@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.388.0

package/dist/tier-engine/web/constants.js

@@ -3,6 +3,7 @@
 // category in the kumiko isolation model (runtime may import client, client
 // may only import client) — otherwise the runtime isolation guard throws on
 // the client imports. Same pattern as text-content/constants.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 // Feature name
 export const TIER_ENGINE_FEATURE = "tier-engine";
 // Qualified write handler names (QN format: scope:type:name).
@@ -18,9 +19,8 @@ export const TierAssignmentSources = {
     billing: "billing",
     default: "default",
 };
-const TIER_ASSIGNMENT_SOURCE_VALUES = Object.values(TierAssignmentSources);
 export function isTierAssignmentSource(value) {
-    return typeof value === "string" && TIER_ASSIGNMENT_SOURCE_VALUES.includes(value);
+    return isOneOf(Object.values(TierAssignmentSources), value);
 }
 // Qualified query handler names.
 export const TierEngineQueries = {

package/dist/user-data-rights/run-export-jobs.js

@@ -19,12 +19,11 @@
 // expiresAt + exportStorageCleanupGraceHours, so expired ZIPs do not stay in
 // storage indefinitely.
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
-import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { createZipStream, tenantExportPrefix, } from "@cosmicdrift/kumiko-framework/files";
 import { resolveProfileForTenant } from "../compliance-profiles/index.js";
-import { decryptStoredPii } from "../shared/index.js";
+import { decryptStoredUserEmail } from "../shared/index.js";
 import { userTable } from "../user/index.js";
 import { selectExportJobsForStorageCleanup } from "./db/queries/export-jobs.js";
 import { runUserExport } from "./run-user-export.js";
@@ -539,8 +538,8 @@ async function lookupUserContact(db, userId) {
     const row = (await fetchOne(db, userTable, { id: userId }));
     if (!row?.email)
         return null;
-    const email = await decryptStoredPii(row.email, "email", "user-data-rights:export-ready");
-    if (email === PII_ERASED_SENTINEL)
+    const email = await decryptStoredUserEmail(row.email, "user-data-rights:export-ready");
+    if (email === null)
         return null;
     return { email, locale: row.locale ?? null };
 }

package/dist/user-data-rights/run-forget-cleanup.js

@@ -274,7 +274,8 @@ async function processUser(args) {
             // is what makes this crash-safe: eraseKey-throw → tx rollback → user
             // stays DeletionRequested → next run retries; flip-throw after a
             // successful erase → retry re-runs the idempotent hooks and eraseKey
-            // (contractually a no-op on an erased/unknown subject). Erasing after
+            // (idempotent: a repeat erase keeps the original tombstone, an unknown
+            // subject gets one). Erasing after
             // the flip instead would risk a permanent silent miss: user already
             // Deleted, no run ever picks him up again, key stays live.
             if (kms) {

package/dist/waitlist/handlers/export-purge.write.js

@@ -54,8 +54,9 @@ export const purgeHandler = defineWriteHandler({
                 details: { confirmCount: event.payload.confirmCount, actualCount: rows.length },
             }));
         }
-        await purgeWaitlistRows(db, rows, event.user.id);
+        // Audit first: purgeWaitlistRows shreds KMS keys, which a later failure cannot roll back.
         await appendAudit(ctx, WAITLIST_PURGED_EVENT_QN, rows.length);
+        await purgeWaitlistRows(db, rows, event.user.id);
         return { isSuccess: true, data: { purged: rows.length } };
     },
 });

package/dist/waitlist/handlers/submit.write.js

@@ -40,9 +40,10 @@ async function hasOpenEntryForEmail(email, ctx) {
     }, platformActor(), waitlistDb(ctx));
     return found.rows.length > 0;
 }
-// The resolver usually reads config; run it outside the handler transaction's
-// critical section so a failing statement cannot abort the transaction that holds
-// the entry, and a slow resolver does not extend the per-email advisory lock.
+// The resolver usually reads config. It runs before the per-email advisory lock so a
+// slow resolver does not extend the lock. It still shares the handler transaction: a
+// thrown JS error is swallowed here, but a failed SQL statement inside it would abort
+// the transaction, so resolvers must not issue statements that can fail.
 async function resolveAdminRecipient(opts, ctx) {
     try {
         return (await opts.notifyRecipient?.(ctx)) || null;
@@ -124,8 +125,7 @@ export function createSubmitHandler(opts) {
                         message: payload.message,
                     }),
                     priority: "normal",
-                    // Operator-facing: the request locale, not the one the entrant picked in the form.
-                    locale: resolveWaitlistMailLocale(ctx.locale),
+                    locale: resolveWaitlistMailLocale(opts.adminLocale),
                 });
             });
             return SUBMITTED;

package/dist/waitlist/import.d.ts

@@ -19,6 +19,7 @@ export type WaitlistImportEntry = {
 };
 export type WaitlistImportOutcome = "created" | "skipped";
 export declare function waitlistImportId(sourceKey: string): string;
+export declare function isWaitlistImportId(id: string): boolean;
 export declare function importWaitlistEntry(db: TenantDb, entry: WaitlistImportEntry, options?: {
     readonly dryRun?: boolean;
 }): Promise<WaitlistImportOutcome>;

package/dist/waitlist/import.js

@@ -13,6 +13,10 @@ export function waitlistImportId(sourceKey) {
     const hex = bytes.subarray(0, 16).toString("hex");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
+// The version nibble marks ids minted by waitlistImportId; legacy row ids are random UUIDs.
+export function isWaitlistImportId(id) {
+    return id[14] === "5";
+}
 function presentOnly(fields) {
     return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
 }

package/dist/waitlist/legacy-migrate.js

@@ -1,10 +1,11 @@
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
-import { countWhere, createTenantDb, selectMany, table, text as textColumn, timestamp, transaction, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { countWhere, createTenantDb, selectMany, table, tableExists, text as textColumn, timestamp, transaction, uuid, } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { archiveStream, createArchivedStreamsTable, eventsTable, isStreamArchived, } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { importWaitlistEntry, waitlistImportId } from "./import.js";
+import { importWaitlistEntry, isWaitlistImportId, waitlistImportId, } from "./import.js";
 import { WAITLIST_STATUS } from "./web/constants.js";
+const ARCHIVED_STREAMS_TABLE = "public.kumiko_archived_streams";
 export const LEGACY_WAITLIST_SOURCES = ["offlot", "publicstatus"];
 export function isLegacyWaitlistSource(value) {
     return LEGACY_WAITLIST_SOURCES.some((known) => known === value);
@@ -152,10 +153,12 @@ async function readLegacyRows(db, from, sourceTable) {
 // new id, so a rebuild would replay the old stream next to it and bring every migrated entry back
 // twice; archived streams are excluded from replay. The offlot default source table is the entity
 // table itself, so its row ids are live entries by design and no id check can tell a wrong table.
-async function archiveLegacyStream(db, legacyId, importedId) {
+async function archiveLegacyStream(db, legacyId, importedId, dryRun) {
     if (legacyId === importedId)
         return 0;
-    if (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId))
+    // A dry run never creates the archive table, so a missing one means nothing is archived yet.
+    const archiveTableReady = !dryRun || (await tableExists(db, ARCHIVED_STREAMS_TABLE));
+    if (archiveTableReady && (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId)))
         return 0;
     const legacyEvents = await countWhere(db, eventsTable, {
         tenantId: SYSTEM_TENANT_ID,
@@ -164,6 +167,8 @@ async function archiveLegacyStream(db, legacyId, importedId) {
     });
     if (legacyEvents === 0)
         return 0;
+    if (dryRun)
+        return 1;
     await archiveStream(db, {
         tenantId: SYSTEM_TENANT_ID,
         aggregateId: legacyId,
@@ -185,6 +190,12 @@ export async function migrateLegacyWaitlist(db, options) {
     if (!options.dryRun && options.from === "offlot")
         await createArchivedStreamsTable(db);
     for (const row of rows) {
+        // The offlot default source is the entity table: rows a previous run imported
+        // are already migrated entries and must neither be re-imported nor archived.
+        if (options.from === "offlot" && isWaitlistImportId(String(row["id"]))) {
+            skipped += 1;
+            continue;
+        }
         const entry = options.from === "offlot"
             ? await mapOfflotRow(row)
             : mapPublicstatusRow(row, options.defaultLocale);
@@ -200,8 +211,8 @@ export async function migrateLegacyWaitlist(db, options) {
             else
                 skipped += 1;
         });
-        if (!options.dryRun && options.from === "offlot") {
-            archivedStreams += await archiveLegacyStream(db, String(row["id"]), waitlistImportId(entry.sourceKey));
+        if (options.from === "offlot") {
+            archivedStreams += await archiveLegacyStream(db, String(row["id"]), waitlistImportId(entry.sourceKey), options.dryRun);
         }
     }
     return { read: rows.length, created, skipped, unreadable, archivedStreams };

package/dist/waitlist/link-on-signup.js

@@ -59,11 +59,14 @@ export const linkWaitlistOnSignup = async (event, tx) => {
     if (typeof user?.email !== "string")
         return;
     const email = normalizeEmail(await decryptStoredPii(user.email, "email", PII_DECRYPT_REASON));
-    const found = await waitlistExecutor.list({
-        filter: { field: "email", op: "eq", value: email },
-        filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
-    }, platformActor(), db);
-    const invited = [...found.rows].sort(newestSubmittedFirst)[0];
+    const findInvited = async () => {
+        const found = await waitlistExecutor.list({
+            filter: { field: "email", op: "eq", value: email },
+            filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
+        }, platformActor(), db);
+        return [...found.rows].sort(newestSubmittedFirst)[0];
+    };
+    const invited = await findInvited();
     // skip: the signup email has no invited waitlist entry (open signup or stale invite).
     if (!invited)
         return;
@@ -71,7 +74,7 @@ export const linkWaitlistOnSignup = async (event, tx) => {
     // skip: defensive guard on the row shape.
     if (typeof id !== "string" || typeof version !== "number")
         return;
-    await waitlistExecutor.update({
+    const updated = await waitlistExecutor.update({
         id,
         version,
         changes: {
@@ -80,4 +83,13 @@ export const linkWaitlistOnSignup = async (event, tx) => {
             provisionedAt: Temporal.Now.instant(),
         },
     }, platformActor(), db);
+    // skip: linked.
+    if (updated.isSuccess)
+        return;
+    // A concurrent admin change that already moved the entry out of `invited` makes the link
+    // moot; otherwise throw so the at-least-once consumer redelivers.
+    // skip: the entry left `invited` concurrently.
+    if ((await findInvited())?.id !== id)
+        return;
+    throw new Error(`waitlist:link-on-signup: could not link waitlist entry ${id}`);
 };

package/dist/waitlist/options.d.ts

@@ -16,6 +16,9 @@ export type WaitlistOptions = {
      *  string or an absent option sends none. Best effort, never fails the submit,
      *  also when the resolver throws or rejects. */
     readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
+    /** Language of the admin notice mail (en, de or es; anything else falls back to en).
+     *  Not taken from the request: a submit comes from the entrant, not the operator. */
+    readonly adminLocale?: string;
     /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
     readonly invite?: WaitlistInviteOptions;
     /** Default: 5 submits per IP per 10 minutes. Pass `{ disabled: true, reason }`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.387.0",
+  "version": "0.388.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -186,6 +186,10 @@
       "types": "./dist/subscription-stripe/index.d.ts",
       "default": "./dist/subscription-stripe/index.js"
     },
+    "./subscription-dodo": {
+      "types": "./dist/subscription-dodo/index.d.ts",
+      "default": "./dist/subscription-dodo/index.js"
+    },
     "./subscription-mollie": {
       "types": "./dist/subscription-mollie/index.d.ts",
       "default": "./dist/subscription-mollie/index.js"
@@ -544,9 +548,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.387.0",
-    "@cosmicdrift/kumiko-renderer": "0.387.0",
-    "@cosmicdrift/kumiko-types": "0.387.0",
+    "@cosmicdrift/kumiko-framework": "0.388.0",
+    "@cosmicdrift/kumiko-renderer": "0.388.0",
+    "@cosmicdrift/kumiko-types": "0.388.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -749,6 +753,10 @@
         "types": "./dist/subscription-stripe/index.d.ts",
         "default": "./dist/subscription-stripe/index.js"
       },
+      "./subscription-dodo": {
+        "types": "./dist/subscription-dodo/index.d.ts",
+        "default": "./dist/subscription-dodo/index.js"
+      },
       "./subscription-mollie": {
         "types": "./dist/subscription-mollie/index.d.ts",
         "default": "./dist/subscription-mollie/index.js"
@@ -1116,15 +1124,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.387.0",
-    "@cosmicdrift/kumiko-locale-es": "0.387.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.387.0",
+    "@cosmicdrift/kumiko-locale-de": "0.388.0",
+    "@cosmicdrift/kumiko-locale-es": "0.388.0",
+    "@cosmicdrift/kumiko-locale-fr": "0.388.0",
+    "@cosmicdrift/kumiko-locale-it": "0.388.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.387.0"
+    "@cosmicdrift/kumiko-testing": "0.388.0"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.387.0"
+    "@cosmicdrift/kumiko-testing": "0.388.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "dispatchToolCall documents which failures carry a code",
+    "detail": "Only handler and dispatcher failures carry a code; local validation errors such as an unknown tool or bad arguments come back without one, and the JSDoc now says so."
+  },
   {
     "version": "0.366.0",
     "type": "improvement",

package/src/audit/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Oversized audit cursor is documented as a 400 validation error",
+    "detail": "The cursor pattern comment now names the validation error (400) the API actually returns instead of 422."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tests cover nested agent grants, erased subjects and anonymous change-password",
+    "detail": "Integration tests now check that a delegating tool handler keeps the cross-tenant-read marker closed, that an erased subject gets no consumer-protection mail, and that the anonymous change-password check runs once; the audit seed helper uses withEnv."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Six-cell code input, autofocus, auto-submit and recovery switch",
+    "detail": "The MFA login, setup, disable and regenerate screens use the six-cell code input with autofocus. Login and setup submit automatically on the sixth digit; disable and regenerate keep the explicit confirm button. Verify, disable and regenerate can switch to a recovery-code field. New keys auth.mfa.verify.useRecoveryCode, useAuthenticatorCode, recoveryCode and recoverySubtitle in all locale packages; auth.mfa.disable.code now names the authenticator code only."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/src/billing-foundation/changes.json

@@ -1,4 +1,59 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Concurrent termination runs, revocation resume and sync ordering",
+    "detail": "record-contract-termination re-checks the requestId after the provider call so a concurrent run appends nothing. Revocation resumes a period-end cancel that was recorded between its two stream reads. sync-subscription stamps the snapshot time as providerEventAtIso so a late older webhook cannot reactivate a synced cancellation."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Ordered terms lists keep their numbers in the confirmation mail",
+    "detail": "The contract confirmation mail prefixes each item of an ordered Markdown list with its number, so references such as \"see no. 3\" in terms and cancellation policies stay intact."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Operator notice tells an unavailable receipt limiter from a reached limit",
+    "detail": "When the termination receipt mail is withheld because the rate limiter failed or has no digest key, the operator notice reports \"receipt_not_sent\" instead of the per-recipient limit reason."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "An abandoned plan-change checkout no longer restarts the withdrawal period",
+    "detail": "The withdrawal period now runs from the latest subscription start only; a checkout consent without a following subscription start does not reopen it, so a later withdrawal of an old contract is cancelled at period end."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Same-second provider update cannot revive a canceled subscription",
+    "detail": "When a non-terminal state event carries the same provider timestamp as a stored cancellation, it is treated as late and discarded."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Several subscription providers in one catalog",
+    "detail": "The billing-plans query returns providers (name, displayName, plans, note) when more than one provider is offered, and start-plan-checkout takes providerName. consumerProtection.providerTexts overrides checkoutNote and vatNote per provider, and the consent record carries providerName. switch-plan always uses the provider of the existing subscription."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "In-app plan switch with a preview and consent",
+    "detail": "A provider plugin that implements previewPlanSwitch and applyPlanSwitch switches plans without a hosted portal. The new plan-switch-preview query returns the proration, the billing-plans result carries inAppPlanSwitch, and the panel shows PlanSwitchConfirmDialog with the withdrawal consent checkboxes. The confirmation mail is sent when the plan_changed webhook arrives with the consent id."
+  },
+  {
+    "version": "0.388.0",
+    "type": "breaking",
+    "title": "A catalog with several providers no longer throws an ambiguous-provider error",
+    "detail": "With more than one subscription provider mounted, billing-plans and start-plan-checkout used to throw. They now list the providers; start-plan-checkout answers with errors.providerRequired when several are offered and no providerName is given, and errors.providerNotOffered for an unknown one. Plugins have to set displayName.",
+    "migration": "Set displayName on custom subscriptionProvider plugins. Callers that send start-plan-checkout with several providers mounted must pass providerName."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Provider choice moved into the checkout dialog",
+    "detail": "The plan panel no longer shows a provider switch. Cards show the first provider's price, or the cheapest one with a \"from\" prefix when providers disagree. With several providers, or with consumerProtection, choosing a plan opens CheckoutConsentDialog, which now has an optional providerChoice (ChoiceCards with the checkout note and, when prices differ, the price), an optional note, and an optional consumerProtection (without it there are no checkboxes and the order carries no consent). The plan switch dialog shows the recurring price with its interval."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Consume on a released reservation extends its tombstone",
+    "detail": "Every consume against a released reservation tombstone now pushes its expiry out, so a long-running job that consumes across the sweep can no longer lose the tombstone and have its earlier units counted twice at settle."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Misconfigured cap period fails on every enforcement",
+    "detail": "A periodEndIso that is unparsable or not after periodStartIso now throws on each enforceCap or reservation call instead of only once the hard cap is reached, so a bad period no longer turns into a 500 at the limit instead of cap_exceeded."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Stock cap lock covers the counted rows, not the error code",
+    "detail": "withStockCap serializes on the table and where filter that are counted, so two handlers capping the same rows under different codes can no longer both pass the check in parallel and exceed the cap together."
+  },
   {
     "version": "0.378.0",
     "type": "fix",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Corrected description of an email channel without app transport",
+    "detail": "Without an app transport only notifications declared with tenantTransport true are delivered; all others fail with missing_credentials, so such apps must mark every outgoing notification or keep an app transport."
+  },
   {
     "version": "0.376.0",
     "type": "improvement",

package/src/config/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "config:query:values and config:query:cascade accept a read scope",
+    "detail": "Both queries take an optional scope (system, tenant, user). With scope system the cascade of a tenant or user key is evaluated at system level, so the system row is returned even when the caller's own tenant has a row for the key. Only a SystemAdmin gets the narrowed read; other callers keep the normal cascade. Inherited-value redaction still applies. Without scope the behavior is unchanged."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Remove unreachable branch in configRowHoldsValue",
+    "detail": "The undefined key definition is now handled together with the plaintext comparison, dropping a dead return without changing behavior."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "forget-subject audit event survives a failing record owner lookup",
+    "detail": "The lookup of the record row's owning tenant now runs inside the file purge step, so a database error there is reported as cleanupError on the subject-forgotten event instead of aborting the handler after the key was erased."
+  },
   {
     "version": "0.377.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Preferences query reports renamed notification types under the current name",
+    "detail": "Rows stored under a former notification name are returned with the current name and collapsed per channel with the delivery precedence (current-name row wins, otherwise any disabled row disables), so settings screens show the effective state."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Inline mail image retries on transient storage errors",
+    "detail": "Only a missing file storage for the file's tenant sends the mail without the inline image; any other read error (timeout, provider failure, DB) is rethrown so the send job retries instead of mailing without the logo."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Unsubscribe tenant origin resolved once per notify call",
+    "detail": "The app's tenantOrigin callback runs once per notify call and tenant instead of once per recipient and channel, so a newsletter no longer causes one lookup and one fallback warning per address. The docs state the callback must only return verified, active domains."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "One-click unsubscribe POST keeps the JSON rejection",
+    "detail": "RFC 8058 one-click POSTs (form body List-Unsubscribe=One-Click) answer an invalid or expired token with the JSON 400 again and skip the branding lookup; only browser form submits get the HTML page."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Resubscribe limit page has its own text",
+    "detail": "A browser that hits the resubscribe limit sees that the address cannot be subscribed again here, instead of the generic \"try again later\" error (new key mail.unsubscribe.resubscribeLimitReached in en, de, es, fr, it)."
+  },
   {
     "version": "0.383.0",
     "type": "fix",

package/src/form-draft/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Encrypted drafts without a PII key service raise an error",
+    "detail": "Reading a ciphertext draft with no PII subject key service configured throws instead of returning an empty draft, so the stale-draft cleanup defers it and no longer releases its file refs as if it were empty."
+  },
   {
     "version": "0.379.0",
     "type": "breaking",

package/src/host-routing/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Redirects documented as hostDispatch-only",
+    "detail": "The redirects option and README state that redirects run inside hostDispatch, so only for requests that reach the HTML fallback; a from matching a static file or an API route never fires. The shared existence lookup of the host and resolver modes is one helper."
+  },
   {
     "version": "0.376.0",
     "type": "improvement",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Undecryptable mail account no longer stops polling of other accounts",
+    "detail": "Any decryption failure of an account address (corrupt envelope, missing key, AAD mismatch) is logged by error class and the account is skipped; the other accounts keep polling."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Rename audit reason comes from the caller role",
+    "detail": "update-account records tenant_admin or system_admin from the caller's roles and honors a client-supplied reason only for the system identity, so a form call can no longer write system reasons such as watch_supervisor. The rename form no longer carries a reason field and the reason payload field is optional."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Seen-message lookup handles listings of any size",
+    "detail": "filterUnknownMessageIds queries the already seen provider message ids in chunks of 1000, so a full-mailbox listing no longer exceeds the Postgres bind parameter limit and aborts the account's poll."
+  },
   {
     "version": "0.378.0",
     "type": "fix",

package/src/jobs/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "readRoles for tenant job status",
+    "detail": "`createJobsFeature({ readRoles: [\"PropertyManager\"] })` lets those app roles call `jobs:query:failures` and `jobs:query:tenant-runs` for their own tenant. They are added to the default `User`, `Editor` and admin roles, which stay. Before, a member who only holds app roles got access_denied.",
+    "migration": "Optional. Apps whose members hold only their own roles pass `createJobsFeature({ readRoles: [...] })`."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Deduplicated job add keeps the finished tenant run row",
+    "detail": "JobQueuedMeta carries the BullMQ creation time of the job. The queued hook only removes finished rows queued before that time (leftovers of a Redis reset), so re-announcing an already finished job no longer turns its row back into queued."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/src/mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tenant mail transport falls back to the app transport without tenant config",
+    "detail": "tenantMailTransport returns null when the channel context carries no tenant config, instead of throwing on every send, so the channel uses the app transport as documented."
+  },
   {
     "version": "0.378.0",
     "type": "improvement",

package/src/renderer-pdf/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "renderTablePdf validates the document for direct callers",
+    "detail": "renderTablePdf parses the document against pdfTableDocumentSchema and throws RendererError invalid_payload above the row, column and cell caps. Title, subtitle, meta entries, headers, empty text, footer text and page label now have length caps and meta at most 500 entries."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/step-dispatcher/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Deliver job validates its payload at the trigger",
+    "detail": "The deliver job now declares its payload schema, so a manual trigger with an invalid payload is rejected up front instead of throwing inside the handler and consuming all retries."
+  },
   {
     "version": "0.365.1",
     "type": "fix",

package/src/subscription-dodo/changes.json

@@ -0,0 +1,14 @@
+[
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "New subscription provider for Dodo Payments",
+    "detail": "createSubscriptionDodoFeature() registers the \"dodo\" subscription provider (Merchant of Record). It verifies Standard Webhooks signatures, maps Dodo events to the foundation events, creates hosted checkouts and portal sessions, and switches plans in the app through previewPlanSwitch and applyPlanSwitch. Config keys are api-key, webhook-secret, billing-live and environment. Plan switches need a Product Collection in Dodo."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "dodoEnvSchema declares the Dodo product id slots",
+    "detail": "dodoEnvSchema({ prices: [\"PRO\"] }) adds one optional DODO_PRODUCT_PRO slot per plan next to the API key and webhook key, and checks the pdt_ prefix. It is the counterpart to stripeEnvSchema."
+  }
+]