Suprnova v1.3.1

Fixed

• Provider-backed applications can reset verified users again. When no Magnetar engine is installed, PasswordReset uses an explicitly reset-capable UserProvider and framework auth_flow_tokens for already verified accounts. EloquentUserProvider<M> opts in when M implements MustVerifyEmail + CanResetPassword; no app_users migration is required.
• The published framework line now contains both post-release repair sets. The translated 1.3.0 changelog layout and headings, CJK wrapping, localized anchors, glossary terms, and prose punctuation are reconciled instead of split across divergent local and remote branches.
• Post-tag CLI and Magnetar hardening is included. Development-process cleanup uses the completed process-group fallback, and the local qualification contracts cover the released refs and plugin-SDK SQLite lanes.

Security

• The provider fallback never treats password reset as first mailbox proof. Unknown and unverified addresses receive the same no-mail response. Install Magnetar when an unverified account must prove mailbox ownership through reset so credential cleanup, auth-epoch advancement, and revocation remain atomic. Provider fallback completion reports framework session and remember revocation failures through PasswordResetOutcome.

Upgrading

• Move every v1.3.0 Git dependency to v1.3.1. Applications with their own users table keep their configured UserProvider; they do not initialize the default app_users engine merely to reset an already verified account. Applications that use Magnetar credentials or unverified-account first proof continue to initialize Magnetar.

Suprnova v1.2.4

Security

• The maintenance-mode bypass secret is compared in constant time.
  MaintenanceMiddleware matched the secret URL with a plain string
  compare, which returns at the first differing byte. Because the secret is
  a bearer credential carried in the request path, that timing difference
  told an attacker how long a prefix they had guessed correctly. The
  compare now runs over the full byte length via subtle::ConstantTimeEq,
  short-circuiting only on a length mismatch - the same shape as the
  bypass-cookie compare next to it.

• rules::Url now rejects script URIs. The rule accepted any scheme
  url::Url could parse, javascript: and vbscript: included, so a
  validated URL could still be a script-execution sink when rendered into
  an href. It now applies Laravel's url rule shape
  (Illuminate\Support\Str::isUrl's ^(PROTOCOLS)://HOST pattern): the
  scheme must be on Laravel's allowlist, be followed by ://, and be
  followed by a non-empty host - Laravel's host group has no ?, so an
  absent or empty host never matches even with a listed scheme. The scheme
  list and the ://-plus-host requirement are Laravel's verbatim; the host
  itself is parsed by the url crate rather than Laravel's regex, so a few
  edge cases still differ - an out-of-range port is rejected here and
  accepted there, and IDN hosts normalise differently. New
  Url::protocols(&[...]) mirrors Laravel's url:http,https; HttpUrl
  is now literal sugar for it and keeps its own message. Behaviour
  change: a URL with an unlisted scheme that used to validate now
  fails - name the scheme with Url::protocols(&["myapp"]) if you meant
  to accept it. Two more behaviour changes: mailto:, data:, and
  tel: are on Laravel's allowlist by name but don't carry an authority
  component, so they now fail; and file:///etc/passwd-style paths -
  scheme:// with nothing between the last two slashes - now fail too,
  since an empty string isn't a host either. Both follow from Laravel's
  own ://-plus-host rule.

• Inertia responses now advertise Vary: X-Inertia everywhere. The
  header was set only on the page-object responses themselves. Redirects,
  404s, 422s, and static responses carried none, so a shared cache keyed on
  the URL alone could serve the JSON page object to a hard browser
  navigation, or the HTML shell to an Inertia XHR. The new
  InertiaHeadersMiddleware - registered by Inertia::install as the
  outermost of the three - sets it on every response, and turns an empty
  200 on an Inertia visit into a 303 back rather than a response the
  client rejects as non-Inertia. InertiaVersionMiddleware now re-flashes
  the session before its 409, so a flashed error survives the client's
  follow-up full-page GET.

• Three Inertia response fixes. InertiaResponse::location_for(&req, url)
  returns 409 + X-Inertia-Location for an Inertia XHR and a plain 302

  • Location for a hard navigation, so an OAuth or SSO bounce entered
    outside the SPA no longer dead-ends on a body-less 409. The existing
    location(url) keeps its always-409 shape. New App::clear_history()
    flashes the history-clear flag into the session so it survives the logout
    redirect and lands on the page that actually renders - the per-response
    .clear_history() marked only the redirect the browser throws away,
    leaving the previous session's encrypted history decryptable. And a
    once prop is now skipped only on a full Inertia visit: an explicit
    router.reload({ only: ['stats'] }) re-resolves it instead of returning
    nothing.

• The SES transport now sends custom message headers. Mail::to(..) .header("List-Unsubscribe", ...) and Mailable::headers() were dropped
  silently under MAIL_DRIVER=ses: the Content.Simple request body had no
  Headers field and the raw-MIME builder never read OutgoingMessage:: headers, even though every other transport forwards them. Both SES paths
  now carry them - Headers as SES v2's {Name, Value} list, raw MIME as
  real header lines - so unsubscribe links, threading headers and routing
  hints survive a driver swap. Header names are validated up front on both
  paths - CR, LF and NUL (the injection bytes, as the Mailgun transport
  already refuses) and anything that is not a valid RFC 5322 field name
  (spaces, colons, non-ASCII) - so attaching a file never changes whether a
  message is accepted.

Fixed

• Nested validation failures now reach the 422 body. #[validate(nested)]
  failures on a nested struct or on an element of a validated Vec<T> were
  dropped between the validator and the response: the request was correctly
  rejected with 422, but the errors map came back empty, so no message
  rendered and the client could not tell which field was at fault. Nested
  failures are now flattened into Laravel's dotted notation -
  address.street, items.1.name, order.items.2.sku - alongside the
  top-level ones.

• The Inertia page object's url keeps the query string. page.url was
  the request path only, so the client recorded /users for a visit to
  /users?page=2&sort=name. Every back/forward navigation and every
  router.reload() then replayed the page without its pagination cursor,
  sort, or filters. It is now path plus query - the same derivation
  InertiaVersionMiddleware already used for X-Inertia-Location, so by
  default the two agree byte for byte. New
  InertiaConfig::url_resolver(...) overrides how the page object names
  the page (Laravel's Inertia::resolveUrlUsing); the version bounce keeps
  naming the URL that arrived, because that is the URL the browser has to
  fetch.

• Inertia::install now applies its config to every response. The
  config handed to Inertia::install was read for three fields and then
  dropped, so every InertiaResponse built without an explicit
  .with_config(...) rendered from InertiaConfig::default(). An app
  scaffolded with --frontend react served the Svelte entry point and no
  React refresh preamble unless SUPRNOVA_FRONTEND was set in the
  environment; SSR enabled on the config never reached a response; and the
  page object's asset version came from a different config than the
  version middleware's resolver. The installed config is now retained on
  the container's Inertia registry and is what InertiaResponse::new
  starts from. Per-response .with_config(...) still overrides, apps that
  never call Inertia::install are unchanged, and a failed (fail-closed)
  install retains nothing. As a side effect the production Vite manifest
  is now parsed once per process rather than once per response.

• Scaffolded apps now install the Inertia protocol middlewares. The
  bootstrap.rs written by suprnova new registered the session, locale,
  CSRF and include middlewares but never called Inertia::install, so a
  generated app had neither InertiaVersionMiddleware nor
  Inertia303Middleware: a browser still running the previous bundle was
  never told to reload after a deploy, and a PUT/PATCH/DELETE that
  redirected stayed on a 302 the client could follow with the original
  verb. The call now lands after SessionMiddleware - where the version
  middleware's session re-flash works - with a named INERTIA_VERSION
  constant to bump when assets change, and it pins the frontend the
  project was generated with (.frontend(Frontend::React) for
  --frontend react), so the HTML shell loads that framework's Vite entry
  point instead of falling back to Svelte's. The generated .env now sets
  SUPRNOVA_FRONTEND to match. The --api starter is unchanged; it has
  no frontend.

• Queue::push_unique no longer reports a queued job as skipped. The
  return value was computed with matches!(outcome, Idempotent::Fresh(())),
  which folded Idempotent::FreshUnfenced into false - the outcome where
  the envelope was pushed but the dedupe lease was lost mid-push. Callers
  branching on that boolean were told a job that was about to run had been
  suppressed as a duplicate. All three outcomes are now matched exhaustively:
  a lost lease returns true with a warn naming the job and its unique
  key, and only a real duplicate returns false. push_unique_later and
  later_unique share the path and are fixed with it.

Changed

• Parity baseline moved to Laravel 13.25.0. The 13.23.0, 13.24.0 and
  13.25.0 release notes were traced item by item to the framework's own
  surface. Everything that reached a Suprnova code path is either fixed in
  this release or has a row in manual/parity.md marked
  not yet or by design no.

Upgrading

Two changes can alter a running app without any code change on your side.

• Settings on the config you pass to Inertia::install now take effect.
  They were read for three fields and dropped. If your install config sets
  .ssr(...), SSR is now on: start the worker (suprnova ssr:start) before
  deploying, or drop the .ssr(...) call. .entry_point,
  .assets_base_url, .default_title and .encrypt_history(...) set there
  also reach the page now.

• rules::Url rejects more. Values that used to pass and no longer do:
  any scheme outside Laravel's allowlist, javascript: and vbscript:
  among them; mailto:, data: and tel:, which are on the allowlist but
  carry no :// host; and scheme:// with an empty host, such as
  file:///path. If you meant to accept a scheme, name it:
  Url::protocols(&["myapp"]).

Suprnova v1.2.3

Fixed

• Datetime casts now read database-native CURRENT_TIMESTAMP text.
  AsDateTime, AsImmutableDateTime, and AsOptionalDateTime continue to
  write canonical RFC-3339, while reads also accept PostgreSQL's
  timezone-bearing text and timezone-free SQLite/MySQL text. Timezone-free
  values are interpreted as UTC, matching the framework's UTC timestamp
  contract.

Suprnova v1.2.2

Fixed

• Correctly writes nullable non-text values through PostgreSQL attribute-based update, upsert, model-less table, and pivot APIs.
• Rejects malformed multi-row upserts with inconsistent column sets.
• Binds automatic pivot timestamps as typed UTC datetimes.

Security

• Strengthens release-gate proof for dormant lockfile dependencies and records the time-bounded RustSec exception described in the changelog.

v1.2.1

GitHub account migration: every repository URL (manual in all seven languages, README, Cargo repository fields, git dependency sources, scaffold templates) now points at github.com/eas4ai instead of the renamed github.com/entrepeneur4lyf. Scaffolded projects also carry a monitored author email. No behavior changes.

Suprnova v1.2.0

Added

• The manual ships in seven languages. manual/es/, manual/fr/,
  manual/de/, manual/pt-BR/, manual/ja/ and manual/zh-Hans/ each
  carry the full 104-chapter manual - every chapter, the table of
  contents, and this changelog - translated from the English source.
  English remains canonical: chapter structure, code blocks, identifiers,
  CLI commands and environment variables are held byte-identical to the
  source, so a translated chapter can never disagree with the English
  about what the framework does, only say it in the reader's language.

  The translations were produced and reviewed for suprnova.app, which
  renders this manual as its /docs. Every section carries a review
  ledger there: verdicts are recorded against content hashes of both the
  English and the translation, two independent reviewers must pass the
  exact bytes for a section to count as approved, and per-locale
  glossaries pin the terminology rulings (which terms stay English,
  which take the native word, and why). Corrections are welcome in
  either repo - a fix here reaches the site on its next sync.

Suprnova v1.1.0

Added

• Per-locale fallback chains. LocalizationConfig gains parents
  (APP_LOCALE_PARENTS, comma-separated child=parent pairs, or the
  chainable .parent(child, parent) builder): a locale can inherit from a
  configured sibling before falling further back to the global
  fallback_locale — pt-PT from pt-BR, en-AU from en-GB, and so
  on, transitively. Lang::get/try_get/get_with/try_get_with/has
  all walk the chain, current locale first, so this works for any
  Translator driver, not just the bundled one. A malformed pair, an
  invalid locale, a child named twice, or a cycle (including a locale
  naming itself as its own parent) fails loudly at config load rather
  than degrading at request time.

  Served catalogs stay chain-flattened ahead of time: FluentTranslator
  now builds each locale's /_suprnova/lang/<locale>.ftl catalog as a
  fold — the embedded framework catalog at the bottom for en/en-*
  locales, then the locale's configured parent chain, then its own
  *.ftl files — so a chained locale is still one self-contained file
  the browser fetches once, with no client-side chain awareness needed.
  Flattening covers configured parents only; the terminal
  fallback_locale is still a Lang-facade-level fallback, not baked
  into the served bytes.

  This makes delta-style catalogs practical: a lang/pt-PT/ directory
  can hold only the handful of strings that actually differ from
  lang/pt-BR/, rather than a full duplicate catalog. The merge that
  makes it possible works at the Fluent AST level — a child's value
  replaces the parent's, attributes merge by name (an override that
  doesn't mention an attribute no longer loses it), select expressions
  replace whole (CLDR plural categories are locale-dependent, so
  variant-by-variant merging isn't coherent), and child-only entries
  append. See manual/localization.md's new "Fallback chains" section
  for the full contract.

Changed

• LocalizationConfig gained the parents field. from_env() and
  the builder are unaffected; a literal struct constructor (tests
  building a LocalizationConfig by hand) needs one more field.
• Served catalog text is now serializer-normalized for every locale,
  and intra-locale multi-file merging (several .ftl files in one
  locale directory) now goes through the same AST-level merge as parent
  chains rather than simple bundle-overriding. Resolved translations are
  unchanged except for the two strict improvements below; the
  underlying bytes rotate regardless — ETag/?v=<hash> rotates once
  on upgrade. The improvements: an override no longer silently drops
  the attributes it doesn't mention, and an attributes-only override no
  longer strips the message's own value (previously an error or a
  fallback resolution; it now resolves to the earlier override's
  value).

Suprnova v1.0.0

Added

• Localization. Message catalogs in lang/<locale>/*.ftl
  (Fluent), a Lang facade with the
  __!("key", name: value) macro, per-request locale detection
  (LocaleMiddleware: session → cookie → Accept-Language →
  APP_LOCALE), and locale-aware formatting for numbers, currency,
  dates, times, lists, and relative times over ICU4X. manual/localization.md
  is the chapter.

  The built-in validation rules stop hardcoding English. Each returns a
  keyed message (validation-min plus its arguments and an English
  fallback), translated once at the serialization boundary — so a Spanish
  app gets Spanish validation errors by dropping in
  lang/es/validation.ftl, with no rule wrapping and no forked copy of
  the framework's messages. Field names humanize through a field-<name>
  lookup. Rule::passes (and ContextualRule / AsyncRule) now return
  Result<(), ValidationMessage>; a custom rule's Err("…".into()) body
  still compiles and still renders verbatim, but the signature in your
  impl needs the new type.

  The browser gets the same bytes the server resolved: the merged catalog
  is served at /_suprnova/lang/<locale>.ftl with an ETag and an
  immutable ?v=<hash> form, the three starter kits parse it with
  @fluent/bundle, and suprnova generate-types emits a MessageKey
  union so renaming a message points the TypeScript compiler at every
  call site.

  Fluent rather than Laravel-style PHP arrays because one format has to
  serve both the server and the browser, and because CLDR plural
  categories are what gets Russian, Polish, and Arabic right —
  trans_choice's integer ranges cannot, which is why there is no
  trans_choice here. Behind a default-on localization feature;
  --no-default-features still compiles and still validates, using the
  embedded English fallbacks.

• IntoInertiaScroll for Paginator. The trait was implemented for
  LengthAwarePaginator and CursorPaginator but not for the simple
  paginator, so simple_paginate results could not feed
  Inertia::paginate at all — despite simple.rs's own module docs
  pointing at it as the URL-generation path. That left offset-paginated
  Inertia collections with a choice between a COUNT(*) per request and
  hand-rolling the scroll metadata. next_page comes from the
  LIMIT n+1 overflow probe rather than a computed last page, there
  being no total to compute one from.

Fixed

• suprnova generate-types emitted a different file on every run.
  The topological sort seeded its work queue by iterating a HashMap,
  and Rust randomises hash iteration order per process, so consecutive
  runs ordered the same interfaces differently. The output is a
  checked-in artifact, so every run produced a diff — and a generated
  file that churns for no reason is one people stop regenerating, after
  which it quietly stops describing the Rust it claims to. The directory
  walk is sorted too, so the output no longer depends on filesystem
  order either. Two runs of the same source are now byte-identical.

• topological_sort did the opposite of its doc comment, emitting
  dependents before dependencies. Harmless — a TypeScript interface may
  reference one declared later in the same file — so the comment is
  corrected rather than the order, which would have reshuffled a tracked
  file for no benefit.

Suprnova v0.9.1

Three defects, all found by running the dogfood app under a containerised
harness rather than by reading the code. Every one of them is invisible to
a test suite that never stops a process the way production stops it.

They compound in a specific order: a rolling deploy SIGKILLs a worker
mid-job (the first), and that job then takes a reclaim path that never
counted the attempt (the second).

Fixed

• schedule:work, queue:work and workflow:work ignored SIGTERM.
  Each selected on tokio::signal::ctrl_c() alone, which installs a
  SIGINT handler — so SIGTERM had no handler anywhere in the process, and
  SIGTERM is what docker stop, Coolify, systemd and Kubernetes send. All
  three already had a careful bounded drain behind that select!; none of
  it had ever executed under a supervisor. Measured before the fix: a
  docker stop on a queue:work container burned its whole 40s grace
  window and exited 137 with the in-flight job destroyed. As PID 1 — which
  is what a container runs — the kernel discards an unhandled SIGTERM
  outright, so the process did not die badly; it did not die at all until
  SIGKILL. Server::run already handled both signals correctly and its
  listener is now shared, which also closes a missed-signal window in the
  scheduler's loop.

• A job that killed its worker could never be dead-lettered. A job
  whose handler fails is nacked and its attempt counted, so it
  dead-letters after max_tries. A job that kills its worker — OOM,
  abort, segfault, or the SIGKILL above — settles nothing; its reservation
  merely lapses, and every driver used to redeliver it byte-identical.
  Such a job is immortal: it kills each worker that claims it, comes back
  unchanged, and kills the next one, for as long as anything restarts
  workers. All three drivers now charge the attempt where they learn a
  worker died, because swapping QUEUE_DRIVER must not change whether a
  poison job can be stopped. attempts now means "deliveries to a worker"
  rather than "handler failures" — documented in manual/queues.md,
  because a worker lost for unrelated reasons burns an attempt too.

• …and the exhausted job is now dead-lettered before it is dispatched.
  Counting the attempt was necessary and not sufficient. Every
  dead-letter decision lived in the worker's settlement path, which
  assumes the handler returns — so it never ran for exactly the jobs that
  could not return. With the driver fix alone the counter climbed
  (measured: 0 → 1 → 2 across three killed workers) and nothing acted on
  it. The budget is now spent before the handler runs. Caught only by
  re-running the container experiment after the first fix looked correct.

• The daemons had no tracing subscriber. serve gets one from
  init_telemetry; queue:work, schedule:work, schedule:run and
  workflow:work come through a different boot path and got nothing, so
  every tracing:: line they emit went nowhere and LOG_LEVEL was inert
  for them. That is most of what they have to say — a worker
  dead-lettering a job, a scheduler skipping a tick it lost, a lock it
  could not release. In a container the only visible output was the
  startup banner, and the process looked idle while doing all of it. Two
  of the defects in this release were invisible until this was fixed.

• A dead-letter with no failed-jobs store bound was a silent deletion.
  The persist step sat inside if let Some(store) = .., so with no store
  the arm did not match and execution fell through to the ack — quieter
  than the failure path directly above it, which at least leaves the
  reservation intact. An absent store was treated as more successful than
  a broken one. It now logs the full envelope at ERROR, because that is
  what queue:retry re-pushes: the difference between work recoverable by
  hand and work that ceased to exist.

• QUEUE_DRIVER=database now binds a failed-jobs store. failed_jobs
  is part of that driver's contract — queue:retry reads it and
  Queue::retry_failed cannot work without it — but bootstrap_from_env
  wired the driver and left the store unset, so a database-backed queue
  dead-lettered into nothing unless the app bound one by hand. Configurable
  via QUEUE_FAILED_DB_TABLE. Only for this driver: memory is ephemeral
  by construction and redis has no table to write to.

• Redis reclaim latency now follows --visibility-timeout. The flag
  sets XAUTOCLAIM's idle threshold, but a separate clock governs how often
  a consumer looks, and the driver left it at sea-streamer's 30s default —
  so --visibility-timeout 5 really meant "up to 35 seconds". The
  interval now tracks the configured timeout, clamped to 1s..=30s so a
  short timeout cannot become an XAUTOCLAIM storm and a long one can only
  make reclaim faster than before.

Added

• TaskBuilder::on_one_server() / on_one_server_for(ttl) — run a
  scheduled task exactly once per due tick across replicas. Without it
  nothing elects a leader for a tick: each schedule:work process
  evaluates the schedule independently, and three replicas were measured
  running every due task three times, every minute, with no variance. A
  nightly billing job on three replicas billed every customer three times.

  without_overlapping() does not cover this and cannot: its lock is
  keyed on the task and released when the handler returns, so a fast task
  frees it before a second replica looks. on_one_server keys on the task
  and the tick and holds the lock past the handler, letting it expire on
  TTL. The two compose.

  Opt-in, matching Laravel. Diverges from Laravel in failing closed: the
  election is only as shared as the cache behind it, so a production boot
  with CACHE_DRIVER=memory and a single-server task is refused, naming
  the offending tasks, with SCHEDULE_ALLOW_MEMORY_LOCK_IN_PRODUCTION=true
  for deployments that genuinely run one scheduler.

Changed

• manual/deployment.md no longer says "run exactly one schedule:work
  process" as the only option, and gains a Stopping cleanly section
  covering the drain windows per subsystem, how to size a platform's
  termination grace above them, and why PID 1 makes a missing signal
  handler worse than it sounds.

Suprnova v0.9.0

Security

• Auth issuance could only be throttled per caller, never per
  recipient. An address-keyed limit answers "is one client noisy"; it
  cannot answer "is one mailbox being flooded". An attacker spread across
  a botnet or a single IPv6 /64 stayed under every per-IP budget while
  filling one victim's inbox with password-reset mail, and nothing in the
  framework could express the limit that would have stopped it — a key
  function could read the path, headers, and query string, but not a
  form-encoded body, so the address was invisible on exactly the route
  that carries it.

  identity_key keys a bucket on the account being acted on. It reads the
  query string first and then a buffered form body, so one key function
  covers both shapes; the value is trimmed and lowercased, because
  Alice@Example.com reaches the same mailbox as alice@example.com and
  a limit bypassed by holding down shift is not a limit; and it is hashed,
  because a rate-limit backend is frequently a shared Redis with weaker
  access control than the primary database.

  Two new middleware builders support it. key_reads_body(cap) buffers
  the body before keying — opt-in, because buffering is work an
  unauthenticated caller gets to make you do, and a body over the cap is
  refused with 413 rather than passed through unkeyed. only_when(pred)
  skips a limiter entirely for requests it has nothing to say about,
  which is what keeps a stacked per-recipient budget from silently
  becoming the binding limit on routes that name no recipient.

  The dogfood app now stacks both on its issuance group: 10 per 5 minutes
  per address, 3 per 15 minutes per recipient.

A review of Torii's session, password, OAuth, and passkey paths turned up
eight defects, all fixed in the pinned fork (suprnova-torii-rs 968b0be).

• Expired sessions could be refreshed back to life. The SeaORM session
  repository's refresh had no expiry predicate and unconditionally extended
  expires_at, and OpaqueSessionProvider::refresh_session skipped the
  is_expired() check that get_session performs. A token held past its
  expiry could be renewed indefinitely. Fixed at both layers. Not reachable
  through Suprnova's own surface — neither Torii nor the framework exposes
  session refresh — but it is public API of both crates.
• The login form leaked which accounts exist, by timing. Authentication
  returned as soon as the email missed, skipping Argon2 entirely: measured at
  54µs for an unknown address against 719ms for a wrong password, a ~13,000x
  gap readable over a network. Both failure paths now verify against a dummy
  hash so they cost the same. This one was reachable through Suprnova's
  password login.
• The JWT iss claim was written but never verified. Algorithm pinning
  was already correct — alg: none and HS/RS confusion were never possible —
  but the issuer was decoration, so two services sharing a signing key would
  accept each other's sessions. Now enforced when an issuer is configured.
• A single-use PKCE verifier could be claimed twice. Consumption was a
  read followed by a delete, so two OAuth callbacks for the same csrf_state
  could both read it before either delete landed. Now claimed in one
  operation — DELETE ... RETURNING on Postgres, a primary-key delete whose
  affected-row count picks the winner on SeaORM.
• Expired sessions were listed as active. find_by_user_id had no expiry
  filter, and expired rows survive until cleanup runs, so a "devices you're
  signed in on" screen offered users dead sessions to revoke while saying
  nothing about the live one.
• A passkey lookup was named authenticate. Torii's
  PasskeyService::authenticate_credential took a credential ID and returned
  the owning user, and PasskeyAuth::authenticate minted a session from it.
  Torii stores passkeys — it carries no WebAuthn dependency and cannot verify
  an assertion, so the only thing those calls proved was that the caller knew
  a credential ID: a value the browser sends in the clear and
  allowCredentials hands to anyone who can start a ceremony. Renamed to
  find_user_by_credential and create_session_for_verified_credential, both
  documenting that verification is the caller's job. Not reachable through
  Suprnova, which drives webauthn-rs itself (see
  torii_integration::passkey) and reaches Torii only for credential storage.
• A WebAuthn challenge was replayable for its whole TTL. Neither backend
  consumed a challenge on read, and the SeaORM get_challenge also ignored
  expires_at entirely, returning expired challenges as live. Reads now
  exclude expired rows on both backends, and a new take_challenge claims one
  exactly once — the same delete-decides-the-winner shape as the PKCE fix.

Breaking

• Azure Blob Storage and Google Cloud Storage moved behind the new
  filesystem-azure and filesystem-gcs features. Storage::register_azblob,
  register_azblob_with, register_gcs, register_gcs_with, AzBlobConfig
  and GcsConfig no longer exist unless you enable the matching feature. If
  you use either backend, add it to your dependency:

  suprnova = { git = "…", tag = "v…", features = ["filesystem-gcs"] }

  You get a compile error naming the missing item, not a runtime failure.

  Both opendal service crates pull rsa, which carries RUSTSEC-2023-0071
  (the Marvin timing attack) with no fixed release upstream. They were the
  only crates enabling reqsign-core/jwt, the feature reqsign-core's
  optional rsa sits behind, so gating them severs all three opendal paths
  to it at once. rsa is now avoidable: --no-default-features --features filesystem,database-postgres resolves without it and still has the
  storage subsystem. Previously no feature combination could shed it while
  keeping storage at all.

  A stock default build still carries rsa — database-mysql is a default
  feature and sqlx-mysql 0.8.6 depends on it non-optionally — so the audit
  exception stays open. S3 is deliberately not gated: reqsign-aws-v4
  takes reqsign-core without jwt, so the S3 driver never contributed a
  path, and gating it would break the most-used cloud backend while removing
  nothing.

Added

• suprnova --version, with -v as well as clap's default -V. Asking a
  CLI its version with the flag every other CLI uses should not print a usage
  error.

Fixed

• Two Redis operations had no upper bound. The cache's tag flush read a
  tag's whole member set with SMEMBERS and deleted key by key, so a tag with
  a large membership stalled the connection and a concurrent write could be
  lost between the read and the delete; tags are now generation-based, flushed
  atomically, and scanned with a bounded SSCAN. The delayed-queue promotion
  pass moved every due job in one unbounded ZRANGEBYSCORE, so a backlog that
  came due together produced a single enormous script; it now promotes in
  batches.
• Two shutdown drains waited forever. schedule:work on Ctrl-C and the
  workflow worker after cancellation both awaited every in-flight task with no
  deadline, so one task that never returned held the process open until
  SIGKILL — an operator sees a daemon that "doesn't stop". Both now wait a
  bounded grace, then abort what remains and report the count.
• The release version-pin sweep only recognised one of the two pin
  syntaxes, so every file carrying a cargo install --tag vX.Y.Z line and
  no dependency snippet was never discovered. suprnova-cli/README.md had
  been telling readers to install v0.6.0 for three releases; manual/cli.md
  and manual/cli-new.md sat at v0.7.2; manual/installation.md carried
  both forms and had one bumped while the other froze. Discovery and rewrite
  now read from one pattern table, and a file's rules are derived from its
  content.
• cargo doc failed for any build with filesystem but without
  testing — seven Storage::fake intra-doc links could not resolve, and
  lib.rs denies broken links. testing is a default feature, so no gate
  step had ever built that combination; check-feature-matrix.sh now does.
• Torii's migrations could not be replayed over their own schema, so a
  database holding it without the torii_migrations tracking table — restored
  from a dump that skipped it, or migrated by hand — could not be brought under
  management. Every Table::create() carried .if_not_exists(); none of the 19
  Index::create() calls did, nor did the ADD COLUMN locked_at alter, so
  replay sailed through the tables and died on the first CREATE INDEX. Fixed
  in the pinned fork (suprnova-torii-rs a0f956d) via has_index /
  has_column rather than IF NOT EXISTS, which sea-query silently drops for
  MySQL — the syntactic fix would have left a default-featured build broken.
• A failed Torii migration aborted the process instead of returning an
  error. SeaORMStorage::migrate unwrapped the migrator and returned
  Ok(()) unconditionally, so init_torii's mapping of the failure into a
  FrameworkError was unreachable code.
• An app's own users table silently suppressed Torii's, because
  .if_not_exists() cannot tell "already mine" from "already somebody
  else's". The migration reported success and authentication failed later on
  a missing column — the reason the --api starter names its table
  app_users. Torii's migration now warns at migrate time when an existing
  users table lacks columns it requires, naming the columns and the remedy.
  It stays a warning rather than a hard failure so existing deployments keep
  booting.
• The Railway and DigitalOcean deployment guides pointed the platform
  health check at a path that could probe Postgres. Both platforms restart
  the container when that check fails, so following the advice turned a
  database blip into a restart loop across every...