@whooshbang/contract-mock 1.0.0-rc.32 → 1.0.0-rc.34

package/CHANGELOG.md

@@ -5,6 +5,21 @@ recorded here.
 
 ## Unreleased
 
+## 1.0.0-rc.34
+
+- Upgrade the Hono runtime to 4.13.7 so consumers do not inherit the security
+  advisories fixed in Hono 4.13.5 and 4.13.7 (FXO-2344).
+- Reissue the mock against `@whooshbang/contracts@1.0.0-rc.22` and
+  `@whooshbang/sdk@1.0.0-rc.31`.
+
+## 1.0.0-rc.33
+
+- Serve the account-credential lifecycle — list, create, rotate and revoke —
+  so a consumer can exercise an organization-wide key against the mock without
+  reaching a real account (FXO-1809).
+- Serve the customer-owned Slack app surfaces: manifest, credential submission
+  and setup restart (SLK-B1/B2).
+
 ## 1.0.0-rc.32
 
 - Serve the project and environment recipient-experience routes, and the

package/README.md

@@ -52,6 +52,24 @@ ten owner-voiced panel values into recipient sessions, and serves the PNG only
 to that session's exact configured origin. System-owned safety, refusal, pause,
 unavailable, and unsubscribe copy is rejected just as it is by the service.
 
+Subscriber data exports are available at
+`GET /v1/projects/{project_id}/subscribers/{subscriber_id}/data-export` through
+an account grant, account credential, or human session. The project-wide operation refuses a
+one-environment project credential, requires `subscriptions:read`,
+`messages:read`, and `machine-clients:read`, and returns a JSON attachment with
+caching disabled.
+The mock combines the created subscriber's profile with representative
+synthetic recipient-response and delivery records to exercise all three
+provenance sections; it does not reconstruct a complete activity history.
+WhooshBang-controller audit and service-log data are listed as exclusions.
+
+The same account authorities erase a subscriber through
+`DELETE /v1/projects/{project_id}/subscribers/{subscriber_id}` when they carry
+all three corresponding write scopes. Repeats return the same empty `204`.
+`POST /v1/account/close` accepts only an administrator human session and the
+exact `close-account` confirmation; its repeat-safe result names any synthetic
+customer-managed provider resource that still needs manual retirement.
+
 Project credentials also execute the customer-endpoint lifecycle under
 `/v1/projects/{project_id}/environments/{environment_id}/customer-endpoints`:
 create with a one-time secret reveal, verify, bounded-overlap rotation, pause,
@@ -218,6 +236,7 @@ All credentials are synthetic local fixtures:
 | --- | --- | --- |
 | `humanSession` | `human-session-token` | default account administrator |
 | `otherHumanSession` | `human-other-session-token` | isolated account administrator |
+| `account` | `account-credential-token` | default account API credential |
 | `projectTest` | `project-test-token` | default test project |
 | `liveProject` | `project-live-token` | default live project |
 | `projectA` | `project-a-token` | isolated test project A |

package/dist/core.d.ts

@@ -17,6 +17,7 @@ export declare const CONTRACT_MOCK_FIXTURE_ENVIRONMENTS: Readonly<{
     readonly testEnvironmentId: "environment_project_synthetic_test";
 }>;
 export declare const CONTRACT_MOCK_FIXTURE_CREDENTIALS: Readonly<{
+    readonly account: "account-credential-token";
     readonly grant: "oauth-grant-token";
     readonly humanSession: "human-session-token";
     readonly otherGrant: "oauth-grant-other-token";