v0.13.12 — Project creation restored, complete localization, and headless auth

New

• Every supported language now has complete translations across settings, onboarding, project home and sidebar, sessions, password recovery, sign-in, and workspace administration. Serbian is a new locale. 241 entries that rendered as placeholders now show real text.
• Headless auth: multi-factor enrolment, enterprise SSO, and profile updates are available through the API and the SDK (PATCH /v1/auth/user, KortixSession.subscribe as the replacement for onAuthStateChange).
• Kortix Apps: one identity guard for every App (createKortixAppGuard, groups always populated), and an embedded App can complete its own sign-in (cookieSameSite).
• Session brief: hover a session to see its summary.

Improved

• Connector catalogue: one-letter searches work, cache entries are compared by identity, and panel padding and search were corrected.
• Markdown code blocks inside lists are inset correctly.
• Slack and Teams: a live run keeps its thread after 15 quiet minutes.
• Triggers: a billing-rejected fire is terminal and keeps its reason code; a reuse, keyed, or pinned delivery handoff is recorded as fired.

Fixed

• Project creation: a failure while creating the managed repository is now logged with its cause. The edge router in front of the API is deployed with every release, so an origin error is never shown as a maintenance page. The managed-git token is verified by creating and deleting a probe repository before it is stored, and the status endpoint reports which credential is in use.
• Connector endpoints must be https on a public host. An invalid endpoint answers 400 instead of failing as a server error.
• Session attachments are reliable again.
• Kortix Apps: the App guard's trailing-slash handling could take seconds on one config string; the viewer secret is resolved per request; the access picker no longer promises options the code does not offer.
• MFA unenrol route typechecks (gotrue() accepts DELETE).

Internal

• Template preview images (/api/og/template) render on the Node runtime with their strings inlined; as an Edge Function the route had grown past Vercel's size limit.
• Preview environments: Node repaired in persistent sandboxes, failed Platinum templates recover, an explicit Daytona fallback, all runtime secrets forwarded, Node engine floor raised, translations kept out of the edge middleware bundle.
• Release gate: follows the deployed test contracts, installs with engine-strict relaxed, verifies the host-only access cookie.
• Route manifest and audit route registry regenerated; the headless auth routes are registered and allowlisted with reasons.
• pi-js-router: open_access is the operator's override and the workflow honours it.

What's Changed

• fix(slack,teams): a live run lost its thread after 15 quiet minutes by @kubet in #7127
• fix(ci): forward all preview runtime secrets by @markokraemer in #7132
• infra(pi-js-router): open_access is the operator's override by @kubet in #7134
• fix(preview): raise Node engine floor and recover provider caches by @markokraemer in #7135
• Repair Node in persistent preview sandboxes by @markokraemer in #7136
• feat(web): complete app localization and add Serbian by @markokraemer in #7109
• chore(release): VERSION → 0.13.12 [skip ci] by @github-actions[bot] in #7142
• chore(release): staging VERSION → 0.13.12 [skip ci] by @github-actions[bot] in #7143
• fix(web): make session attachments reliable by @sutharjay1 in #7084
• fix(triggers): treat billing-rejected fires as terminal, preserve reason code by @agent-kortix in #7146
• fix(web): correct panel padding and search by @sutharjay1 in #7149
• fix(web): restore queued prompt removal toast copy by @sutharjay1 in #7150
• feat(web): add session brief hover card by @sutharjay1 in #7151
• fix(web): render real text for 241 broken i18nComplete entries by @sutharjay1 in #7160
• feat(api,sdk): complete the headless auth surface — 16/16 Supabase auth operations now have a Kortix equivalent by @markokraemer in #7085
• fix(connectors): support one-letter catalogue searches by @DimitrijeGlibic in #7156
• fix(api): loud provision/connector failures + deploy the prod API router Worker from deploy-prod by @markokraemer in #7161
• release: main → staging (2026-09-07, provisioning fix + i18n + headless auth) by @markokraemer in #7163
• hotfix(staging): template OG image route on Node runtime (unblocks 0.13.12 frontend deploy) by @markokraemer in #7166
• test(release-gate): spec 23 ignores the CORS preflight; quarantine spec 26's staging-only timeouts (0.13.12) by @markokraemer in #7169
• Release v0.13.12 — Project creation restored, complete localization, and headless auth by @github-actions[bot] in #7167

Full Changelog: v0.13.11...v0.13.12