@cosmicdrift/kumiko-samples 0.387.0 → 0.388.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.387.0",
+  "version": "0.388.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.387.0",
+  "version": "0.388.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -63,6 +63,7 @@
     "./billing-foundation": "./src/billing-foundation/index.ts",
     "./billing-foundation/web": "./src/billing-foundation/web/index.ts",
     "./subscription-stripe": "./src/subscription-stripe/index.ts",
+    "./subscription-dodo": "./src/subscription-dodo/index.ts",
     "./subscription-mollie": "./src/subscription-mollie/index.ts",
     "./foundation-shared": "./src/foundation-shared/index.ts",
     "./auth-foundation": "./src/auth-foundation/index.ts",
@@ -359,6 +360,10 @@
         "types": "./dist/subscription-stripe/index.d.ts",
         "default": "./dist/subscription-stripe/index.js"
       },
+      "./subscription-dodo": {
+        "types": "./dist/subscription-dodo/index.d.ts",
+        "default": "./dist/subscription-dodo/index.js"
+      },
       "./subscription-mollie": {
         "types": "./dist/subscription-mollie/index.d.ts",
         "default": "./dist/subscription-mollie/index.js"
@@ -728,6 +733,8 @@
     "@testing-library/user-event": "^14.6.1",
     "@cosmicdrift/kumiko-locale-de": "workspace:*",
     "@cosmicdrift/kumiko-locale-es": "workspace:*",
+    "@cosmicdrift/kumiko-locale-fr": "workspace:*",
+    "@cosmicdrift/kumiko-locale-it": "workspace:*",
     "@cosmicdrift/kumiko-renderer-mail-html": "workspace:*",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",

package/packages/bundled-features/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "dispatchToolCall documents which failures carry a code",
+    "detail": "Only handler and dispatcher failures carry a code; local validation errors such as an unknown tool or bad arguments come back without one, and the JSDoc now says so."
+  },
   {
     "version": "0.366.0",
     "type": "improvement",

package/packages/bundled-features/src/agent-tools/tool-dispatch.ts

@@ -1,6 +1,6 @@
 import type { SessionUser, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import { isKumikoError } from "@cosmicdrift/kumiko-framework/errors";
-import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
+import { runAsAgentToolCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
 import { createFallbackLogger, type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { FILTER_OPS, isRecord } from "./filter-ops.ts";
@@ -411,13 +411,13 @@ function dispatchClient(
   }
 }
 
-/** Executes one LLM-issued tool call. Never throws — a missing tool, a missing argument, a
- *  disallowed filter field, or a rejected handler call (cap check, validation, ...) all come
- *  back as `{ ok: false }` so the agent loop can feed the error back to the model instead of
- *  crashing. Client errors (< 500) keep their message and carry a `code`; 429 adds
- *  `retryable`. Server-side failures (>= 500, unknown throws) are logged and returned as a
- *  generic message so internals never reach the model. `request.user` must be the caller's real identity — every server-kind tool runs
- *  through the same permission-checked dispatcher pipeline as a normal HTTP request. */
+/** Executes one LLM-issued tool call. Never throws: every failure comes back as `{ ok: false }`
+ *  so the agent loop can feed the error back to the model instead of crashing.
+ *  Handler and dispatcher failures carry a `code` (429 adds `retryable`); client errors (< 500)
+ *  keep their message, server failures (>= 500, unknown throws) are logged and returned as a
+ *  generic message. Local validation errors (unknown tool, bad arguments) have no `code`.
+ *  `request.user` must be the caller's real identity: server-kind tools run through the same
+ *  permission-checked pipeline as an HTTP request. */
 export async function dispatchToolCall(request: ToolCallRequest): Promise<ToolCallResult> {
   const { dispatcher, user, toolName, input, dispatchTable, runId, toolCallId } = request;
   const classifyFailure = createFailureClassifier(toolName, request.log ?? fallbackLog);
@@ -427,7 +427,7 @@ export async function dispatchToolCall(request: ToolCallRequest): Promise<ToolCa
   }
 
   try {
-    return await runAsDirectCallEntry(async () => {
+    return await runAsAgentToolCallEntry(async () => {
       switch (descriptor.kind) {
         case "search":
           return await dispatchSearch(descriptor, dispatcher, user, toolName, input);

package/packages/bundled-features/src/audit/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Oversized audit cursor is documented as a 400 validation error",
+    "detail": "The cursor pattern comment now names the validation error (400) the API actually returns instead of 422."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tests cover nested agent grants, erased subjects and anonymous change-password",
+    "detail": "Integration tests now check that a delegating tool handler keeps the cross-tenant-read marker closed, that an erased subject gets no consumer-protection mail, and that the anonymous change-password check runs once; the audit seed helper uses withEnv."
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/packages/bundled-features/src/audit/handlers/audit-events.ts

@@ -20,7 +20,7 @@ import {
 
 const MAX_LIMIT = 100;
 
-// At most 18 digits keeps the id inside bigint, so an oversized cursor or id is a 422, not a 500.
+// At most 18 digits keeps the id inside bigint, so an oversized cursor or id is a validation error (400), not a 500.
 const CURSOR_PATTERN = /^\d{1,18}$/;
 
 export const auditListPayloadShape = {

package/packages/bundled-features/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Six-cell code input, autofocus, auto-submit and recovery switch",
+    "detail": "The MFA login, setup, disable and regenerate screens use the six-cell code input with autofocus. Login and setup submit automatically on the sixth digit; disable and regenerate keep the explicit confirm button. Verify, disable and regenerate can switch to a recovery-code field. New keys auth.mfa.verify.useRecoveryCode, useAuthenticatorCode, recoveryCode and recoverySubtitle in all locale packages; auth.mfa.disable.code now names the authenticator code only."
+  },
   {
     "version": "0.379.0",
     "type": "fix",

package/packages/bundled-features/src/auth-mfa/feature-exports.ts

@@ -8,7 +8,7 @@ import type { MfaTokenSecretsEnv } from "./token-secrets.ts";
 
 export type BindMfaRevokeAllOtherSessions = (
   revoker: (userId: string, currentSid: string | undefined) => Promise<number>,
-) => void;
+) => () => void;
 
 // Reads the late-bind setter off a mounted auth-mfa feature's exports —
 // mirrors sessions' own bindAutoRevokeFromFeature. run{Prod,Dev}App call
@@ -79,7 +79,7 @@ export function bindMfaTokenSecretsFromFeature(
   return undefined;
 }
 
-export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => void;
+export type BindRevokeAllPatTokens = (revoker: (userId: string) => Promise<number>) => () => void;
 
 // Reads the late-bind setter off a mounted auth-mfa feature's exports —
 // run{Prod,Dev}App call this once the personal-access-tokens feature (if

package/packages/bundled-features/src/auth-mfa/feature.ts

@@ -220,10 +220,16 @@ export function createAuthMfaFeature(
 
     const bindRevokeAllOtherSessions: BindMfaRevokeAllOtherSessions = (revoker) => {
       revokeAllOtherSessions = revoker;
+      return () => {
+        if (revokeAllOtherSessions === revoker) revokeAllOtherSessions = undefined;
+      };
     };
 
     const bindRevokeAllPatTokens: BindRevokeAllPatTokens = (revoker) => {
       revokeAllPatTokens = revoker;
+      return () => {
+        if (revokeAllPatTokens === revoker) revokeAllPatTokens = undefined;
+      };
     };
 
     return {

package/packages/bundled-features/src/auth-mfa/web/i18n.ts

@@ -13,6 +13,11 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.verify.submit": "Verify",
     "auth.mfa.verify.submitting": "…",
     "auth.mfa.verify.backToLogin": "Back to login",
+    "auth.mfa.verify.recoveryCode": "Recovery code",
+    "auth.mfa.verify.recoverySubtitle":
+      "Enter one of the recovery codes you saved when you set up two-factor authentication.",
+    "auth.mfa.verify.useAuthenticatorCode": "Use the code from your app",
+    "auth.mfa.verify.useRecoveryCode": "Use a recovery code instead",
     "auth.mfa.errors.invalidCode": "Invalid code. Please try again.",
     "auth.mfa.errors.invalidTotpCode": "Invalid code. Please try again.",
     "auth.mfa.errors.invalidChallengeToken": "Your sign-in has expired. Please sign in again.",
@@ -43,7 +48,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.disable.title": "Disable two-factor authentication",
     "auth.mfa.disable.description":
       "Confirm with a code from your authenticator app or a recovery code. Your account will then be protected by your password alone.",
-    "auth.mfa.disable.code": "Code from your authenticator app or a recovery code",
+    "auth.mfa.disable.code": "Code from your authenticator app",
     "auth.mfa.disable.confirm": "Disable",
     "auth.mfa.disable.cancel": "Cancel",
     "auth.mfa.disable.trigger": "Disable two-factor authentication",

package/packages/bundled-features/src/auth-mfa/web/mfa-code-or-recovery-field.tsx

@@ -0,0 +1,68 @@
+import { usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+
+export type MfaCodeOrRecoveryFieldProps = {
+  readonly id: string;
+  readonly codeLabel: string;
+  readonly code: string;
+  readonly onCodeChange: (code: string) => void;
+  readonly useRecovery: boolean;
+  readonly onUseRecoveryChange: (useRecovery: boolean) => void;
+  readonly disabled?: boolean;
+};
+
+export function MfaCodeOrRecoveryField({
+  id,
+  codeLabel,
+  code,
+  onCodeChange,
+  useRecovery,
+  onUseRecoveryChange,
+  disabled,
+}: MfaCodeOrRecoveryFieldProps): ReactNode {
+  const t = useTranslation();
+  const { Button, Field, Input } = usePrimitives();
+
+  return (
+    <>
+      <Field id={id} label={useRecovery ? t("auth.mfa.verify.recoveryCode") : codeLabel} required>
+        {useRecovery ? (
+          <Input
+            kind="text"
+            id={id}
+            name={id}
+            value={code}
+            onChange={onCodeChange}
+            disabled={disabled}
+            autoFocus
+            autoComplete="off"
+          />
+        ) : (
+          <Input
+            kind="code"
+            length={6}
+            id={id}
+            name={id}
+            value={code}
+            onChange={onCodeChange}
+            disabled={disabled}
+            autoFocus
+          />
+        )}
+      </Field>
+      <Button
+        type="button"
+        variant="link"
+        disabled={disabled}
+        onClick={() => {
+          onUseRecoveryChange(!useRecovery);
+          onCodeChange("");
+        }}
+      >
+        {useRecovery
+          ? t("auth.mfa.verify.useAuthenticatorCode")
+          : t("auth.mfa.verify.useRecoveryCode")}
+      </Button>
+    </>
+  );
+}

package/packages/bundled-features/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -12,6 +12,7 @@
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { AuthMfaHandlers } from "./constants.ts";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.tsx";
 
 export type MfaDisableDialogProps = {
   readonly open: boolean;
@@ -28,13 +29,24 @@ export function MfaDisableDialog({
   onError,
 }: MfaDisableDialogProps): ReactNode {
   const t = useTranslation();
-  const { Dialog, Field, Input } = usePrimitives();
+  const { Dialog } = usePrimitives();
   const dispatcher = useDispatcher();
   const [code, setCode] = useState("");
+  const [useRecovery, setUseRecovery] = useState(false);
+
+  const reset = (): void => {
+    setCode("");
+    setUseRecovery(false);
+  };
+
+  const handleOpenChange = (nextOpen: boolean): void => {
+    if (!nextOpen) reset();
+    onOpenChange(nextOpen);
+  };
 
   const confirm = async (): Promise<void> => {
     const res = await dispatcher.write<{ disabled: boolean }>(AuthMfaHandlers.disable, { code });
-    setCode("");
+    reset();
     if (!res.isSuccess) {
       onError(res.error.i18nKey);
       return;
@@ -45,7 +57,7 @@ export function MfaDisableDialog({
   return (
     <Dialog
       open={open}
-      onOpenChange={onOpenChange}
+      onOpenChange={handleOpenChange}
       variant="danger"
       title={t("auth.mfa.disable.title")}
       description={t("auth.mfa.disable.description")}
@@ -54,16 +66,14 @@ export function MfaDisableDialog({
       onConfirm={confirm}
       testId="mfa-disable-dialog"
     >
-      <Field id="mfa-disable-code" label={t("auth.mfa.disable.code")} required>
-        <Input
-          kind="text"
-          id="mfa-disable-code"
-          name="mfa-disable-code"
-          value={code}
-          onChange={setCode}
-          autoComplete="one-time-code"
-        />
-      </Field>
+      <MfaCodeOrRecoveryField
+        id="mfa-disable-code"
+        codeLabel={t("auth.mfa.disable.code")}
+        code={code}
+        onCodeChange={setCode}
+        useRecovery={useRecovery}
+        onUseRecoveryChange={setUseRecovery}
+      />
     </Dialog>
   );
 }

package/packages/bundled-features/src/auth-mfa/web/mfa-regenerate-recovery-dialog.tsx

@@ -9,6 +9,7 @@
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { AuthMfaHandlers } from "./constants.ts";
+import { MfaCodeOrRecoveryField } from "./mfa-code-or-recovery-field.tsx";
 
 export type MfaRegenerateRecoveryDialogProps = {
   readonly open: boolean;
@@ -25,16 +26,27 @@ export function MfaRegenerateRecoveryDialog({
   onError,
 }: MfaRegenerateRecoveryDialogProps): ReactNode {
   const t = useTranslation();
-  const { Dialog, Field, Input } = usePrimitives();
+  const { Dialog } = usePrimitives();
   const dispatcher = useDispatcher();
   const [code, setCode] = useState("");
+  const [useRecovery, setUseRecovery] = useState(false);
+
+  const reset = (): void => {
+    setCode("");
+    setUseRecovery(false);
+  };
+
+  const handleOpenChange = (nextOpen: boolean): void => {
+    if (!nextOpen) reset();
+    onOpenChange(nextOpen);
+  };
 
   const confirm = async (): Promise<void> => {
     const res = await dispatcher.write<{ recoveryCodes: readonly string[] }>(
       AuthMfaHandlers.regenerateRecovery,
       { code },
     );
-    setCode("");
+    reset();
     if (!res.isSuccess) {
       onError(res.error.i18nKey);
       return;
@@ -45,7 +57,7 @@ export function MfaRegenerateRecoveryDialog({
   return (
     <Dialog
       open={open}
-      onOpenChange={onOpenChange}
+      onOpenChange={handleOpenChange}
       title={t("auth.mfa.regenerate.title")}
       description={t("auth.mfa.regenerate.description")}
       confirmLabel={t("auth.mfa.regenerate.confirm")}
@@ -53,16 +65,14 @@ export function MfaRegenerateRecoveryDialog({
       onConfirm={confirm}
       testId="mfa-regenerate-recovery-dialog"
     >
-      <Field id="mfa-regenerate-code" label={t("auth.mfa.regenerate.code")} required>
-        <Input
-          kind="text"
-          id="mfa-regenerate-code"
-          name="mfa-regenerate-code"
-          value={code}
-          onChange={setCode}
-          autoComplete="one-time-code"
-        />
-      </Field>
+      <MfaCodeOrRecoveryField
+        id="mfa-regenerate-code"
+        codeLabel={t("auth.mfa.regenerate.code")}
+        code={code}
+        onCodeChange={setCode}
+        useRecovery={useRecovery}
+        onUseRecoveryChange={setUseRecovery}
+      />
     </Dialog>
   );
 }

package/packages/bundled-features/src/auth-mfa/web/mfa-setup-preauth-screen.tsx

@@ -79,6 +79,7 @@ export function MfaSetupPreauthScreen({
   const [setup, setSetup] = useState<SetupState | null>(null);
   const [acknowledged, setAcknowledged] = useState(false);
   const [code, setCode] = useState("");
+  const [attempt, setAttempt] = useState(0);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [retryAfterSeconds, setRetryAfterSeconds] = useState<number | null>(null);
@@ -109,13 +110,13 @@ export function MfaSetupPreauthScreen({
     }
   };
 
-  const confirmSetup = async (): Promise<void> => {
-    if (!setup) return;
+  const confirmSetup = async (submittedCode: string): Promise<void> => {
+    if (!setup || busy) return;
     setBusy(true);
     setError(null);
     setRetryAfterSeconds(null);
     try {
-      const res = await confirmMfaSetupPreauth(setup.setupToken, code);
+      const res = await confirmMfaSetupPreauth(setup.setupToken, submittedCode);
       if (res.kind !== "success") {
         setError(res.error.reason);
         setRetryAfterSeconds(res.error.retryAfterSeconds ?? null);
@@ -130,7 +131,11 @@ export function MfaSetupPreauthScreen({
           setSetup(null);
           setAcknowledged(false);
           setCode("");
+          return;
         }
+        // Remount: the field was disabled during confirm and lost focus.
+        setCode("");
+        setAttempt((n) => n + 1);
         return;
       }
       onSuccess?.(res.data.landingPath);
@@ -143,7 +148,7 @@ export function MfaSetupPreauthScreen({
 
   const onSubmit = (e?: FormEvent): void => {
     e?.preventDefault();
-    void confirmSetup();
+    void confirmSetup(code);
   };
 
   return (
@@ -226,13 +231,17 @@ export function MfaSetupPreauthScreen({
 
             <Field id="mfa-setup-preauth-code" label={t("auth.mfa.enable.code")} required>
               <Input
-                kind="text"
+                key={attempt}
+                kind="code"
+                length={6}
                 id="mfa-setup-preauth-code"
                 name="mfa-setup-preauth-code"
                 value={code}
                 onChange={setCode}
+                onComplete={(next) => void confirmSetup(next)}
                 disabled={busy || !acknowledged}
-                autoComplete="one-time-code"
+                hasError={error !== null}
+                autoFocus={attempt > 0}
               />
             </Field>
 

package/packages/bundled-features/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -27,6 +27,10 @@ export type MfaVerifyScreenProps = {
   readonly onCancel?: () => void;
 };
 
+type CodeEntryMode = "authenticator" | "recovery";
+
+const MFA_CODE_LENGTH = 6;
+
 function reasonToKey(reason: string): string {
   switch (reason) {
     case "invalid_totp_code":
@@ -56,14 +60,17 @@ export function MfaVerifyScreen({
   const t = useTranslation();
   const { Form, Field, Input, Button, Banner } = usePrimitives();
   const session = useSession();
+  const [mode, setMode] = useState<CodeEntryMode>("authenticator");
   const [code, setCode] = useState("");
+  const [attempt, setAttempt] = useState(0);
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
-  const doSubmit = async (): Promise<void> => {
+  const doSubmit = async (submittedCode: string): Promise<void> => {
+    if (submitting) return;
     setSubmitting(true);
     setError(null);
-    const res = await verifyMfaChallenge(challengeToken, code);
+    const res = await verifyMfaChallenge(challengeToken, submittedCode);
     if (res.kind === "success") {
       await session.refresh();
       setSubmitting(false);
@@ -72,30 +79,65 @@ export function MfaVerifyScreen({
     }
     setSubmitting(false);
     setError(res.error.reason);
+    // Remount: the input was disabled during submit and lost focus.
+    setAttempt((n) => n + 1);
+    if (mode === "authenticator") setCode("");
   };
 
   const onSubmit = (e?: FormEvent): void => {
     e?.preventDefault();
-    void doSubmit();
+    void doSubmit(code);
   };
 
+  const toggleMode = (): void => {
+    setMode(mode === "authenticator" ? "recovery" : "authenticator");
+    setCode("");
+    setError(null);
+  };
+
+  const isRecovery = mode === "recovery";
+  const fieldId = isRecovery ? "mfa-verify-recovery-code" : "mfa-verify-code";
+  const defaultSubtitle = isRecovery
+    ? t("auth.mfa.verify.recoverySubtitle")
+    : t("auth.mfa.verify.subtitle");
+
   return (
-    <AuthCard
-      title={title ?? t("auth.mfa.verify.title")}
-      subtitle={subtitle ?? t("auth.mfa.verify.subtitle")}
-    >
+    <AuthCard title={title ?? t("auth.mfa.verify.title")} subtitle={subtitle ?? defaultSubtitle}>
       <Form onSubmit={onSubmit}>
-        <Field id="mfa-verify-code" label={t("auth.mfa.verify.code")} required>
-          <Input
-            kind="text"
-            id="mfa-verify-code"
-            name="mfa-verify-code"
-            value={code}
-            onChange={setCode}
-            disabled={submitting}
-            required
-            autoComplete="one-time-code"
-          />
+        <Field
+          id={fieldId}
+          label={isRecovery ? t("auth.mfa.verify.recoveryCode") : t("auth.mfa.verify.code")}
+          required
+        >
+          {isRecovery ? (
+            <Input
+              key={`${mode}-${attempt}`}
+              kind="text"
+              id={fieldId}
+              name={fieldId}
+              value={code}
+              onChange={setCode}
+              disabled={submitting}
+              required
+              autoFocus
+              autoComplete="off"
+            />
+          ) : (
+            <Input
+              key={`${mode}-${attempt}`}
+              kind="code"
+              length={MFA_CODE_LENGTH}
+              id={fieldId}
+              name={fieldId}
+              value={code}
+              onChange={setCode}
+              onComplete={(next) => void doSubmit(next)}
+              disabled={submitting}
+              hasError={error !== null}
+              required
+              autoFocus
+            />
+          )}
         </Field>
         {error !== null ? <Banner variant="error">{t(reasonToKey(error))}</Banner> : null}
         <Button type="submit" loading={submitting} disabled={submitting}>
@@ -103,6 +145,11 @@ export function MfaVerifyScreen({
             ? t("auth.mfa.verify.submitting")
             : (submitLabel ?? t("auth.mfa.verify.submit"))}
         </Button>
+        <Button type="button" variant="link" onClick={toggleMode} disabled={submitting}>
+          {isRecovery
+            ? t("auth.mfa.verify.useAuthenticatorCode")
+            : t("auth.mfa.verify.useRecoveryCode")}
+        </Button>
         {onCancel ? (
           <Button type="button" variant="secondary" onClick={onCancel} disabled={submitting}>
             {t("auth.mfa.verify.backToLogin")}

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,59 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Concurrent termination runs, revocation resume and sync ordering",
+    "detail": "record-contract-termination re-checks the requestId after the provider call so a concurrent run appends nothing. Revocation resumes a period-end cancel that was recorded between its two stream reads. sync-subscription stamps the snapshot time as providerEventAtIso so a late older webhook cannot reactivate a synced cancellation."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Ordered terms lists keep their numbers in the confirmation mail",
+    "detail": "The contract confirmation mail prefixes each item of an ordered Markdown list with its number, so references such as \"see no. 3\" in terms and cancellation policies stay intact."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Operator notice tells an unavailable receipt limiter from a reached limit",
+    "detail": "When the termination receipt mail is withheld because the rate limiter failed or has no digest key, the operator notice reports \"receipt_not_sent\" instead of the per-recipient limit reason."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "An abandoned plan-change checkout no longer restarts the withdrawal period",
+    "detail": "The withdrawal period now runs from the latest subscription start only; a checkout consent without a following subscription start does not reopen it, so a later withdrawal of an old contract is cancelled at period end."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Same-second provider update cannot revive a canceled subscription",
+    "detail": "When a non-terminal state event carries the same provider timestamp as a stored cancellation, it is treated as late and discarded."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Several subscription providers in one catalog",
+    "detail": "The billing-plans query returns providers (name, displayName, plans, note) when more than one provider is offered, and start-plan-checkout takes providerName. consumerProtection.providerTexts overrides checkoutNote and vatNote per provider, and the consent record carries providerName. switch-plan always uses the provider of the existing subscription."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "In-app plan switch with a preview and consent",
+    "detail": "A provider plugin that implements previewPlanSwitch and applyPlanSwitch switches plans without a hosted portal. The new plan-switch-preview query returns the proration, the billing-plans result carries inAppPlanSwitch, and the panel shows PlanSwitchConfirmDialog with the withdrawal consent checkboxes. The confirmation mail is sent when the plan_changed webhook arrives with the consent id."
+  },
+  {
+    "version": "0.388.0",
+    "type": "breaking",
+    "title": "A catalog with several providers no longer throws an ambiguous-provider error",
+    "detail": "With more than one subscription provider mounted, billing-plans and start-plan-checkout used to throw. They now list the providers; start-plan-checkout answers with errors.providerRequired when several are offered and no providerName is given, and errors.providerNotOffered for an unknown one. Plugins have to set displayName.",
+    "migration": "Set displayName on custom subscriptionProvider plugins. Callers that send start-plan-checkout with several providers mounted must pass providerName."
+  },
+  {
+    "version": "0.388.0",
+    "type": "improvement",
+    "title": "Provider choice moved into the checkout dialog",
+    "detail": "The plan panel no longer shows a provider switch. Cards show the first provider's price, or the cheapest one with a \"from\" prefix when providers disagree. With several providers, or with consumerProtection, choosing a plan opens CheckoutConsentDialog, which now has an optional providerChoice (ChoiceCards with the checkout note and, when prices differ, the price), an optional note, and an optional consumerProtection (without it there are no checkboxes and the order carries no consent). The plan switch dialog shows the recurring price with its interval."
+  },
   {
     "version": "0.379.0",
     "type": "fix",