baukit 0.11.0

baukit v0.11.0

One release train for the Rust crates, TypeScript packages, and templates.

Rust crates

baukit-auth

• Breaking: VerificationError and AuthRejection are now non-exhaustive.
  Both add Unavailable; AuthRejection also adds Misconfigured. Downstream
  matches need a wildcard arm. Store failures, OIDC connection and body-read
  failures, timeouts, and provider 408, 429, or 5xx responses return HTTP 503 with
  the standard unavailable envelope and Retry-After: 5. Fully received but
  invalid provider metadata or JWKS documents, other provider 4xx responses, and
  server configuration errors return HTTP 500 without Retry-After. Neither
  response sends an OAuth challenge. Invalid, revoked, unknown, and expired
  credentials still return 401.
• Add VerificationError::is_unavailable() and is_misconfigured(), plus a pure
  From<VerificationError> conversion for AuthRejection. Request handling logs
  infrastructure failures at error level with safe causes. Store errors log only
  their variant kind. HTTP error displays omit URLs and private diagnostics.
• Add MAX_API_TOKEN_NAME_LENGTH, ApiTokenService::prepare and prepare_at,
  and the sqlx-postgres helper insert_api_token. Preparation returns an opaque
  PreparedApiToken and the one-time GeneratedApiToken. The insert helper
  requires a prepared token, so callers cannot bypass validation with a raw
  ApiTokenRecord. Products can insert under their own lock in the same
  transaction as policy checks and other writes. The store validates records
  through the same prepared type and uses the same INSERT helper.

baukit-config

• No component-specific changes in this train.

baukit-core

• No component-specific changes in this train.

baukit-credential-vault

• No component-specific changes in this train.

baukit-data-subject

• Apply job migration 0004 in PostgreSQL fixtures for the store's new key columns.

baukit-egress

Added

• Add GuardedClient::execute_stream and EgressStreamResponse with status,
  headers and chunked reads. Both response modes share the guarded send path,
  request tracing, timeouts and byte limits.
• Add AllowedEndpoint, AllowedEndpointError and AddressPolicy::OnlyEndpoint
  for an exact scheme, host and effective port. The HTTP flag selects HTTP only
  when true and HTTPS only when false.
• Add AddressPolicy::PublicHttp and EgressOptions::with_redirect_responses.
  Opted-in redirects return status and headers with an empty body and are never
  followed. Defaults still require public HTTPS and reject redirects.

Fixed

• Block metadata addresses 100.100.100.200 and fd20:ce::254 under every
  policy, including IPv4-mapped and well-known NAT64 forms where applicable.
• Give timeout tests time to receive headers under concurrent workspace load,
  while keeping a short bound on reads after the streaming deadline expires.

Breaking

• AddressPolicy gains PublicHttp and OnlyEndpoint.
  DestinationRejection gains Endpoint. Both enums are now
  #[non_exhaustive]; downstream matches need a fallback arm. This requires
  a minor release during 0.x.

baukit-erasure

• Apply job migration 0004 in PostgreSQL fixtures for the store's new key columns.

baukit-events

• No component-specific changes in this train.

baukit-http

• No component-specific changes in this train.

baukit-integrations

• No component-specific changes in this train.

baukit-jobs

• Add PostgresJobStore::enqueue_deduplicated and
  enqueue_deduplicated_in_transaction to share a key only while a job is
  pending or running. Existing idempotency behavior stays unchanged.
• Add enqueue_pending_deduplicated and
  enqueue_pending_deduplicated_in_transaction for one pending follow-up while
  another job runs. Claiming clears the pending key so retries cannot collide
  with a follow-up. The two deduplication modes use independent keys.
• Breaking: add public Job::dedupe_key and Job::pending_dedupe_key fields.
  Custom stores and tests that construct Job must set them, usually to None.
  Keep Job constructible for custom JobStore implementations. Enqueue and
  claim now require migration 0004, including calls to existing methods,
  because returned jobs include both columns.
• Add migrations/0004_baukit_jobs_active_deduplication.sql and
  POSTGRES_MIGRATION_0004_SQL. Products must copy it as a new ordered
  migration before upgrading the store. Worker and authenticated
  backend templates include it as migration 0007.
• Document migration 0004 deployment order in the upgrade skill and backfill
  only the newest legacy pending row per key in the adoption example.

baukit-mcp

• Return HTTP 503 with the flat {"error":"identity_unavailable"} body and
  Retry-After: 5 for temporary identity-verification failures, including OIDC
  body-read failures and provider 408, 429, or 5xx responses. Fully received but
  invalid provider metadata or JWKS documents, other provider 4xx responses, and
  server configuration errors return HTTP 500 with
  {"error":"identity_misconfigured"} and no Retry-After. Both responses omit
  the OAuth challenge and log a safe cause at error level. Invalid credentials
  still return 401.
• Add the optional suite feature and McpServices::with_suite_links to register list_suite_links. It requires links:read, resolves the admitted product owner through SuiteOwnerResolver, reads through SuiteLinksRead, and returns credential-free link metadata in pages of 100.
• SuiteLinksTool::new and McpServices::with_suite_links require an explicit owner resolver. Unmapped identities receive an unauthenticated tool error before links are read. This changes the constructor signatures introduced in this unreleased change.

baukit-openapi

• No component-specific changes in this train.

baukit-ops

• No component-specific changes in this train.

baukit-push

Added

• Add ExpoPushSender::with_guarded_client(GuardedClient) for ticket requests
  and immediate or deferred receipt requests through baukit-egress. The
  dependency is direct and needs no feature flag. Guarded failures retain the
  guard's retry classification and omit provider response bodies.

Changed

• Keep accepted tickets as PushDeliveryStatus::Accepted when an immediate
  receipt fetch fails, on both transports. Callers can persist the ticket and
  poll later instead of sending the notification again. Deferred receipt calls
  still report failures.
• Use a manual ExpoPushSender debug formatter that omits endpoint URLs and
  credentials.
• Log failed immediate receipt fetches at debug level with retryability and no
  notification data. Mark guarded authorization headers sensitive.

baukit-ratelimit

• No component-specific changes in this train.

baukit-runtime

• No component-specific changes in this train.

baukit-suite

• Clarify that handlers overriding prepare_at must delegate prepare to it.

• Keep entitlement events retryable when a custom inbox skips preparation. Pass the receiver clock to PlatformEventHandler::prepare_at for deterministic free-cache deadlines.

• Document that erasure removes revision cursors and products must filter late events for erased subjects.

• Add per-peer hosted authorize_url overrides with config and registry validation. The full path and suite protocol query parameters are preserved.

• Breaking: PeerUrls, PeerRegistrySettings and SuiteConfig are non-exhaustive. Replace external struct literals with PeerUrls::new, PeerRegistrySettings::default and their builders, or mutate defaults. ActivePeer gains authorize_url: Option<url::Url>, parsed during registry validation. This requires a minor release.

• Add the read-only SuiteLinksRead service port, implemented by SuiteLinkService.

• Apply job migration 0004 in PostgreSQL fixtures for the store's new key columns.

• Add read-through entitlement refresh with per-subject single-flight, explicit free fallback, transactional cache erasure and batched receipt retention. Configure the hub source and event prefix, prepare pulls before receipt transactions, and keep cached ticket verification available during JWKS refresh.

• Revise the unreleased platform API: public event context constructors, PlatformEventDecoder, PlatformEventHandler::prepare, cache revision and erasure methods, a required source for hub reads, EntitlementSourceError, and detailed configuration errors from ticket_verifier.

• Add the optional platform feature with typed hub events, a signed receiver, transactional PostgreSQL receipts, entitlement caches, standalone reads and a cached Ed25519 ticket verifier.

baukit-sync

• No component-specific changes in this train.

baukit-telemetry

• No component-specific changes in this train.

baukit-test

• No component-specific changes in this train.

TypeScript packages

a11y-core

Minor Changes

• Release the coordinated baukit 0.11.0 train.

analytics-core

Minor Changes

• Release the coordinated baukit 0.11.0 train.

analytics-posthog-native

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/analytics-core@0.11.0

analytics-posthog-web

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/analytics-core@0.11.0

api-runtime

Minor Changes

• Release the coordinated baukit 0.11.0 train.

auth-native

Minor Changes

• Release the coordinated baukit 0.11.0 train.

auth-node

Minor Changes

• Release the coordinated baukit 0.11.0 train.

auth-web

• Add SilentTokenBroker for silent multi-product OIDC authorization with in-memory tokens, remembered failures, account binding and explicit popup login. A blocked popup preserves earlier failures, and closing a popup returns login_required with reason interaction_cancelled.
• Add completeSilentTokenCallback and the CALLBACK_MESSAGE constant for dedicated callback pages.
• Add optional SilentAuthorizationWindow.closed for custom popup environments and the unsupported_environment error code for construction outside a browser without an explicit environment.

Minor Changes

• Release the coordinated baukit 0.11.0 train.
• 7fdf020: Add SilentTokenBroker for silent authorization against multiple OIDC realms with PKCE, verified account claims, in-memory token caches and explicit popup login. Blocked popups preserve earlier remembered failures; closed popups return login_required with reason interaction_cancelled. Custom environments can expose popup closure through optional SilentAuthorizationWindow.closed. Construction outside a browser without an explicit environment throws SilentTokenError with code unsupported_environment. Add completeSilentTokenCallback and the CALLBACK_MESSAGE constant for same-origin callback pages.

data-contracts-dexie

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/data-contracts@0.11.0

data-contracts-expo-sqlite

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/data-contracts@0.11.0

data-contracts

Minor Changes

• Release the coordinated baukit 0.11.0 train.

events

Minor Changes

• Release the coordinated baukit 0.11.0 train.

integrations-client

Minor Changes

• Release the coordinated baukit 0.11.0 train.

localization-core

Minor Changes

• Release the coordinated baukit 0.11.0 train.

navigation

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/a11y-core@0.11.0
  • @baukit/ui-tokens@0.11.0

notifications-core

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/localization-core@0.11.0

notifications-expo

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/notifications-core@0.11.0

preferences-core

Minor Changes

• Release the coordinated baukit 0.11.0 train.

pwa-web

Minor Changes

• Release the coordinated baukit 0.11.0 train.

suite-client

• Load the packed entitlements export under CommonJS with its declared runtime dependencies.

• Add suiteAuthorizeUrl and validateSuiteAuthorizePeer for per-peer hosted consent URLs with preserved paths and unchanged suite query parameters.

• Trim trailing slashes from the default peer web URL before appending /suite/authorize.

• Publish the entitlement verifier for CommonJS consumers as well as ES modules.

• Add @baukit/suite-client/entitlements for offline Ed25519 ticket verification on web and Hermes.

Minor Changes

• f6c8a8f: Add validated per-peer hosted consent URLs with suiteAuthorizeUrl and
  validateSuiteAuthorizePeer. Preserve configured paths and existing suite query
  parameters. Local consent remains the default.
• 68d0db3: Add the entitlements subpath for offline hub ticket verification on web and React Native without WebCrypto.
• Release the coordinated baukit 0.11.0 train.

Patch Changes

• Updated dependencies
  • @baukit/integrations-client@0.11.0
  • @baukit/localization-core@0.11.0

sync-client

Minor Changes

• Release the coordinated baukit 0.11.0 train.

ui-tokens

Minor Changes

• Release the coordinated baukit 0.11.0 train.

Commits

• chore: prepare baukit v0.11.0 (ae1d0566)
• test(cli): compare the platform golden trees (2ea16683)
• Merge sb-ptmpl: generated platform receiver wiring (B3) (83539dd9)
• fix(cli): correct platform clients and receipt scheduling (b25933ee)
• feat(cli): generate platform receiver wiring (388db5cc)
• Merge sb-platform: platform receiver, entitlement tickets and cache (B1) (03084ea0)
• Merge sb-jobs: active and pending-only enqueue deduplication (B8) (06417816)
• docs(jobs): clarify migration rollout and legacy backfill (d4e91c41)
• fix(suite): close platform receiver and entitlement gaps (fd083b37)
• Merge sb-tmpl: Expo 57.0.31 pins and per-checkout Cargo target cache (B6) (ac818974)
• Merge sb-suite: hosted authorize URL, suite links MCP tool, azp allowlist (B2, B11) (7f598822)
• fix(templates): preserve plain compose cache defaults (d9041654)
• fix(suite): require owner resolution and isolate MCP smoke resources (ceab68b1)
• feat(jobs)!: add pending-only enqueue deduplication (addec87c)
• Merge sb-egress: streaming, endpoint pinning, PublicHttp and guarded push (B7, B10) (7db7131b)
• fix(egress): stabilize timeout tests and pin endpoint schemes (e8b6f191)
• Merge sb-auth: 503 for unavailable identity, transactional token insert (B5, B9) (e60ab405)
• fix(auth): retry transient provider statuses and body failures (b5dfb9cf)
• Merge sb-authweb: silent multi-product token broker (B4) (2a0fbca1)
• fix(auth-web): preserve login failures and detect popup closure (892ec2cc)
• fix(auth): distinguish verification failures and require prepared token inserts (ede66ed1)
• feat(suite): platform receiver, entitlement ticket verifier and entitlement cache (68d0db3d)
• feat(egress): stream guarded responses, pin single endpoints and route push through egress (13beb066)
• fix(templates): bump Expo pins and key the target cache by checkout (98cac6f8)
• feat(suite): hosted authorize URL, read-only links MCP tool and OIDC azp allowlist (f6c8a8f4)
• feat(auth-web): add a silent multi-product token broker (7fdf0207)
• feat(jobs): deduplicate enqueues against active jobs only (910aff1b)
• feat(auth): return 503 when the token store is unavailable and expose transactional token insert (21da87f6)
• feat(jingle): mix voiceovers, music and effects into one final track (c311786e)
• docs(data-subject): track the v0.10.32 release as done (6539b0a7)