v0.10.0

0.10.0 (2026-11-02)

⚠ BREAKING CHANGES

• auth: migration 0014_optout_read_scope gives the built-in auditor optout:read; custom roles are untouched. An app's optout:manage scope does not grant reads.
• auth: the built-in developer and support roles lose sms:read: they no longer list or read messages, delivery receipts, message parts or webhook attempts (directly or through includes and relation filters), and a developer can no longer replay a webhook attempt (replay reads the attempt as the caller). A developer reads its own app's messages through an app key with the sms:read scope. Deployments whose overlay says jit_role: support keep creating support users, now without sms:read; pending is the recommended value.
• api: an app key now needs the optout:read scope to list opt-outs; without it the list is empty and a detail is 404.
• auth: the eleven SMS_SSO_* environment variables are retired. A gateway that sets one its configuration does not reference as ${VAR} refuses to start; move the settings into human_login.sso. A Helm release that still sets the old top-level sso: values is refused by the retired-values guard.
• auth: [keypair, human_login] deployments are now envelope-Optional and accept a person's bearer, where every unsigned request used to be refused. A password session acts as its non-admin role; owner and admin must pair a console key. bootstrap --owner-password-out yields a password that opens nothing at the API for the owner it creates. The console must ask for openid profile. A deactivation or promotion takes effect within the 60-second standing cache. Migration: none; contract digest identical.
• login: no per-peer bucket; per_email and aggregate buckets; the cheap checks first (VSA-4a)
• db: No release tag contains 0009 yet; the latest is v0.9.0. The next release therefore runs 0009 and 0012 together on every deployment that upgrades from v0.9.0 or earlier. That upgrade deletes the deployment's OAuth clients, the OP's signing keys, its Argon2id password hashes and its in-flight SSO sign-ins. The tables come back empty, and nothing serves them until VSA-3 and VSA-4.
• config: vsms reads its deployment configuration from YAML (#449)
• webhooks: deliver sealed or HMAC, chosen per endpoint (#447)
• auth: no token endpoint or login exists; machine clients register a public key (register-client), consoles pair a key (pair-console-key), and bootstrap creates the user row only.
• console: the OIDC code leg, cookie session, SSO discovery and seven console env vars are deleted, with no compatibility mode.
• sdk-node: VsmsClient.privateKeyJwt, PrivateKeyJwtTokenStore, TokenStore, the tokenStore accessor and every token option are removed. Build a VsmsClient with a key and serverKeys. Needs Node 22.11 or newer.
• auth: every non-OP route requires a signed request; bearer access tokens are no longer accepted. The Next.js console and the Node SDK cannot reach a live gateway until VS-5b and VS-7 move them to signing.

Features

• api: support looks up a message's delivery status without reading it (#472) (b10f6df)
• auth: a person reads opt-outs and consent records only with an opt-out permission (#471) (3dd42c7)
• auth: accept a machine token beside the envelope (VSA-3b) (#455) (81cdc0a)
• auth: ClientKey and register-client, an app client's signing public key (VS-2) (#441) (c15ab28)
• auth: ConsoleKey, registerConsoleKey and pair-console-key, a human console's signing public key (VS-5a) (#442) (515bdc2)
• auth: developer and support no longer read messages, and a first sign-in waits as pending (#470) (7843836)
• auth: seal every route in a signed envelope, and the Rust SDK signs (VS-3, VS-6) (#443) (8403d4b)
• auth: serve machine tokens again behind the op: block (VSA-3a) (#454) (fb62c4d)
• auth: single sign-on comes back under human_login.sso (VSA-4c) (#458) (47cb94b)
• auth: the API accepts a person's token from human_login, never as owner or admin (VSA-4b) (#457) (56d662d)
• auth: the password login, the console client row and the human_login gate (VSA-4a) (e04bda2)
• config: auth.methods, and a deployment that does not permit hmac_webhooks (#451) (d41108b)
• config: the human_login: block, and the rules that serve it (VSA-4a) (df85a0a)
• config: vsms reads its deployment configuration from YAML (#449) (ca689ab)
• console: look up whether a message arrived, by id, client reference or number (#473) (ed826dd)
• console: sign in with a paired browser key, delete the OIDC session (#445) (1fbc14e)
• core: Argon2id password hashing and the one-time password generator (VSA-4a) (7e4467a)
• db: restore the OpenID Provider tables, empty (migration 0012, VSA-2) (#453) (773240f)
• gateway: POST /login, the grant gate and a provider that serves either method (VSA-4a) (bae6c3c)
• gateway: seed-console-client, and a password for provision-user and bootstrap (VSA-4a) (f1496fd)
• sdk-node: sign every request through the Rust sealer compiled to WebAssembly (VS-7) (#444) (88d7d1a)
• webhooks: deliver sealed or HMAC, chosen per endpoint (#447) (47b8f1a)

Bug Fixes

• api: reading messages needs a permission, not just a signed-in person (#469) (edae701)
• auth: stamp lastLoginAt after the code, do the same database work on every refusal, no fixed dummy password (VSA-4a) (5321e2b)
• clippy 1.99.0 on the review round's code (VSA-4a) (3efc3ec)
• config: the chart keeps an operator's ConfigMaps, and no error repeats part of a secret (#450) (49bb45c)
• console-client: seed-console-client and serve refuse a machine client's row (VSA-4a) (994a990)
• deploy: an edge zone for /login and /token, and a Caddyfile comment that is true again (VSA-4a) (539ee57)
• deps: clear the 2026-10-30 Dependabot alerts by re-resolution (#452) (eb8418f)
• gateway: announce an account without sharing a variable with the password file (VSA-4a) (012e084)
• login: no per-peer bucket; per_email and aggregate buckets; the cheap checks first (VSA-4a) (e0959c5)
• token: key the authorization_code grant on its code, not the public client_id (VSA-4a) (73ab9e5)

Performance

• worker: a keyless claim costs the hmac work, not the sealed backlog (#448) (a6ac007)

Refactoring

• auth: delete the embedded OpenID Provider and the human OAuth plane (#446) (29f93c4)
• gateway: announce a new account's id without a user_id binding (VSA-4a) (e191730)

Documentation

• agents: the review round's five non-obvious findings (VSA-4a) (5b8e9fa)
• align four tables Super-linter's MD060 refused (VSA-4a) (d20c7d3)
• align the rate-limit table Super-linter's MD060 wants aligned (VSA-4a) (0c799a0)
• auth: the console sign-in in the architecture, the runbook, the example config and AGENTS.md (VSA-4a) (25099ad)
• the edge diagram names the new zone (VSA-4a) (add5ec7)
• the limiter split, the edge zone, and one sentence about what a password may be (VSA-4a) (7c499c7)

Tests

• auth: compare the statement counts before asserting the count is plausible (VSA-4a) (74310a5)
• auth: do not spell the driver's path where the R1 scan reads it (VSA-4a) (a7f09c1)
• auth: the login suites, the grant gate, serve's boot check and the commands (VSA-4a) (5f095c5)
• gateway: a throttled sign-in is observably never authenticated (VSA-4a) (cdc8270)

Chores

• deps: cratestack 0.16.0 with envelope and cose (VS-1); clear the advisories cargo deny fails on (#439) (e3e38ff)