0.24.0

Features

• core,react,server,devtools: $atom feature pack (fd60624e)
• core,devtools: add atom reset/watch, serverOnly guard, mutation log (3df5f09b)
• core,react: add $computed primitive + useComputed hook (a6e6ff33)
• core,server: add persist adapters for $atom (cookie, localStorage, sessionStorage) (43802902)
• react: add useSelector hook + shallowEqual utility (20be7cc4)
• bucket: scope file storage keys by tenant when one is active (e67ca3a1)
• cli: gate sub-process output on log level (>= DEBUG) (e6fe66a6)
• ui: rebuild ControlSelect combobox on Base UI with multi-select pills (215231cf)
• api/notifications: org-scope the admin notification list (73a0fd8c)
• audits: implement audit retention policy with scheduled cleanup (55bc57fb)
• ui: extract TurnstileWidget — reusable Turnstile captcha component (9dda983c)
• ui: translatable parameter labels in the admin parameters editor (a77f3fcc)
• users: MySessionController — self-service session management (be9af87c)
• payments: connected-account refunds + checkout email pre-fill (f46498f5)
• payments: connected-accounts webhook support (4968e01d)
• api/notifications: lang-aware notifications — request-language capture + translations resolution (+ fr security emails) (50212d3c)
• security: $issuer access tokens compose name from first/last + mint given_name/family_name (8b7b5f3a)
• payments: redesign the dev mock checkout page as a hosted-checkout-style card (5c6baa1f)
• auth: first/last name in registration + OIDC profile claims in id_token (1db9a343)
• logger: add CliFormatterProvider for compact CLI output format, remove prettyprint [BREAKING] (14f261cf)
• ui/auth: rename post-auth redirect query param r → redirect (e5f16fcb)
• cli/cloudflare: derive the wildcard Worker-route zone from the domain (a003e3be)
• oauth: trusted (first-party) clients skip the consent screen (4015403e)
• security: ephemeral EdDSA key fallback in setSigningKey (dev/test, empty privateKey) (2b60324e)
• oauth: id_token issuance + openid-configuration + /oauth/jwks + confidential token auth (Plan 0 Task 6) (cb163eef)
• oauth: authorize prompt=none (login_required + silent SSO) + nonce round-trip (Plan 0 Task 5) (325be5f7)
• oauth: confidential client secret + bounded wildcard redirect (Plan 0 Tasks 3+4) (9bbe5f93)
• security: realm/issuer 'signing' config -> asymmetric tokens + JWKS (5f0c3372)
• security: JwtProvider asymmetric signing + getJwks (HS256 default kept) (8777c007)

Bug Fixes

• docs,test: migrate guide examples t→z, de-flake crud updatedAt test (d8bf1ce2)
• core,server,devtools: close cross-feature $atom review findings (77d411fc)
• devtools: close serverOnly leak in atom log + metadata routes (39a8bb89)
• core,devtools: close task-5 atom review findings (adbcc406)
• core,react: close task-4 $computed review findings (581e2d3d)
• core,server: close task-3 atom-persistence review findings (ea61f555)
• core,react,devtools: address review findings on atom validation (task 2) (8e68e1d4)
• core,react,devtools: enforce atom schema validation on writes + hydration decode (dedfae5e)
• security,api,ui: close Phase 0 hotfixes + payments/jobs/ui remediation (6af79d19)
• react: correct useStore reactivity, error-boundary reset, action supersession, hash-strip (0c89bf94)
• cli: scope Cloudflare waitUntil per invocation, add queue DLQ, guard destructive migrations (00f63e8d)
• orm: keep paginate's next-page sentinel when size comes from query.limit (d772cc6e)
• scheduler: treat lock contention as a dedup skip, not an error (89131817)
• core: allow scoped injection after start() (7e5f9a5a)
• api/users: scope admin actions to the caller's realm (869c6d67)
• api/verifications: stop returning the verification code over HTTP (17081a47)
• devtools: never mount devtools endpoints in production (e652bd3c)
• lock: generate the lock id per invocation, not per composition (3b98fd69)
• redis/bun: return the SET reply so lock protocol works under Bun (6c185d9e)
• cli/db: check all providers for migration drift, not just the first (b14f20a4)
• crypto: fail closed on default APP_SECRET in production (c3cf7c45)
• api/parameters: emit parameter schema as JSON Schema, not raw ZodObject (b9dccf45)
• orm/sqlite: map array-of-enum columns to JSON (5933dff6)
• orm: stop SchemaValidator cache from growing unboundedly (faf2e65e)
• ui/segmented: match Button height pixel-for-pixel per size token (3b59b701)
• oauth: re-mint id_token on the refresh_token grant (038f286f)
• sigil: enforce excludedPaths on the petition button; fix profile avatar crop (2042f98c)
• ui: AutoForm i18nPrefix — skip description when the dict key is missing (bed242ca)
• parameters: serverless cache revalidation TTL (cross-isolate staleness) (7054d52e)
• payments: capture checkout-session webhooks on connected accounts (3832f5eb)
• payments-stripe: create Connect v2 accounts via account token (FR/PSD2) (0fbf5377)
• ui/app-shell: fill-mode sidebar anchors to the wrapper, not the viewport (765f9600)
• orm: or/and where keys AND-combine with sibling conditions instead of short-circuiting (ed8b1dbd)
• ui/auth: login + reset links propagate ?redirect= alongside realm (91085cc0)
• react/form: useForm keeps submit/lifecycle callbacks fresh across renders (5e428a50)
• server/auth: /_auth/userinfo returns the request's RESOLVED user, not a raw-token re-derivation (ea8a7884)
• ui: ControlSelect combobox trigger surface matches native SelectTrigger (bg-transparent, not bg-background) (e97a6013)
• parameters: org-scope the parameters table + provider caches (multi-tenant isolation) [BREAKING] (44cf49c7)
• api/oauth: hand login page return URL as redirect, not redirect_uri (a9011515)
• ci: repair green pipeline — oauth migration, playground e2e, table refresh (74a67368)
• auth: OIDC discovery is always lazy (never a boot dependency for a relying party) (2ae2bcc9)