Skip to content

baukit 0.10.19

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 20:18
· 124 commits to main since this release
v0.10.19
f3044e0

baukit v0.10.19

One release train for the Rust crates, TypeScript packages, and templates.

Rust crates

baukit-auth

  • Add Principal::authenticated_at() and with_authenticated_at() for verified login times. All token profiles validate numeric auth_time with the existing clock skew and reject malformed claims. API tokens and internal principals have no login time.
  • Clerk session tokens have no auth_time. A Retain-erased user stays fenced until the product adds it through a Clerk JWT template. The claim must be this session's authentication time and stay unchanged on refresh. Never use user-level values such as {{user.last_sign_in_at}}: a sign-in on another device would advance the claim and admit an old pre-erasure session. Baukit does not map another Clerk claim automatically.

baukit-config

  • No component-specific changes in this train.

baukit-core

  • No component-specific changes in this train.

baukit-credential-vault

  • No component-specific changes in this train.

baukit-egress

  • No component-specific changes in this train.

baukit-erasure

  • Breaking: pass a login time to fence checks and ErasureService::erase. A login after erased_at can re-onboard only after every erasure operation completes. Missing login times keep the permanent fence.
  • Add POSTGRES_REONBOARDING_MIGRATION_SQL, to copy after 0001. Re-erasure updates the fence with the database clock; old idempotency keys keep their receipts.
  • erased_at DEFAULT now() backfills existing fences with the migration time. Subjects erased before the upgrade can re-onboard with a login after the migration once every erasure operation completes. Their pre-erasure sessions stay fenced.

baukit-events

  • No component-specific changes in this train.

baukit-http

  • No component-specific changes in this train.

baukit-integrations

  • No component-specific changes in this train.

baukit-jobs

  • Keep polling a job's handler and timeout while its cancellation query waits
    for a database connection.

baukit-mcp

  • No component-specific changes in this train.

baukit-openapi

  • No component-specific changes in this train.

baukit-ops

  • No component-specific changes in this train.

baukit-push

  • No component-specific changes in this train.

baukit-ratelimit

  • No component-specific changes in this train.

baukit-runtime

  • No component-specific changes in this train.

baukit-suite

  • No component-specific changes in this train.

baukit-sync

  • No component-specific changes in this train.

baukit-telemetry

  • No component-specific changes in this train.

baukit-test

  • No component-specific changes in this train.

TypeScript packages

a11y-core

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

analytics-core

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

analytics-posthog-native

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
    • @baukit/analytics-core@0.10.19

analytics-posthog-web

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
    • @baukit/analytics-core@0.10.19

api-runtime

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

auth-native

  • Add profile_erased to session-expired reasons and accept it in clearSession. Plain clearing stays silent.
  • Persist fresh OIDC authentication after erasure. The next sign-in requests prompt=login until a successful sign-in clears the marker.
  • Isolate session-expired listener errors in the Clerk adapter. Document Clerk re-onboarding requirements.

Minor Changes

  • 43021fe: Add the profile_erased session-expired reason to clearSession. OIDC persists a force-login marker and requests prompt=login until a successful sign-in. Clerk and browser WorkOS emit the reason; their provider integrations need fresh authentication and JWT auth_time for re-onboarding.

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

auth-node

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

auth-web

  • Add profile_erased to session-expired reasons and accept it in clearSession. Plain clearing stays silent.
  • Persist fresh OIDC authentication after erasure. The next sign-in requests prompt=login until a successful sign-in clears the marker.
  • Isolate session-expired listener errors in the provider adapters. Document Clerk and browser WorkOS re-onboarding requirements.

Minor Changes

  • 43021fe: Add the profile_erased session-expired reason to clearSession. OIDC persists a force-login marker and requests prompt=login until a successful sign-in. Clerk and browser WorkOS emit the reason; their provider integrations need fresh authentication and JWT auth_time for re-onboarding.

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

data-contracts-dexie

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
  • Updated dependencies [7662c50]
    • @baukit/data-contracts@0.10.19

data-contracts-expo-sqlite

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
  • Updated dependencies [7662c50]
    • @baukit/data-contracts@0.10.19

data-contracts

  • Add ScopedPersistenceLifecycle.handleProfileErased() and blocked reason profile-erased. It erases the last selected partition even after session cleanup closes it, removes its registry entry, and blocks with any cleanup error. Transitions remain serialized, and concurrent selection cannot reopen the erased profile.

Minor Changes

  • 7662c50: Add ScopedPersistenceLifecycle.handleProfileErased() and blocked reason profile-erased. Erase the last selected partition even after session cleanup closes it, remove its registry entry, and keep cleanup errors in the blocked state. Serialize erasure with identity transitions so a concurrent selection cannot reopen the erased profile.

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

events

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

integrations-client

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

localization-core

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

navigation

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
    • @baukit/a11y-core@0.11.0
    • @baukit/ui-tokens@0.10.19

notifications-core

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
    • @baukit/localization-core@0.10.19

notifications-expo

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
    • @baukit/notifications-core@0.10.19

preferences-core

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

pwa-web

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

suite-client

Patch Changes

  • Release the coordinated baukit 0.10.19 train.
  • Updated dependencies
    • @baukit/integrations-client@0.10.19
    • @baukit/localization-core@0.10.19

sync-client

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

ui-tokens

Patch Changes

  • Release the coordinated baukit 0.10.19 train.

Commits

  • chore: prepare baukit v0.10.19 (f3044e0)
  • fix(scripts): skip consumed changesets when updating CLI install tags (cfeb68a)
  • feat(data-contracts): serialize profile erasure cleanup (7662c50)
  • fix(templates): isolate local data by server profile (510cb2c)
  • feat(auth): expire sessions after profile erasure (43021fe)
  • test(erasure): verify forced login after Keycloak SSO (5fc49fd)
  • feat(erasure): allow fresh logins to re-onboard after erasure (d1c0d46)
  • fix(jobs): keep handlers running during cancellation checks (3214782)
  • perf(templates): run stubbed web QA specs fully parallel (f303073)
Assets 2
Loading