A coordinated beta 4 package train · Changelog

All 104 @playstack/* packages are prepared as 0.1.0-beta.4, including the CLI and their exact internal dependency and peer requirements. Artifact, integration and skills manifests advance with the package train.

This version retains the implementations described in the beta 3 local snapshot, including bounded consent evidence, worker-time audience credentials, immutable checkout recovery and email/promotion settings, transactional identity, bearer-mail retries, operator controls, privacy filtering and lossless authoritative DNS. Those fixes remain part of this train. The additions below include persistence contract and schema changes that adopting applications must review together.

Identity and account workflows

Auth and Accounts support encrypted, transaction-bound security-message intents. Hosts can commit proof state and its durable handoff together, then claim, render and submit the message through a worker. Caller transactions also compose Accounts mutations and reads, Auth credential work and MFA operations with application writes.

API Keys adds caller-transaction issuance, verification, rotation, revocation and family revocation, plus read-your-writes listing. Key state, application attribution and required audit/outbox evidence can commit together without a transaction bridge. Hosts retain permission policy and expose issued secrets only after the outer commit.

Auth adds an optional dual-inbox email-change flow with separate single-use approvals and an atomic final address change. Applications retain identity-linking, dispute, freeze and suspension policy. The existing new-inbox confirmation and old-inbox reversal flow remains available.

Auth React represents pending login and MFA challenge progression separately from authenticated session authority, with cancellation and stale-completion fences. Hosts still provide challenge issuance, transport endpoints, routes and presentation.

Retention, inboxes, uploads and scheduled work

Audit supports calendar-month, exact-duration and until-deletion retention policies while preserving checkpoint verification. Closed-scope erasure and lifecycle authorization remain explicit.
Notifications provides recipient and account-scoped lists and counts, bounded bulk-read operations and atomic read-and-archive transitions with transactional evidence.
Storage offers strict S3 upload descriptors that bind checksum, length and encryption requirements, plus checksum-enabled HEAD results. Unsupported providers refuse these guarantees. Local MinIO qualification does not replace live AWS/KMS qualification.
Queues carries immutable scheduled occurrence identity and time into handler and failure contexts, retaining the original occurrence through retries. Provider cadence and schedule-replacement limitations remain explicit; dated application payloads remain supported.
Trusted-proxy CIDR parsing rejects malformed numeric prefixes instead of accepting them through coercion.

AI accounting and subscription commands

AI distinguishes user and system actors and persists reported successful and failed outcomes with known, partial or unknown usage. Missing measurements remain unknown rather than becoming zero; cost estimates retain their configured prices. Receipt, usage evidence and outbox writes share one transaction. Crashes without a reported outcome still require host reconciliation; this is not a durable in-flight execution engine.

Billing adds caller-transaction trial creation, reads, extension and cancellation. Trial creation remains create-once; extension uses an expected-current deadline, and cancellation or paid conversion remain terminal against extension and replay.

Optional durable subscription commands support period-end cancellation and withdrawal, plus immediate same-interval plan changes for the documented Stripe profile. Prepared requests retain exact financial intent and replay bounds; accepted-generation checks reject preparations made before an intervening accepted command. Unknown provider outcomes retain their recovery barrier. Command acknowledgement does not grant access: verified webhooks or reconciliation still own subscription projection.

Cross-interval or currency changes, quantity changes, multi-item subscriptions, deferred proration, pending-payment/SCA and paused-subscription resumption remain outside that profile. Retain qualified provider or Portal workflows for them.

Current-state writes and asynchronous ownership

Commerce attaches checkout references through a narrow persistence operation that preserves newer payment and fulfillment state. Lifecycle decisions lock and read the current order before changing it. Payments reserves refunds against the captured amount read under the payment lock, and Catalog validates product status inside the write transaction so archived products remain terminal. Feedback uses atomic duplicate admission, with only the winning report owning its transactional event.

Browser providers for Audiences, Notifications and Extension retire asynchronous work when their client or active scope changes. Notifications rolls back only the optimistic field it owns. Cache treats an expired KV read as a logical miss, avoiding deletion of a newer write; its write-behind admission snapshots batch membership before payload serialization. Local Storage listing uses one ordering rule for sorting and continuation.

Adoption

Refresh the complete selected dependency graph to beta 4, regenerate the adopting application's lockfile and verify the exact reviewed artifacts. Older local beta 4 snapshots may contain different bytes; a matching version label alone does not establish that a package contains these changes. Do not combine older beta 4 artifacts with this train or retain exact beta 3 dependencies within it.

The schema, worker, proof-binding, provider and retention checks in beta 3's upgrade checklist still apply. Update public persistence ports, custom adapters, published scaffolds and adopted schema fragments together. AI actor/outcome accounting and durable security-message state require application persistence mapping and reviewed migrations. Native subscription commands additionally need the optional BillingSubscriptionCommand and permanent BillingSubscriptionCommandScope schema, including its accepted-generation counter and matching reservation contract across every writer. These source changes do not apply an application migration or backfill.

Retain the qualified Prisma dispatch fence for affected adapters: exact matching Prisma Client and adapter-pg 7.10.1 now join its supported versions. The guarded unfenced rollback defect is not declared repaired. Qualify application-owned authority, worker handoff, browser/MFA transport, retention and recovery before removing existing safeguards. Native Checkout and subscription commands now require dedicated Stripe SDK clients with guarded, original-key/deadline-bound POST admission. Billing preserves the configured SDK instance and its unrelated operations; explicit native escape-hatch calls remain unmanaged. The Stripe usage reporter requires its matching dedicated client, captures request inputs before awaits and keeps unknown outcomes quarantined. Loopback qualification covers hidden SDK retries and response-body failures for both paths; meter-event receipts still do not establish asynchronous invoice inclusion. Live-provider qualification remains required: local tests and supported source contracts do not establish live Stripe, AWS/KMS or application adoption.

Custom persistence adapters

Update custom adapters against the declarations and scaffolds shipped with this train. In particular:

Commerce requires transaction-current findOrderForUpdate and narrow attachCheckout; full saves preserve the stored checkout reference.
Payments reserveRefund derives capacity from the locked payment instead of accepting a ceiling from an earlier service read.
Inventory replay results return their retained receipt without a new balance snapshot; new mutations retain their balance result.
Notifications uses scoped atomic transitions, unread counts and bounded read batches in place of unrestricted whole-record inbox updates.
Licensing Issuer no longer requires the unused activation-by-ID lookup.
API Keys requires assertTransaction and transaction-aware list, preserving native locking and physical transaction participation across all key operations.

Structural typechecking is a prerequisite. Qualify real transaction participation, rollback, concurrency and outbox behavior before replacing application safeguards.

Qualification boundaries

Local qualification includes real PostgreSQL with exact Prisma versions, native and packed ESM/CommonJS consumers, strict declarations and frozen reinstall checks. The Node PrismaPg fence adds exact matching Client/adapter-pg 7.10.1; the separate transaction-abort classifier retains its documented 7.9.1-only profile.

Stripe Checkout, subscription-command and usage fixtures exercise the actual SDK against loopback HTTP, including hidden retries and response-body failures. Checkout's HTTP guard preserves trusted, original-key whole-operation rejection proofs through SDK wrapping while withholding raw diagnostics and preventing implicit resubmission. Ordinary provider failures still require recovery. Auth React pending-login progression has local Chromium cookie/bearer coverage. These checks do not establish live provider behavior, cross-site cookie support or an adopting application's authority, persistence and deployment configuration.

Publication status

Beta 4 is upcoming. Source preparation, builds, site deployment and local package stores are not evidence of a completed private-registry publication. Publish through the protected release workflow, verify durable completion and artifact integrity, and qualify a fresh authenticated installation before adoption. Never replace an already published immutable registry version with different bytes.