@cosmicdrift/kumiko-bundled-features 0.306.0 → 0.308.0

package/src/auth-email-password/handlers/invite-accept.write.ts

@@ -23,7 +23,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link), DB-row-owner ist tenant-feature
 import {

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -22,7 +22,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
 import {
   INVITATION_STATUS,

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -31,7 +31,7 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { decryptStoredPii } from "../../shared";
 // kumiko-lint-ignore cross-feature-import invite-flow
 import {
@@ -92,7 +92,7 @@ export function createInviteSignupCompleteHandler() {
   >({
     name: "invite-signup-complete",
     schema: InviteSignupCompleteSchema,
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     escapeHatch: {

package/src/auth-email-password/handlers/login.write.ts

@@ -10,7 +10,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { verifyDummyPassword, verifyPassword } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";

package/src/auth-email-password/handlers/logout.write.ts

@@ -1,5 +1,5 @@
 import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 
 // Logout — JWT is stateless, so server-side we only return OK. A future
 // revocation list / session table can land here without changing the

package/src/auth-email-password/handlers/reset-password.write.ts

@@ -1,6 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { hashPassword } from "../../shared";
 import { AuthErrors } from "../constants";
 import { invalidResetToken } from "../errors";

package/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -1,5 +1,5 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle";
 
 // Anonymous-readable status for the (unauthenticated) signup page: lets it

package/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -29,7 +29,7 @@ import {
 import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { generateUniqueName } from "@cosmicdrift/kumiko-framework/random";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import signup-confirm reads tenants.key for slug-uniqueness check (TOCTOU + DB-unique-index zusammen)
 import { tenantTable } from "../../tenant/schema/tenant";
 import { invalidSignupToken, signupEmailAlreadyRegistered } from "../errors";
@@ -67,7 +67,7 @@ export function createSignupConfirmHandler() {
   return defineWriteHandler<"signup-confirm", typeof SignupConfirmSchema, SignupConfirmData>({
     name: "signup-confirm",
     schema: SignupConfirmSchema,
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     agent: { expose: false },
     escapeHatch: {

package/src/auth-email-password/handlers/signup-request.write.ts

@@ -25,7 +25,7 @@ import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "../constants";
 import type { AuthMailLocale } from "../email-templates";
 import { renderActivationEmail } from "../email-templates";

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -15,7 +15,7 @@
 import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { UserQueries } from "../../user";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
 import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "../email-templates";

package/src/auth-email-password/handlers/verify-email.write.ts

@@ -1,6 +1,6 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { AuthErrors } from "../constants";
 import { invalidVerificationToken } from "../errors";
 import { verifyVerificationToken } from "../verification-token";

package/src/auth-email-password/password-policy.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import * as z from "zod";
 
 // Top-10k common-password list (SecLists, MIT license). Filtered to length // kumiko-lint-ignore comment-lang "MIT" false-positives the DE-word regex
 // >=8, since shorter entries are already rejected by `.min(8)` below (keeps

package/src/auth-mfa/__tests__/session-scoped-sse-revoke.integration.test.ts

@@ -0,0 +1,270 @@
+// Session-scoped SSE revocation (kumiko-framework "session-scoped-revoke").
+//
+// enable-confirm (and disable/regenerate-recovery) call
+// sessionRevokeAllOthers, which appends sessions:event:session-revoked with
+// an optional `keptSessionId` set to the caller's own sid — the ONE sid this
+// write deliberately does NOT revoke. Before this fix,
+// createAccessInvalidationEventConsumer ignored that and called
+// sseBroker.publishAccessInvalidation USERWIDE, which closed the caller's
+// own just-opened SSE stream along with every other session's — the exact
+// bug this test proves fixed: studio's live MFA-status panel never saw the
+// state flip because its own stream died with everyone else's.
+//
+// This is a KEEP-list (spare exactly keptSessionId), not a kill-list
+// (scope to the revoked sessionIds) — the first test below proves why: a
+// third session (C) that was already logged out through the real
+// /api/auth/logout endpoint BEFORE enable-confirm runs never appears in any
+// session-revoked event's sessionIds (logout revokes via the raw
+// sessionRevoker callback with no event at all). A kill-list keyed on
+// sessionIds would silently leave C's still-open stream running; the
+// keep-list closes it like every other non-kept stream, exactly as the
+// pre-scoping userwide invalidation always did.
+//
+// Real stack throughout: setupTestStack + real HTTP (createLiveDispatcher for
+// the SSE streams, stack.http for the writes), never createTestDispatcher.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { createLiveDispatcher } from "@cosmicdrift/kumiko-dispatcher-live";
+import type { SessionCreator } from "@cosmicdrift/kumiko-framework/api";
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
+import { configureEntityFieldEncryption } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createLateBoundHolder,
+  createTestEnvelopeCipher,
+  resetTestTables,
+} from "@cosmicdrift/kumiko-framework/testing";
+import * as z from "zod";
+import { AuthHandlers } from "../../auth-email-password/constants";
+import { createAuthEmailPasswordFeature } from "../../auth-email-password/feature";
+import { createConfigFeature } from "../../config";
+import { createConfigResolver } from "../../config/resolver";
+import { configValuesTable } from "../../config/table";
+import { makeSessionHelpers } from "../../sessions/__tests__/test-helpers";
+import { createSessionsFeature } from "../../sessions/feature";
+import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
+import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
+import { createTenantFeature } from "../../tenant";
+import { TenantHandlers } from "../../tenant/constants";
+import { tenantMembershipsTable } from "../../tenant/membership-table";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createUserFeature } from "../../user/feature";
+import { userEntity, userTable } from "../../user/schema/user";
+import { base32Decode } from "../base32";
+import { AuthMfaHandlers } from "../constants";
+import { bindMfaRevokeAllOtherSessionsFromFeature, createAuthMfaFeature } from "../feature";
+import { userMfaEntity } from "../schema/user-mfa";
+import { currentTotpCode } from "../totp";
+
+let stack: TestStack;
+let h: ReturnType<typeof makeSessionHelpers>;
+let sessionCreator: SessionCreator;
+const callbacks = createLateBoundHolder<SessionCallbacks>("session-callbacks");
+
+const encryptionKey = randomBytes(32).toString("base64");
+const SETUP_TOKEN_SECRET = "test-mfa-setup-token-secret-at-least-32-bytes!!";
+const TENANT = testTenantId(1);
+
+const chunkGates = new Map<string, { promise: Promise<void>; release: () => void }>();
+
+function createGate(gateId: string): () => void {
+  let release!: () => void;
+  const promise = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  chunkGates.set(gateId, { promise, release });
+  return release;
+}
+
+const streamProbeFeature = defineFeature("stream-probe", (r) => {
+  r.streamHandler(
+    "probe:tail",
+    z.object({ gateId: z.string().min(1) }),
+    async function* (event) {
+      yield { phase: "open" as const };
+      const gate = chunkGates.get(event.payload.gateId);
+      if (!gate) throw new Error(`missing gate ${event.payload.gateId}`);
+      await gate.promise;
+      yield { phase: "survived" as const };
+    },
+    { access: { roles: ["User"] } },
+  );
+});
+
+function buildLiveFetch(authJwt: string): {
+  readonly fetch: typeof fetch;
+  readonly csrfToken: string;
+} {
+  const csrfToken = generateToken();
+  const cookieHeader = `kumiko_auth=${authJwt}; kumiko_csrf=${csrfToken}`;
+  const fetchImpl = (async (url: unknown, init: RequestInit | undefined) => {
+    const reqInit: RequestInit = {
+      ...(init ?? {}),
+      headers: {
+        ...(init?.headers ?? {}),
+        Cookie: cookieHeader,
+      },
+    };
+    return stack.app.request(String(url), reqInit);
+  }) as unknown as typeof fetch;
+  return { fetch: fetchImpl, csrfToken };
+}
+
+async function openProbeStream(token: string): Promise<{
+  iter: AsyncIterator<{ phase: string }>;
+  release: () => void;
+}> {
+  const gateId = generateToken();
+  const release = createGate(gateId);
+  const { fetch, csrfToken } = buildLiveFetch(token);
+  const dispatcher = createLiveDispatcher({ fetch, readCsrf: () => csrfToken });
+  const iter = dispatcher
+    .stream<{ phase: string }>("stream-probe:stream:probe:tail", { gateId })
+    [Symbol.asyncIterator]();
+  const first = await iter.next();
+  expect(first.done).toBe(false);
+  expect(first.value).toEqual({ phase: "open" });
+  return { iter, release };
+}
+
+beforeAll(async () => {
+  const encryption = createTestEnvelopeCipher(encryptionKey);
+  configureEntityFieldEncryption(encryption);
+  const resolver = createConfigResolver({ cipher: encryption });
+  const bound = sessionCallbacksFromLateBound(callbacks);
+  const mfaFeature = createAuthMfaFeature({
+    setupTokenSecret: SETUP_TOKEN_SECRET,
+    issuer: "Kumiko Test",
+    challengeTokenSecret: "test-mfa-challenge-secret-at-least-32-bytes!!",
+  });
+
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createUserFeature(),
+      createTenantFeature(),
+      createAuthEmailPasswordFeature(),
+      authFoundationFeature,
+      createSessionsFeature({ autoRevokeOnPasswordChange: bound.asMassRevoker() }),
+      mfaFeature,
+      streamProbeFeature,
+    ],
+    extraContext: { configResolver: resolver, configEncryption: encryption },
+    authConfig: {
+      ...bound.asAuthConfig(),
+      membershipQuery: "tenant:query:memberships",
+      loginHandler: AuthHandlers.login,
+    },
+  });
+  callbacks.set(createSessionCallbacks({ db: stack.db }));
+  bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(callbacks.get().sessionRevokeAllOthers);
+
+  h = makeSessionHelpers(stack, TENANT, bound.asAuthConfig().sessionCreator);
+  const boundSessionCreator = bound.asAuthConfig().sessionCreator;
+  if (!boundSessionCreator) throw new Error("sessionCreator not bound — check setup order");
+  sessionCreator = boundSessionCreator;
+
+  await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, userSessionEntity);
+  await unsafeCreateEntityTable(stack.db, userMfaEntity);
+  await unsafePushTables(stack.db, { configValuesTable, tenantMembershipsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await resetTestTables(stack.db, [
+    userTable,
+    tenantMembershipsTable,
+    userSessionTable,
+    eventsTable,
+  ]);
+  chunkGates.clear();
+});
+
+describe("session-scoped SSE revoke (enable-confirm keeps the caller's own stream open)", () => {
+  test("enable-confirm from session A keeps A's stream alive, closes B's, and also closes C's even though C was already logged out through the eventless /api/auth/logout path", async () => {
+    await h.seedUser("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionA = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionB = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+    const sessionC = await h.login("mfa-scope-a@example.com", "pw-long-enough");
+
+    const streamA = await openProbeStream(sessionA.token);
+    const streamB = await openProbeStream(sessionB.token);
+    const streamC = await openProbeStream(sessionC.token);
+
+    // C logs out through the REAL endpoint — sessionRevoker (session-
+    // callbacks.ts) revokes the row directly, no session-revoked event at
+    // all. C's sid therefore never appears in any later event's sessionIds.
+    const logoutRes = await h.authedPost("/api/auth/logout", sessionC.token);
+    expect(logoutRes.status).toBe(200);
+
+    const start = await h.authedPost("/api/write", sessionA.token, {
+      type: AuthMfaHandlers.enableStart,
+      payload: { accountLabel: "mfa-scope-a@example.com" },
+    });
+    expect(start.status).toBe(200);
+    const startBody = (await start.json()) as {
+      data: { setupToken: string; otpauthUri: string };
+    };
+    const secretParam =
+      new URLSearchParams(startBody.data.otpauthUri.split("?")[1]).get("secret") ?? "";
+    const secret = base32Decode(secretParam);
+
+    const confirm = await h.authedPost("/api/write", sessionA.token, {
+      type: AuthMfaHandlers.enableConfirm,
+      payload: { setupToken: startBody.data.setupToken, code: currentTotpCode(secret) },
+    });
+    expect(confirm.status).toBe(200);
+
+    await stack.eventDispatcher?.runOnce();
+
+    // Assert B and C first, without releasing A's gate: their rejections are
+    // proof the publish already reached every listener (they fire from the
+    // same publish loop), so a still-pending A cannot pass "by being slow".
+    await expect(streamB.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+    await expect(streamC.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+
+    streamA.release();
+    const survivedChunk = await streamA.iter.next();
+    expect(survivedChunk.done).toBe(false);
+    expect(survivedChunk.value).toEqual({ phase: "survived" });
+  });
+
+  test("an invalidation reason with no keptSessionId (role change) still closes every session's stream, unscoped", async () => {
+    const { userId } = await h.seedUser("mfa-scope-b@example.com", "pw-long-enough");
+    const sessionA = await h.login("mfa-scope-b@example.com", "pw-long-enough");
+    const sessionB = await h.login("mfa-scope-b@example.com", "pw-long-enough");
+
+    const streamA = await openProbeStream(sessionA.token);
+    const streamB = await openProbeStream(sessionB.token);
+
+    const admin = await withMintedSession(sessionCreator, TestUsers.systemAdmin);
+    const result = await stack.http.writeOk(
+      TenantHandlers.updateMemberRoles,
+      { userId, tenantId: TENANT, roles: ["Admin"] },
+      admin,
+    );
+    expect(result).toBeTruthy();
+
+    await stack.eventDispatcher?.runOnce();
+
+    await expect(streamA.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+    await expect(streamB.iter.next()).rejects.toMatchObject({ code: "access_denied" });
+  });
+});

package/src/auth-mfa/handlers/disable.write.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { findUserMfaRow } from "../db/queries";
 import { invalidTotpCode, mfaNotEnabled } from "../errors";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa";

package/src/auth-mfa/handlers/enable-confirm-preauth.write.ts

@@ -8,7 +8,7 @@ import {
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { base32Decode } from "../base32";
@@ -63,7 +63,7 @@ export function createEnableConfirmPreauthHandler(opts: EnableConfirmPreauthOpti
       setupToken: z.string().min(1),
       code: z.string().length(6),
     }),
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:

package/src/auth-mfa/handlers/enable-confirm.write.ts

@@ -2,7 +2,7 @@ import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { burnToken } from "../../shared";
 import { base32Decode } from "../base32";
 import { findUserMfaRow } from "../db/queries";

package/src/auth-mfa/handlers/enable-start-preauth.write.ts

@@ -1,6 +1,6 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { base32Encode } from "../base32";
 import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants";
 import { findUserMfaRow } from "../db/queries";

package/src/auth-mfa/handlers/enable-start.write.ts

@@ -1,5 +1,5 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { UserQueries } from "../../user";
 import { base32Encode } from "../base32";
 import { MFA_SETUP_TOKEN_TTL_MINUTES } from "../constants";

package/src/auth-mfa/handlers/regenerate-recovery.write.ts

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { z } from "zod";
+import * as z from "zod";
 import { findUserMfaRow } from "../db/queries";
 import { invalidTotpCode, mfaNotEnabled } from "../errors";
 import { generateRecoveryCodes, hashRecoveryCodes } from "../recovery-codes";

package/src/auth-mfa/handlers/status.query.ts

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { userMfaTable } from "../schema/user-mfa";
 
 // "Is MFA enabled for me" — the one thing a settings screen needs before it

package/src/auth-mfa/handlers/verify.write.ts

@@ -7,7 +7,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { z } from "zod";
+import * as z from "zod";
 import { burnToken, sessionLocaleField, sessionTimezoneField } from "../../shared";
 import { USER_STATUS, UserQueries } from "../../user";
 import { MFA_VERIFY_LOCKOUT_MINUTES, MFA_VERIFY_MAX_ATTEMPTS } from "../constants";
@@ -45,7 +45,7 @@ export function createMfaVerifyHandler(opts: MfaVerifyOptions) {
   return defineWriteHandler({
     name: "verify",
     schema: z.object({ challengeToken: z.string().min(1), code: z.string().min(6).max(9) }),
-    access: { roles: ["anonymous"] },
+    access: { roles: ["anonymous"], personalData: "public-intake" },
     rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
     escapeHatch: {
       reason:

package/src/billing-foundation/billing-info-query.ts

@@ -16,7 +16,7 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { QnTypes, qn, SYSTEM_TENANT_ID, toKebab } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import SUBSCRIPTION_STRIPE_FEATURE is a plain string const in constants.ts (no imports); the barrel import (../subscription-stripe) would create a module cycle with billing-foundation via feature.ts → verify-webhook.ts, because billing-foundation/index.ts now re-exports billing-info-query.ts.
 import { SUBSCRIPTION_STRIPE_FEATURE } from "../subscription-stripe/constants";
 import { subscriptionAggregateId } from "./aggregate-id";

package/src/billing-foundation/events.ts

@@ -10,7 +10,7 @@
 // accounting-export, churn-analytics) listenen direkt auf den event-
 // type ohne payload-discriminator.
 
-import { z } from "zod";
+import * as z from "zod";
 import { BILLING_FOUNDATION_FEATURE, SubscriptionStatuses } from "./constants";
 
 // Aggregate-type für den event-store. Eine subscription pro Tenant ist

package/src/billing-foundation/handlers/create-checkout-session.write.ts

@@ -15,7 +15,7 @@
 // resolved den Tenant.
 
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { SUBSCRIPTION_PROVIDER_EXTENSION } from "../constants";
 import type { SubscriptionProviderPlugin } from "../types";
 

package/src/billing-foundation/handlers/create-portal-session.write.ts

@@ -15,7 +15,7 @@ import {
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SUBSCRIPTION_PROVIDER_EXTENSION } from "../constants";
 import { SUBSCRIPTION_PII_FIELDS } from "../entities";

package/src/billing-foundation/handlers/list-subscriptions.query.ts

@@ -7,7 +7,7 @@ import {
   decryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { QueryHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { SUBSCRIPTION_PII_FIELDS } from "../entities";
 import { subscriptionsProjectionTable } from "../projection";
 

package/src/billing-foundation/handlers/process-event.write.ts

@@ -17,7 +17,7 @@ import {
   encryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { subscriptionAggregateId } from "../aggregate-id";
 import { SubscriptionEventTypes, SubscriptionStatuses } from "../constants";
 import { SUBSCRIPTION_PII_FIELDS, subscriptionEntity } from "../entities";

package/src/billing-foundation/handlers/process-payment-event.write.ts

@@ -15,7 +15,7 @@ import {
   encryptPiiFieldValues,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { z } from "zod";
+import * as z from "zod";
 import { paymentAggregateId } from "../aggregate-id";
 import { PAYMENT_PII_FIELDS, paymentEntity } from "../entities";
 import {

package/src/cap-counter/__tests__/cap-counter.integration.test.ts

@@ -23,7 +23,7 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { CapCounterHandlers, CapCounterQueries } from "../constants";
 import {
   CapExceededError,

package/src/cap-counter/__tests__/enforce-cap.test.ts

@@ -114,6 +114,13 @@ describe("enforceCap — burstable profile (mails / tokens)", () => {
     await expect(enforceCap(ctx, opts)).rejects.toThrow(CapExceededError);
   });
 
+  test("amount checks the last of the booked units: 1190 + 10 units passes, + 11 throws", async () => {
+    const ctx = stubCalendarCtx([{ value: 1190, lastSoftWarnedAt: null }]);
+    const passing = await enforceCap(ctx, { ...opts, amount: 10 });
+    expect(passing).toEqual({ state: "soft-hit", value: 1199, crossed: true });
+    await expect(enforceCap(ctx, { ...opts, amount: 11 })).rejects.toThrow(CapExceededError);
+  });
+
   test("CapExceededError carries cap-name + limit + currentValue", async () => {
     const ctx = stubCalendarCtx([{ value: 1500, lastSoftWarnedAt: null }]);
     try {

package/src/cap-counter/__tests__/stock-cap-guard.integration.test.ts

@@ -23,7 +23,7 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { capCounterEntity } from "../entity";
 import { createStockCapGuard } from "../stock-cap-guard";
 

package/src/cap-counter/__tests__/with-cap-enforcement.integration.test.ts

@@ -24,7 +24,7 @@ import {
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { z } from "zod";
+import * as z from "zod";
 import { bookCapUsage, readRollingCapUsage } from "../book-cap-usage";
 import { CapCounterQueries } from "../constants";
 import type { SoftHitNotifier } from "../enforce-cap";

package/src/cap-counter/book-cap-usage.ts

@@ -9,7 +9,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "temporal-polyfill";
-import { z } from "zod";
+import * as z from "zod";
 import { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id";
 import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, ROLLING_INCREMENTED_EVENT_QN } from "./constants";
 import { capCounterEntity } from "./entity";

package/src/cap-counter/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.307.0",
+    "type": "improvement",
+    "title": "enforceCap accepts an amount for multi-unit bookings"
+  },
   {
     "version": "0.278.0",
     "type": "improvement",