sporades 0.9.0 → 0.9.1

package/CHANGES.md

@@ -1,116 +1,10 @@
 # Changes
 
-## Unreleased - 2026-08-21
+## Unreleased - 2026-08-24
 
-Changes since v0.8.7.
+Changes since v0.9.0.
 
-### 🚀 Features
-
-- Allow token-shaped Access-key metadata (7211528).
-- Implement verified Stripe event policy delivery (7a68cbe).
-- Implement signed Stripe callback admission (8721c85).
-- Add access key operator controls (08161a6).
-- Add durable Stripe Customer Portal sessions (8a3a604).
-- Preserve access key provenance in jobs (9d1cd62).
-- Add scoped access key file reads (a1033cf).
-- Add browser access key management (7859ecd).
-- Complete owner access key lifecycle (d9c72ab).
-- Implement durable one-time Stripe Checkout (79da915).
-- Add user-owned scoped access keys (2ede8b3).
-- Add declarative session auth admission (a62c566).
-- Preserve exact endpoint body bytes (0968c99).
-
-### 🐛 Bug Fixes
-
-- Fix Stripe callback and Vanilla policy gaps (6b5792f).
-- Bound hosted inspection diagnostics (84977d0).
-- Preserve bounded host inspection failures (5ff9e59).
-- Bind privileged key work to run lifetime (1c201e4).
-- Close operator audit and output gaps (16669ee).
-- Harden access key operator boundaries (a8a6e99).
-- Reject malformed schedule provenance (04d5528).
-- Bind scheduled jobs to privileged actors (f0945a8).
-- Validate scheduled job actor provenance (5f984a4).
-- Harden durable job provenance (5023593).
-- Redact file scope denial provenance (9947213).
-- Correlate access key response loss (a9ed599).
-- Recover access key management failures (e3d42d1).
-- Require sessions for owner security changes (79e99ae).
-- Close first-key transition races (90472d8).
-- Serialize access key owner transitions (effce34).
-- Privatize access key runtime state (f091dd8).
-- Preserve middleware access key state (8d27903).
-- Isolate lifecycle audit delivery (ebc095a).
-- Commit access key lifecycle audits (e6b0a6d).
-- Preserve access key provenance (4f87ed6).
-- Isolate access key admission (48fe0a5).
-- Preserve guarded handler type safety (9496593).
-- Harden declarative auth admission (1d35da1).
-
-### 📝 Documentation
-
-- Preserve legacy auth profiles in job provenance (549542e).
-- Revalidate owner Sessions and trust Cloudflare clients (ca43887).
-- Keep Stripe event idempotency stable across renames (a86758e).
-- Normalize access key report metadata (95bec68).
-- Fix access key endpoint examples (d3098bd).
-- Publish scoped access key guide (0cf7f8e).
-- Define completed ticket state (b4c4dc8).
-- Normalize access key ticket evidence (491a042).
-- Record access key adapter identities (14277b7).
-- Correct access key proof attribution (a8eadaa).
-- Record access key release completion (779256b).
-- Prove and pack the built-in Stripe payment contract (655e656).
-- Publish access key authority contract (b6efd20).
-- Close access key operator ticket (27877d5).
-- Close durable job provenance ticket (14bcd01).
-- Close access key file reads ticket (7a94f2a).
-- Close browser access key management ticket (42a8520).
-- Extend Stripe Checkout to subscriptions (8d1c72c).
-- Close access key lifecycle ticket (6f06be7).
-- Close scoped access key tracer (c041fa8).
-- Close auth admission ticket (75c817f).
-- Build dormant blank Capsule Stripe foundation (6c0e683).
-- Specify user-owned scoped access keys (8325d69).
-
-### 🧪 Tests
-
-- Revalidate linked Access-key owners (751ee7f).
-- Bound escaped Access-key operator envelopes (099a5a1).
-- Revalidate Sessions during Access-key rotation (79d3e6c).
-- Make Privileged Access-key writes audit-atomic (1737023).
-- Timestamp Access-key revocation after locking (3b70301).
-- Preserve valid Schedule diagnostic names (a002b25).
-- Close Access-key authority and issuance races (f118728).
-- Recheck Access-key expiry inside rotation locks (70d4c0c).
-- Enforce no-store after endpoint header merging (bf50484).
-- Bind File Access-key tests to live Sessions (7e63a82).
-- Require live Session authority for Access-key management (155f154).
-- Revalidate Sessions during Access-key issuance (3a9288e).
-- Harden Access-key operator and Hosted limits (0d5f10c).
-- Make Access-key operator audits atomic (3e972ac).
-- Verify acceptance container cleanup (82ac350).
-- Gate raw container cleanup fallback (235ac72).
-- Bind acceptance cleanup to container id (0dff342).
-- Report suite failures before missing proof (27d8f62).
-- Reconcile JUnit suite outcomes (a19bb41).
-- Recognize required JUnit suites (1dace92).
-- Tokenize junit cases once (1951edd).
-- Prove admitted jobs survive key retirement (717da14).
-- Harden Stripe Checkout authority boundaries (c94fc74).
-
-### 📦 Packaging
-
-- Separate documentation validation from full suite (3863ac1).
-- Harden release acceptance cleanup (b431ab4).
-- Keep release failures opaque (9041772).
-- Report bounded release failure details (b869c92).
-- Report release suite failures (5dea6d8).
-- Reconcile release junit evidence (2f9f8fe).
-- Fail closed on release evidence (6f5b0a7).
-- Require access key release evidence (ddd3b47).
-- Close access key release proof gaps (62cc34b).
-- Prove access key release contract (c29c725).
+No changes detected.
 
 ## 0.8.5 - 2026-08-15
 
@@ -148,3 +42,4 @@ generated artifacts, and documentation.
   not select a current Team or automatically partition Capsule data; Sporades
   never sends Join-link email. See the [Built-in Teams reference](https://mgscox.github.io/sporades/reference/teams).
 
+

package/bin/sporades-host-helper.js

@@ -595,7 +595,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.0";
+var CLI_VERSION = "0.9.1";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([

package/bin/sporades.js

@@ -28533,7 +28533,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.0";
+var CLI_VERSION = "0.9.1";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.9.0";
+export declare const CLI_VERSION = "0.9.1";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.9.0";
+export const CLI_VERSION = "0.9.1";
 //# sourceMappingURL=cli-version.js.map

package/dist/generated-source-manifest.json

@@ -81,7 +81,7 @@
       "tsconfig.json",
       "tsconfig.runtime.json"
     ],
-    "digest": "ec02055cc61403379404980e6c1c98b6e79af71a90c55ae233470491e098b9c2"
+    "digest": "a93ee63c2500d1e7ea0f60aa3905608760377bc9eac3bff30611c2aaa38d7f1d"
   },
   "outputs": {
     "files": [
@@ -352,6 +352,6 @@
       "dist/user-preferences-runtime.js",
       "dist/user-preferences-runtime.js.map"
     ],
-    "digest": "3370cb5422b0386df1277c41b3d7ee058ff67450589c9168486e9e43875c62b7"
+    "digest": "531fa4e3e14ca22571cf27f770df5c25e7c4c4c050b19169fa180be262414add"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sporades",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "CLI-first platform for building, running, and hosting full-stack Sporades Capsules.",
   "homepage": "https://mgscox.github.io/sporades/",
   "license": "MIT",