@cosmicdrift/kumiko-bundled-features 0.116.1 → 0.118.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.116.1",
+  "version": "0.118.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -95,11 +95,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.116.1",
-    "@cosmicdrift/kumiko-framework": "0.116.1",
-    "@cosmicdrift/kumiko-headless": "0.116.1",
-    "@cosmicdrift/kumiko-renderer": "0.116.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.116.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.118.0",
+    "@cosmicdrift/kumiko-framework": "0.118.0",
+    "@cosmicdrift/kumiko-headless": "0.118.0",
+    "@cosmicdrift/kumiko-renderer": "0.118.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.118.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/nodemailer": "^8.0.0",

package/src/personal-access-tokens/__tests__/feature.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "bun:test";
+import { createPersonalAccessTokensFeature } from "../feature";
+
+describe("createPersonalAccessTokensFeature toggleable-option (tier-gating)", () => {
+  test("without toggleable: feature is always-on (toggleableDefault undefined)", () => {
+    expect(createPersonalAccessTokensFeature({ scopes: {} }).toggleableDefault).toBeUndefined();
+  });
+
+  test("toggleable:{default:false} makes the feature tier-gatable, fail-closed", () => {
+    const feature = createPersonalAccessTokensFeature({
+      scopes: {},
+      toggleable: { default: false },
+    });
+    expect(feature.toggleableDefault).toBe(false);
+  });
+
+  test("toggleable:{default:true} declares toggleable, enabled-by-default", () => {
+    const feature = createPersonalAccessTokensFeature({
+      scopes: {},
+      toggleable: { default: true },
+    });
+    expect(feature.toggleableDefault).toBe(true);
+  });
+});

package/src/personal-access-tokens/feature.ts

@@ -17,6 +17,10 @@ export type PersonalAccessTokensOptions = {
   // Per-token request rate limit for PAT-authenticated calls. Defaults to
   // PAT_DEFAULT_RATE_LIMIT (120/60s). run-prod-app builds the limiter from this.
   readonly rateLimit?: PatRateLimit;
+  /** Make the whole feature tier-gatable via the tier-engine. Use
+   *  { default: false } for fail-closed gating (feature off until a tier grants
+   *  it). Omit to keep PAT always-on (default). */
+  readonly toggleable?: { readonly default: boolean };
 };
 
 export type PatFeatureExports = {
@@ -35,9 +39,13 @@ export function createPersonalAccessTokensFeature(
   const { scopes } = options;
   return defineFeature(PAT_FEATURE, (r) => {
     r.describe(
-      "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `read_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — the resolver is wired via run-prod-app, not the dispatcher.",
+      "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `read_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — the resolver is wired via run-prod-app, not the dispatcher. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
     );
     r.uiHints({ displayLabel: "Personal Access Tokens", category: "identity", recommended: false });
+    // Opt-in tier-gating (mirrors ledger/tags): when set, the feature declares
+    // itself r.toggleable so the dispatcher gate + tier-engine can switch PAT
+    // on/off per tenant. { default: false } = fail-closed until a tier grants it.
+    if (options.toggleable !== undefined) r.toggleable(options.toggleable);
     // Resolver reads memberships + users on every PAT request to build live
     // roles — make both boot-time deps so a mis-wiring fails validateBoot.
     r.requires("user", "tenant");