events sind beide fields immer strings; ein malformed-payload
-            // (custom-handler-bug) würde hier silent zum cache-skip führen statt
-            // throwing — der lifecycle-pipeline darf nicht durch hook-fehler
-            // blocken (afterCommit-pattern, side-effect-best-effort).
-            if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
-                return;
-            applyAssignment(data.tenantId, data.tier);
+        r.hook({
+            type: "postSave",
+            target: { allOf: "tier-assignment" },
+            handler: async (result) => {
+                // result.data has tenantId + tier (after entity-update merge)
+                const data = result.data; // @cast-boundary engine-payload
+                // skip: defensive guard on the payload shape. Correct entity events
+                // always carry both fields as strings; a malformed payload (a custom
+                // handler bug) skips the cache update instead of throwing, because a
+                // hook error must not block the lifecycle pipeline (afterCommit,
+                // best-effort side effect).
+                if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
+                    return;
+                applyAssignment(data.tenantId, data.tier);
+            },
         });
-        r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
-            const data = payload.data; // @cast-boundary engine-payload
-            // skip: gleiche type-guard semantik wie postSave-hook oben.
-            if (typeof data.tenantId !== "string")
-                return;
-            const tenantId = data.tenantId;
-            takeTicket(tenantId);
-            cache.delete(tenantId);
-            publishAssignmentChange(tenantId);
+        r.hook({
+            type: "postDelete",
+            target: { allOf: "tier-assignment" },
+            handler: async (payload) => {
+                const data = payload.data; // @cast-boundary engine-payload
+                // skip: gleiche type-guard semantik wie postSave-hook oben.
+                if (typeof data.tenantId !== "string")
+                    return;
+                const tenantId = data.tenantId;
+                takeTicket(tenantId);
+                cache.delete(tenantId);
+                publishAssignmentChange(tenantId);
+            },
         });
         // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
         // mit tenant-create rollback), schreibt tier-assignment via Direct-
@@ -302,55 +310,61 @@ export function createTierEngineFeature(opts = {}) {
         if (opts.defaultTier !== undefined) {
             const defaultTier = opts.defaultTier;
             const autoDefaultTierHookReason = "seeds the default tier-assignment stream of the tenant just created";
-            r.hook("postSave", { allOf: "tenant" }, async (result, ctx) => {
-                // result-shape: kumiko-framework's SaveContext mit isNew + data
-                const saveResult = result; // @cast-boundary engine-payload
-                // skip: nur bei tenant-create (initial) — tenant-updates feuern
-                // auch postSave aber wir wollen kein neues tier-assignment bei
-                // re-keying oder name-update.
-                if (saveResult.isNew !== true)
-                    return;
-                const data = saveResult.data; // @cast-boundary engine-payload
-                // skip: defensive type-guard. Tenant-entity hat id zwingend, aber
-                // CrudExecutor's payload-shape ist runtime-unknown.
-                if (typeof data.id !== "string")
-                    return;
-                const newTenantId = data.id; // @cast-boundary engine-payload
-                const aggregateId = tierAssignmentAggregateId(newTenantId);
-                // tenant is an r.systemScope() feature, so this cross-feature hook gets a
-                // fail-closed ctx.db — reach for ctx.systemDb instead (see entity-handlers.ts).
-                // Event-store paths need the raw DbConnection — TenantDb only exposes
-                // select/insert/update/delete, not execute (db.execute(sql`SELECT pg_notify(...)`) would TypeError).
-                const rawDb = ctx.systemDb
-                    ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
-                    : ctx.db && "unsafeRaw" in ctx.db
-                        ? ctx.db.unsafeRaw()
-                        : undefined;
-                // skip: defensive — inTransaction phase always sets db, but AppContext's
-                // type makes it optional. Throwing would be overreach (lifecycle
-                // blocking), silent-skip is defensive-soft.
-                if (!rawDb)
-                    return;
-                // Idempotency: stream-existence-check vor create. Pattern aus
-                // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
-                const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
-                // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
-                if (streamVersion > 0)
-                    return;
-                // SystemUser für den NEUEN tenant — der Hook wird vom signup-
-                // user (anderer tenant, oder SystemAdmin) ausgelöst, aber das
-                // tier-assignment muss im stream des neu-erzeugten tenants
-                // landen (= aggregate-id deterministic auf newTenantId). Memory
-                // `feedback_event_store_tenant_consistency`: by.tenantId muss =
-                // ziel-tenant.
-                const systemUser = {
-                    id: "00000000-0000-4000-8000-000000000001",
-                    tenantId: newTenantId,
-                    roles: ["SystemAdmin"],
-                };
-                const tdb = createTenantDb(rawDb, newTenantId, "system");
-                await tierAssignmentExecutor.create({ id: aggregateId, tier: defaultTier, source: TierAssignmentSources.default }, systemUser, tdb);
-            }, { phase: HookPhases.inTransaction, escapeHatch: { reason: autoDefaultTierHookReason } });
+            r.hook({
+                type: "postSave",
+                target: { allOf: "tenant" },
+                handler: async (result, ctx) => {
+                    // result-shape: kumiko-framework's SaveContext mit isNew + data
+                    const saveResult = result; // @cast-boundary engine-payload
+                    // skip: nur bei tenant-create (initial) — tenant-updates feuern
+                    // auch postSave aber wir wollen kein neues tier-assignment bei
+                    // re-keying oder name-update.
+                    if (saveResult.isNew !== true)
+                        return;
+                    const data = saveResult.data; // @cast-boundary engine-payload
+                    // skip: defensive type-guard. Tenant-entity hat id zwingend, aber
+                    // CrudExecutor's payload-shape ist runtime-unknown.
+                    if (typeof data.id !== "string")
+                        return;
+                    const newTenantId = data.id; // @cast-boundary engine-payload
+                    const aggregateId = tierAssignmentAggregateId(newTenantId);
+                    // tenant is an r.systemScope() feature, so this cross-feature hook gets a
+                    // fail-closed ctx.db — reach for ctx.systemDb instead (see entity-handlers.ts).
+                    // Event-store paths need the raw DbConnection — TenantDb only exposes
+                    // select/insert/update/delete, not execute (db.execute(sql`SELECT pg_notify(...)`) would TypeError).
+                    const rawDb = ctx.systemDb
+                        ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
+                        : ctx.db && "unsafeRaw" in ctx.db
+                            ? ctx.db.unsafeRaw()
+                            : undefined;
+                    // skip: defensive — inTransaction phase always sets db, but AppContext's
+                    // type makes it optional. Throwing would be overreach (lifecycle
+                    // blocking), silent-skip is defensive-soft.
+                    if (!rawDb)
+                        return;
+                    // Idempotency: stream-existence-check vor create. Pattern aus
+                    // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
+                    const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
+                    // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
+                    if (streamVersion > 0)
+                        return;
+                    // SystemUser für den NEUEN tenant — der Hook wird vom signup-
+                    // user (anderer tenant, oder SystemAdmin) ausgelöst, aber das
+                    // tier-assignment muss im stream des neu-erzeugten tenants
+                    // landen (= aggregate-id deterministic auf newTenantId). Memory
+                    // `feedback_event_store_tenant_consistency`: by.tenantId muss =
+                    // ziel-tenant.
+                    const systemUser = {
+                        id: "00000000-0000-4000-8000-000000000001",
+                        tenantId: newTenantId,
+                        roles: ["SystemAdmin"],
+                    };
+                    const tdb = createTenantDb(rawDb, newTenantId, "system");
+                    await tierAssignmentExecutor.create({ id: aggregateId, tier: defaultTier, source: TierAssignmentSources.default }, systemUser, tdb);
+                },
+                phase: HookPhases.inTransaction,
+                escapeHatch: { reason: autoDefaultTierHookReason },
+            });
         }
         // Extension-point declaration + self-registration. Pattern analog
         // mail-foundation/file-foundation: das feature deklariert den

package/dist/user/feature.js

@@ -21,7 +21,7 @@ export function createUserFeature() {
             recommended: true,
         });
         r.systemScope();
-        r.entity("user", userEntity);
+        r.entity({ name: "user", ...userEntity });
         // Self-extension: `user` declares AND fulfils principalStatus (precedent:
         // tier-engine/feature.ts) — wires the blocked-principal check into every stack that mounts `user`.
         r.extendsRegistrar(EXT_PRINCIPAL_STATUS, {});

package/dist/user-data-rights/feature.js

@@ -56,7 +56,7 @@ export function createUserDataRightsFeature(opts = {}) {
             category: "compliance",
             recommended: false,
         });
-        r.requires("user", "data-retention", "compliance-profiles", "sessions");
+        r.requires({ features: ["user", "data-retention", "compliance-profiles", "sessions"] });
         r.usesApi("compliance.forTenant");
         r.usesApi("retention.policyFor");
         // S2.U6 — restrict-account ruft sessions.revokeAllForUser cross-feature.
@@ -92,13 +92,13 @@ export function createUserDataRightsFeature(opts = {}) {
             env: "TENANT_MODEL",
         }));
         // S2.U3 Atom 1b — ExportJob-Lifecycle-Entity.
-        r.entity("export-job", exportJobEntity);
+        r.entity({ name: "export-job", ...exportJobEntity });
         // S2.U3 Atom 4a — Download-Token-Entity. Worker generiert Token beim
         // Flip auf done (siehe run-export-jobs.ts). Hash in DB, plain im
         // RunExportJobsResult fuer Atom 5 (Notification per Email).
-        r.entity("export-download-token", exportDownloadTokenEntity);
+        r.entity({ name: "export-download-token", ...exportDownloadTokenEntity });
         // S2.U7 — Audit-Trail invalid Download-Attempts (DPO Brute-Force-Detection).
-        r.entity("download-attempt", downloadAttemptEntity);
+        r.entity({ name: "download-attempt", ...downloadAttemptEntity });
         // S2.U6 — DSGVO Art. 18 Account-Freeze (Verarbeitungs-Pause).
         // Endpoints fuer Restrict + Lift. Login-Block fuer Restricted Users
         // lebt in auth-email-password/login.write.ts.

package/dist/user-data-rights-defaults/feature.js

@@ -14,7 +14,7 @@ import { userSessionDeleteHook, userSessionExportHook, } from "./hooks/user-sess
 // `user` (S2.H1) und `fileRef` (S2.H2).
 //
 // Architektur-Entscheidung (S2.H1+H2): user-data-rights selbst kann
-// nicht r.requires("user", "files") + r.useExtension(EXT_USER_DATA, ...)
+// nicht r.requires({ features: ["user", "files"] }) + r.useExtension(EXT_USER_DATA, ...)
 // machen weil es selbst Provider von EXT_USER_DATA ist (Boot-Validator
 // lehnt self-extension ab). Lösung: drittes optional-mountbares Feature
 // das requires beide Sources + die useExtension-Calls macht.
@@ -40,7 +40,7 @@ export function createUserDataRightsDefaultsFeature() {
             category: "compliance",
             recommended: false,
         });
-        r.requires("user", "files", "user-data-rights");
+        r.requires({ features: ["user", "files", "user-data-rights"] });
         // Optional sources: hooks are registered unconditionally but each one
         // no-ops at runtime when its source feature isn't mounted (see
         // hooks/feature-mounted.ts) — the export runner has no per-hook

package/dist/user-profile/feature.js

@@ -22,10 +22,10 @@ export function createUserProfileFeature(options) {
             category: "identity",
             recommended: true,
         });
-        r.requires("user");
-        r.requires("auth-email-password");
-        r.requires("user-data-rights");
-        r.requires("user-data-rights-defaults");
+        r.requires({ features: ["user"] });
+        r.requires({ features: ["auth-email-password"] });
+        r.requires({ features: ["user-data-rights"] });
+        r.requires({ features: ["user-data-rights-defaults"] });
         const handlers = allowEmailChange ? { changeEmail: r.writeHandler(changeEmailWrite) } : {};
         // Boot-validator requires a "screen:<id>.title" key per r.screen(), plus
         // one entry per i18nKey()-marked dot-form label below — kept inline (not

package/dist/waitlist/feature.js

@@ -15,7 +15,7 @@ export function createWaitlistFeature(opts = {}) {
         r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
         r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
         r.systemScope();
-        r.requires("tenant", "auth-email-password", "user-data-rights");
+        r.requires({ features: ["tenant", "auth-email-password", "user-data-rights"] });
         r.translations({ keys: WAITLIST_I18N });
         r.notification("confirmation", {
             variables: WAITLIST_CONFIRMATION_VARIABLES,
@@ -26,7 +26,7 @@ export function createWaitlistFeature(opts = {}) {
             record: WAITLIST_ADMIN_NOTICE_RECORD,
             localizedTemplate: waitlistAdminNoticeTemplate,
         });
-        r.entity("waitlistEntry", waitlistEntryEntity);
+        r.entity({ name: "waitlistEntry", ...waitlistEntryEntity });
         r.writeHandler(createSubmitHandler(opts));
         r.writeHandler(createInviteHandler(opts.invite));
         r.writeHandler(rejectHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.365.1",
+  "version": "0.367.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -524,12 +524,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.365.1",
-    "@cosmicdrift/kumiko-framework": "0.365.1",
-    "@cosmicdrift/kumiko-headless": "0.365.1",
-    "@cosmicdrift/kumiko-renderer": "0.365.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.365.1",
-    "@cosmicdrift/kumiko-types": "0.365.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.367.0",
+    "@cosmicdrift/kumiko-framework": "0.367.0",
+    "@cosmicdrift/kumiko-headless": "0.367.0",
+    "@cosmicdrift/kumiko-renderer": "0.367.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.367.0",
+    "@cosmicdrift/kumiko-types": "0.367.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1078,9 +1078,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.365.1",
-    "@cosmicdrift/kumiko-locale-es": "0.365.1",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.365.1",
+    "@cosmicdrift/kumiko-locale-de": "0.367.0",
+    "@cosmicdrift/kumiko-locale-es": "0.367.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.367.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Agent tool failures are classified instead of passing raw messages through",
+    "detail": "dispatchToolCall now adds a code to failed tool results. Client errors keep their message, rate limits also set retryable and retryAfterSeconds. Server errors and unknown throws are logged with their cause and returned to the model as \"Tool failed unexpectedly\", so internal details such as database messages no longer reach the model. ToolCallRequest accepts an optional log."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "Removed unused AuthHandlers.inviteCancel constant",
+    "detail": "AuthHandlers.inviteCancel pointed at auth-email-password:write:invite-cancel, a handler that never existed. The constant is removed.",
+    "migration": "If you referenced AuthHandlers.inviteCancel, use tenant:write:cancel-invitation."
+  },
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "invite-create is no longer exposed to agents",
+    "detail": "The admin invite-create handler is now opted out of the agent tool catalog with agent: { expose: false }, like the other invite handlers, because it mails an accept link to an arbitrary address."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "cap-counter calendar settle is idempotent",
+    "detail": "Settling a calendar cap reservation now keeps the row as a tombstone (new column store_cap_reservations.settled_at, retained for 24 hours) instead of deleting it. A repeated settle with the same reservation id is a no-op, and confirm, give-back and expiry sweep ignore settled rows. The sweep deletes expired tombstones.",
+    "migration": "Apps with cap-counter generate a migration for the new column store_cap_reservations.settled_at (kumiko migrate generate)."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Email channel can send through the tenant's own mail provider",
+    "detail": "EmailChannelOptions gets tenantTransport, a resolver called per send with the delivery channel context. mail-foundation exports tenantMailTransport for it: a tenant with a provider configured sends through its own transport, a broken provider fails the send, a tenant without a provider uses the app transport. The transport is built per send and never cached, and the tenant comes from the server-side delivery context only. ChannelContext now carries the tenant's config accessor as config. Without tenantTransport nothing changes."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "forget-subject is covered for users stored before the KMS and users without an event stream",
+    "detail": "Tests now cover forget-subject for users stored as plaintext before the KMS was configured and for users without an event stream. Both succeed since the KMS tombstone fix, close the login door and write the audit event."
+  },
   {
     "version": "0.365.1",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Delivery signs unsubscribe links itself",
+    "detail": "r.notification(name, { unsubscribe: true }) makes delivery put a signed data.unsubscribeUrl into every email of that notification when the service has unsubscribeLinks. User recipients get a user token, route recipients an address token (only with a blind-index key, otherwise no link). The token is scoped to tenant, notification and channel; a link the caller passes in data.unsubscribeUrl wins. runProdApp option unsubscribe: { secret } mounts createUnsubscribeRoutes and wires the links; the base URL comes from auth.publicOrigin, auth.mail.baseUrl or APP_BASE_URL, and without one boot warns and no link is added."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Unsubscribe links use the tenant's host and the mail's language, apps learn about address opt-outs",
+    "detail": "unsubscribeLinks and the runProdApp option unsubscribe take tenantOrigin, an app callback that returns the sending tenant's own origin (subdomain or custom domain) per send; null, a throw or a non-https value fall back to the app origin and never fail the send. The signed token now carries the mail's locale (notify option locale), so the confirmation, result and undo pages render in that language; tokens without it keep working and show English. A form post to the resubscribe route now answers with an HTML page, JSON callers are unchanged. After a committed address opt-out an app job declared with trigger on DeliveryHandlers.unsubscribeAddress receives addressHash, notificationType and channel (unsubscribeAddressPayloadSchema) with the tenant in ctx.triggeredBy.tenantId; hashUnsubscribeAddress(email) matches it to the app's own subscriber. UNSUBSCRIBE_PAGE_EN exports the English page texts, German and Spanish come with the locale packages."
+  },
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Renaming a notification type keeps user preferences and address opt-outs",
+    "detail": "r.notification accepts renamedFrom, a list of former qualified names. Preferences and address opt-outs stored under a former name keep applying to the renamed notification, and a stored choice under the current name wins over one under a former name. New writes via setPreference and the unsubscribe and resubscribe handlers are stored under the current name, resubscribeAddress also lifts opt-outs under former names. Boot fails if an alias is a current notification name, is the wildcard, or is claimed by two notifications."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Inbound mail fetch can skip already-seen message ids",
+    "detail": "InboundMailProviderPlugin.fetch receives an optional filterUnknownMessageIds(providerMessageIds) hook. The watch supervisor implements it with a tenant- and account-scoped lookup of already-seen provider message ids and returns the ids not seen yet, so a plugin can avoid downloading messages it has already processed."
+  },
+  {
+    "version": "0.366.0",
+    "type": "breaking",
+    "title": "InboundMailContext exposes metricsFor to provider plugins",
+    "detail": "InboundMailContext gains an optional metricsFor(featureName) returning a MetricsHandle. runProdApp, the worker app and the dev server wire it from the observability meter, so provider plugins can emit their own metrics through the same pipeline.",
+    "migration": "Code that builds SystemWireDeps itself adds metricsFor (createMetricsForFactory(meter))."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/template-resolver/changes.json

@@ -1,4 +1,29 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Notifications can keep their mail template system-only",
+    "detail": "r.notification(name, { systemOnly: true }) marks the stored mail template as a platform text. Tenant admins no longer see it in the template overview, list or detail, and creating a tenant version (upsert-tenant, copy-locale, import-bundle, also a SystemAdmin writing for a tenant) is refused with access_denied and templateResolver.errors.systemOnlyTemplate. SystemAdmins edit the system template as before, and the mail renderer always uses it, even if a tenant row exists from before."
+  },
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Rich text placeholders no longer nest paragraphs",
+    "detail": "A richText placeholder alone in a paragraph compiles into a div that keeps the paragraph attributes, and one inside other text renders inline with line breaks instead of its own paragraphs. Mails and PDFs no longer contain <p><p>. richText and stepIs are now reserved template variable names, like the other renderer helpers.",
+    "migration": "A notification that declares a template variable called richText, stepIs or percent fails at boot; rename the variable."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template bundles with a logo can be seeded",
+    "detail": "seedSystemTemplateBundle(db, bundle, { dispatcher }) now seeds bundles that carry resources such as a logo by running the import-bundle-system write on the given seed dispatcher. With ifExists \"skip\" (default) nothing is written when every locale row already exists; if only some exist, the whole bundle is imported again. Without a dispatcher such a bundle still fails with a message that names the missing option."
+  },
+  {
+    "version": "0.367.0",
+    "type": "improvement",
+    "title": "Template conditions with data-if and a percent variable type",
+    "detail": "A paragraph, heading or table row with data-if=\"name\" renders only when the variable has a value (0 counts as a value); inside a repeat row the name refers to the row field, on the repeat row itself to the root variable. The sanitizer keeps the attribute, and template validation reports a condition on an undeclared variable. New variable type percent (templateVariable.percent()) takes percentage points and renders locale-aware, 12 as \"12 %\" in German and \"12%\" in English; the preview uses its example value. The document designer has no toolbar control for conditions yet; the attribute survives editing."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.367.0",
+    "type": "fix",
+    "title": "Tests seed tenant memberships and events through the framework",
+    "detail": "Test-only change. Integration tests create read_tenant_memberships from tenantMembershipEntity and seed rows with seedRow instead of hand-written DDL and raw INSERTs. Fake events go through the event-store append, and backdated audit events are written with runSeedWritesAt instead of an UPDATE on created_at. No runtime behavior changes."
+  },
   {
     "version": "0.365.0",
     "type": "improvement",