@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.386.0",
+  "version": "0.388.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
-  "license": "BUSL-1.1",
+  "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
   "repository": {
     "type": "git",
@@ -186,6 +186,10 @@
       "types": "./dist/subscription-stripe/index.d.ts",
       "default": "./dist/subscription-stripe/index.js"
     },
+    "./subscription-dodo": {
+      "types": "./dist/subscription-dodo/index.d.ts",
+      "default": "./dist/subscription-dodo/index.js"
+    },
     "./subscription-mollie": {
       "types": "./dist/subscription-mollie/index.d.ts",
       "default": "./dist/subscription-mollie/index.js"
@@ -544,9 +548,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.386.0",
-    "@cosmicdrift/kumiko-renderer": "0.386.0",
-    "@cosmicdrift/kumiko-types": "0.386.0",
+    "@cosmicdrift/kumiko-framework": "0.388.0",
+    "@cosmicdrift/kumiko-renderer": "0.388.0",
+    "@cosmicdrift/kumiko-types": "0.388.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -749,6 +753,10 @@
         "types": "./dist/subscription-stripe/index.d.ts",
         "default": "./dist/subscription-stripe/index.js"
       },
+      "./subscription-dodo": {
+        "types": "./dist/subscription-dodo/index.d.ts",
+        "default": "./dist/subscription-dodo/index.js"
+      },
       "./subscription-mollie": {
         "types": "./dist/subscription-mollie/index.d.ts",
         "default": "./dist/subscription-mollie/index.js"
@@ -1116,15 +1124,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.386.0",
-    "@cosmicdrift/kumiko-locale-es": "0.386.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.386.0",
+    "@cosmicdrift/kumiko-locale-de": "0.388.0",
+    "@cosmicdrift/kumiko-locale-es": "0.388.0",
+    "@cosmicdrift/kumiko-locale-fr": "0.388.0",
+    "@cosmicdrift/kumiko-locale-it": "0.388.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.386.0"
+    "@cosmicdrift/kumiko-testing": "0.388.0"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.386.0"
+    "@cosmicdrift/kumiko-testing": "0.388.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "dispatchToolCall documents which failures carry a code",
+    "detail": "Only handler and dispatcher failures carry a code; local validation errors such as an unknown tool or bad arguments come back without one, and the JSDoc now says so."
+  },
   {
     "version": "0.366.0",
     "type": "improvement",

package/src/audit/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Oversized audit cursor is documented as a 400 validation error",
+    "detail": "The cursor pattern comment now names the validation error (400) the API actually returns instead of 422."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tests cover nested agent grants, erased subjects and anonymous change-password",
+    "detail": "Integration tests now check that a delegating tool handler keeps the cross-tenant-read marker closed, that an erased subject gets no consumer-protection mail, and that the anonymous change-password check runs once; the audit seed helper uses withEnv."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Six-cell code input, autofocus, auto-submit and recovery switch",
+    "detail": "The MFA login, setup, disable and regenerate screens use the six-cell code input with autofocus. Login and setup submit automatically on the sixth digit; disable and regenerate keep the explicit confirm button. Verify, disable and regenerate can switch to a recovery-code field. New keys auth.mfa.verify.useRecoveryCode, useAuthenticatorCode, recoveryCode and recoverySubtitle in all locale packages; auth.mfa.disable.code now names the authenticator code only."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/src/billing-foundation/changes.json

@@ -1,4 +1,59 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Concurrent termination runs, revocation resume and sync ordering",
+    "detail": "record-contract-termination re-checks the requestId after the provider call so a concurrent run appends nothing. Revocation resumes a period-end cancel that was recorded between its two stream reads. sync-subscription stamps the snapshot time as providerEventAtIso so a late older webhook cannot reactivate a synced cancellation."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Ordered terms lists keep their numbers in the confirmation mail",
+    "detail": "The contract confirmation mail prefixes each item of an ordered Markdown list with its number, so references such as \"see no. 3\" in terms and cancellation policies stay intact."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Operator notice tells an unavailable receipt limiter from a reached limit",
+    "detail": "When the termination receipt mail is withheld because the rate limiter failed or has no digest key, the operator notice reports \"receipt_not_sent\" instead of the per-recipient limit reason."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "An abandoned plan-change checkout no longer restarts the withdrawal period",
+    "detail": "The withdrawal period now runs from the latest subscription start only; a checkout consent without a following subscription start does not reopen it, so a later withdrawal of an old contract is cancelled at period end."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Same-second provider update cannot revive a canceled subscription",
+    "detail": "When a non-terminal state event carries the same provider timestamp as a stored cancellation, it is treated as late and discarded."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Several subscription providers in one catalog",
+    "detail": "The billing-plans query returns providers (name, displayName, plans, note) when more than one provider is offered, and start-plan-checkout takes providerName. consumerProtection.providerTexts overrides checkoutNote and vatNote per provider, and the consent record carries providerName. switch-plan always uses the provider of the existing subscription."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "In-app plan switch with a preview and consent",
+    "detail": "A provider plugin that implements previewPlanSwitch and applyPlanSwitch switches plans without a hosted portal. The new plan-switch-preview query returns the proration, the billing-plans result carries inAppPlanSwitch, and the panel shows PlanSwitchConfirmDialog with the withdrawal consent checkboxes. The confirmation mail is sent when the plan_changed webhook arrives with the consent id."
+  },
+  {
+    "version": "0.388.0",
+    "type": "breaking",
+    "title": "A catalog with several providers no longer throws an ambiguous-provider error",
+    "detail": "With more than one subscription provider mounted, billing-plans and start-plan-checkout used to throw. They now list the providers; start-plan-checkout answers with errors.providerRequired when several are offered and no providerName is given, and errors.providerNotOffered for an unknown one. Plugins have to set displayName.",
+    "migration": "Set displayName on custom subscriptionProvider plugins. Callers that send start-plan-checkout with several providers mounted must pass providerName."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Provider choice moved into the checkout dialog",
+    "detail": "The plan panel no longer shows a provider switch. Cards show the first provider's price, or the cheapest one with a \"from\" prefix when providers disagree. With several providers, or with consumerProtection, choosing a plan opens CheckoutConsentDialog, which now has an optional providerChoice (ChoiceCards with the checkout note and, when prices differ, the price), an optional note, and an optional consumerProtection (without it there are no checkboxes and the order carries no consent). The plan switch dialog shows the recurring price with its interval."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Consume on a released reservation extends its tombstone",
+    "detail": "Every consume against a released reservation tombstone now pushes its expiry out, so a long-running job that consumes across the sweep can no longer lose the tombstone and have its earlier units counted twice at settle."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Misconfigured cap period fails on every enforcement",
+    "detail": "A periodEndIso that is unparsable or not after periodStartIso now throws on each enforceCap or reservation call instead of only once the hard cap is reached, so a bad period no longer turns into a 500 at the limit instead of cap_exceeded."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Stock cap lock covers the counted rows, not the error code",
+    "detail": "withStockCap serializes on the table and where filter that are counted, so two handlers capping the same rows under different codes can no longer both pass the check in parallel and exceed the cap together."
+  },
   {
     "version": "0.378.0",
     "type": "fix",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Corrected description of an email channel without app transport",
+    "detail": "Without an app transport only notifications declared with tenantTransport true are delivered; all others fail with missing_credentials, so such apps must mark every outgoing notification or keep an app transport."
+  },
   {
     "version": "0.376.0",
     "type": "improvement",

package/src/config/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "config:query:values and config:query:cascade accept a read scope",
+    "detail": "Both queries take an optional scope (system, tenant, user). With scope system the cascade of a tenant or user key is evaluated at system level, so the system row is returned even when the caller's own tenant has a row for the key. Only a SystemAdmin gets the narrowed read; other callers keep the normal cascade. Inherited-value redaction still applies. Without scope the behavior is unchanged."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Remove unreachable branch in configRowHoldsValue",
+    "detail": "The undefined key definition is now handled together with the plaintext comparison, dropping a dead return without changing behavior."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "forget-subject audit event survives a failing record owner lookup",
+    "detail": "The lookup of the record row's owning tenant now runs inside the file purge step, so a database error there is reported as cleanupError on the subject-forgotten event instead of aborting the handler after the key was erased."
+  },
   {
     "version": "0.377.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Preferences query reports renamed notification types under the current name",
+    "detail": "Rows stored under a former notification name are returned with the current name and collapsed per channel with the delivery precedence (current-name row wins, otherwise any disabled row disables), so settings screens show the effective state."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Inline mail image retries on transient storage errors",
+    "detail": "Only a missing file storage for the file's tenant sends the mail without the inline image; any other read error (timeout, provider failure, DB) is rethrown so the send job retries instead of mailing without the logo."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Unsubscribe tenant origin resolved once per notify call",
+    "detail": "The app's tenantOrigin callback runs once per notify call and tenant instead of once per recipient and channel, so a newsletter no longer causes one lookup and one fallback warning per address. The docs state the callback must only return verified, active domains."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "One-click unsubscribe POST keeps the JSON rejection",
+    "detail": "RFC 8058 one-click POSTs (form body List-Unsubscribe=One-Click) answer an invalid or expired token with the JSON 400 again and skip the branding lookup; only browser form submits get the HTML page."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Resubscribe limit page has its own text",
+    "detail": "A browser that hits the resubscribe limit sees that the address cannot be subscribed again here, instead of the generic \"try again later\" error (new key mail.unsubscribe.resubscribeLimitReached in en, de, es, fr, it)."
+  },
   {
     "version": "0.383.0",
     "type": "fix",

package/src/form-draft/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Encrypted drafts without a PII key service raise an error",
+    "detail": "Reading a ciphertext draft with no PII subject key service configured throws instead of returning an empty draft, so the stale-draft cleanup defers it and no longer releases its file refs as if it were empty."
+  },
   {
     "version": "0.379.0",
     "type": "breaking",

package/src/host-routing/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Redirects documented as hostDispatch-only",
+    "detail": "The redirects option and README state that redirects run inside hostDispatch, so only for requests that reach the HTML fallback; a from matching a static file or an API route never fires. The shared existence lookup of the host and resolver modes is one helper."
+  },
   {
     "version": "0.376.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Undecryptable mail account no longer stops polling of other accounts",
+    "detail": "Any decryption failure of an account address (corrupt envelope, missing key, AAD mismatch) is logged by error class and the account is skipped; the other accounts keep polling."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Rename audit reason comes from the caller role",
+    "detail": "update-account records tenant_admin or system_admin from the caller's roles and honors a client-supplied reason only for the system identity, so a form call can no longer write system reasons such as watch_supervisor. The rename form no longer carries a reason field and the reason payload field is optional."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Seen-message lookup handles listings of any size",
+    "detail": "filterUnknownMessageIds queries the already seen provider message ids in chunks of 1000, so a full-mailbox listing no longer exceeds the Postgres bind parameter limit and aborts the account's poll."
+  },
   {
     "version": "0.378.0",
     "type": "fix",

package/src/jobs/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "readRoles for tenant job status",
+    "detail": "`createJobsFeature({ readRoles: [\"PropertyManager\"] })` lets those app roles call `jobs:query:failures` and `jobs:query:tenant-runs` for their own tenant. They are added to the default `User`, `Editor` and admin roles, which stay. Before, a member who only holds app roles got access_denied.",
+    "migration": "Optional. Apps whose members hold only their own roles pass `createJobsFeature({ readRoles: [...] })`."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Deduplicated job add keeps the finished tenant run row",
+    "detail": "JobQueuedMeta carries the BullMQ creation time of the job. The queued hook only removes finished rows queued before that time (leftovers of a Redis reset), so re-announcing an already finished job no longer turns its row back into queued."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/src/mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tenant mail transport falls back to the app transport without tenant config",
+    "detail": "tenantMailTransport returns null when the channel context carries no tenant config, instead of throwing on every send, so the channel uses the app transport as documented."
+  },
   {
     "version": "0.378.0",
     "type": "improvement",

package/src/renderer-pdf/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "renderTablePdf validates the document for direct callers",
+    "detail": "renderTablePdf parses the document against pdfTableDocumentSchema and throws RendererError invalid_payload above the row, column and cell caps. Title, subtitle, meta entries, headers, empty text, footer text and page label now have length caps and meta at most 500 entries."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/step-dispatcher/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Deliver job validates its payload at the trigger",
+    "detail": "The deliver job now declares its payload schema, so a manual trigger with an invalid payload is rejected up front instead of throwing inside the handler and consuming all retries."
+  },
   {
     "version": "0.365.1",
     "type": "fix",

package/src/subscription-dodo/changes.json

@@ -0,0 +1,14 @@
+[
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "New subscription provider for Dodo Payments",
+    "detail": "createSubscriptionDodoFeature() registers the \"dodo\" subscription provider (Merchant of Record). It verifies Standard Webhooks signatures, maps Dodo events to the foundation events, creates hosted checkouts and portal sessions, and switches plans in the app through previewPlanSwitch and applyPlanSwitch. Config keys are api-key, webhook-secret, billing-live and environment. Plan switches need a Product Collection in Dodo."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "dodoEnvSchema declares the Dodo product id slots",
+    "detail": "dodoEnvSchema({ prices: [\"PRO\"] }) adds one optional DODO_PRODUCT_PRO slot per plan next to the API key and webhook key, and checks the pdt_ prefix. It is the counterpart to stripeEnvSchema."
+  }
+]

package/src/subscription-stripe/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Stripe plugin has a displayName",
+    "detail": "The Stripe plugin sets displayName \"Stripe\", which the provider choice in the billing panel shows."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "A malformed stored credential no longer leaks into the error",
+    "detail": "A stored api-key or webhook-secret that is not valid JSON used to raise the JSON parser's own message, which repeats the value into logs and the webhook 401 body. The error now has a fixed text and names no input. subscription-dodo behaves the same."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/template-resolver/changes.json

@@ -1,4 +1,52 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Template overrides, key collisions and by-tenant queries",
+    "detail": "link-pdf refuses a key that already holds an inline image (key_in_use). by-tenant no longer runs a query per row, tenant-override-counts selects only the needed columns, and tenant-overrides resolves names beyond the first 200 tenants or users through the new ids filter of the tenant and member directories. Notification preference and form-draft cleanup queries bind array parameters as Postgres array literals."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Re-seeding keeps archived system templates, drops stale drafts and adds only missing bundle locales",
+    "detail": "A boot-time re-seed no longer reactivates an archived system template and clears an open system draft when the seeded content changes. A bundle with resources seeded with ifExists skip imports only the missing locales instead of overwriting existing system rows. copy-locale fails with version_conflict when its source changed between the upload and the transaction, and releases the uploaded files."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "isCollectionRefusedKind is a type predicate",
+    "detail": "isCollectionRefusedKind accepts unknown and narrows to the refused kinds; tier-engine's isTierAssignmentSource shares the isOneOf implementation. Behavior is unchanged."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Layout usage list matches the overview",
+    "detail": "The usage query of a mail layout filters the mail rows by the caller's visibility like the overview and logs a warning when the 5000-row limit cuts the result."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Admin views follow the delivery rule of rendering",
+    "detail": "List, find-by-id, diff-to-system, validate, preview and the document base hide a collection row that a locked system template of the same slug shadows, as mail, PDF and the resolver already do."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Seeded title key must look like a namespace:key",
+    "detail": "seedSystemTemplate rejects a titleI18nKey without a namespace prefix or with whitespace, so free text cannot pass as a key and show up raw in the UI."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Failing release keeps the upload error",
+    "detail": "When releasing already uploaded files fails after a refused upload in copy-locale or bundle import, the release error is logged and the original error is returned, and the releases run once."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Mail layout enums and hex color pattern are exported client-side",
+    "detail": "The layout editor imports the width, font, accent line and button style lists plus the hex pattern from the template-resolver web barrel instead of keeping copies, so editor and server validation cannot drift."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tenant directory search contract documented",
+    "detail": "A search returns the first limit matches in tenant-key order, sorted by label afterwards; the handler description now says so."
+  },
   {
     "version": "0.383.0",
     "type": "improvement",

package/src/tenant-lifecycle/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Destroy sweep keeps a minimum time slice per tenant",
+    "detail": "With many tenants in destroying state the shared tick budget no longer shrinks a tenant's slice below two seconds, so chunking hooks make progress instead of failing the stage as no-progress attempts."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "set-tenant-tier no longer accepts source default",
+    "detail": "The source field of set-tenant-tier is limited to manual and billing. The value default is reserved for the signup default tier and made a manual grant look like a billing row that the next sync overwrites."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/waitlist/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Link-on-signup failures, legacy re-run and purge audit order",
+    "detail": "link-on-signup throws when the entry update fails and the entry is still invited, so the consumer redelivers. The offlot legacy migration skips rows that are already imports. purge writes its audit event before shredding keys."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Admin notice language comes from adminLocale",
+    "detail": "The admin notice mail used the request locale, which is the entrant's browser language. The new adminLocale option (en, de or es, default en) sets the operator's language."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Legacy migration dry run counts the streams it would archive",
+    "detail": "The dry run now runs the read-only archive checks and reports archivedStreams without writing; the CLI prints \"would archive\" for it."
+  },
   {
     "version": "0.379.0",
     "type": "improvement",

package/dist/billing-foundation/consumer-protection/stored-user-email.d.ts

@@ -1 +0,0 @@
-export declare function openStoredUserEmail(stored: string, fallbackRequestId: string): Promise<string | null>;

package/dist/billing-foundation/consumer-protection/stored-user-email.js

@@ -1,8 +0,0 @@
-import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
-import { decryptStoredPii } from "../../shared/index.js";
-// findForAuth returns the stored column, which is ciphertext under an active KMS;
-// channel-email refuses to mail a ciphertext address. Null for an erased subject.
-export async function openStoredUserEmail(stored, fallbackRequestId) {
-    const email = await decryptStoredPii(stored, "email", fallbackRequestId);
-    return email === PII_ERASED_SENTINEL ? null : email;
-}