@openlup/platform 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -8,6 +8,130 @@ SemVer promise.
 
 ## [Unreleased]
 
+## [0.17.0]
+
+- Publishable on the npm `latest` dist-tag as `0.17.0`, from tag
+  `openlup-platform-v0.17.0`.
+
+- Add experimental `./communications` and browser-safe
+  `./communications/contracts`, plus generic capped raw-body, hex-HMAC and
+  constant-time comparison helpers in the existing `./http` entry. Compose neutral
+  transport/results/capture, rendering/content, independent Auth verification,
+  receipt/observation, polling/reconciliation, consent and membership sync engines.
+  Provider clients, protocol/key mapping, copy and activation remain host-owned.
+- Require explicit egress admission for supported injected network senders.
+  Guarded transports validate fresh host decisions, redirect sink sends and
+  suppress drops before network entry; provider names grant no admission.
+  Capture remains local acceptance. Preserve the maintained reference transport
+  through its trusted composition bridge and keep Auth/provider verification separate.
+- Add Polish/English invoice, role, opt-out and inquiry default-content factories
+  with whole-copy injection. Preserve implicit Polish invoice and existing role
+  expectations; EN invoice is construction-time opt-in. Reference opt-out page
+  copy, EN legacy/error text, document language and escaping change deliberately.
+  Pure inquiry rendering activates no sender. See the
+  [B1/B2 expectation inventory](../../docs/platform/plans/oss-m04-communications-triggers.md#b1-egress-boundary).
+- Add an opt-in immutable composition-time purpose registry with mandatory
+  classification and finite legacy defaults. Registration grants no consent,
+  provider activation or managed schema permission; custom-purpose persistence
+  stays with the host. Add neutral newsletter processing and marketing ports
+  without a runner or a new public purpose.
+- Add four bounded native store groups: delivery observation/readback, existing-rail
+  membership sync, operator notification recipients and durable consent decisions.
+  Append CREATE-only direct catalogue position 70,
+  `20261019200000_communications_native_operations.sql`, and its exact sparse
+  projection. Standard factory lanes refuse unsafe effective privileges.
+  Sync uses `public.outbox_events`; the sidecar is not another executor.
+- Compose selected native readback and atomic signed-token preferences with Core
+  readiness, explicit provider/binding identities and host-supplied clocks and
+  schedules. Add distinct opt-in operator evidence and installed substitute-provider
+  proof. Captured, network-accepted and membership-synced are not delivered.
+  Native consent excludes managed 16-hour / 2-day / 4-week caps and legacy
+  contact-touching, and is not a send-time fence. No default cadence, deployment
+  activation, full native general sender or UI package capability is added.
+  [T07 destinations](../../docs/platform/plans/oss-m04-communications-triggers.md#t07-destination-matrix)
+  remain explicitly open with their owning modules.
+- @openlup/platform size growth: added the reviewed neutral communications runtime and browser content contracts, bounded native stores and SQL projection, and their API/adoption documentation.
+
+Migration: `0.16.0` did not export communications. Upgrade the complete package
+set to `0.17.0` for the exact core peers, then explicitly select and bind the new
+experimental capability. Existing non-communications entries retain their contracts.
+The host retains renderer/copy, environment, origin, egress, provider protocol,
+credentials and schedule ownership. The generic HTTP helpers do not replace the
+independent Auth Standard Webhooks or provider-specific verification protocols.
+
+Install the complete selected direct canonical catalogue through position 70
+before selecting native stores. `COMMUNICATIONS_MIGRATIONS` projects positions
+2, 9, 20 and 70; never reapply these sparse files over an existing canonical
+history or treat them as a standalone chain. Preserve managed/private lineage
+and custom-purpose persistence: registering a purpose does not expand managed
+CHECKs. Thread the same registered purpose union and registry through selected
+policy, token, newsletter and store bindings; omitted arguments retain finite
+legacy defaults and existing signing bytes.
+
+`registerNativeSyncWorkInTransaction` is a trusted host transaction seam. Its
+caller-owned executor must already hold the lane's safe effective privileges;
+this function does not check those privileges. The caller owns the transaction
+and must commit or roll back permission, sidecar and existing-rail effects
+atomically. Use a safely admitted lane; the helper grants no provider or claim
+authority. Standard native sync factory transactions check
+`public.communication_native_sync_state`, `public.outbox_events` and
+`public.communication_recipient_consents`.
+
+Custom native stores must provide binding-scoped `findByMessageId`, bounded
+`listEvidence` (1–100) and atomic `registerPreference` as declared by the new
+surface. Supply explicit provider/binding identities and full catalogue admission.
+Hosts preserving older opt-out page bytes retain their own presentation binding;
+token purposes, verification and existing HTTP status/header semantics remain.
+See the [package composition guidance](README.md#communications-import).
+
+Growth reading: +61.4% against the retained initial `0.16.0` baseline (256,973
+packed bytes), measured before S1 notes at 414,808 bytes; final S1 measurements
+are recorded in the programme evidence. No cap is changed. Baseline evidence
+(2026-10-20): the published `0.16.0` tarball is 257,434 packed bytes, SHA256
+`030756175d61279aab0ae7b26b27783e08467ec93673f5623d19d0b7fc436463`.
+S1 option B retains the initial release-gates baseline rather than replacing it
+with this observed registry identity.
+
+## [0.16.0]
+
+- Publishable on the npm `latest` dist-tag as `0.16.0`, from tag
+  `openlup-platform-v0.16.0`.
+
+- Add the experimental identity capability at `./identity` and browser-safe
+  `./identity/contracts`: role-based authorization, actor-scoped profiles,
+  bounded normalized contact matching, unconfirmed soft accounts with explicit
+  email-trust policies, and configured-origin magic-link redirect resolution.
+- Add operator invitations with transactional pending acceptance, expiry,
+  cancellation and revoked re-invitation for direct stores, and immediate active
+  membership with repeat/concurrent recovery for managed stores. Direct operator
+  login uses single-use email challenges, operator-audience sessions, live
+  membership authorization, explicit first-administrator bootstrap and bounded
+  challenge pruning. An opt-in OIDC access-token verifier provides pinned issuer
+  discovery, bounded rotating JWKS, strict claim validation and deterministic
+  issuer/subject principals for direct composition.
+- Add versioned personal-data contributors, identity export and transactional
+  direct erasure with contributor vetoes, challenge/invitation cleanup,
+  pseudonymization, guarded operator revocation and idempotent receipts. Managed
+  export reports incomplete coverage; managed erasure refuses with
+  `MANAGED_PRIVACY_ERASURE_UNAVAILABLE` without mutation. Issued tokens may remain
+  valid until expiry.
+- Add seven byte-identical identity SQL projections and host-selected module
+  schema readiness. The projections retain canonical migration identities and
+  positions; they are not a standalone installation chain.
+
+Migration: identity adoption is opt-in; upgrade the complete package set together
+for the exact `@openlup/core` `0.16.0` peer pin. Supply the selected bundle's schema
+inventory, clients and delivery bindings, an explicit email-trust policy, exact
+redirect origins, a distinct operator audience and a deployment policy for
+admin, operator and privacy routes. Managed soft-account provisioning requires
+an email-trust envelope with automatic confirmation disabled and all enabled
+non-email providers declared email-verifying. Install the complete direct
+catalogue through `20261018190000_identity_privacy_erasures` before enabling
+identity; never reapply projections to an existing canonical history. Managed
+adopters need their committed chain's
+`20261018160000_identity_service_role_capabilities.sql` forward for contact linking
+and operator membership capabilities, and must supply their own erasure path.
+
 ## [0.15.0]
 
 - Publishable on the npm `latest` dist-tag as `0.15.0`, from tag