@microteia/console 2.38.0 → 2.42.0

package/CONSOLE-VERSIONS.md

@@ -22,6 +22,60 @@
 - fix(command): what was broken, and what it did to whoever hit it.
 -->
 
+#### [2.42.0] — 2026-11-08
+
+- feat(kernel/manifest)!: the optional prerequisite `self-service-tenants` and the backend parameter
+  `SELF_SERVICE_TENANTS` are gone. Whether a new account gets an organization of its own is now decided
+  by SYSTEM in Access Management › Users (stored in `system/registration`), and takes effect without a
+  deploy. A `SELF_SERVICE_TENANTS` line left in `.env.<projectId>` is ignored: an installation that had it
+  set to `false` must tick "Block automatic organizations" there once, after upgrading the kernel to
+  9.214.0.
+- docs(installation): `MICROTEIA.md` no longer cites `SELF_SERVICE_TENANTS` as a platform setting.
+
+#### [2.41.0] — 2026-11-07
+
+- feat(cli/publish): after the catalog is written, the source repository (the one `gh repo view` names
+  for the checkout) gets the same `kernel-<version>` tag on the commit recorded by `pack`, as a release
+  with no assets whose notes point to the artifacts in the releases repository, marked latest only when
+  the version is promoted. A failure to create it only warns.
+- feat(cli/publish): the source commit must be on GitHub BEFORE anything is uploaded — otherwise publish
+  refuses with "push it first", and nothing went out. Checked only at the end, it left the kernel live
+  and the tag to be made by hand, and publishing again could not fix it because the catalog refuses a
+  published version. A package with no usable commit (no `source`, or packed dirty) only warns.
+- feat(cli/pack): records the source commit in the manifest, and warns up front when the tree is dirty
+  or the commit has not been pushed (from the local remote refs, no network).
+
+#### [2.40.1] — 2026-11-07
+
+- chore(cli/pack, cli/pack-console): `LICENSE` (AGPL-3.0-or-later) and `NOTICE` (section 7 terms and the Microteia Extension Exception) now ship with every artifact the Console builds — at the root of the kernel tarball and in the published Console folder (both listed in `files`). The Console's `package.json` declares `AGPL-3.0-or-later` and the repository URL instead of `UNLICENSED`, and its README gains a License section pointing to the source code.
+
+#### [2.40.0] — 2026-11-07
+
+- feat(provision): writes `backend_state/applied` — the fingerprint each extension has live in the
+  project, with its approval — so a copy installed later with the same fingerprint is released by the
+  application without another run. Rewritten in full at the end of every run (empty included), from
+  what that run stamped.
+- feat(provision): copies whose fingerprint the project already has applied are stamped right after
+  the survey, carrying the recorded approval, so they never depend on the project document again.
+- feat(provision): before any deploy or `--prune`, the document is reduced to entries that stay true
+  whatever happens — installed extensions, newest copy's fingerprint. If that write fails the command
+  stops before changing the project: otherwise the document could keep announcing a function that
+  `--prune` was about to delete.
+- feat(firestore): `getDocument` reads one document over REST and returns `null` when it does not
+  exist.
+
+#### [2.39.0] — 2026-11-06
+
+- feat(export-catalog): the snapshot is built by `buildInstalledCatalog` from the `@microteia/sdk`
+  installed in `extensions/` (`loadCatalogWriter`, via `createRequire`), no longer by a copy inside the
+  Console. The Console still reads Firestore over REST; the format now has one owner, the same kernel
+  that reads it, and the same function the application uses for "Export catalog". The file gains
+  `exportedBy: "console"`.
+- feat(export-catalog): `extensions/` with an installed SDK is now required even with `--output`. An SDK
+  from a kernel that predates the writer is refused, pointing to `microteia unpack --version latest`,
+  instead of falling back to an unchecked copy. Without a role on the Firebase project, "Export catalog"
+  on the Extensions screen of the application writes the same file.
+
 #### [2.38.0] — 2026-11-05
 
 - feat(provision): deploys the Cloud Functions source an extension ships in its package, after the project operator approves that exact SHA-256. The Console recomputes the hash over what it writes (mismatch or a path outside the folder is refused), shows the files, the npm dependencies and the kind of each function, and asks; outside a terminal it holds the extension and prints `microteia provision --approve <id>@<hash>`. Approved source goes to `.microteia/packaged-functions/` and is read like any extension source (gate, duplicate names, dependencies); the copy to read before approving goes to `.microteia/packaged-review/` and is never mounted. A source already in the installation or the kernel wins over the packaged one.