@cosmicdrift/kumiko-bundled-features 0.331.0 → 0.333.0

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -23,7 +23,8 @@ export type InviteCreateOptions = {
     readonly locale?: AuthMailLocale;
     readonly canAssignRole?: (inviterRoles: readonly string[], targetRole: string) => boolean;
     /** Opt-in allow-list for app-defined (unranked) roles the elevation guard
-     *  would otherwise reject with unassignable_membership_role (fw#2398). */
+     *  would otherwise reject with unassignable_membership_role (fw#2398).
+     *  Rank-aware alternative: declare roles via EXT_ASSIGNABLE_ROLE. */
     readonly additionalAssignableRoles?: readonly string[];
 };
 export declare function createInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-create", z.ZodObject<{

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -18,7 +18,7 @@
 // invite-create.
 import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesFromUsages, defineWriteHandler, EXT_ASSIGNABLE_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
@@ -54,7 +54,7 @@ export function createInviteCreateHandler(opts) {
             if (forbiddenRole !== undefined) {
                 return writeFailure(reservedMembershipRoleError(forbiddenRole));
             }
-            const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [event.payload.role], []);
+            const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [event.payload.role], [], assignableAppRolesFromUsages(ctx.registry.getExtensionUsages(EXT_ASSIGNABLE_ROLE)));
             if (elevationForbidden !== undefined &&
                 !opts.additionalAssignableRoles?.includes(elevationForbidden)) {
                 return writeFailure(unassignableMembershipRoleError(elevationForbidden));

package/dist/cap-counter/aggregate-id.d.ts

@@ -6,19 +6,18 @@
  */
 export declare function capCounterAggregateId(tenantId: string, capName: string, periodStartIso: string): string;
 /**
- * Deterministic aggregate-id für ein Rolling-Window-Counter-Aggregate
- * aus dem Paar (tenantId, capName). Pro Tenant + Cap existiert genau
- * EIN Rolling-Aggregate-Stream — die Window-Semantik kommt rein aus
- * dem Read-Pfad (Filter via event-store-Timestamp).
+ * Deterministic aggregate id for a rolling-window counter, derived from
+ * (tenantId, capName). Exactly ONE rolling aggregate stream exists per
+ * tenant + cap; window semantics come purely from the read path
+ * (filtering on the event-store timestamp), so no period is part of the id.
  *
- * **Eigener Namespace:** kollidiert NICHT mit
- * `capCounterAggregateId(tenantId, capName, "1970-01-01...")` — selbe
- * inputs, andere uuidv5-namespace, anderer Output-UUID. Damit ist auch
- * verhindert dass ein versehentlicher Calendar-Increment auf den
- * Rolling-Stream trifft.
+ * **Separate namespace:** does NOT collide with
+ * `capCounterAggregateId(tenantId, capName, "1970-01-01...")`. Same inputs,
+ * different uuidv5 namespace, different output UUID. This also prevents an
+ * accidental calendar increment from landing on the rolling stream.
  *
- * **Aufruf-Pattern:** Caller (incrementRollingCap-Helper) ruft mit
- * tenantId + capName auf, erzeugt Increment-Events am stream. Race-
- * frei: der event-store hängt mit auto-incrementing version an.
+ * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.write`) calls
+ * this with tenantId + capName and appends increment events to the stream.
+ * Race-free because the event store appends with an auto-incrementing version.
  */
 export declare function rollingCapAggregateId(tenantId: string, capName: string): string;

package/dist/cap-counter/aggregate-id.js

@@ -21,20 +21,19 @@ export function capCounterAggregateId(tenantId, capName, periodStartIso) {
     return uuidv5(`${tenantId}|${capName}|${periodStartIso}`, CAP_COUNTER_NAMESPACE);
 }
 /**
- * Deterministic aggregate-id für ein Rolling-Window-Counter-Aggregate
- * aus dem Paar (tenantId, capName). Pro Tenant + Cap existiert genau
- * EIN Rolling-Aggregate-Stream — die Window-Semantik kommt rein aus
- * dem Read-Pfad (Filter via event-store-Timestamp).
+ * Deterministic aggregate id for a rolling-window counter, derived from
+ * (tenantId, capName). Exactly ONE rolling aggregate stream exists per
+ * tenant + cap; window semantics come purely from the read path
+ * (filtering on the event-store timestamp), so no period is part of the id.
  *
- * **Eigener Namespace:** kollidiert NICHT mit
- * `capCounterAggregateId(tenantId, capName, "1970-01-01...")` — selbe
- * inputs, andere uuidv5-namespace, anderer Output-UUID. Damit ist auch
- * verhindert dass ein versehentlicher Calendar-Increment auf den
- * Rolling-Stream trifft.
+ * **Separate namespace:** does NOT collide with
+ * `capCounterAggregateId(tenantId, capName, "1970-01-01...")`. Same inputs,
+ * different uuidv5 namespace, different output UUID. This also prevents an
+ * accidental calendar increment from landing on the rolling stream.
  *
- * **Aufruf-Pattern:** Caller (incrementRollingCap-Helper) ruft mit
- * tenantId + capName auf, erzeugt Increment-Events am stream. Race-
- * frei: der event-store hängt mit auto-incrementing version an.
+ * **Caller:** `CapCounterHandlers.incrementRolling` (via `ctx.write`) calls
+ * this with tenantId + capName and appends increment events to the stream.
+ * Race-free because the event store appends with an auto-incrementing version.
  */
 // @wrapper-known uuid-domain
 export function rollingCapAggregateId(tenantId, capName) {

package/dist/cap-counter/feature.js

@@ -17,25 +17,24 @@
 //      Pre-Save-Wrapper mit asymmetrischen Soft/Hard-Toleranzen pro
 //      Cap-Profile.
 //
-// **Calendar vs. Rolling — wann welches:**
-//   - **Calendar-Period** (incrementCap + enforceCap): Cap resettet
-//     sich am Period-Start (1. des Monats etc.). Counter ist 1 Row in
-//     der projection. Schneller Read.
-//   - **Rolling-Window** (incrementRollingCap + enforceRollingCap):
-//     Cap rollt kontinuierlich (z.B. "letzten 7 Tage"). Werte
-//     verfallen Event-für-Event ohne Reset. Kein projection — Read
-//     summiert über die letzten N Tage Events.
+// **Calendar vs. Rolling — when to use which:**
+//   - **Calendar period** (bookCapUsage + enforceCap): the cap resets at
+//     period start (1st of the month etc.). The counter is one row in the
+//     projection. Fast read.
+//   - **Rolling window** (CapCounterHandlers.incrementRolling + enforceRollingCap):
+//     the cap rolls continuously (e.g. "last 7 days"). Values expire
+//     event by event without a reset. No projection; the read sums the
+//     events of the last N days.
 //
-// **Was diese Feature NICHT macht:**
-//   - **Kein Foundation-Wiring.** mail-foundation / file-foundation /
-//     ai-foundation sind heute BYOK-default und haben keinen Plattform-
-//     Pool zum Zählen. Cap-Counter ist generic — wenn ein App-Owner
-//     den Counter nutzen will, ruft er `incrementCap(...)` /
-//     `incrementRollingCap(...)` aus seinem eigenen Handler auf.
-//   - **Kein Reset-Cron für Calendar-Period.** Funktioniert ohne —
-//     der periodStartIso-Bestandteil der aggregate-id rollt am
-//     Period-Tick natürlich auf einen frischen Counter. Alte Rows
-//     bleiben für Audit liegen.
+// **What this feature does NOT do:**
+//   - **No foundation wiring.** mail-foundation / file-foundation /
+//     ai-foundation are BYOK by default today and have no platform pool
+//     to count. cap-counter is generic: an app owner who wants to use the
+//     counter calls `bookCapUsage(...)` /
+//     `ctx.write(CapCounterHandlers.incrementRolling, ...)` from their own handler.
+//   - **No reset cron for the calendar period.** Works without one: the
+//     periodStartIso part of the aggregate id rolls over to a fresh
+//     counter at the period tick. Old rows stay for audit.
 //   - **Kein Notification-Pfad als Hard-Wiring.** Cap-counter
 //     entkoppelt — `enforceCapAndMaybeNotify` (siehe enforce-cap.ts)
 //     ist ein Convenience-Helper, der einen Caller-supplied

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -85,6 +85,9 @@ export function createTenantCapsListQuery(caps, listCaps) {
             totalCount: z.boolean().optional(),
         }),
         access: { roles: ["SystemAdmin"] },
+        escapeHatch: {
+            reason: "cap-overview:tenant-caps:list — grants app-owned CapSpec.usage()/usageBatch() providers raw SQL for aggregates TenantDb has no typed helper for (e.g. a SUM)",
+        },
         handler: async (query, ctx) => {
             if (!ctx.systemDb) {
                 throw new InternalError({

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject, recordRowExistsInTenant, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
+import { nullBlindIndexesForSubject, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
@@ -10,6 +10,7 @@ import { assertIrreversibleOperationAllowed } from "@cosmicdrift/kumiko-framewor
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
+import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
@@ -99,23 +100,38 @@ async function resolveTenantScopeDenial(db, features, user, raw) {
     const ownedInTenant = await subjectRowExistsInTenant(db, features, raw.userId, user.tenantId);
     return ownedInTenant ? undefined : memberDenied;
 }
-// fw#2789: the host entity's OWN retention declaration gets the last word on
-// a targeted row-shred — blockDelete (legally mandated physical retention,
-// e.g. ledger/invoice text) means this command must refuse, not silently
-// anonymize or proceed. Deliberately independent of the tenant feature/gate
-// above: a retention obligation holds in single-tenant apps too, and running
-// unconditionally (not nested under `features.has("tenant")`) keeps that
-// true. Only the entity's declared `retention.strategy` is consulted here —
-// NOT the data-retention feature's tenant-preset/override layering
-// (resolveRetentionPolicy) — so a tenant cannot override its own way past a
-// blockDelete declared on the entity.
-function resolveRetentionDenial(features, raw) {
+// fw#2789/#2805: blockDelete (legally mandated physical retention, e.g.
+// ledger/invoice text) means this command must refuse, not silently
+// anonymize or proceed. Refused when the host entity itself declares
+// blockDelete OR the owning tenant's effective data-retention policy
+// (preset/override layering) does, so a tenant preset cannot be bypassed here.
+// The entity declaration is checked first and independent of the tenant
+// feature/gate and of data-retention being mounted: a retention obligation
+// holds in single-tenant apps too.
+async function resolveRetentionDenial(ctx, raw, 
+// Lazy: unsafeRaw writes an audit entry per call, so only request it once a read is needed.
+getRunner) {
     if (raw.kind !== "record")
         return undefined;
+    const features = ctx.registry.features;
+    const deny = () => writeFailure(new AccessDeniedError({ details: { reason: TARGET_RECORD_RETENTION_BLOCK_DELETE } }));
     const entity = findRegisteredEntity(features, raw.entity);
-    if (entity?.retention?.strategy !== "blockDelete")
+    if (entity?.retention?.strategy === "blockDelete")
+        return deny();
+    if (!features.has("data-retention"))
         return undefined;
-    return writeFailure(new AccessDeniedError({ details: { reason: TARGET_RECORD_RETENTION_BLOCK_DELETE } }));
+    // The row's own tenant, not the actor's: a SystemAdmin acts across tenants.
+    const runner = getRunner();
+    const owningTenantId = await recordRowOwningTenantId(runner, features, raw.entity, raw.id);
+    if (owningTenantId === undefined)
+        return undefined;
+    const effective = await resolveRetentionPolicyForTenant({
+        db: runner,
+        registry: ctx.registry,
+        tenantId: owningTenantId,
+        entityName: raw.entity,
+    });
+    return effective.policy?.strategy === "blockDelete" ? deny() : undefined;
 }
 // Denied cross-tenant probes must still leave an audit trail (fw#2348).
 // Appended outside the handler tx (fw#2592): the caller's
@@ -190,7 +206,7 @@ export const forgetSubjectWrite = defineWriteHandler({
     agent: { expose: false, risk: "high" },
     escapeHatch: {
         reason: "denial audit append names the prober's own tenant stream on the outside-transaction db; " +
-            "the tenant-scope check runs against the subject's tenant, not necessarily the caller's; " +
+            "the tenant-scope and retention checks run against the subject's tenant, not necessarily the caller's; " +
             "the blind-index sweep and search purge address the subject across tenants; the user " +
             "lifecycle update and PAT revoke run on the SYSTEM user stream.",
     },
@@ -218,7 +234,7 @@ export const forgetSubjectWrite = defineWriteHandler({
         // Runs AFTER the tenant gate (VORHER only means "before the shred"): a
         // retention check ahead of the tenant gate would leak a foreign
         // entity's retention posture to a cross-tenant prober.
-        const retentionDenial = resolveRetentionDenial(ctx.registry.features, raw);
+        const retentionDenial = await resolveRetentionDenial(ctx, raw, () => ctx.db.unsafeRaw("retention check reads the record row's owning tenant, not the caller's"));
         if (retentionDenial) {
             // Own reason constant, not tenantScopeDenial's `.error.code` pattern:
             // AccessDeniedError.code is the generic "access_denied" for every

package/dist/subscription-stripe/plugin-methods.js

@@ -17,7 +17,7 @@ import { createHash } from "node:crypto";
 import { KNOWN_RECURRING_INTERVALS, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import Stripe from "stripe";
-import { mapStripeSubscriptionState } from "./verify-webhook.js";
+import { isResourceMissingStripeError, mapStripeSubscriptionState } from "./verify-webhook.js";
 export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation = true } = {}) {
     return async (ctx, options) => {
         // #104-Invariante: ohne billing-live darf keine Stripe-Session
@@ -79,9 +79,6 @@ export function createStripeCancelSubscription(runtime) {
         await stripe.subscriptions.cancel(providerSubscriptionId);
     };
 }
-function isResourceMissingStripeError(error) {
-    return (error instanceof Stripe.errors.StripeInvalidRequestError && error.code === "resource_missing");
-}
 export function createStripeRetrieveSubscription(runtime, { priceToTier }) {
     return async (ctx, providerSubscriptionId) => {
         const stripe = await runtime.clientForCtx(ctx);

package/dist/subscription-stripe/verify-webhook.d.ts

@@ -1,8 +1,9 @@
 import type { PaymentEvent, SubscriptionEvent } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { type SubscriptionEventType, type SubscriptionStatus } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import type Stripe from "stripe";
+import Stripe from "stripe";
 import type { StripeWebhookRuntime } from "./runtime.js";
+export declare function isResourceMissingStripeError(error: unknown): boolean;
 export type StripeWebhookOptions = {
     /** Price-to-tier-Map. Plugin liest die price-id aus dem event und
      *  mapped auf tier-name. Fehlt die price-id im Mapping → null. App-

package/dist/subscription-stripe/verify-webhook.js

@@ -25,17 +25,25 @@
 // sig-verify, kein split-brain.
 //
 // **Invoice-event lazy-fetch:**
-// Bei `invoice.paid` und `invoice.payment_failed` enthält der webhook-
-// payload nur die subscription-id (Stripe-Webhooks expanden subscription
-// nicht automatisch). Plugin macht einen lazy-fetch via
-// `stripe.subscriptions.retrieve(subId)` um an das full subscription-
-// Object für status/tier/period-end-mapping zu kommen. Bei Stripe-API-
-// failure (= subscription gelöscht zwischen webhook + retrieve)
-// returnt der Plugin defensiv null — der nächste subscription-event
-// wird den state korrekt handhaben.
+// Invoice payloads carry only the subscription id (Stripe does not expand
+// subscription in webhooks), so the plugin lazy-fetches via
+// `stripe.subscriptions.retrieve(subId)` to get the full subscription for
+// status/tier/period-end mapping. resource_missing (deleted between webhook
+// and retrieve) returns null; any other Stripe error becomes 503 so Stripe
+// redelivers.
 import { BillingEventKinds, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { ExtraRouteRejection } from "@cosmicdrift/kumiko-framework/api";
+import Stripe from "stripe";
 import { Temporal } from "temporal-polyfill";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes } from "./constants.js";
+export function isResourceMissingStripeError(error) {
+    return (error instanceof Stripe.errors.StripeInvalidRequestError && error.code === "resource_missing");
+}
+// Anything but resource_missing (network, 5xx, rate limit) is transient: a 503 makes Stripe retry,
+// whereas a silent null would be acknowledged as 200 and the event lost for good.
+function transientProviderRejection(error) {
+    return new ExtraRouteRejection(503, { error: { code: "subscription_provider_transient" } }, `stripe retrieve failed: ${error instanceof Error ? error.message : String(error)}`);
+}
 /**
  * Stripe-webhook-handler. Implementiert den Plugin-Contract
  * `verifyAndParseWebhook`. **Pre-tenant-resolution** — kein
@@ -231,12 +239,13 @@ async function extractSubscriptionFromEvent(event, stripe) {
             try {
                 return await stripe.subscriptions.retrieve(subId);
             }
-            catch {
-                // Stripe-API-failure beim retrieve (z.B. subscription gelöscht
-                // zwischen webhook + retrieve). Defensive: null returnen, damit
-                // foundation 200 ignored returnt — der nächste subscription-
-                // event wird's korrekt handhaben.
-                return null;
+            catch (error) {
+                // Subscription deleted between webhook and retrieve: null makes the
+                // foundation answer 200 ignored; the next subscription event carries
+                // the state.
+                if (isResourceMissingStripeError(error))
+                    return null;
+                throw transientProviderRejection(error);
             }
         }
         default:
@@ -263,16 +272,18 @@ async function parsePaymentEvent(event, stripe) {
     // Lazy-fetch with expand: the raw webhook payload carries neither
     // line_items (needed for priceId) nor an expanded payment_intent (needed
     // for tenantId — see below). Same lazy-fetch pattern as
-    // extractSubscriptionFromEvent's invoice-branch above, same defensive
-    // null on API failure (session gone/expired between webhook + retrieve).
+    // extractSubscriptionFromEvent's invoice-branch above, null only for resource_missing
+    // (session gone between webhook + retrieve), other failures reject with 503.
     let expanded;
     try {
         expanded = await stripe.checkout.sessions.retrieve(session.id, {
             expand: ["line_items", "payment_intent"],
         });
     }
-    catch {
-        return null;
+    catch (error) {
+        if (isResourceMissingStripeError(error))
+            return null;
+        throw transientProviderRejection(error);
     }
     // Tenant-resolution: mode:"payment" checkout sessions carry tenantId on
     // the PaymentIntent's OWN metadata (plugin-methods.ts sets it via

package/dist/tenant/constants.d.ts

@@ -11,7 +11,7 @@ export declare const MEMBER_STATUS_CELL_COMPONENT: "MemberStatusCell";
 export declare const MEMBER_ROLES_CELL_COMPONENT: "MemberRolesCell";
 /** Closed allowlist for invite-role picker — never free text (escalation guard). */
 export declare const DEFAULT_INVITE_ROLE_OPTIONS: readonly ["User", "Editor", "Admin"];
-export declare const OWNER_INVITE_ROLE_OPTIONS: readonly ["User", "Editor", "Admin", "TenantAdmin"];
+export declare const OWNER_INVITE_ROLE_OPTIONS: readonly ["User", "Member", "Editor", "Admin", "TenantAdmin"];
 export declare const TenantHandlers: {
     readonly create: "tenant:write:create";
     readonly update: "tenant:write:update";

package/dist/tenant/constants.js

@@ -22,7 +22,13 @@ export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"];
 // Full assignable rank list, used by memberRolesEditScreen: that screen is
 // prefilled with a member's *current* roles, so it must be able to represent
 // every rank a membership can actually hold, including TenantAdmin (fw#2452).
-export const OWNER_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin", "TenantAdmin"];
+export const OWNER_INVITE_ROLE_OPTIONS = [
+    "User",
+    "Member",
+    "Editor",
+    "Admin",
+    "TenantAdmin",
+];
 // Qualified write handler names (QN format: scope:type:name)
 export const TenantHandlers = {
     create: "tenant:write:create",

package/dist/tenant/feature.d.ts

@@ -1,4 +1,4 @@
-import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type AssignableAppRoles, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export { tenantEntity, tenantTable } from "./schema/tenant.js";
 export type TenantFeatureOptions = {
     /** Adds the /members "invite" drawer button + its `invite-create`
@@ -9,5 +9,8 @@ export type TenantFeatureOptions = {
      *  handler lookup fails). Off by default: `tenant` cannot see whether an
      *  app configured that optional auth-email-password flow. */
     readonly inviteScreen?: boolean;
+    /** Screen options only — the elevation guard always reads the registry. */
+    readonly assignableAppRoles?: AssignableAppRoles;
 };
+export declare function collectAssignableAppRoles(features: readonly FeatureDefinition[]): AssignableAppRoles;
 export declare function createTenantFeature(options?: TenantFeatureOptions): FeatureDefinition;

package/dist/tenant/feature.js

@@ -1,4 +1,4 @@
-import { access, createSystemConfig, createTenantConfig, defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesFromUsages, createSystemConfig, createTenantConfig, defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, EXT_ASSIGNABLE_ROLE, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
 import { activeTenantIdsQuery } from "./handlers/active-tenant-ids.query.js";
 import { addMemberWrite } from "./handlers/add-member.write.js";
 import { cancelInvitationWrite } from "./handlers/cancel-invitation.write.js";
@@ -20,8 +20,13 @@ import { TENANT_I18N } from "./i18n.js";
 import { tenantInvitationEntity } from "./invitation-table.js";
 import { tenantMembershipEntity } from "./membership-table.js";
 import { tenantEntity } from "./schema/tenant.js";
-import { createMembersScreen, inviteCreateScreen, memberRolesEditScreen, tenantEditScreen, tenantListScreen, } from "./screens.js";
+import { createInviteCreateScreen, createMemberRolesEditScreen, createMembersScreen, tenantEditScreen, tenantListScreen, } from "./screens.js";
 export { tenantEntity, tenantTable } from "./schema/tenant.js";
+export function collectAssignableAppRoles(features) {
+    return assignableAppRolesFromUsages(features
+        .flatMap((feature) => feature.extensionUsages)
+        .filter((usage) => usage.extensionName === EXT_ASSIGNABLE_ROLE));
+}
 // --- Feature ---
 export function createTenantFeature(options) {
     return defineFeature("tenant", (r) => {
@@ -33,6 +38,10 @@ export function createTenantFeature(options) {
         });
         r.systemScope();
         r.requires("config");
+        r.extendsRegistrar(EXT_ASSIGNABLE_ROLE, {});
+        r.bootCheck(({ features }) => {
+            collectAssignableAppRoles(features);
+        });
         r.entity("tenant", tenantEntity);
         r.entity("tenant-membership", tenantMembershipEntity);
         r.entity("tenant-invitation", tenantInvitationEntity);
@@ -128,9 +137,9 @@ export function createTenantFeature(options) {
         // §2.6), invite via a drawer-hosted actionForm, role-edit via
         // actionForm. Screen access matches handler access.admin.
         r.screen(createMembersScreen(options));
-        r.screen(memberRolesEditScreen);
+        r.screen(createMemberRolesEditScreen(options?.assignableAppRoles));
         if (options?.inviteScreen) {
-            r.screen(inviteCreateScreen);
+            r.screen(createInviteCreateScreen(options.assignableAppRoles));
         }
         r.nav({
             id: "members",

package/dist/tenant/handlers/update-member-roles.write.js

@@ -1,6 +1,6 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { access, createSystemUser, defineWriteHandler, findForbiddenRoleAssignment, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, assignableAppRolesFromUsages, createSystemUser, defineWriteHandler, EXT_ASSIGNABLE_ROLE, findForbiddenRoleAssignment, withResponseData, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -70,7 +70,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
         const row = existing; // @cast-boundary generic-record
         const currentTargetRoles = parseRoles(row["roles"]);
         if (!event.user.roles.includes("system")) {
-            const forbiddenElevation = findForbiddenRoleAssignment(event.user.roles, event.payload.roles, currentTargetRoles);
+            const forbiddenElevation = findForbiddenRoleAssignment(event.user.roles, event.payload.roles, currentTargetRoles, assignableAppRolesFromUsages(ctx.registry.getExtensionUsages(EXT_ASSIGNABLE_ROLE)));
             if (forbiddenElevation !== undefined) {
                 return writeFailure(unassignableMembershipRoleError(forbiddenElevation));
             }

package/dist/tenant/i18n.js

@@ -24,12 +24,14 @@ export const TENANT_I18N = {
     "tenant:entity:__action-form__:field:email": { en: "Email" },
     "tenant:entity:__action-form__:field:role": { en: "Role" },
     "tenant:entity:__action-form__:field:role:option:User": { en: "User" },
+    "tenant:entity:__action-form__:field:role:option:Member": { en: "Member" },
     "tenant:entity:__action-form__:field:role:option:Admin": { en: "Admin" },
     "tenant:entity:__action-form__:field:role:option:TenantAdmin": { en: "Tenant Admin" },
     "tenant:entity:__action-form__:field:role:option:Editor": { en: "Editor" },
     "tenant:entity:__action-form__:field:userId": { en: "User ID" },
     "tenant:entity:__action-form__:field:roles": { en: "Roles" },
     "tenant:entity:__action-form__:field:roles:option:User": { en: "User" },
+    "tenant:entity:__action-form__:field:roles:option:Member": { en: "Member" },
     "tenant:entity:__action-form__:field:roles:option:Admin": { en: "Admin" },
     "tenant:entity:__action-form__:field:roles:option:TenantAdmin": { en: "Tenant Admin" },
     "tenant:entity:__action-form__:field:roles:option:Editor": { en: "Editor" },

package/dist/tenant/index.d.ts

@@ -1,6 +1,6 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
-export { createTenantFeature } from "./feature.js";
+export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export type { InvitationStatus } from "./invitation-table.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
 export { isTenantServingPublicContent } from "./is-tenant-serving-public-content.js";

package/dist/tenant/index.js

@@ -1,6 +1,6 @@
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries } from "./constants.js";
-export { createTenantFeature } from "./feature.js";
+export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";
 export { INVITATION_STATUS, INVITATION_STATUSES, tenantInvitationEntity, tenantInvitationsTable, } from "./invitation-table.js";
 export { isTenantServingPublicContent } from "./is-tenant-serving-public-content.js";
 export { tenantMembershipEntity, tenantMembershipsTable } from "./membership-table.js";

package/dist/tenant/screens.d.ts

@@ -1,9 +1,35 @@
-import { type EntityEditScreenDefinition, type EntityListScreenDefinition, type ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type AssignableAppRoles, type EntityEditScreenDefinition, type EntityListScreenDefinition, type ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export declare const tenantListScreen: EntityListScreenDefinition;
 export declare const tenantEditScreen: EntityEditScreenDefinition;
 export declare function createMembersScreen(options?: {
     readonly inviteScreen?: boolean;
 }): ScreenDefinition;
+export declare function createInviteCreateScreen(assignableAppRoles?: AssignableAppRoles): {
+    id: "invite-create";
+    type: "actionForm";
+    handler: "auth-email-password:write:invite-create";
+    fields: {
+        email: {
+            type: "text";
+            required: true;
+            format: "email";
+        };
+        role: {
+            type: "select";
+            options: string[];
+            required: true;
+        };
+    };
+    layout: {
+        sections: {
+            fields: string[];
+        }[];
+    };
+    submitLabel: string;
+    access: {
+        roles: readonly string[];
+    };
+};
 export declare const inviteCreateScreen: {
     id: "invite-create";
     type: "actionForm";
@@ -16,7 +42,7 @@ export declare const inviteCreateScreen: {
         };
         role: {
             type: "select";
-            options: readonly ["User", "Editor", "Admin"];
+            options: string[];
             required: true;
         };
     };
@@ -30,6 +56,36 @@ export declare const inviteCreateScreen: {
         roles: readonly string[];
     };
 };
+export declare function createMemberRolesEditScreen(assignableAppRoles?: AssignableAppRoles): {
+    id: "member-roles-edit";
+    type: "actionForm";
+    handler: "tenant:write:update-member-roles";
+    redirect: "members";
+    cancelTarget: "members";
+    fields: {
+        userId: {
+            type: "text";
+            required: true;
+        };
+        roles: {
+            type: "multiSelect";
+            options: string[];
+            required: true;
+        };
+    };
+    layout: {
+        sections: {
+            fields: (string | {
+                field: string;
+                readOnly: true;
+            })[];
+        }[];
+    };
+    submitLabel: string;
+    access: {
+        roles: readonly string[];
+    };
+};
 export declare const memberRolesEditScreen: {
     id: "member-roles-edit";
     type: "actionForm";
@@ -43,7 +99,7 @@ export declare const memberRolesEditScreen: {
         };
         roles: {
             type: "multiSelect";
-            options: readonly ["User", "Editor", "Admin", "TenantAdmin"];
+            options: string[];
             required: true;
         };
     };

package/dist/tenant/screens.js

@@ -1,5 +1,5 @@
 import { AuthHandlers } from "@cosmicdrift/kumiko-bundled-features/auth-email-password/constants";
-import { access, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, i18nKey, isAssignableByRole, } from "@cosmicdrift/kumiko-framework/engine";
 import { DEFAULT_INVITE_ROLE_OPTIONS, INVITE_CREATE_SCREEN_ID, MEMBER_ROLES_CELL_COMPONENT, MEMBER_ROLES_EDIT_SCREEN_ID, MEMBER_STATUS_CELL_COMPONENT, MEMBERS_SCREEN_ID, OWNER_INVITE_ROLE_OPTIONS, TenantHandlers, TenantQueries, } from "./constants.js";
 // Cross-tenant SystemAdmin platform view of the tenants themselves. The tenant
 // feature runs with `r.systemScope()`, so the entityList returns every tenant.
@@ -138,38 +138,56 @@ export function createMembersScreen(options) {
 // only entry point is the drawer button on /members. Only registered by
 // feature.ts when `TenantFeatureOptions.inviteScreen` is set — see
 // createMembersScreen's doc comment above for why.
-export const inviteCreateScreen = {
-    id: INVITE_CREATE_SCREEN_ID,
-    type: "actionForm",
-    handler: AuthHandlers.inviteCreate,
-    fields: {
-        email: { type: "text", required: true, format: "email" },
-        role: { type: "select", options: DEFAULT_INVITE_ROLE_OPTIONS, required: true },
-    },
-    layout: {
-        sections: [{ fields: ["email", "role"] }],
-    },
-    submitLabel: i18nKey("tenant.members.invite.submit"),
-    access: { roles: access.admin },
-};
-export const memberRolesEditScreen = {
-    id: MEMBER_ROLES_EDIT_SCREEN_ID,
-    type: "actionForm",
-    handler: TenantHandlers.updateMemberRoles,
-    redirect: MEMBERS_SCREEN_ID,
-    cancelTarget: MEMBERS_SCREEN_ID,
-    fields: {
-        userId: { type: "text", required: true },
-        // Prefilled with the member's current roles, so the option list must be
-        // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
-        // omits TenantAdmin and would silently strip it on submit. Escalation
-        // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
-        roles: { type: "multiSelect", options: OWNER_INVITE_ROLE_OPTIONS, required: true },
-    },
-    layout: {
-        // Prefill userId from rowAction; readOnly so the operator cannot retarget.
-        sections: [{ fields: [{ field: "userId", readOnly: true }, "roles"] }],
-    },
-    submitLabel: i18nKey("tenant.members.roles.edit.submit"),
-    access: { roles: access.admin },
-};
+export function createInviteCreateScreen(assignableAppRoles = new Map()) {
+    // Admin sees this screen too, so only app roles Admin may grant are offered (fw#2414).
+    const appRoleOptions = [...assignableAppRoles]
+        .filter(([, assignableFrom]) => isAssignableByRole(assignableFrom, "Admin"))
+        .map(([role]) => role);
+    return {
+        id: INVITE_CREATE_SCREEN_ID,
+        type: "actionForm",
+        handler: AuthHandlers.inviteCreate,
+        fields: {
+            email: { type: "text", required: true, format: "email" },
+            role: {
+                type: "select",
+                options: [...DEFAULT_INVITE_ROLE_OPTIONS, ...appRoleOptions],
+                required: true,
+            },
+        },
+        layout: {
+            sections: [{ fields: ["email", "role"] }],
+        },
+        submitLabel: i18nKey("tenant.members.invite.submit"),
+        access: { roles: access.admin },
+    };
+}
+export const inviteCreateScreen = createInviteCreateScreen();
+export function createMemberRolesEditScreen(assignableAppRoles = new Map()) {
+    return {
+        id: MEMBER_ROLES_EDIT_SCREEN_ID,
+        type: "actionForm",
+        handler: TenantHandlers.updateMemberRoles,
+        redirect: MEMBERS_SCREEN_ID,
+        cancelTarget: MEMBERS_SCREEN_ID,
+        fields: {
+            userId: { type: "text", required: true },
+            // Prefilled with the member's current roles, so the option list must be
+            // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
+            // omits TenantAdmin and would silently strip it on submit. Escalation
+            // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+            roles: {
+                type: "multiSelect",
+                options: [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()],
+                required: true,
+            },
+        },
+        layout: {
+            // Prefill userId from rowAction; readOnly so the operator cannot retarget.
+            sections: [{ fields: [{ field: "userId", readOnly: true }, "roles"] }],
+        },
+        submitLabel: i18nKey("tenant.members.roles.edit.submit"),
+        access: { roles: access.admin },
+    };
+}
+export const memberRolesEditScreen = createMemberRolesEditScreen();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.331.0",
+  "version": "0.333.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.331.0",
-    "@cosmicdrift/kumiko-framework": "0.331.0",
-    "@cosmicdrift/kumiko-headless": "0.331.0",
-    "@cosmicdrift/kumiko-renderer": "0.331.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.331.0",
-    "@cosmicdrift/kumiko-types": "0.331.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.333.0",
+    "@cosmicdrift/kumiko-framework": "0.333.0",
+    "@cosmicdrift/kumiko-headless": "0.333.0",
+    "@cosmicdrift/kumiko-renderer": "0.333.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.333.0",
+    "@cosmicdrift/kumiko-types": "0.333.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -983,8 +983,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.331.0",
-    "@cosmicdrift/kumiko-locale-es": "0.331.0",
+    "@cosmicdrift/kumiko-locale-de": "0.333.0",
+    "@cosmicdrift/kumiko-locale-es": "0.333.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/cap-overview/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.332.0",
+    "type": "fix",
+    "title": "tenant-caps:list declares its unsafeRaw escapeHatch"
+  },
   {
     "version": "0.318.0",
     "type": "improvement",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.332.0",
+    "type": "fix",
+    "title": "forget-subject respects tenant retention blockDelete"
+  },
   {
     "version": "0.167.0",
     "type": "breaking",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.332.0",
+    "type": "fix",
+    "title": "Stripe retrieve transient errors answer 503 instead of ignored"
+  },
   {
     "version": "0.320.0",
     "type": "fix",

package/src/tenant/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.333.0",
+    "type": "improvement",
+    "title": "Apps declare assignable membership roles via EXT_ASSIGNABLE_ROLE"
+  },
   {
     "version": "0.313.0",
     "type": "fix",