Durable workflows, transactional identity and lossless DNS

0.1.0-beta.3 records the combined local package snapshot. Registry publication was not established; this note's date describes the development summary, not a publication date. It includes the audience/operator work and the subsequent identity, checkout, delivery, privacy and DNS refinements. The upcoming beta 4 train retains these implementations under a coordinated new version. This historical entry remains available; deploying the site does not publish packages.

Earlier beta 3 Yalc builds and adopter archives contain different bytes. Refresh the complete selected package graph and verify exact artifact identities rather than assuming an existing beta 3 installation contains every change below. Release notes and local snapshots are not live registry availability checks. Use the beta 4 upgrade guidance for the current train; the checklist below describes the original beta 3 snapshot.

Audience and operator workflows

Audiences supplies the confirmation producer missing from beta 2, encrypted durable proofs, early-access invitation batches and verified-recipient acceptance, authorized exports, soft removal and explicit all-list contact erasure. The consent-mail recipe composes Notifications' PostgreSQL queue and independent replay receipts with Delivery and Mail; consent does not grant admission.

Current subscription state now stores consentRevision separately from historical evidence. Transaction-bound appendConsent uses stable idempotent identities; listConsent exposes bounded, scoped cursor pages. Subscription mutations and subscriber listings no longer materialize a subscriber's lifetime consent history. Canonical application persistence can implement the public ports without creating a second contact authority. State, evidence and required outbox writes must share the same physical transaction.

The narrower admission profile commits subscriber state, consent evidence and identifier-only work without issuing bearer credentials. Confirmation verifies the original proof and current enrollment without creating unrelated tokens. Claimed Delivery preparation can mint and bind per-submission content; durable resend limits and host enrollment authority remain enforced on the original transaction. Token-returning convenience APIs remain available.

Admin UI adds scoped subscriber/filter/detail, invitation, export, removal, erasure-review and masked integration settings controls. Accounts added deletion-generation-bound closure-reminder recipient resolution. Hosts retain authorization, worker scheduling, linked-store cleanup and provider qualification.

Durable webhooks and delivery

Webhooks adds production outbound Prisma storage, bounded retry/age/attempt budgets, history and compaction, encrypted settings, shared route/global cooldown coordination and bounded Discord retry-body parsing. Stripe/GitHub verification rejects ambiguous signatures and parses the same captured body it verifies. Administrative resends still require non-delivery evidence and prior-sender fencing; Slack/Discord profiles do not provide that evidence.

Delivery distinguishes positively confirmed temporary and permanent refusals from uncertain outcomes. Confirmed temporary refusals can retry safely; permanent refusals become terminal without retry or implicit endpoint suppression. Unknown outcomes remain quarantined. Notifications retains independent queue receipts after consumed jobs are deleted. SMTP rejects sparse recipient evidence rather than treating it as confirmed acceptance.

Bearer-bearing mail can opt into contentBinding: 'per-submission': logical authority and retry budgets stay immutable while each complete rendered message, including its credential, receives a separate content commitment. Issuance and binding join the claimed preparation transaction; definitive rejection/revocation and safe-retry handoff join the outcome transaction. Unknown outcomes stay quarantined without automatic credential rotation or resend. Hosts still compose native proof issuance, source/lifecycle locks, templates and protected cleanup.

Transactional notification preparation

Notifications prepares policy, recipient and rendering results within the caller's transaction, without provider I/O or nested transactions. The preparation-only createNotificationPreparer factory needs no unused root resolvers, queue, Delivery or event ports. Native validation retains bounded immutable snapshots, private failures and transaction-lifetime checks; hosts retain source authority and the atomic Delivery/content handoff.

Broader Sentry privacy filtering

Errors removes embedded URL secrets, sensitive metadata, camelCase credential keys, sensitive property names, password/email aliases, nonopaque-looking user IDs and nested user/request payloads. Relative URL filtering recognizes normalized URL/URI suffixes generally, including nested arrays, rather than a short list of field names. Paths and ordinary diagnostic structure survive. Keep host-specific privacy controls and qualify the actual SDK hook before removing application guards.

Caches, identity and adoption

Cache adds direct ioredis binding, bounded memory/Redis composition, native batches, remaining-TTL fills, combined statistics and opt-in write-behind with provisional local visibility. Unknown writes stop dispatch and invalidate local values; ordinary writes remain acknowledged. L1 is not distributed authority.

Auth adds capability-selective maintenance, transactional active-user checks and bounded public UDP/TCP DNS observations. API-key issuance/rotation rechecks expiry after awaited authorization; Analytics React avoids duplicate shallow-navigation pageviews. Billing preserves checkout lifecycle metadata and absolute expiry.

Immutable checkout recovery and closed-key protection

Billing separates fresh checkout preparation from submission with prepareCheckout and submitCheckout, retaining the exact provider request and idempotency identity. recoverCheckoutAttempt resolves durable ambiguous attempts without applying fresh-request expiry rules to an existing request. Changed input conflicts; recovery is bounded by the provider replay window and can require reconciliation instead of returning an expired redirect. Permanently closed keys cannot reopen, including after redactClosedCheckoutAttempt removes eligible private URL/error material while retaining request commitments and replay identity.

Stripe prepared requests also preserve authorized first-customer email and promotion-code settings. A pure replay assertion rejects changed same-key input before provider I/O. Canonical applications retain their journal/customer ownership, while the Billing service keeps its precreated-customer profile; closed-key, redaction and reconciliation protections remain intact.

Transactional identity and account scopes

Auth finalizes JWT issuance and refresh inside the session transaction. Signing failure rolls back renewal state; grace recovery returns the exact encrypted final response, not a reconstructed JWT, and refuses consumed or revoked successors. Revalidation preserves signed expiry and immutable bindings. Custom backing strategies must supply withAccessTokenIssuer; post-commit JWT wrappers are not a supported replacement.

Credential operations accept caller transactions and purpose-specific proofTtlMs. Locked current-state checks, insert-only creation and targeted conditional mutations protect identity ownership, first-verification evidence and monotonic revocation/deletion. Mail-producing operations require transactional delivery when joining a caller transaction. Hosts must implement the new persistence ports and select their identity-linking policy.

One-shot prepared registration, authentication, reset and password-change operations move expensive password work before write locks, then recheck current authority in the caller transaction. Password change requires a purpose-bound, expiring step-up grant with transaction-local authorization. Renewal-aware session inventory includes live refresh authority after access expiry; revocation covers retained descendants, and bounded cleanup reclaims expired recovery ciphertext without discarding replay evidence or recreating purged credentials.

Optional adapters add a strict local-key Node JWT codec, independently encrypted OAuth/PKCE attempts with a production Prisma artifact, and GitHub user-login profiles. Crypto's encryption-only entrypoint needs no unused signing keys. Nest Auth's opt-in strict extraction checks original raw header evidence and rejects duplicate or conflicting credentials. Host identity-linking, Account/MFA policy, browser transport, mail templates and deployment qualification remain application responsibilities.

Accounts' createAccountDirectory supports creation/list/resolution without unused invitation or purge dependencies. Nest Accounts accepts trusted principal and context hooks. Accounts React's useAccountScope supplies discriminated access states and stable scope identities with abort/stale-result guards: unchanged refreshes preserve page state, while logout, session/account/role changes or invalidation retire stale work. Routing and server authorization remain host-owned; cancellation does not undo an accepted server mutation.

Notifications' memory/Prisma inbox adapters now reject invalid, cross-recipient and hidden archived cursor anchors explicitly. countUnread aggregates the exact recipient type/ID without loading the inbox. Hosts retain recipient authorization and cursor-recovery UI policy.

Lossless authoritative DNS observations

The bounded public UDP/TCP transport includes MX/SRV/CAA, preserving null/root targets, independent SRV fields and complete binary CAA values. Literal leftmost wildcard questions are preserved without expansion; authority-host validation remains strict. Address admission/pinning, response correlation, deadlines, cancellation and parser limits remain enforced.

Projection change from earlier local snapshots: TXT.chunks returns ordered raw readonly Uint8Array[], not ASCII strings. Empty/binary chunks and split UTF-8 sequences remain lossless. Matching public declarations, ESM/CommonJS runtimes, parser worker and exact optional @dnspect/dns-ts@0.4.0 peer ship together. DNS responses are not ownership or DNSSEC proofs, and local package checks are not live network or registry qualification.

Explicit schema selection and site composition

CLI accepts queue-only Notifications composition and explicit artifacts: []. The inbox is optional; copy selection does not erase existing tables or waive runtime schema needs. Current configuration examples and optional-artifact cleanup guidance are corrected and tested.

--local-packages=archives plans and installs reviewed repository archive closures, checking artifact identities, integrity and dependencies without global Yalc state. Archive/Yalc source conflicts remain explicit rather than silently replacing pins. PostgreSQL compound-relation checks qualify ordered unique references, field types, nullability and safe referential actions, including singular inverse relationships. Structural compatibility does not establish native adapter-write or lifecycle qualification; application-owned relationships remain application-owned.

The site composes native private-preview confirmation/welcome delivery and optional read-only admin browsing. Public content adds seeded FAQ/licensing pages, LLM discovery, page-specific OpenGraphs templates, expanded sharing tags, structured data, source-derived freshness and editorial feeds. Configuration, mail/provider readiness and post-deploy crawl qualification remain separate activation steps.

Upgrade checklist

For applications moving from beta 2 or an earlier beta 3 local snapshot:

1. Verify your package source. Confirm the approved beta 3 registry artifacts and tarball integrities, then qualify a fresh authenticated install with normal package-manager security checks. Local Yalc signatures or matching version labels are not registry availability evidence. Never overwrite an already published immutable registry version; stop and reconcile any conflicting bytes.
2. Refresh the whole selected dependency graph. Keep every installed @playstack/* package, including the CLI, on 0.1.0-beta.3. Regenerate and commit the lockfile through the application's package manager; replace stale local snapshots deliberately. Do not mix old runtime bytes with new declarations.
3. Select schemas before migrating. Read the artifact selection rules, run compatibility preflight, review selected schema changes, then apply the application's migrations before starting workers. Notifications' inbox, queue and admission artifacts are independently optional. artifacts: [] suppresses copying, not existing-schema validation or runtime requirements; it does not delete old files, tables, jobs or retained replay receipts.
4. Update DNS TXT projections. TXT.chunks is ordered readonly Uint8Array[], not strings. Preserve chunk boundaries and exact bytes; do not decode each chunk as UTF-8 or coerce binary content to text. See the lossless snapshot example. Ship the exact optional @dnspect/dns-ts@0.4.0 peer and native worker assets together. Wildcard questions are literal; authority-host checks remain strict.
5. Refresh native Sentry filtering. Install sanitizeSentryEvent as the final error-event beforeSend step. Verify relative URL/URI-suffix fields through the application's actual hook; keep host-specific privacy and other telemetry controls. Source changes do not refresh already installed consumer artifacts.
6. Adopt changed persistence and transaction contracts. Map bounded consent state/evidence and per-submission Delivery bindings to the selected schema; review migrations before activation. Implement required Auth persistence and transactional JWT backing ports. Use durable Billing preparation/recovery, not repeated fresh provider creation, for immutable retries. These changes do not migrate application data or qualify custom adapters automatically.
7. Qualify application activation separately. Recheck worker scheduling, transaction/dispatch fences, current authority, replay/erasure policy and live provider/network behavior for the features being enabled. Keep unqualified operations disabled; local package tests do not establish deployment readiness.

Qualification remains separate

These contracts still require selected migrations, current-authority checks, transaction/dispatch fences and application integration tests. Local erasure does not certify linked stores, retained replay fences, providers or backups. Yalc inspection cannot establish deployed registry availability or resolve the reported cold-cache install 503s. Adopt the reviewed registry artifacts only after publication and actual-builder verification, not by relabeling installed snapshots.