@cosmicdrift/kumiko-samples 0.338.0

package/packages/bundled-features/src/form-draft/lookup.ts

@@ -0,0 +1,62 @@
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
+import { formDraftTable } from "./executor.js";
+import type { FormDraftBlob } from "./schemas.js";
+
+export type FormDraftRow = {
+  readonly id: string;
+  readonly version: number;
+  readonly draft: FormDraftBlob;
+  readonly insertedAt: Temporal.Instant;
+};
+
+// Shared by save (upsert lookup + race re-lookup), discard, and get — always
+// scoped by tenantId + ownerId + draftKey, tenantId included explicitly
+// (not relying on TenantDb auto-scoping) to mirror delivery/upsert-preference.ts.
+export async function lookupDraft(
+  db: TenantDb,
+  tenantId: TenantId,
+  ownerId: string,
+  draftKey: string,
+): Promise<FormDraftRow | undefined> {
+  return fetchOne<FormDraftRow>(db, formDraftTable, { tenantId, ownerId, draftKey });
+}
+
+export type FormDraftSummaryRow = {
+  readonly id: string;
+  readonly draftKey: string;
+  readonly draft: FormDraftBlob;
+};
+
+// LIKE metacharacters in a caller-controlled screenId must not widen the
+// prefix scan (e.g. a literal "%" matching every draft).
+function escapeLikePattern(value: string): string {
+  return value.replace(/[\\%_]/g, (m) => `\\${m}`);
+}
+
+// draftKey is `${screenId}:${entityId}` or `${screenId}:new:${draftId}`
+// (framework-wizard-mode.md) — "drafts for a screenId" is a LIKE prefix
+// match on that leading segment. tenantId + ownerId equality narrows to the
+// caller's own rows via the (tenantId, ownerId, draftKey) unique index
+// before the pattern filter applies.
+export async function listDraftsByScreen(
+  db: TenantDb,
+  tenantId: TenantId,
+  ownerId: string,
+  screenId: string,
+): Promise<readonly FormDraftSummaryRow[]> {
+  // ponytail: hard cap — savedAt lives in jsonb so SQL ORDER BY+LIMIT is wrong;
+  // promote savedAt to a column when callers need correct newest-N under the ceiling.
+  return selectMany<FormDraftSummaryRow>(
+    db,
+    formDraftTable,
+    {
+      tenantId,
+      ownerId,
+      draftKey: { like: `${escapeLikePattern(screenId)}:%` },
+    },
+    { limit: 200 },
+  );
+}

package/packages/bundled-features/src/form-draft/release-file-refs.ts

@@ -0,0 +1,69 @@
+import type { FormDraftBlob } from "./schemas.js";
+
+// The draft blob's `values` is free-form by design (issue #1889: form-draft
+// never knows the consuming form's field schema, only { values, stepIndex,
+// savedAt }). A FileRef pointer is therefore recognised purely by shape —
+// any object anywhere in `values` carrying a non-empty string `storageKey`
+// matches what POST /files returns (file-routes.ts) and what a photo-upload
+// step writes into the draft, whether under a single "file" field or nested
+// in a "files"/"images" array.
+function isFileRefPointer(value: unknown): value is { readonly storageKey: string } {
+  if (typeof value !== "object" || value === null) return false;
+  const storageKey = (value as { storageKey?: unknown }).storageKey;
+  return typeof storageKey === "string" && storageKey.length > 0;
+}
+
+function collectStorageKeys(value: unknown, keys: Set<string>): void {
+  if (isFileRefPointer(value)) {
+    keys.add(value.storageKey);
+    // skip: FileRef pointer is a leaf — nothing further to recurse into.
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectStorageKeys(item, keys);
+    // skip: array items are already visited recursively above.
+    return;
+  }
+  if (typeof value === "object" && value !== null) {
+    for (const item of Object.values(value)) collectStorageKeys(item, keys);
+  }
+}
+
+export function collectDraftFileRefKeys(
+  draft: FormDraftBlob | null | undefined,
+): readonly string[] {
+  if (!draft) return [];
+  const keys = new Set<string>();
+  collectStorageKeys(draft.values, keys);
+  return [...keys];
+}
+
+// Best-effort by design: a storage hiccup must not block a draft discard or
+// the nightly cleanup sweep — this is storage-cost hygiene, not GDPR Art. 17
+// erasure, so there is no fail-closed requirement (contrast
+// user-data-rights-defaults/hooks/file-ref.userdata-hook.ts, which rolls
+// back the whole forget on a binary-delete failure). Each failing key is
+// logged and skipped; the caller's row-level operation proceeds regardless.
+//
+// Takes an already-decided key list, not the draft blob — callers must run
+// collectDraftFileRefKeys() output through db/queries' owned-storage-key
+// filter first. `values` is free-form, client-supplied JSON (issue #1889);
+// releasing a key straight out of it without verifying a real, owned
+// file_refs row exists would let a crafted `{ storageKey: "<victim's key>" }`
+// delete someone else's file — the same ownership check file-routes.ts runs
+// before every read/delete (loadFileForTenant + FileAccessGuard).
+export async function releaseDraftFileRefs(
+  keys: readonly string[],
+  deleteBinary: (storageKey: string) => Promise<void>,
+  log?: { warn(msg: string, data?: Record<string, unknown>): void },
+): Promise<void> {
+  for (const key of keys) {
+    try {
+      await deleteBinary(key);
+    } catch (err) {
+      log?.warn(`[form-draft] failed to release FileRef storageKey=${key}`, {
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+}

package/packages/bundled-features/src/form-draft/schemas.ts

@@ -0,0 +1,61 @@
+import * as z from "zod";
+import { FORM_DRAFT_KEY_MAX_LENGTH, FORM_DRAFT_VALUES_MAX_BYTES } from "./constants.js";
+
+const draftKeySchema = z.string().trim().min(1).max(FORM_DRAFT_KEY_MAX_LENGTH);
+
+// UTF-8 byte length, not string.length — `values` is arbitrary JSON that can
+// hold multi-byte characters, and the event-store row this ends up in is
+// bounded by bytes, not JS string units.
+function jsonByteLength(value: unknown): number {
+  return new TextEncoder().encode(JSON.stringify(value)).length;
+}
+
+const draftValuesSchema = z
+  .record(z.string(), z.unknown())
+  .refine(
+    (values) => jsonByteLength(values) <= FORM_DRAFT_VALUES_MAX_BYTES,
+    `values exceeds the ${FORM_DRAFT_VALUES_MAX_BYTES}-byte limit`,
+  );
+
+// The draft blob shape — fixed by issue #1889 here, not left for consumers
+// to invent per-app. `stepIndex` is in from the start so wizard-mode resume
+// (kumiko-framework#1884) doesn't need a later migration.
+export const formDraftBlobSchema = z.object({
+  values: z.record(z.string(), z.unknown()),
+  stepIndex: z.number().int().min(0),
+  savedAt: z.string(),
+});
+export type FormDraftBlob = z.infer<typeof formDraftBlobSchema>;
+
+// savedAt is stamped server-side (see handlers/save.write.ts) — never
+// accepted from the caller.
+export const saveDraftPayloadSchema = z.object({
+  draftKey: draftKeySchema,
+  values: draftValuesSchema,
+  stepIndex: z.number().int().min(0),
+});
+export type SaveDraftPayload = z.infer<typeof saveDraftPayloadSchema>;
+
+// releaseFiles defaults to false/absent: the caller's only two current call
+// sites (render-edit.tsx, both on a *successful submit*) delete the draft
+// row right after the domain entity write already carries the same
+// storageKeys forward — releasing them here would destroy files the entity
+// now depends on. Only an actual abandon/abort flow should pass
+// releaseFiles: true (issue #1915's "explicit abort" case).
+export const discardDraftPayloadSchema = z.object({
+  draftKey: draftKeySchema,
+  releaseFiles: z.boolean().optional(),
+});
+export type DiscardDraftPayload = z.infer<typeof discardDraftPayloadSchema>;
+
+export const getDraftPayloadSchema = z.object({
+  draftKey: draftKeySchema,
+});
+export type GetDraftPayload = z.infer<typeof getDraftPayloadSchema>;
+
+// screenId is the draftKey's leading segment by convention (see lookup.ts),
+// so it shares the same charset/length constraints as a full draftKey.
+export const listDraftsPayloadSchema = z.object({
+  screenId: draftKeySchema,
+});
+export type ListDraftsPayload = z.infer<typeof listDraftsPayloadSchema>;

package/packages/bundled-features/src/form-draft-user-data/changes.json

@@ -0,0 +1 @@
+[]

package/packages/bundled-features/src/form-draft-user-data/hooks.ts

@@ -0,0 +1,57 @@
+// EXT_USER_DATA hooks for the form-draft feature's `form-draft` entity
+// (GDPR Art. 20 export / Art. 17 erasure). Lives apart from form-draft so
+// consumers without the user-data-rights pipeline don't pull a hard
+// dependency.
+
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { formDraftExecutor, formDraftTable } from "../form-draft/index.js";
+
+export const formDraftExportHook: UserDataExportHook = async (ctx) => {
+  const rows = await ctx.db.selectMany(formDraftTable, {
+    tenantId: ctx.tenantId,
+    ownerId: ctx.userId,
+  });
+  if (rows.length === 0) return null;
+  return {
+    entity: "form-draft",
+    rows: rows.map((r) => ({
+      draftKey: r["draftKey"],
+      draft: r["draft"],
+      insertedAt: r["insertedAt"],
+    })),
+  };
+};
+
+// Real physical delete, not crypto-shredding — `draft` is jsonb (entity.ts
+// explains why it can't use the string-only PII field-encryption engine).
+// A drafted form is pure pre-submit scratch state with no value once the
+// owner is gone, so both forget strategies (delete/anonymize) remove the
+// row outright rather than anonymizing in place. Per-row via the executor
+// (event -> rebuild-safe), scoped to this user only — never touches other
+// owners' drafts, tenant model doesn't matter here (unlike folders' single-
+// user gating: a form-draft row always has exactly one owner already).
+export const formDraftDeleteHook: UserDataDeleteHook = async (ctx) => {
+  const rows = await ctx.db.selectMany<{ id: string }>(formDraftTable, {
+    tenantId: ctx.tenantId,
+    ownerId: ctx.userId,
+  });
+  const systemUser = createSystemUser(ctx.tenantId);
+  const failures: string[] = [];
+  for (const row of rows) {
+    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, ctx.db);
+    if (!result.isSuccess) {
+      failures.push(`${row.id}: ${result.error.message}`);
+    }
+  }
+  // A silently-ignored delete failure would let the forget pipeline flip the
+  // user to Deleted (Art. 17 "done") while the row — and its PII — is still
+  // there. Throwing rolls back this user's sub-tx (runForgetCleanup) so the
+  // status stays DeletionRequested and the next run retries.
+  if (failures.length > 0) {
+    throw new Error(`[form-draft-user-data] failed to delete draft(s): ${failures.join(", ")}`);
+  }
+};

package/packages/bundled-features/src/form-draft-user-data/index.ts

@@ -0,0 +1,21 @@
+// Provides the EXT_USER_DATA export/delete hooks for the form-draft
+// feature's `form-draft` entity as a standalone feature — mount it alongside
+// form-draft + user-data-rights when an app needs form drafts in its GDPR
+// export/forget pipeline. Kept separate from form-draft (which requires
+// nothing) so form-draft consumers without the user-data-rights stack don't
+// pull a hard dependency. Mirrors notes-history-user-data.
+
+import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engine";
+import { formDraftDeleteHook, formDraftExportHook } from "./hooks.js";
+
+export const formDraftUserDataFeature = defineFeature("form-draft-user-data", (r) => {
+  r.describe(
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `form-draft` feature's `form-draft` entity. Mounts the EXT_USER_DATA export hook so a user's saved drafts are included in the user-data export bundle, and a delete hook that physically removes the user's own draft rows on forget. Kept separate from `form-draft` so form-draft consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `form-draft`.",
+  );
+  r.requires("user-data-rights");
+  r.optionalRequires("form-draft");
+  r.useExtension(EXT_USER_DATA, "form-draft", {
+    export: formDraftExportHook,
+    delete: formDraftDeleteHook,
+  });
+});

package/packages/bundled-features/src/foundation-shared/changes.json

@@ -0,0 +1 @@
+[]

package/packages/bundled-features/src/foundation-shared/config-helpers.ts

@@ -0,0 +1,97 @@
+// Shared config-read helpers used by the per-tenant Foundation factories
+// (ai-foundation, mail-foundation, file-foundation). Each foundation reads
+// its config-keys + secret out of `ctx`, narrows undefined → throw, and
+// dispatches to a provider. The narrowing helpers live here as a single
+// source so all three foundations report errors the same way and a fix
+// to one error-message format reaches all callers.
+//
+// **Why a shared module instead of duplicate copies:**
+//   First two foundations (ai + mail) hand-rolled identical helpers,
+//   the third (file) made it three times. That's the threshold where
+//   premature-abstraction-warnings flip to DRY-warnings — three nearly-
+//   identical 25-LOC helper-pairs across three files would diverge in
+//   error-text under maintenance, exactly the bug-class extraction
+//   prevents.
+//
+// **What this module is NOT:**
+//   - Not a feature — no `defineFeature`, no boot-time registration.
+//   - Not a barrel for everything — only the helpers actually shared
+//     across foundations live here. Per-foundation transport/provider-
+//     factories stay in their own package.
+
+import { InternalError, UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
+
+/**
+ * Narrow `value | undefined` → `value` with a clear message that names
+ * which config key resolved to nothing. Use for keys whose `undefined`
+ * means a registry misconfiguration (no value + no default).
+ *
+ * Throws InternalError (500): `undefined` here is a developer bug, not a
+ * tenant-configuration gap — contrast requireNonEmpty.
+ *
+ * Foundation-Pattern: this is the wrap-helper around `await ctx.config(
+ * featureFoundationFeature.exports.configKeys.someKey)` — the call-site
+ * stays a single line per key.
+ *
+ * **`featureName` is the qualified-name prefix in the error** (e.g.
+ * `"ai-foundation"`, `"mail-foundation"`) — included so that an exception
+ * surfaced from a multi-foundation app pinpoints the failing foundation.
+ */
+export function requireDefined<T>(value: T | undefined, featureName: string, label: string): T {
+  if (value === undefined) {
+    throw new InternalError({
+      message: `${featureName}: '${label}' config key resolved to undefined — registry misconfigured (no value + no default)`,
+    });
+  }
+  return value;
+}
+
+/**
+ * Narrow `string | undefined` → non-empty `string`. Tighter than
+ * `requireDefined` for the case where the registry HAS a default (often
+ * `""`) but the foundation requires the tenant to have set a real value
+ * before the factory can build a working transport / provider.
+ *
+ * Typical use: SMTP host, S3 bucket, model id — values without which the
+ * downstream SDK would 400 with a cryptic message. The clearer "tenant
+ * must configure X via tenant-admin UI" lands at the call-site instead.
+ *
+ * Whitespace is trimmed: a whitespace-only value counts as empty, and the
+ * returned string has surrounding whitespace removed — so a stray " host "
+ * never reaches the SDK as-is.
+ *
+ * Throws UnconfiguredError (422, code "unconfigured") so clients can route
+ * the user to the settings screen instead of a generic 500.
+ */
+export function requireNonEmpty(
+  value: string | undefined,
+  featureName: string,
+  label: string,
+  uiHint = "Set via tenant-admin UI or seed-handler.",
+): string {
+  const trimmed = requireDefined(value, featureName, label).trim();
+  if (trimmed.length === 0) {
+    throw new UnconfiguredError({ feature: featureName, key: label, hint: uiHint });
+  }
+  return trimmed;
+}
+
+/**
+ * Narrow a `ctx.secrets.get()` result → set secret. The secrets-counterpart
+ * to requireNonEmpty: a missing secret is a tenant-configuration gap, not a
+ * crash — same 422 contract, so clients route to the settings screen.
+ *
+ * `key` is the secret's qualified name (`HANDLE.name`) so the error names
+ * exactly what `secrets:write:set` expects.
+ */
+export function requireSecretSet<T>(
+  value: T | undefined,
+  featureName: string,
+  key: string,
+  uiHint = "Set via secrets:write:set or the tenant-admin UI.",
+): T {
+  if (value === undefined) {
+    throw new UnconfiguredError({ feature: featureName, key, hint: uiHint });
+  }
+  return value;
+}

package/packages/bundled-features/src/foundation-shared/host-allowlist.ts

@@ -0,0 +1,17 @@
+/** Parses a comma-separated operator host allowlist env var. Never throws —
+ *  an unset or empty value just means no bypass. */
+export function readHostAllowlistFromEnv(
+  envVar: string,
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): readonly string[] {
+  const raw = env[envVar];
+  if (!raw) return [];
+  return raw
+    .split(",")
+    .map((host) => host.trim())
+    .filter((host) => host.length > 0);
+}
+
+export function isHostAllowlisted(host: string, allowlist: readonly string[]): boolean {
+  return allowlist.some((candidate) => candidate.toLowerCase() === host.toLowerCase());
+}

package/packages/bundled-features/src/foundation-shared/index.ts

@@ -0,0 +1,14 @@
+// Public API of foundation-shared — utilities consumed by the per-tenant
+// Foundation packages (ai-foundation, mail-foundation, file-foundation).
+
+export { requireDefined, requireNonEmpty, requireSecretSet } from "./config-helpers.js";
+export { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
+export {
+  BlockedHostError,
+  HostResolutionError,
+  MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR,
+  type MailConnectTarget,
+  type MailHostGuardOptions,
+  readAllowedPrivateMailHostsFromEnv,
+  resolveMailConnectTarget,
+} from "./mail-host-policy.js";

package/packages/bundled-features/src/foundation-shared/mail-host-policy.ts

@@ -0,0 +1,60 @@
+// Connect-time egress guard for tenant-supplied SMTP/IMAP hosts (shared by
+// mail-transport-smtp and inbound-provider-imap): a tenant-controlled host
+// must resolve to a public address, never an internal one. Resolution
+// happens exactly once and the caller connects to the resolved address
+// directly (see kumiko-http's resolvePublicHostname for why that matters),
+// so this also covers hosts that were valid when a tenant set them and
+// only later re-resolve to a private address.
+//
+// `allowedPrivateMailHosts` is the operator's own escape hatch for an
+// internal relay or a dev/test server (mailpit, greenmail) — deliberately
+// an operator env var (KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS, read via
+// readAllowedPrivateMailHostsFromEnv), never a tenant-config key, so a
+// tenant can never grant themselves the bypass. Shared by both features
+// since a deploy commonly mounts both; declared once in mail-transport-
+// smtp's envSchema (see its feature.ts) to avoid the framework's env-var-
+// conflict check tripping when both features are mounted together.
+
+import type { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { resolvePublicHostname } from "@cosmicdrift/kumiko-framework/http";
+import { isHostAllowlisted, readHostAllowlistFromEnv } from "./host-allowlist.js";
+
+export const MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_MAIL_ALLOWED_PRIVATE_HOSTS";
+
+export function readAllowedPrivateMailHostsFromEnv(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): readonly string[] {
+  return readHostAllowlistFromEnv(MAIL_ALLOWED_PRIVATE_HOSTS_ENV_VAR, env);
+}
+
+export type MailHostGuardOptions = {
+  readonly allowedPrivateMailHosts?: readonly string[];
+  readonly lookupFn?: typeof lookup;
+};
+
+export type MailConnectTarget = {
+  readonly host: string;
+  readonly servername?: string;
+};
+
+export async function resolveMailConnectTarget(
+  host: string,
+  options: MailHostGuardOptions = {},
+): Promise<MailConnectTarget> {
+  if (isHostAllowlisted(host, options.allowedPrivateMailHosts ?? [])) {
+    return { host };
+  }
+  const resolved = await resolvePublicHostname(host, options.lookupFn);
+  // An IP-literal host pins to itself — no hostname was ever there for TLS
+  // SNI/cert validation to check, so `servername` stays unset (the mail
+  // libraries themselves skip SNI for an IP host).
+  if (isIP(host) !== 0) {
+    return { host: resolved.address };
+  }
+  return { host: resolved.address, servername: host };
+}
+
+// Re-exported so callers can classify a rejection (policy verdict, no
+// retry) without importing kumiko-http directly.
+export { BlockedHostError, HostResolutionError } from "@cosmicdrift/kumiko-framework/http";

package/packages/bundled-features/src/inbound-mail-foundation/aggregate-id.ts

@@ -0,0 +1,40 @@
+import { v5 as uuidv5 } from "uuid";
+
+// Fixed UUID-namespaces für deterministic aggregate-id-Ableitung.
+// Generiert einmalig (2026-07-12), in Stein gemeißelt: ein Wechsel würde
+// jeden existing aggregate-Stream re-keyen → kaputte Message-Historie,
+// kaputte Idempotency. Drift-Pins in __tests__/feature.test.ts.
+
+/** Namespace für inbound-message-Streams. */
+const INBOUND_MESSAGE_NAMESPACE = "7f2a9c41-3d6b-4e0f-9c58-2b1e7a4d8f63";
+
+/** Namespace für mail-thread-Streams. */
+const MAIL_THREAD_NAMESPACE = "b48d1e72-5c9a-4f36-8e0d-6a3f9b2c7e15";
+
+/**
+ * Deterministic aggregate-id für eine inbound-message. Key ist
+ * (accountId, providerMessageId): derselbe Provider-Fetch der zweimal
+ * dieselbe Message liefert (IDLE-Doppel-Notify, Cursor-Overlap,
+ * Watch-Restart-Replay) landet auf demselben Stream — der Idempotency-
+ * Check im ingest-handler sieht den bereits appendeten Event.
+ *
+ * accountId (nicht tenantId) im Key: zwei Accounts desselben Tenants
+ * können dieselbe Mail empfangen (CC an beide Postfächer) — das sind
+ * fachlich ZWEI inbound-messages.
+ */
+// @wrapper-known uuid-domain
+export function inboundMessageAggregateId(accountId: string, providerMessageId: string): string {
+  return uuidv5(`${accountId}:${providerMessageId}`, INBOUND_MESSAGE_NAMESPACE);
+}
+
+/**
+ * Deterministic aggregate-id für einen mail-thread. Key ist
+ * (tenantId, threadKey) — Threads sind tenant-weit, nicht account-weit:
+ * eine Konversation die über zwei verbundene Postfächer läuft ist EIN
+ * Thread. threadKey kommt normalisiert vom Provider (References/
+ * In-Reply-To-Chain bzw. Provider-Thread-ID).
+ */
+// @wrapper-known uuid-domain
+export function mailThreadAggregateId(tenantId: string, threadKey: string): string {
+  return uuidv5(`${tenantId}:${threadKey}`, MAIL_THREAD_NAMESPACE);
+}

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -0,0 +1,32 @@
+[
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Poll cursor is persisted with the account's tenantId",
+    "detail": "Several bundled-feature fixes. The inbound-mail watch supervisor now stamps `tenantId` when it first saves a poll cursor, so cursors persist instead of failing on the NOT NULL column. The anonymous queries of managed-pages, template-resolver, seo, compliance-profiles and auth-email-password rate-limit per IP and handler, so one handler no longer drains the bucket of the others. The personal-access-token list loads up to the maximum page size without a pager that could not page. Serial host ids beyond int4 are denied as not found, and the notes forget hook resolves the tenant retention preset once."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "OAuth callback fails before creating an account when no secrets context is wired",
+    "detail": "The inbound-mail OAuth callback now checks for a configured secrets context before exchanging the authorization code and creating the mail account. Without secrets the callback answers 500 `secrets_context_missing` and no orphan account is left behind. `form-draft:get` now logs a warning when a stored draft blob fails its schema instead of dropping it silently."
+  },
+  {
+    "version": "0.306.0",
+    "type": "fix",
+    "title": "Tenant destroy no longer fails on mail-account, inbound-message and mail-thread rows",
+    "detail": "The inbound-mail tenant-destroy hooks passed the tenant-scoped TenantDb they receive into raw DbRunner helpers, so the app-data stage failed and the tenant ended in destroyFailed. They now use ctx.db methods and declare an escapeHatch for the event-stream archive."
+  },
+  {
+    "version": "0.298.0",
+    "type": "breaking",
+    "title": "createInboundMailConnectRoutes() returns ExtraRouteDefinition[] with static options only",
+    "migration": "createInboundMailConnectRoutes(options) now returns readonly ExtraRouteDefinition[] (connect route as entry: \"user\", callback route as entry: \"signature\") instead of mounting itself on app. options is now static config only - any db/registry/dispatch values previously passed through options are supplied by the framework via the route's deps instead. Replace extraRoutes: (app, deps) => createInboundMailConnectRoutes(options)(app, deps) with extraRoutes: createInboundMailConnectRoutes(options) (spread into the app's route array alongside other route definitions)."
+  },
+  {
+    "version": "0.150.0",
+    "type": "fix",
+    "title": "`@cosmicdrift/kumiko-framework/engine` bekommt `ctx.tryAppendEvent` — ein savepoint-scope…",
+    "detail": "`@cosmicdrift/kumiko-framework/engine` bekommt `ctx.tryAppendEvent` — ein savepoint-scoped Gegenstück zu `ctx.unsafeAppendEvent`, das `VersionConflictError` als `{ ok: false, conflict }` zurückgibt statt zu werfen, ohne die restliche Handler-Transaktion zu poisonen (Bun.SQL/ postgres.js brechen den gesamten `begin()` bei einem ungefangenen Statement- Fehler ab, SQLSTATE 25P02, selbst wenn der JS-Error gefangen wird — `tryAppendEvent` läuft dafür in einem echten `SAVEPOINT`). `@cosmicdrift/kumiko-bundled-features/inbound-mail-foundation`: der `ingest-message`-Handler nutzt `ctx.tryAppendEvent` für den Message-Append — zwei parallele Ingest-Aufrufe für dieselbe `providerMessageId` (Watch-Push vs. Poll-Reconciliation-Überschneidung) liefern jetzt beide `{ duplicate: scheitert (#1038, Finding aus PR-Review #952). - @cosmicdrift/kumiko-framework@0.150.0 - @cosmicdrift/kumiko-headless@0.150.0 - @cosmicdrift/kumiko-renderer@0.150.0 - @cosmicdrift/kumiko-dispatcher-live@0.150.0 - @cosmicdrift/kumiko-renderer-web@0.150.0"
+  }
+]