@cosmicdrift/kumiko-bundled-features 0.388.0 → 0.389.0

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "requiredPolicy \"systemAdmins\"",
+    "detail": "The new auth-mfa:config:required value systemAdmins (between optional and admins) forces MFA enrollment only for users whose merged global and tenant roles contain SystemAdmin. TenantAdmins and other roles log in as before; enrolled users are always challenged regardless of policy. No locale labels are involved, the option list has none."
+  },
   {
     "version": "0.388.0",
     "type": "improvement",

package/src/cap-counter/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Settle and consume racing on a swept reservation book their units",
+    "detail": "After the sweep deleted a reservation's row, a consume could commit its released tombstone between the two reads of a parallel settle or consume. That call took the released tombstone for a settled one, so settle reported success without booking its amount and a second consume was rejected with cap_reservation_settled. Only a settled tombstone counts as settled now; a released one runs into the insert conflict and the retry books against it."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Settle after a sweep survives a lost counter race",
+    "detail": "The amount is booked first and the tombstone written afterwards, so a version conflict on the counter retries the whole settle instead of leaving a tombstone that turns the retry into a no-op and drops the usage from the cap."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/config/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "config:write:set passes readCascade to validators",
+    "detail": "The set handler binds readCascade to the config resolver, the tenant-scoped db and the secrets reader, so validators see the same cascade as the value queries."
+  },
   {
     "version": "0.388.0",
     "type": "improvement",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Tests pin the erasure write purpose in forget-subject and the forget cleanup",
+    "detail": "A pre-KMS user whose key was already erased still ends deleted, loses its tokens and gets the erased sentinel in the update event."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "The subject file purge reads candidate rows in pages",
+    "detail": "A user owning many records no longer loads them all into memory at once; every page is purged, not only the first."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Unsubscribe link origin is looked up once per notify call",
+    "detail": "The tenantOrigin callback runs once per tenant for a notify call with many recipients, and a fallback warning is logged once. A callback that hangs is still not guarded by a timeout, so keep it fast."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "buildSystemChannelContext for system tenant mails outside a handler",
+    "detail": "buildSystemChannelContext(deps, { config, secrets }) returns a ChannelContext for the system tenant whose readAttachment reads file and inline attachments. SystemWireDeps (wire hook and runWorkerApp wireComponents) has a new required filesForTenant that deps can pass straight in."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/document-ingest-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "appendMissingDocumentExtractEvent and shared ready/failed payload schemas",
+    "detail": "A provider whose job died after creating the extract calls appendMissingDocumentExtractEvent(deps, existing, fileRefId, { readyEventQn, failedEventQn, mapError }) to append the missing terminal event; it returns appended-ready, appended-failed or already-terminal. documentExtractReadyPayloadSchema and documentExtractFailedPayloadSchema are exported so providers register their own event names with the shared payload shape."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/src/host-routing/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Redirects from /api paths fail at boot",
+    "detail": "Redirects run inside hostDispatch after static files and API routes, so a from of /api or /api/... was silently dead config. Boot validation now throws; the options and README already describe the HTML-fallback scope."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/mail-transport-smtp/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "SMTP authentication is optional",
+    "detail": "authUser is no longer a required key and the SMTP password secret no longer counts as missing in readiness. With an empty user the transport connects without auth, which suits internal relays; with a user set, a missing password still fails the send."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "MANAGED_PAGES_FEATURE names the feature",
+    "detail": "The barrel exports the MANAGED_PAGES_FEATURE constant so other code can refer to the feature name without a string literal."
+  },
   {
     "version": "0.363.0",
     "type": "improvement",

package/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Feature-prefixed undeclared secret keys are not deletable",
+    "detail": "The delete handler still accepts legacy undeclared keys, but a key starting with \"<feature>:\" of a mounted feature now fails as unknown key. Feature-owned credentials keep their writeRoles protection."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/sessions/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "isPrincipalBlocked is no longer exported from sessions",
+    "detail": "The sessions export dropped its re-export of isPrincipalBlocked, which ignored isDeleted. isPrincipalRowBlocked from the user export covers status and isDeleted and is what the session callbacks use.",
+    "migration": "import isPrincipalRowBlocked (for a user row) or isPrincipalBlocked (for a bare status) from \"@cosmicdrift/kumiko-bundled-features/user\" instead of the sessions export"
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/src/step-dispatcher/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Mail steps do not retry permanent rejections or throws",
+    "detail": "MailDispatchResult failures take an optional smtpCode; 5xx is permanent and recorded after the first attempt. A throwing mail runner is not retried, since the message may already be sent. A mail runner that wants a retry after a transport error should return a failure without smtpCode instead of throwing."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/template-resolver/changes.json

@@ -1,4 +1,40 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "copy-locale reads source files from the owning tenant's storage",
+    "detail": "The copy of linked files uses readFileRefContent with the provider of the fileRef's tenant. A source file whose fileRef row exists but whose bytes cannot be read fails the copy with template_resource_source_unreadable and releases the files already copied. A deleted fileRef is still left out of the copy."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "replaceText explains finds across formatting or placeholders",
+    "detail": "replaceText matches inside single text nodes so formatting stays intact. A find that appears in the block line but crosses a formatting change now fails with text_spans_formatting, and a find with a {{placeholder}} fails with placeholder_not_replaceable, both with translated messages. Only a string that is not in the block at all still gives text_not_found."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "send-test-status follows the tenantEditable roles",
+    "detail": "send-test-status takes its access from templateEditAccess(policy.tenantEditable), like send-test. Roles that may send a test mail now get the status, and a TenantAdmin without an edit opt-in gets a 403 on both."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "overview follows the tenantEditable roles",
+    "detail": "The overview query takes its access from templateEditAccess(policy.tenantEditable). An opted-in role lists exactly the released templates, and a TenantAdmin without an opt-in is refused with a 403, matching the screen visibility and the write handlers."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "overview search and sort use the translated title",
+    "detail": "The overview query translates a seeded titleI18nKey with the request locale before it filters by search and sorts by title. A search for the visible title now matches, and the raw key is still searchable."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "legalContentSeed keeps and can set the content folder",
+    "detail": "seedTextBlock no longer resets the folder of an existing block to null when the seed passes no folder. legalContentSeed takes an optional folder, so apps do not need their own seed loop to keep legal blocks in the SystemAdmin content tree."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/tenant-lifecycle/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Tenant destroy keeps user keys of members in other live tenants",
+    "detail": "The subject-keys stage erases user keys only for members without a membership in another tenant whose status is not destroyed. The tenant and tenant-record keys are erased as before."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/user-data-rights/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "USER_DATA_RIGHTS_FEATURE is exported from the barrel",
+    "detail": "The feature name constant that lived in web/constants.ts is now part of the public barrel."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Complete, exported handler name constants",
+    "detail": "UserDataRightsHandlers now covers all eight write handlers and UserDataRightsQueries all five explicit query handlers, and both are exported from user-data-rights and user-data-rights/web. A test compares them with the feature's registered handlers."
+  },
   {
     "version": "0.384.0",
     "type": "fix",

package/src/waitlist/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "A failing notifyRecipient SQL statement no longer aborts the submit",
+    "detail": "The resolver receives a ctx whose systemDb runs in a savepoint, so a failed statement is rolled back and the submit answers 200 with the entry stored. Only ctx.systemDb is savepoint-scoped; other ctx handles stay in the handler transaction."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "waitlist purge retry after a failed shred is covered",
+    "detail": "An integration test fails the second key shred of a purge, checks that the entries stay and no audit event is written, and that the retried purge erases every entry and records its audit event. No runtime change."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Waitlist import enforces the live field limits",
+    "detail": "migrateLegacyWaitlist counts a source row with a value above the live field limit as unreadable instead of importing it; importWaitlistEntry throws for it."
+  },
   {
     "version": "0.388.0",
     "type": "fix",