@whooshbang/contract-mock 1.0.0-rc.28 → 1.0.0-rc.30

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to the deterministic WhooshBang contract mock are
 recorded here.
 
+## Unreleased
+
+## 1.0.0-rc.30
+
+- Add normalized recipient-logo upload, atomic replacement, session-authorized
+  PNG serving, cache headers, and recipient-session logo projection.
+- Project the ten owner-voiced embedded-panel copy keys while refusing every
+  system-owned safety, failure, pause, unavailable, and unsubscribe key.
+- Reissue the mock against `@whooshbang/sdk@1.0.0-rc.27`, whose browser-only
+  recipient subpaths replace the retired standalone recipient-component
+  package.
+
+## 1.0.0-rc.29
+
+- Add project recipient-copy override inventory, update, reset, validation, and
+  effective-value behavior for dashboard, SDK, and MCP parity testing.
+- Reissue the mock against `@whooshbang/contracts@1.0.0-rc.18` and
+  `@whooshbang/sdk@1.0.0-rc.26`.
+
 ## 1.0.0-rc.20
 
 - Route test and live messages through the notifier's selected default

package/README.md

@@ -45,6 +45,13 @@ inspection snapshot, models bounded overlap, updates safe last-used metadata
 on authentication, and returns `credential_invalid` after revocation. These
 values are local fixtures, not production credential material.
 
+It can also configure the project recipient experience, upload a bounded PNG
+logo, and manage sparse recipient-copy overrides. The mock normalizes the logo
+before storing it, atomically replaces the prior asset, projects its ID and the
+ten owner-voiced panel values into recipient sessions, and serves the PNG only
+to that session's exact configured origin. System-owned safety, refusal, pause,
+unavailable, and unsubscribe copy is rejected just as it is by the service.
+
 Project credentials also execute the customer-endpoint lifecycle under
 `/v1/projects/{project_id}/environments/{environment_id}/customer-endpoints`:
 create with a one-time secret reveal, verify, bounded-overlap rotation, pause,
@@ -64,6 +71,25 @@ second archive or an edit to an archived connection is refused. Credential
 material and every reference to one are absent from these responses, including
 for the shared identity WhooshBang operates.
 
+The catalogue presents hosted Slack first as
+`WhooshBang for Slack — Recommended`. Creating that arm returns a durable
+`authorization_setup`; fetching its mock authorization URL completes the
+provider browser round trip and returns to the Dashboard with the same
+connection ID. The active resource exposes only safe workspace display,
+capabilities, health, App Home deep link, recovery action, and successful
+verification/delivery timestamps. `.../{connection_id}/reauthorize` repeats
+the flow on the exact connection, health verifies it, archive is repeat-safe,
+and purge is refused because the tenant does not own the platform installation.
+
+When the owner enables Slack in N17 and exactly one eligible Slack connection
+is attached to the notifier, a recipient session offers Slack. Its provider
+handoff binds that exact connection; ambiguity or a lifecycle change fails
+closed. Environment-scoped agent sends may include `connection_id`, and the
+mock refuses a different connection without producing a provider attempt. The
+control API completes the provider handoff without manufacturing an OAuth code
+or token, then exercises preference, pause/resume, exact unsubscribe, and
+recovered visible delivery through the normal provider-neutral contracts.
+
 A `customer_byok` create connects a bot the customer already owns by supplying
 its credential and naming no identity at all. The mock reads the identity out
 of the credential's `<digits>:<secret>` shape, because it has no provider to