@cosmicdrift/kumiko-bundled-features 0.381.0 → 0.383.0

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.383.0",
+    "type": "fix",
+    "title": "delivery-log projection masks the recipient address",
+    "detail": "The inline projection now masks the address with the same helper as the write path, also on rebuild, so legacy events with a full address no longer reach the attempt log. Already masked addresses and connection-name channels stay unchanged. Swallowed errors in the snapshot save, queue-depth poll and channel pre-resolve now log a scrubbed warning."
+  },
   {
     "version": "0.379.0",
     "type": "improvement",

package/src/jobs/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.383.0",
+    "type": "breaking",
+    "title": "Job handlers can return ctx.defer(ms)",
+    "detail": "A handler that returns ctx.defer(ms) moves the queue job to delayed and runs again after ms, like the maxPerTenant defer. It consumes no retry attempt and records no failure, failure log or failed run; the run row of the deferred pass is removed and a tenantVisibleRun record goes back to queued. maxDefers on the job (default 100, shared counter with maxPerTenant defers) bounds the loop; exceeding it fails the run for good (no retry) with a clear message. Inline runs (boot gates) throw. New run-logger hook onJobDeferred, passed through the entrypoint jobs options. JobHandlerFn may now return a JobDeferral. JobContext has a required defer member.",
+    "migration": "add defer to every hand-built JobContext object (tests, seeds), e.g. defer: (delayMs) => ({ kind: \"job-deferral\", delayMs })"
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/sessions/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.383.0",
+    "type": "improvement",
+    "title": "sessionChecker looks up the user and the membership concurrently",
+    "detail": "The session check starts the user lookup together with the session read and the membership lookup together with the last-seen refresh. Results and the fail-open behavior are unchanged; a failed lookup that is not needed no longer raises an unhandled rejection."
+  },
   {
     "version": "0.336.0",
     "type": "fix",

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.383.0",
+    "type": "improvement",
+    "title": "Tenant directory search stops decrypting once the limit is reached",
+    "detail": "Tenant names are encrypted and not in the search index, so the directory search decrypts in small batches and stops after limit matches; the 1000-row scan cap stays. With more matches than the limit, the first matches in key order are returned (sorted by label), not the best alphabetical ones. The missing-profile list drops tenants that already have a profile before decrypting."
+  },
   {
     "version": "0.365.0",
     "type": "fix",