v0.1.0 — Public baseline
Public baseline
This first release publishes the Apache-2.0 TypeScript and PostgreSQL reference implementation reviewed in PR #4.
Included
- authenticated, size-limited Kakao webhook ingestion
- PostgreSQL-backed event leases, customer identities, and idempotent booking leads
- recorded legacy-schema migration with advisory locking
- concurrency-safe customer identity ownership
- HMAC-protected OAuth state cookies and typed Kakao token-exchange failures
- redacted failure logging and fail-closed production composition
- contributor, governance, security, support, and threat-model documentation
Verification
The release commit passed:
- Node 22 tests, source and test type-checking, build, migration-asset verification, metadata checks, and a high-severity dependency audit: https://github.com/cstion-ai/cstion/actions/runs/30183068811
- PostgreSQL 16 migration, concurrent identity, event lease-recovery, and booking-idempotency scenarios: https://github.com/cstion-ai/cstion/actions/runs/30183068811/job/89742897735
- CodeQL: https://github.com/cstion-ai/cstion/actions/runs/30183068816
- dependency review on PR #4: https://github.com/cstion-ai/cstion/actions/runs/30183026080
Reproduce locally with npm ci, npm test, npm run typecheck, npm run build, and npm audit --audit-level=high. With a disposable PostgreSQL database, run DATABASE_URL=... npm run test:postgres.
Known limits
This release is not production-ready. CRM and Google Sheets adapters are still fakes and production startup intentionally fails closed. It does not include edge rate limiting, a server-side one-time OAuth state store, backup/restore rehearsal, sustained-load evidence, or real provider integration tests. No public adoption or deployment usage is claimed.