@cosmicdrift/kumiko-bundled-features 0.371.0 → 0.372.0

package/dist/user-data-rights/schema/export-job.d.ts

@@ -13,7 +13,7 @@ export type ExportJobStatus = (typeof EXPORT_JOB_STATUS)[keyof typeof EXPORT_JOB
  */
 export declare const ACTIVE_JOB_CONSTRAINT = "read_export_jobs_one_active_per_user";
 export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    userId: {
+    readonly userId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -36,7 +36,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    requestedFromTenantId: {
+    readonly requestedFromTenantId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -59,7 +59,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    status: {
+    readonly status: {
         readonly type: "select";
         readonly description?: string;
         readonly options: readonly ["pending", "running", "done", "failed"];
@@ -83,7 +83,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    requestedAt: {
+    readonly requestedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -98,7 +98,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    startedAt: {
+    readonly startedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -113,7 +113,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    completedAt: {
+    readonly completedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -128,7 +128,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    downloadStorageKey: {
+    readonly downloadStorageKey: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -151,7 +151,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    expiresAt: {
+    readonly expiresAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -166,7 +166,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    errorMessage: {
+    readonly errorMessage: {
         readonly type: "longText";
         readonly description?: string;
         readonly maxLength?: number;
@@ -182,7 +182,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    bytesWritten: {
+    readonly bytesWritten: {
         readonly type: "bigInt";
         readonly description?: string;
         readonly required?: boolean;
@@ -196,7 +196,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
     };
 }, "tenant">;
 export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    userId: {
+    readonly userId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -219,7 +219,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    requestedFromTenantId: {
+    readonly requestedFromTenantId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -242,7 +242,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    status: {
+    readonly status: {
         readonly type: "select";
         readonly description?: string;
         readonly options: readonly ["pending", "running", "done", "failed"];
@@ -266,7 +266,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    requestedAt: {
+    readonly requestedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -281,7 +281,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    startedAt: {
+    readonly startedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -296,7 +296,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    completedAt: {
+    readonly completedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -311,7 +311,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    downloadStorageKey: {
+    readonly downloadStorageKey: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -334,7 +334,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    expiresAt: {
+    readonly expiresAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -349,7 +349,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    errorMessage: {
+    readonly errorMessage: {
         readonly type: "longText";
         readonly description?: string;
         readonly maxLength?: number;
@@ -365,7 +365,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    bytesWritten: {
+    readonly bytesWritten: {
         readonly type: "bigInt";
         readonly description?: string;
         readonly required?: boolean;

package/dist/user-data-rights/web/privacy-center-screen.js

@@ -1,4 +1,5 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-headless";
 // @runtime client
 // Export section (Art. 20) — the one part of user-data-rights' privacy-center
 // screen that stays custom (fw#2312). Registered as an EditExtensionSection
@@ -29,7 +30,7 @@ function failureKey(error) {
 // kein Date-API (no-date-api-Guard) und universell. Leer/null → "—".
 export function formatDate(iso) {
     if (!iso)
-        return "—";
+        return EMPTY_VALUE_PLACEHOLDER;
     const tIndex = iso.indexOf("T");
     return tIndex > 0 ? iso.slice(0, tIndex) : iso;
 }

package/dist/waitlist/entity.d.ts

@@ -1,6 +1,6 @@
 export declare function isOpenWaitlistStatus(status: unknown): boolean;
 export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    name: {
+    readonly name: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -23,7 +23,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    email: {
+    readonly email: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -46,7 +46,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    company: {
+    readonly company: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -69,7 +69,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    portfolio: {
+    readonly portfolio: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -92,7 +92,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    message: {
+    readonly message: {
         readonly type: "longText";
         readonly description?: string;
         readonly maxLength?: number;
@@ -108,7 +108,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    locale: {
+    readonly locale: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -131,7 +131,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    status: {
+    readonly status: {
         readonly type: "select";
         readonly description?: string;
         readonly options: readonly ["pending", "invited", "provisioned", "rejected"];
@@ -155,7 +155,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    submittedAt: {
+    readonly submittedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -170,7 +170,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    invitedAt: {
+    readonly invitedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -185,7 +185,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    invitedBy: {
+    readonly invitedBy: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -208,7 +208,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    provisionedAt: {
+    readonly provisionedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -223,7 +223,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    linkedTenantId: {
+    readonly linkedTenantId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -248,7 +248,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     };
 }, "global">;
 export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    name: {
+    readonly name: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -271,7 +271,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    email: {
+    readonly email: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -294,7 +294,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    company: {
+    readonly company: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -317,7 +317,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    portfolio: {
+    readonly portfolio: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -340,7 +340,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    message: {
+    readonly message: {
         readonly type: "longText";
         readonly description?: string;
         readonly maxLength?: number;
@@ -356,7 +356,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    locale: {
+    readonly locale: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -379,7 +379,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    status: {
+    readonly status: {
         readonly type: "select";
         readonly description?: string;
         readonly options: readonly ["pending", "invited", "provisioned", "rejected"];
@@ -403,7 +403,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    submittedAt: {
+    readonly submittedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -418,7 +418,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    invitedAt: {
+    readonly invitedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -433,7 +433,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    invitedBy: {
+    readonly invitedBy: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -456,7 +456,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    provisionedAt: {
+    readonly provisionedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -471,7 +471,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    linkedTenantId: {
+    readonly linkedTenantId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;

package/dist/waitlist/lib.d.ts

@@ -4,7 +4,30 @@ export declare const WAITLIST_CROSS_TENANT_REASON = "waitlist is platform-wide (
 export declare const adminAccess: {
     readonly roles: readonly string[];
 };
-export declare const waitlistExecutor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor;
+export declare const waitlistExecutor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor<{
+    readonly id: string;
+    readonly tenantId: string;
+    readonly version: number;
+    readonly insertedAt: Temporal.Instant;
+    readonly modifiedAt: Temporal.Instant | null;
+    readonly insertedById: string | null;
+    readonly modifiedById: string | null;
+    readonly isDeleted?: boolean | undefined;
+    readonly deletedAt?: Temporal.Instant | null | undefined;
+    readonly deletedById?: string | null | undefined;
+    readonly company: string | null;
+    readonly email: string;
+    readonly invitedAt: Temporal.Instant | null;
+    readonly invitedBy: string | null;
+    readonly linkedTenantId: string | null;
+    readonly locale: string;
+    readonly message: string | null;
+    readonly name: string;
+    readonly portfolio: string | null;
+    readonly provisionedAt: Temporal.Instant | null;
+    readonly status: string;
+    readonly submittedAt: Temporal.Instant;
+}>;
 export declare function normalizeEmail(email: string): string;
 export declare function waitlistDb(ctx: Pick<AppContext, "systemDb">): TenantDb;
 export declare function platformActor(): SessionUser;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.371.0",
+  "version": "0.372.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -536,12 +536,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.371.0",
-    "@cosmicdrift/kumiko-framework": "0.371.0",
-    "@cosmicdrift/kumiko-headless": "0.371.0",
-    "@cosmicdrift/kumiko-renderer": "0.371.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.371.0",
-    "@cosmicdrift/kumiko-types": "0.371.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.372.0",
+    "@cosmicdrift/kumiko-framework": "0.372.0",
+    "@cosmicdrift/kumiko-headless": "0.372.0",
+    "@cosmicdrift/kumiko-renderer": "0.372.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.372.0",
+    "@cosmicdrift/kumiko-types": "0.372.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1102,12 +1102,12 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.371.0",
-    "@cosmicdrift/kumiko-locale-es": "0.371.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.371.0",
+    "@cosmicdrift/kumiko-locale-de": "0.372.0",
+    "@cosmicdrift/kumiko-locale-es": "0.372.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.372.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.371.0"
+    "@cosmicdrift/kumiko-testing": "0.372.0"
   },
   "peerDependencies": {
     "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "fix",
+    "title": "forget-subject removes files bound to the forgotten subject",
+    "detail": "Forgetting a record or user subject now deletes the bytes, derivatives and file_refs rows behind that subject's personal file fields (fail closed with missing_file_storage or file_delete_failed in cleanupError), so a retry can finish the job; the entity row stays."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/data-retention/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "improvement",
+    "title": "runRetentionCleanup is exported for app tests",
+    "detail": "The data-retention entry point now exports runRetentionCleanup with its argument, result and skip types, so an app test can drive a retention run with its own now and file context and check that bytes, file_refs rows and the entity row are gone. The user-data-rights recipe shows the pattern."
+  },
   {
     "version": "0.363.0",
     "type": "improvement",

package/src/delivery/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "breaking",
+    "title": "Queued delivery jobs carry the recipient address sealed",
+    "detail": "createDeliveryService takes an addressCipher; the boot wiring passes the master-key cipher, so delivery.render and delivery.send payloads hold sealedAddress instead of address. Workers open it through ctx.configEncryption.",
+    "migration": "Roll out worker and web together with the same KUMIKO_SECRETS_MASTER_KEY_V<n>; a worker without the master key fails sealed jobs with send_failed. Code that calls createDeliveryService itself passes addressCipher to get sealed payloads."
+  },
+  {
+    "version": "0.372.0",
+    "type": "improvement",
+    "title": "createUnsubscribePageChromeReader gives app routes the tenant branding for unsubscribe pages",
+    "detail": "The JSDoc of renderUnsubscribeResultPage pointed to a chrome read that only works for SystemAdmin, so app routes for legacy unsubscribe links rendered without branding. The new `createUnsubscribePageChromeReader({ dispatchSystemQuery })` returns `(tenantId, locale) => MailChrome | null`, failing soft to null. Build it once in the `wire` hook, whose deps now also carry `dispatchSystemQuery` (runProdApp, runWorkerApp.wireComponents, createKumikoServer), and call it with a tenant the route resolved itself, for example from the Host, never with a tenantId from the query string or body. The chrome query itself stays SystemAdmin-only; anonymous `/api/query` callers are still rejected for every tenant."
+  },
   {
     "version": "0.371.0",
     "type": "improvement",

package/src/files/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "breaking",
+    "title": "Orphaned upload bytes are swept through a new upload ledger",
+    "detail": "The files feature registers the store_file_upload_ledger table and an hourly sweep job. FileContext has the new methods writeUploadBytes and forgetUploadBytes, which the four upload paths use; a custom FileContext or resolver must provide the ledger (withUploadLedger wraps a resolver). TenantDb.deleteMany resolves to the number of deleted rows instead of void. A fileRef commit whose ledger row was already swept throws InternalError \"upload expired\".",
+    "migration": "Generate and apply a migration with `kumiko-schema generate` — uploads fail without the new store_file_upload_ledger table"
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/src/personal-access-tokens/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "fix",
+    "title": "Tenants whose tier excludes API tokens now reach the lockedFallbackScreen",
+    "detail": "GET /api/schema removed every screen of a feature the tenant has switched off, and the role projection then dropped the navs of other features that pointed at them. The token list screen was gone, so the upgrade screen set via lockedFallbackScreen was never shown. Screens that declare a fallback (and the same-feature screens those fallbacks name) now stay in the schema; the server still rejects their queries and writes with feature_disabled, which makes the renderer show the fallback. Navs, content collections and workspaces of the disabled feature are still removed."
+  },
+  {
+    "version": "0.372.0",
+    "type": "improvement",
+    "title": "The token list looks like any other Kumiko list",
+    "detail": "The create button now sits in the page header next to the title, and an empty list shows the standard hint with a create button. The German title of the list screen is \"API-Tokens\" instead of \"Personal Access Tokens\", which also fixes the breadcrumb of the mint screen. Renderer, all apps: a projection list without an entity create button now shows its first primary toolbar action (one that needs no confirmation dialog) in the page header on desktop as well, with its label, instead of in the toolbar row; on phones it already did. On desktop only an icon derived from the action id (or declared on the action) is shown; the plus fallback exists only on phones. Consumers get this after the bump without code changes."
+  },
   {
     "version": "0.368.0",
     "type": "improvement",

package/src/template-resolver/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "improvement",
+    "title": "Text examples of template variables follow the template's language",
+    "detail": "The `example` of a text or richText templateVariable is now read like `label`: an i18n key resolves to the translation of the edited template's locale, plain text stays as it is. Preview, the sample values bar and send-test therefore show German examples for a German template. Example values of other types (link, number, enum-like text values) stay as declared; put the explanation of such a value into the variable's label. Apps: register `templateVariable.text({ example: \"<app>:mail.example.x\" })` and add the key with de, en and es via `r.translations`."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "fix",
+    "title": "Account forget-cleanup removes userOwned files uploaded by someone else",
+    "detail": "runForgetCleanup now purges the bytes, derivatives and file_refs rows behind every file field whose subject is the deleted user, not only files the user uploaded; a failing byte delete keeps the user in DeletionRequested so the next run retries."
+  },
   {
     "version": "0.369.0",
     "type": "fix",