@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/auth-mfa/handlers/verify.write.js

@@ -33,6 +33,8 @@ export function createMfaVerifyHandler(opts) {
                 "Also reads the MFA enrollment of the tenant named in the signed login/setup token, not the " +
                 "guest dispatch tenant.",
         },
+        // Payload carries the TOTP/recovery code and the challenge token.
+        agent: { expose: false },
         description: "Finishes a two-step sign-in by checking a TOTP or recovery code against the challenge token that login handed back, under a per-account attempt cap, and derives the resulting session.",
         handler: async (event, ctx) => {
             const verified = verifyMfaChallengeToken(event.payload.challengeToken, opts.challengeTokenSecret);

package/dist/auth-mfa/hmac-token-codec.js

@@ -3,6 +3,9 @@ import { Temporal } from "temporal-polyfill";
 function hmacSign(input, secret) {
     return createHmac("sha256", secret).update(input).digest("base64url");
 }
+// `domain` is part of the signed input: it is the only thing that stops a token
+// minted for one MFA step from verifying as another (e.g. a preauth-setup token
+// replayed as a challenge token), since both share the same secret and payload shape.
 export function createHmacTokenCodec(domain, isPayload) {
     function isEncodedBody(value) {
         if (typeof value !== "object" || value === null)

package/dist/auth-mfa/mfa-challenge-token.js

@@ -6,6 +6,10 @@ function isPayload(value) {
     const v = value;
     return typeof v["userId"] === "string" && typeof v["tenantId"] === "string";
 }
+// Domain-separated from mfa-preauth-setup (see hmac-token-codec). Single-use is
+// enforced by the consumer via burnToken (purpose "mfa-challenge"); this codec
+// only signs and verifies. Brute-forcing the code behind a valid token is
+// limited separately in mfa-verify-attempts.ts.
 const codec = createHmacTokenCodec("mfa-challenge", isPayload);
 export function signMfaChallengeToken(payload, ttlMinutes, secret, now = Temporal.Now.instant()) {
     return codec.sign(payload, ttlMinutes, secret, now);

package/dist/auth-mfa/mfa-preauth-setup-token.js

@@ -6,6 +6,9 @@ function isPayload(value) {
     const v = value;
     return typeof v["userId"] === "string" && typeof v["tenantId"] === "string";
 }
+// Domain "mfa-preauth-setup" must never equal the challenge domain: a setup
+// token has to fail verification as a challenge token and vice versa. The
+// challenge token secret is reused deliberately; the domain carries the separation.
 const codec = createHmacTokenCodec("mfa-preauth-setup", isPayload);
 export function signMfaPreauthSetupToken(payload, ttlMinutes, secret, now = Temporal.Now.instant()) {
     return codec.sign(payload, ttlMinutes, secret, now);

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -9,6 +9,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -101,6 +104,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -121,6 +125,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -141,6 +146,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/auth-mfa/web/mfa-client.d.ts

@@ -1,4 +1,4 @@
-import type { LoginFailure, LoginResponse } from "../../auth-email-password/web/index.js";
+import { type LoginFailure, type LoginResponse } from "../../auth-email-password/web/index.js";
 export type MfaVerifyResult = {
     readonly kind: "success";
     readonly data: LoginResponse;

package/dist/auth-mfa/web/mfa-client.js

@@ -6,6 +6,8 @@
 // byte-identical to /auth/login's ({isSuccess, token, user} | {isSuccess:
 // false, error}) since auth-routes.ts mints via the same
 // mintSessionAndRespond() for both routes.
+// kumiko-lint-ignore cross-feature-import client-only types, the feature's server barrel has no web/ re-export
+import { toLoginResponse, } from "../../auth-email-password/web/index.js";
 export async function verifyMfaChallenge(challengeToken, code) {
     const res = await fetch("/api/auth/mfa/verify", {
         method: "POST",
@@ -21,11 +23,7 @@ export async function verifyMfaChallenge(challengeToken, code) {
     if (body.isSuccess === true && body.token !== undefined && body.user !== undefined) {
         return {
             kind: "success",
-            data: {
-                token: body.token,
-                user: body.user,
-                ...(typeof body.landingPath === "string" && { landingPath: body.landingPath }),
-            },
+            data: toLoginResponse(body.token, body.user, body.landingPath),
         };
     }
     const err = body.error;
@@ -109,11 +107,7 @@ export async function confirmMfaSetupPreauth(setupToken, code) {
     if (body.isSuccess === true && body.token !== undefined && body.user !== undefined) {
         return {
             kind: "success",
-            data: {
-                token: body.token,
-                user: body.user,
-                ...(typeof body.landingPath === "string" && { landingPath: body.landingPath }),
-            },
+            data: toLoginResponse(body.token, body.user, body.landingPath),
         };
     }
     const err = body.error;

package/dist/billing-foundation/billing-info-query.js

@@ -1,6 +1,6 @@
 // Generic billing-info query-handler-config factory. Extracted from the
 // near-identical billing-info.query.ts app copies in show-pony and
-// publicstatus (infra#446) — the only per-app variables were the
+// publicstatus — the only per-app variables were the
 // TTier union/resolver, the allowed roles, and how Stripe prices are read
 // off the app's extraContext.
 //

package/dist/billing-foundation/checkout-core.d.ts

@@ -19,11 +19,11 @@ export declare function findProviderPlugin(ctx: HandlerContext, providerName: st
 export declare function resolveProviderPlugin(ctx: HandlerContext, providerName: string): ResolvedProvider;
 /** Picks the catalog's provider — an explicit `catalog.providerName`, or the
  *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when no provider is available (unset `providerName` not
- *  registered, or no registered plugin exposes `priceToTier`) — a config
- *  state `billing-plans` renders as `enabled: false` instead of erroring.
- *  More than one candidate is a config bug, not a "no provider yet" state,
- *  and still throws `UnconfiguredError`. */
+ *  one. Returns null when `providerName` is unset and no registered plugin
+ *  exposes `priceToTier` — a state `billing-plans` renders as
+ *  `enabled: false` instead of erroring. An explicit `providerName` that is
+ *  not registered, or more than one candidate, is a config bug and throws
+ *  `UnconfiguredError`. */
 export declare function findCatalogProvider(ctx: HandlerContext, catalog: BillingPlanCatalog): ResolvedProvider | null;
 /** `findCatalogProvider` for callers that require a provider to proceed —
  *  start-plan-checkout and switch-plan. `FeatureDisabledError` (not

package/dist/billing-foundation/checkout-core.js

@@ -37,16 +37,20 @@ export function resolveProviderPlugin(ctx, providerName) {
 }
 /** Picks the catalog's provider — an explicit `catalog.providerName`, or the
  *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when no provider is available (unset `providerName` not
- *  registered, or no registered plugin exposes `priceToTier`) — a config
- *  state `billing-plans` renders as `enabled: false` instead of erroring.
- *  More than one candidate is a config bug, not a "no provider yet" state,
- *  and still throws `UnconfiguredError`. */
+ *  one. Returns null when `providerName` is unset and no registered plugin
+ *  exposes `priceToTier` — a state `billing-plans` renders as
+ *  `enabled: false` instead of erroring. An explicit `providerName` that is
+ *  not registered, or more than one candidate, is a config bug and throws
+ *  `UnconfiguredError`. */
 export function findCatalogProvider(ctx, catalog) {
     if (catalog.providerName) {
         const found = findProviderPlugin(ctx, catalog.providerName);
         if (!found) {
-            ctx.log?.warn(`billing-foundation: catalog.providerName "${catalog.providerName}" is not a registered subscriptionProvider — billing-plans renders as disabled`);
+            throw new UnconfiguredError({
+                feature: "billing-foundation",
+                key: "catalog.providerName",
+                hint: `provider "${catalog.providerName}" not registered`,
+            });
         }
         return found;
     }

package/dist/billing-foundation/entities.d.ts

@@ -9,6 +9,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -69,6 +72,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -89,6 +93,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -142,6 +147,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -162,6 +168,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -182,6 +189,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/billing-foundation/handlers/switch-plan.write.js

@@ -4,8 +4,8 @@
 // gets a `catalog`.
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { assertBillingEnabled, assertRedirectOrigins, isNonEmptyStringArray, joinBaseUrl, resolveCatalogProvider, resolveProviderPlugin, } from "../checkout-core.js";
-import { isSwitchableSubscriptionStatus, isTerminalSubscriptionStatus } from "../constants.js";
+import { assertBillingEnabled, assertRedirectOrigins, isNonEmptyStringArray, joinBaseUrl, resolveCatalogProvider, } from "../checkout-core.js";
+import { isSwitchableSubscriptionStatus } from "../constants.js";
 import { getSubscriptionForTenant } from "../get-subscription-for-tenant.js";
 import { purchaseRolesOf, resolvePlanPrices } from "../plan-catalog.js";
 export function createSwitchPlanHandler(options, catalog) {
@@ -25,9 +25,7 @@ export function createSwitchPlanHandler(options, catalog) {
             const { name: catalogProviderName, plugin } = resolveCatalogProvider(ctx, catalog, "switch-plan");
             await assertBillingEnabled(ctx, plugin, "switch-plan");
             const sub = await getSubscriptionForTenant(ctx, event.user.tenantId);
-            if (!sub ||
-                isTerminalSubscriptionStatus(sub.status) ||
-                !isSwitchableSubscriptionStatus(sub.status)) {
+            if (!sub || !isSwitchableSubscriptionStatus(sub.status)) {
                 throw new ConflictError({
                     i18nKey: "billing-foundation.errors.noActiveSubscription",
                     message: "tenant has no switchable subscription; use billing-foundation:write:start-plan-checkout to start one",
@@ -47,14 +45,13 @@ export function createSwitchPlanHandler(options, catalog) {
             }
             // providerSubscriptionId only exists at the subscription's own provider; after a
             // provider migration the catalog provider can differ, which is not a plan switch.
-            const { plugin: switchPlugin } = resolveProviderPlugin(ctx, sub.providerName);
             if (sub.providerName !== catalogProviderName) {
                 throw new ConflictError({
                     i18nKey: "billing-foundation.errors.providerMismatch",
                     message: `tenant's active subscription is on provider "${sub.providerName}", the catalog resolves provider "${catalogProviderName}" — switch-plan cannot switch across providers`,
                 });
             }
-            if (!switchPlugin.createPlanSwitchSession) {
+            if (!plugin.createPlanSwitchSession) {
                 throw new UnprocessableError("plan_switch_not_supported", {
                     i18nKey: "billing-foundation.errors.planSwitchNotSupported",
                     message: `subscription-foundation: provider "${sub.providerName}" has no createPlanSwitchSession-method`,
@@ -74,7 +71,7 @@ export function createSwitchPlanHandler(options, catalog) {
             const baseUrl = options.baseUrl ?? "";
             const returnUrl = joinBaseUrl(baseUrl, catalog.returnPath ?? catalog.successPath);
             assertRedirectOrigins([returnUrl], options.baseUrl);
-            const result = await switchPlugin.createPlanSwitchSession(ctx, {
+            const result = await plugin.createPlanSwitchSession(ctx, {
                 providerSubscriptionId: sub.providerSubscriptionId,
                 targetPriceId: target.priceId,
                 allowedPriceIds,

package/dist/billing-foundation/projection.d.ts

@@ -9,6 +9,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -49,6 +51,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -69,6 +72,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -89,6 +93,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -141,6 +146,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -161,6 +167,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -181,6 +188,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/cap-counter/book-cap-usage.js

@@ -8,19 +8,28 @@ import { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id.js"
 import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, ROLLING_INCREMENTED_EVENT_QN } from "./constants.js";
 import { capCounterEntity } from "./entity.js";
 const { table, executor } = createEntityExecutor("cap-counter", capCounterEntity);
-const capBookingSchema = z.object({
+// periodStartIso feeds the aggregate id and Temporal.Instant.from(); a non-instant string would
+// silently fork a counter row on update and throw a RangeError (500) on create.
+const capPeriodSchema = z.object({
     capName: z.string().min(1).max(100),
-    periodStartIso: z.string().min(1),
+    periodStartIso: z.iso.datetime({ offset: true }),
+});
+const capBookingSchema = capPeriodSchema.extend({
     amount: z.number().int().positive().default(1),
 });
 function isLostCounterRace(result) {
     return !result.isSuccess && result.error.code === "version_conflict";
 }
-// Each attempt writes event + projection atomically, so a conflict means another booker just committed — bounded by how many bookers run at once (pool max, default 10); this ceiling only guards against non-convergence.
+// Each attempt writes event + projection atomically, so a conflict means another booker just committed. Contention is bounded by the bookers running at once across ALL replicas on the same DB (not per pool), so the jittered backoff spreads out losers instead of letting them collide again in lockstep; the ceiling only guards against non-convergence.
 const MAX_COUNTER_WRITE_ATTEMPTS = 20;
+const BACKOFF_JITTER_MS_PER_ATTEMPT = 5;
+function sleepMs(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function retryCounterWriteOnVersionConflict(writeAttempt) {
     let result = await writeAttempt();
     for (let attempt = 1; attempt < MAX_COUNTER_WRITE_ATTEMPTS && isLostCounterRace(result); attempt++) {
+        await sleepMs(Math.random() * attempt * BACKOFF_JITTER_MS_PER_ATTEMPT);
         result = await writeAttempt();
     }
     return result;
@@ -64,11 +73,12 @@ export async function bookCapUsage(ctx, options) {
     return retryCounterWriteOnVersionConflict(() => attemptWrite(ctx.db));
 }
 export async function markCapSoftWarned(ctx, options) {
-    const aggregateId = capCounterAggregateId(ctx.user.tenantId, options.capName, options.periodStartIso);
+    const parsed = capPeriodSchema.parse(options);
+    const aggregateId = capCounterAggregateId(ctx.user.tenantId, parsed.capName, parsed.periodStartIso);
     return retryCounterWriteOnVersionConflict(async () => {
         const existing = await ctx.db.selectMany(table, { id: aggregateId }, { limit: 1 });
         if (existing.length === 0) {
-            throw new Error(`cap-counter: cannot mark-soft-warned, no counter found for tenant=${ctx.user.tenantId} cap=${options.capName} period=${options.periodStartIso}`);
+            throw new Error(`cap-counter: cannot mark-soft-warned, no counter found for tenant=${ctx.user.tenantId} cap=${parsed.capName} period=${parsed.periodStartIso}`);
         }
         const row = existing[0];
         if (!row) {

package/dist/cap-counter/enforce-cap.js

@@ -1,6 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
-import { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
+import { KumikoError, reraiseAsKumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { markCapSoftWarned, readRollingCapUsage } from "./book-cap-usage.js";
 import { capCounterEntity } from "./entity.js";
 // Temporal globally provided by the framework's polyfill init
@@ -48,6 +48,10 @@ export async function enforceCap(ctx, options) {
     if (!ctx.db) {
         throw new Error("cap-counter.enforceCap: ctx.db missing — run inside a handler context");
     }
+    const amount = options.amount ?? 1;
+    if (!Number.isInteger(amount) || amount < 1) {
+        throw new Error(`cap-counter.enforceCap: amount must be a positive integer, got ${options.amount}`);
+    }
     const tolerance = CAP_TOLERANCES[options.profile];
     const softThreshold = options.limit * tolerance.soft;
     const hardThreshold = options.limit * tolerance.hard;
@@ -55,7 +59,7 @@ export async function enforceCap(ctx, options) {
     const row = rows[0];
     const storedValue = row ? row["value"] : 0; // @cast-boundary db-row
     // The last of `amount` units sees this value before its own increment.
-    const value = storedValue + (options.amount ?? 1) - 1;
+    const value = storedValue + amount - 1;
     if (value >= hardThreshold) {
         throw new CapExceededError(options.capName, options.limit, value, tolerance);
     }
@@ -193,10 +197,12 @@ export async function enforceCapAndMaybeNotify(ctx, options) {
             tenantId: ctx.user.tenantId,
         });
         // Flip the soft-warned flag so the same period doesn't re-notify.
-        await markCapSoftWarned(ctx, {
+        const marked = await markCapSoftWarned(ctx, {
             capName: options.capName,
             periodStartIso: options.periodStartIso,
         });
+        if (!marked.isSuccess)
+            throw reraiseAsKumikoError(marked.error);
     }
     return result;
 }

package/dist/cap-counter/entity.d.ts

@@ -9,6 +9,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/cap-counter/feature.js

@@ -91,7 +91,9 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         entity: "cap-counter",
         columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
         defaultSort: { field: "capName", dir: "asc" },
-        searchable: true,
+        // Search resolves against the caller's own tenant stream, so on this
+        // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.
+        searchable: false,
         access: { roles: ["SystemAdmin"] },
     });
     r.nav({
@@ -105,7 +107,6 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         keys: {
             ...CAP_COUNTER_I18N,
             "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
-            "cap-counter:entity:cap-counter:field:tenantId": { de: "Mandant", en: "Tenant" },
         },
     });
 });

package/dist/cap-counter/i18n.d.ts

@@ -1,4 +1,5 @@
 type LocalizedString = {
+    readonly de: string;
     readonly en: string;
 };
 export declare const CAP_COUNTER_I18N: Readonly<Record<string, LocalizedString>>;

package/dist/cap-counter/i18n.js

@@ -1,10 +1,11 @@
 export const CAP_COUNTER_I18N = {
-    "screen:cap-list.title": { en: "Usage caps" },
-    "cap-counter:entity:cap-counter:field:tenantId": { en: "Tenant" },
-    "cap-counter:entity:cap-counter:field:capName": { en: "Cap" },
-    "cap-counter:entity:cap-counter:field:value": { en: "Value" },
-    "cap-counter:entity:cap-counter:field:periodStart": { en: "Period start" },
+    "screen:cap-list.title": { de: "Nutzungslimits", en: "Usage caps" },
+    "cap-counter:entity:cap-counter:field:tenantId": { de: "Mandant", en: "Tenant" },
+    "cap-counter:entity:cap-counter:field:capName": { de: "Limit", en: "Cap" },
+    "cap-counter:entity:cap-counter:field:value": { de: "Wert", en: "Value" },
+    "cap-counter:entity:cap-counter:field:periodStart": { de: "Periodenbeginn", en: "Period start" },
     "cap-counter:entity:cap-counter:field:lastSoftWarnedAt": {
+        de: "Letzte Soft-Warnung",
         en: "Last soft warning",
     },
 };

package/dist/cap-overview/handlers/caps-usage.query.js

@@ -51,30 +51,23 @@ export function createCapsUsageQuery(caps) {
             const rows = await Promise.all(caps.map(async (cap) => {
                 const used = await cap.usage(db, targetTenantId);
                 const limit = await cap.limit(tier, { config: ctx.config });
+                const base = {
+                    id: cap.id,
+                    label: cap.label,
+                    limit,
+                    ...(cap.icon !== undefined && { icon: cap.icon }),
+                    ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }),
+                };
                 if (used === null) {
-                    return {
-                        id: cap.id,
-                        label: cap.label,
-                        used: null,
-                        limit,
-                        fraction: 0,
-                        tone: "default",
-                        percent: null,
-                        ...(cap.icon !== undefined && { icon: cap.icon }),
-                        ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }),
-                    };
+                    return { ...base, used: null, fraction: 0, tone: "default", percent: null };
                 }
                 const fraction = computeFraction(used, limit);
                 return {
-                    id: cap.id,
-                    label: cap.label,
+                    ...base,
                     used,
-                    limit,
                     fraction,
                     tone: computeTone(fraction),
                     percent: limit === null ? null : Math.round(computeUnclampedFraction(used, limit) * 100),
-                    ...(cap.icon !== undefined && { icon: cap.icon }),
-                    ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }),
                 };
             }));
             return { rows };

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -52,6 +52,26 @@ function assertSupportedTierFilterOp(op) {
         });
     }
 }
+function extractTierFilter(filters) {
+    const tierFilters = filters.filter((f) => f.field === "tier");
+    if (tierFilters.length !== filters.length || tierFilters.length > 1) {
+        const unsupportedField = filters.find((f) => f.field !== "tier")?.field ?? "tier";
+        throw new ValidationError({
+            fields: [
+                {
+                    path: "filters",
+                    code: "unsupported_field",
+                    i18nKey: "cap-overview.errors.filterFieldUnsupported",
+                    params: { field: unsupportedField },
+                },
+            ],
+        });
+    }
+    const tierFilter = tierFilters[0];
+    if (tierFilter !== undefined)
+        assertSupportedTierFilterOp(tierFilter.op);
+    return tierFilter;
+}
 function matchesTierFilter(tier, filter) {
     if (filter === undefined)
         return true;
@@ -104,10 +124,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
             // query builder (only `like`, SQL-LIKE case-sensitive) — filtered here
             // in JS, same as tenant/team-list.query.ts's search.
             const search = query.payload.search?.trim().toLowerCase();
-            const filters = query.payload.filters ?? [];
-            const tierFilter = filters.find((f) => f.field === "tier");
-            if (tierFilter !== undefined)
-                assertSupportedTierFilterOp(tierFilter.op);
+            const tierFilter = extractTierFilter(query.payload.filters ?? []);
             const merged = tenants
                 .filter((tenant) => search === undefined || search === "" || tenant.name.toLowerCase().includes(search))
                 .map((tenant) => {
@@ -144,24 +161,33 @@ export function createTenantCapsListQuery(caps, listCaps) {
             // that the fix is a real combined read-projection, not a cursor
             // bolted onto this merge.
             const offset = query.payload.cursor ? Number(decodeCursor(query.payload.cursor)) : 0;
+            if (!Number.isInteger(offset) || offset < 0) {
+                throw new ValidationError({
+                    fields: [
+                        {
+                            path: "cursor",
+                            code: "invalid_cursor",
+                            i18nKey: "cap-overview.errors.invalidCursor",
+                        },
+                    ],
+                });
+            }
             const limit = query.payload.limit;
             const page = sorted.slice(offset, offset + limit);
-            // N+1 avoidance: usage is computed only for this page's tenant ids,
-            // never for the full tenant set.
+            // Usage is computed only for this page's tenant ids, never for the
+            // full tenant set; caps without usageBatch still cost one query per
+            // tenant of the page, so those run in parallel.
             const pageTenantIds = page.map((row) => row.tenantId);
             const usageByCap = new Map();
-            for (const cap of listedCaps) {
+            await Promise.all(listedCaps.map(async (cap) => {
                 if (cap.usageBatch) {
                     usageByCap.set(cap.id, await cap.usageBatch(db, pageTenantIds));
+                    // skip: batch result already stored, no per-tenant fallback needed
+                    return;
                 }
-                else {
-                    const perTenant = new Map();
-                    for (const tenantId of pageTenantIds) {
-                        perTenant.set(tenantId, await cap.usage(db, tenantId));
-                    }
-                    usageByCap.set(cap.id, perTenant);
-                }
-            }
+                const perTenantEntries = await Promise.all(pageTenantIds.map(async (tenantId) => [tenantId, await cap.usage(db, tenantId)]));
+                usageByCap.set(cap.id, new Map(perTenantEntries));
+            }));
             const limitByCapAndTier = await resolveLimitsByCapAndTier(listedCaps, new Set(page.map((row) => row.tier)), { config: ctx.config });
             const rows = page.map((row) => {
                 const capFields = {};