chore(main): release openinspection 2.3.0

[github-actions]

🤖 I have created a release beep boop

2.3.0 (2026-10-15)

Features

• auth: add the deleteInspection capability and restrict inspector deletes to their own inspections (da01a6e)
• auth: cover every place money is shown or changed with the financial capability (e69bd75)
• auth: cover every place money is shown or changed with the financial capability (569ce10)
• auth: hide Pending Invites from non-managers and add the deleteInspection capability (64a65e2)
• config: default a new workspace's Reply-To to its owner, with a dry-run backfill for existing ones (4d367ee)
• email: absorb short rate limits, defer instead of fail on quota, throttle the automation flush (c8e15cd)
• email: carry the human check through delayed report emails (d8d4113)
• email: confirm a person with Turnstile instead of refusing client email in a new company's first 24 hours (57ec37b)
• email: report provider quota usage, classify rate limiting, honour send-only keys (c316f64)
• email: the human check on the repair-share email, one token per page action, and honest Outbox reasons (541b319)
• inspections: let the Send report dialog hand off to adding a person (522fff3)
• inspections: let the Send report dialog hand off to adding a person (5912019)
• integrations: resolve each outside service's source in one place (719e7da)
• integrations: resolve each outside service's source in one place (470b131)
• integrations: step-by-step Stripe connection test behind one Test connection button (1bbaf4d)
• integrations: stepwise "test connection" for BYO email and Stripe (9e2cb4d)
• isn: add a published report's link to its ISN order (acc1eb3)
• lint: ratchet placeholder descriptions toward zero (e7862fd)
• native: accept native OAuth access tokens on /api (0dee762)
• native: client-generated inspection ids and background media uploads (0d1c3d1)
• native: CORS for app origins and one-time WebSocket tickets (1262a20)
• native: import an exported offline package on behalf of another member (b6eafab)
• native: import an offline Yjs update behind a mandatory snapshot (ee3b000)
• native: mount the OAuth provider when native clients are enabled (ac16eef)
• native: native API contract registry, snapshot and breaking-change gate (f067f17)
• native: native authorization branch and token lifetimes (ccd421b)
• native: native consent page (2e5e940)
• native: offline access limit input in compliance settings (c097198)
• native: per-tenant offline access limit (schema, validation, API) (b6b2dec)
• native: resolve pending photo entries to storage keys inside the document (a736db4)
• native: server support for native offline clients (0fa0a6a)
• native: size offline package imports for the free tier; make limits configurable (9e3517e)
• native: version handshake and native session endpoint (442cb66)
• qbo: Check credentials button in the Your Intuit app section (fbe338b)
• qbo: check that the Intuit app credentials are a matching pair (a4f57c7)
• qbo: match a contact to a QuickBooks customer from the items that need attention (5897a05)
• qbo: match a contact to a QuickBooks customer, undo it, and read where it stands (bb9a336)
• qbo: push again the invoices that were waiting for a QuickBooks customer once a contact is matched (5a83857)
• qbo: report the environment, connection time, match counts and credential origins in the status (2a8c758)
• qbo: rework the QuickBooks settings page around the connection (2784d1c)
• qbo: search QuickBooks customers and expose the contact match routes (c84a3dc)
• qbo: show and manage the QuickBooks match on the contact page (deae121)
• settings: one "Test connection" button that runs a step-by-step Resend check (54bbe74)
• team: remove a member with an unsynced-data warning; app-mode sign-in (c8708f9)

Bug Fixes

• api: give the two routes that shared an operationId their own (f256dc1)
• auth: complete standalone TOTP sign-in through the /login page (eec2ea7)
• auth: give /login its own response schema; correct the token-relay rule (8421d45)
• auth: make invite links resolve, latch same-frame form submits, keep hints under reserved error space (fa7e6aa)
• auth: read the caller's capabilities only when money is involved (cb48542)
• auth: refuse anonymous API access by default and tighten send, assign and delete rules (6336718)
• auth: refuse anonymous API access by default and tighten who may send, assign and change inspections (c0b1026)
• auth: satisfy the two CI-only gates for the delete audit record (1fe2dff)
• automation: a suspended company sends nothing from cron; put the remaining full-screen overlays on the layer stack (07c603a)
• close review findings on the human check and the stepwise tests (de721c3)
• close the second review's findings on the human check (d579146)
• cron: ack on self-continuation send failure instead of retrying (8384c14)
• cron: ack on self-continuation send failure instead of retrying (CF 10250) (97aabf6)
• cron: stop idle KV deletes and the always-true retention probe (bf46dc3)
• cron: stop spending KV deletes on ticks that have nothing to do (e279c06)
• deps: patch dompurify and fast-uri advisories (cf53eb7)
• deps: patch ip-address SSRF advisory (cfe07c2)
• deps: update dompurify and fast-uri (d1a88a4)
• editor: ask for the human check when publishing from the full-screen editor (abda844)
• editor: keep focus on the Publish button while the readiness check runs, so closing the dialog returns it (11983dc)
• editor: keep the row and section "..." buttons focusable so a dialog they open can return focus (a419cd6)
• editor: portal the row and section "..." menus to the page body and keep keys inside them (c621a23)
• email: address PR 364 CI failures (425f7cd)
• email: resolve the email service per tenant on late-tenant routes; report Resend usage (f8c86b4)
• email: resolve the email service per tenant on routes that learn their tenant late (450a958)
• email: structured error handling and delivery_failed signer status (049731c)
• email: structured error handling, delivery_failed status, and type fixes (b84a42e)
• gate: a bare aria-disabled does not protect a submit, only pendingProps' inert click does (769878d)
• gate: escape every regex metacharacter in the tag name jsx-scan builds a pattern from (41cbfe2)
• gate: harden the jsx gate scanner and the three detectors against the shapes the review constructed (18c520d)
• i18n: use the glossary term for Settings in the Check credentials message (e38b27d)
• isn: tenant-scope the report lookup, fix the settings save fan-out (1d0b351)
• logging: stop 4xx scanner traffic reading as errors, and mark alertable failures (5eef03f)
• logging: stop 4xx scanner traffic reading as errors, and mark alertable failures (9119e8e)
• mcp: answer resources/read of a missing record with InvalidParams (a01cb72)
• mcp: stop offering multipart upload routes as MCP tools (0e50aa1)
• native: bound archive inflation, repair half-created inspections, tighten import and credential rules (c277223)
• native: clear the remaining import and results-document debts (a402e9a)
• native: close the MCP surface on native-only deployments; harden grants and the version handshake (0347fb3)
• native: do not revoke a healthy grant on a transient marker read error (8ad3eba)
• native: durable replay record for package writes; import media and results before queued writes (4ad302b)
• native: fail closed when native clients are off; restrict native redirect URIs (6c418d7)
• native: finish a client-id create on replay (8a53eba)
• native: keep the contract tooling out of the product tree; order the e2e project after two-factor (c2db941)
• native: keep ticket, presence and video upload calls out of the 426 rule (c8d116d)
• native: re-check membership when redeeming a socket ticket; drop credentials for app origins (96936b4)
• native: record package creates; refuse a package whose created inspection was deleted (fe7bb0c)
• native: require PKCE S256, show the redirect scheme, harden flag-off paths (c08b954)
• native: reuse an existing contact when a client-id create names the client (1526f2e)
• native: revoke grants on credential change; resolve role, scope from current state (3faf605)
• native: scope package replay records to their inspection (6a2ffc9)
• native: single-spend concurrent creates; check inspection and issuer on public uploads (cdd502a)
• native: skip snapshot for no-op imports; expose a bytes-in import function (e05ab70)
• qbo: accept the session token as a Bearer credential on the QuickBooks API routes (fa79de8)
• qbo: build the search literal character by character (e9a5aba)
• qbo: escape the search text for LIKE in a single pass (2a05d3d)
• qbo: keep the re-send time budget private (cf7a4b6)
• qbo: make Sync now report what it did, name the contact on attention rows, search without escapes Intuit ignores (bd30362)
• qbo: send the session JWT as Bearer on the settings page's API calls (b2d3143)
• second review pass on the human check, and put the code back in the file's own style (fa2ced9)
• submit the gated forms reliably, and satisfy the CI-tier gates (cc44043)
• team: hide the Pending Invites tab from people who cannot manage the team (59eca31)
• team: only owners may remove, demote, invite or promote owners (92b297b)
• third review pass on the human check (51d7885)
• types: resolve all type-check errors from email provider refactor (59fc28e)
• types: resolve paraglide TS7016 by including generated .d.ts in tsconfig (aba24b8)
• ui: absorb the second click of a double click on a confirm that closes on the first (5a95b1c)
• ui: drop LayerHandle.isTop, nothing reads it since the trap uses coverage() (0f0d3b8)
• ui: finish moving busy-disabled actions to pending, and give IconButton the same state (d279c45)
• ui: gate the two defect classes found by hand, and clear what the gates found (2e689ae)
• ui: give dialog triggers one shared way to keep focus, so closing a dialog returns it (b07a0b3)
• ui: give every bare submit a busy guard, stop forms that empty themselves from dropping focus, park closed drawers (793a416)
• ui: give every trigger that opens or closes a dialog while busy one shared way to keep focus (25015df)
• ui: guard every remaining write that a render-based pending state cannot stop, and make the gate see them (8cf1e1d)
• ui: guard remaining writes and check the double-submit guard per call (9317cd7)
• ui: guard the writes the wider gate now sees, and drop two latches that could swallow a real action (8b406a7)
• ui: harden the shared dialog stack, move the remaining hand-rolled overlays onto it, and gate new ones (71ba3c6)
• ui: keep focus on busy actions and latch every submit (6923c8b)
• ui: keep focus on every button that starts async work, and latch the signing submits (0b7d08e)
• ui: latch every form whose submit button only goes inert after a render, and gate the class (c7b10ba)
• ui: latch forms and shield closing dialogs against double clicks (106a876)
• ui: layer stack review fixes — visibility-gated layers, trap awareness, focus restore (8701194)
• ui: let Escape reach a focused menu item, keep the open menu's trigger visible, and give the bottom drawer a real dialog (925e081)
• ui: move focus into a popover only once it is visible, so the first open takes it too (76d887d)
• ui: one overlay layer stack so only the topmost dialog answers the keyboard (f82bb61)
• ui: only the topmost dialog answers the keyboard, and the page stays locked until the last one closes (4eb91c2)
• ui: raise the close shield for dialogs that unmount, and not over a dialog that is standing (881ce55)
• ui: reopen the in-flight latches that waited for a busy flag their callers never raise (38dbfb7)
• ui: size the reserved Input slot to the taller of hint and error so a blur error cannot move the button (c511b9e)
• webhooks: register the two webhook limiters and follow the limiter's new shape in its source check (df7541a)
• webhooks: verify inbound webhooks with the company's own secret and bound unauthenticated ingress (785fd87)
• webhooks: verify with the company's own secret and bound unauthenticated ingress (e4307ed)
• workflow: send the signed-evidence email when only a tenant provider is configured (28d05e6)

---

This PR was generated with Release Please. See documentation.