@cosmicdrift/kumiko-samples 0.348.0 → 0.348.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.348.0",
+  "version": "0.348.1",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.348.0",
+  "version": "0.348.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/channel-email/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.348.1",
+    "type": "fix",
+    "title": "Email channel decrypts the resolved recipient address so notify to users and tenants works with an active KMS",
+    "detail": "Email notifications to resolved users reach the plaintext address under an active KMS\nWith an active PII KMS, an app's `resolveEmail` that reads the stored `user.email` returns ciphertext, and the PII guard rightly refused to send it (`recipient address is a PII ciphertext`). That broke every `notify` target that resolves an address from a user id: a single user, a list of users and `{ tenant }`. The email channel now decrypts the resolved address (`decryptStoredPii`, a no-op without KMS or for plaintext) before it is used for delivery, opt-out checks and the attempt log. The guard is unchanged.",
+    "migration": "No action needed. Apps whose resolveEmail returns the raw stored user.email now send to the plaintext address instead of failing with \"recipient address is a PII ciphertext\"."
+  },
   {
     "version": "0.342.0",
     "type": "improvement",

package/packages/bundled-features/src/channel-email/email-channel.ts

@@ -1,3 +1,4 @@
+import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbRow } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
@@ -8,6 +9,7 @@ import {
   type NotificationRenderer,
   type RenderedMessage,
 } from "../delivery/index.js";
+import { decryptStoredPii } from "../shared/index.js";
 import { guardEmailMessage } from "./pii-guard.js";
 import type { EmailTransport } from "./types.js";
 
@@ -117,8 +119,12 @@ export function createEmailChannel(options: EmailChannelOptions): DeliveryChanne
     name: "email",
     mode: "queued",
 
+    // resolveEmail typically returns the raw stored user.email, which is ciphertext under an active KMS.
     async resolve(userId, ctx) {
-      return resolveEmail(userId, ctx);
+      const stored = await resolveEmail(userId, ctx);
+      if (stored === null) return null;
+      const address = await decryptStoredPii(stored, "email", "channel-email:resolve");
+      return address === PII_ERASED_SENTINEL ? null : address;
     },
 
     render(message, _ctx) {