@cosmicdrift/kumiko-bundled-features 0.333.0 → 0.335.0

package/dist/sessions/handlers/revoke-all-for-user.write.d.ts

@@ -2,6 +2,7 @@ import * as z from "zod";
 export declare const revokeAllForUserWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"user-session:revoke-all-for-user", z.ZodObject<{
     userId: z.ZodString;
     tenantId: z.ZodOptional<z.ZodString>;
+    exceptSessionId: z.ZodOptional<z.ZodUUID>;
 }, z.core.$strip>, {
     count: number;
     userId: string;

package/dist/sessions/handlers/revoke-all-for-user.write.js

@@ -14,7 +14,10 @@ const REVOKE_ALL_SESSIONS_REASON = "revokes the target user's sessions in every
 // Art. 18) and potentially other ops flows ("ban user", "compromised
 // account"). Unlike revoke-all-others, the caller's own session (if any)
 // is revoked too — the caller is System (cron/operator/cross-feature),
-// not the end-user themselves.
+// not the end-user themselves. A caller that IS the end-user (an admin
+// editing their own roles) passes `exceptSessionId` to keep that one
+// session alive; the event then carries keptSessionId so the SSE streams of
+// that session stay open too.
 //
 // Tenant-scope: the userSession schema persists tenantId per row (a user
 // can have sessions in multiple tenants). Omitting `tenantId` revokes
@@ -28,9 +31,10 @@ export const revokeAllForUserWrite = defineWriteHandler({
     schema: z.object({
         userId: z.string().min(1),
         tenantId: z.string().min(1).optional(),
+        exceptSessionId: z.uuid().optional(),
     }),
     access: { roles: access.privileged },
-    description: "Irreversibly signs a named user out of all their live sessions, across every tenant unless a tenantId narrows it; use it for operator actions such as freezing or banning an account.",
+    description: "Irreversibly signs a named user out of all their live sessions, across every tenant unless a tenantId narrows it, optionally sparing one session (exceptSessionId); use it for operator actions such as freezing or banning an account, or a role change that must not end the editor's own session.",
     agent: { risk: "high" },
     escapeHatch: {
         reason: REVOKE_ALL_SESSIONS_REASON,
@@ -41,6 +45,9 @@ export const revokeAllForUserWrite = defineWriteHandler({
             userId: event.payload.userId,
             revokedAt: null,
             ...(event.payload.tenantId !== undefined && { tenantId: event.payload.tenantId }),
+            ...(event.payload.exceptSessionId !== undefined && {
+                id: { ne: event.payload.exceptSessionId },
+            }),
         });
         // Lightweight append alongside the direct-write above (#1559) — see
         // revoke.write.ts for why this isn't a lifecycle event on
@@ -68,6 +75,9 @@ export const revokeAllForUserWrite = defineWriteHandler({
             const payload = sessionRevokedSchema.parse({
                 userId: event.payload.userId,
                 sessionIds: updated.map((row) => row.id),
+                ...(event.payload.exceptSessionId !== undefined && {
+                    keptSessionId: event.payload.exceptSessionId,
+                }),
             });
             const reqCtx = requestContext.get();
             await append(runner, {

package/dist/sessions/handlers/revoke.write.js

@@ -4,7 +4,7 @@ import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import * as z from "zod";
-import { SessionErrors } from "../constants.js";
+import { SessionErrors, USER_SESSION_ENTITY_NAME } from "../constants.js";
 import { userSessionTable } from "../schema/user-session.js";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, } from "../session-revoked-event.js";
 // Revoke a single session by id (= JWT jti). Three distinguishable outcomes:
@@ -66,7 +66,7 @@ export const revokeWrite = defineWriteHandler({
             i18nKey: "errors.ownershipDenied",
             details: {
                 scope: "entity",
-                entityName: "user-session",
+                entityName: USER_SESSION_ENTITY_NAME,
                 action: "revoke",
                 userId: event.user.id,
             },

package/dist/sessions/schema/user-session.d.ts

@@ -9,6 +9,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -29,6 +30,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -109,6 +111,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;
@@ -129,6 +132,7 @@ export declare const userSessionEntity: import("@cosmicdrift/kumiko-types/fields
         readonly filterable?: boolean;
         readonly encrypted?: boolean;
         readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
         readonly format?: "email" | "url" | "phone" | "password";
         readonly default?: string;

package/dist/sessions/schema/user-session.js

@@ -1,5 +1,6 @@
 import { deriveEntityTableMeta } from "@cosmicdrift/kumiko-framework/db";
 import { access, createEntity, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { USER_SESSION_ENTITY_NAME } from "../constants.js";
 // userSession — one row per signed-in client (browser tab, mobile app).
 // The PRIMARY key is the sid — generated by the framework at login time and
 // embedded in the JWT's `jti` claim. Using sid-as-PK means the auth middleware
@@ -78,6 +79,6 @@ export const userSessionEntity = createEntity({
 // revocation is a column write, not an aggregate). Handlers write via ctx.db;
 // the meta carries no executor-only brand so those writes stay legal. See
 // feature.ts for the rebuild-exclusion rationale (#494/#498).
-export const userSessionTable = deriveEntityTableMeta("user-session", userSessionEntity, {
+export const userSessionTable = deriveEntityTableMeta(USER_SESSION_ENTITY_NAME, userSessionEntity, {
     source: "unmanaged",
 });

package/dist/sessions/screens.js

@@ -1,10 +1,14 @@
-import { access, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { access, i18nKey, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { SESSION_DETAIL_SCREEN_ID, SESSION_LIST_SCREEN_ID, SESSION_MINE_SCREEN_ID, SessionHandlers, SessionQueries, } from "./constants.js";
 const listAccess = { roles: access.admin };
 export const sessionListScreen = {
     id: SESSION_LIST_SCREEN_ID,
     type: "projectionList",
     query: SessionQueries.list,
+    // The `list` handler honours `limit` only (no offset/total), so a pager would
+    // show page 1 forever: send one max-size request and render no pager.
+    pagination: false,
+    pageSize: MAX_LIST_LIMIT,
     // Mirrors list.query's own fallback (unrecognised/absent sort → createdAt
     // desc) — kept in sync by hand, boot-validator only requires the field
     // be present once the query accepts `sort` (fw#2230).

package/dist/sessions/session-callbacks.js

@@ -6,7 +6,7 @@ import { Temporal } from "temporal-polyfill";
 import { encryptForDirectWrite } from "../shared/index.js";
 import { tenantMembershipsTable } from "../tenant/index.js";
 import { isPrincipalBlocked, userTable } from "../user/index.js";
-import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS } from "./constants.js";
+import { DEFAULT_SESSION_EXPIRY_MS, LAST_SEEN_REFRESH_MS, USER_SESSION_ENTITY_NAME, } from "./constants.js";
 import { userSessionEntity, userSessionTable } from "./schema/user-session.js";
 import { SESSION_REVOKED_AGGREGATE_TYPE, SESSION_REVOKED_EVENT_QN, sessionRevokedSchema, } from "./session-revoked-event.js";
 // Re-exported so existing `../sessions` importers keep working unchanged.
@@ -19,7 +19,7 @@ export function createSessionCallbacks(opts) {
             const sid = generateId();
             const now = Temporal.Now.instant();
             const expiresAt = now.add({ milliseconds: ttlMs });
-            await insertOne(db, userSessionTable, await encryptForDirectWrite(userSessionEntity, "user-session", {
+            await insertOne(db, userSessionTable, await encryptForDirectWrite(userSessionEntity, USER_SESSION_ENTITY_NAME, {
                 id: sid,
                 tenantId: user.tenantId,
                 userId: user.id,

package/dist/shared/index.d.ts

@@ -10,7 +10,7 @@ export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter, type LockoutCounterState } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { joinRowParentIsVisible, parentRowIsVisible } from "./parent-visibility.js";
+export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/index.js

@@ -10,7 +10,7 @@ export { isIdentityV3Hash, verifyIdentityV3Hash } from "./identity-v3-hash.js";
 export { isTenantDb } from "./is-tenant-db.js";
 export { createLockoutCounter } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
-export { joinRowParentIsVisible, parentRowIsVisible } from "./parent-visibility.js";
+export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";

package/dist/shared/lockout-counter.js

@@ -1,6 +1,6 @@
 // Generic Redis-backed failed-attempt counter with auto-expiring lockout.
 // Extracted from auth-email-password/lockout-store.ts and
-// auth-mfa/mfa-verify-attempts.ts (infra#446) — both were byte-identical
+// auth-mfa/mfa-verify-attempts.ts — both were byte-identical
 // INCR/NX logic, differing only in their Redis key prefixes.
 // Two keys per subject so each can carry its own TTL:
 //   - count-key: 24h, carries the streak. Monotonic — once threshold is

package/dist/shared/parent-visibility.d.ts

@@ -1,4 +1,9 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 export declare function parentRowIsVisible(registry: Registry, entityType: string, entityId: string, user: SessionUser, db: TenantDb): Promise<boolean>;
 export declare function joinRowParentIsVisible(registry: Registry, joinEntityName: string, payload: Readonly<Record<string, unknown>>, user: SessionUser, db: TenantDb): Promise<boolean>;
+export declare function denyUnlessJoinRowParentVisible(registry: Registry, joinEntityName: string, payload: {
+    readonly entityType: string;
+    readonly entityId: string;
+}, user: SessionUser, db: TenantDb): Promise<WriteFailure | null>;

package/dist/shared/parent-visibility.js

@@ -1,9 +1,15 @@
 import { createEntityExecutor, isUuid, } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 // Keyed by definition identity, not by entity name — two test stacks can
 // register different EntityDefinitions under the same entity name.
 const executorsByEntity = new WeakMap();
+// Postgres `serial` is int4; a larger digit string would raise 22003 (numeric
+// out of range) inside the write transaction instead of denying cleanly.
+const SERIAL_ID_MAX = 2_147_483_647;
 function idShapeMatchesEntity(entity, entityId) {
-    return entity.idType === "serial" ? /^\d+$/.test(entityId) : isUuid(entityId);
+    if (entity.idType !== "serial")
+        return isUuid(entityId);
+    return /^\d{1,10}$/.test(entityId) && Number(entityId) <= SERIAL_ID_MAX;
 }
 // Checks whether a client-supplied (entityType, entityId) host reference is one
 // the caller can see via that entity's own read path — tenant scope plus its
@@ -52,3 +58,13 @@ export async function joinRowParentIsVisible(registry, joinEntityName, payload,
     }
     return parentRowIsVisible(registry, entityType, entityId, user, db);
 }
+// Write-handler gate over joinRowParentIsVisible: null means proceed, anything
+// else is returned as-is. The host reference is client input, so this must run
+// FIRST in the handler, ahead of every other lookup — a denied caller then
+// can't tell an invisible parent apart from a missing assignment or an unknown
+// tag/folder; every path answers with the same NotFoundError.
+export async function denyUnlessJoinRowParentVisible(registry, joinEntityName, payload, user, db) {
+    if (await joinRowParentIsVisible(registry, joinEntityName, payload, user, db))
+        return null;
+    return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+}

package/dist/shared/row-bound-grant.js

@@ -3,11 +3,13 @@
 // user-data-rights' confirm-deletion-by-token and any "you just created this
 // row, now enrich it" flow.
 //
-// The row's own anchor (a value that moves on when the row is consumed: a
-// request id, a status, a version) is mixed INTO the HMAC purpose rather
-// than carried in the token. Verification recomputes it from the row's
-// CURRENT anchor, so a replayed token dies the moment the row moves on —
-// single-use semantics without a burn key or Redis. Minting and redeeming
+// The row's own anchor (a value that moves on when the row is consumed) is
+// mixed INTO the HMAC purpose rather than carried in the token. It must be
+// unique per cycle and never recur (request id, UUID, monotonic version): a
+// status can return to an earlier value and revive an old grant (ABA replay).
+// Verification recomputes it from the row's CURRENT anchor, so a replayed
+// token dies the moment the row moves on — single-use semantics without a
+// burn key or Redis. Minting and redeeming
 // share one purpose-building function so the two can't drift apart; that
 // coupling is the whole point of this module, since an unanchored purpose
 // silently degrades to a bearer token valid for the full TTL.
@@ -27,7 +29,9 @@
 // clear. A grant on a row therefore exposes that row's id to whoever holds
 // the link. Where the id itself must stay hidden, use an opaque handle
 // (single-use-token-store) instead.
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { peekTokenSubject, signToken, verifyToken } from "./signed-token.js";
+const log = createFallbackLogger("row-bound-grant");
 const FAILED = { ok: false };
 function anchoredPurpose(purpose, anchor) {
     return `${purpose}:${anchor}`;
@@ -40,6 +44,10 @@ export function signRowBoundGrant(args) {
 // hand an attacker a row-existence oracle on an endpoint that is open to
 // anonymous callers.
 export async function redeemRowBoundGrant(args) {
+    // Misconfiguration must throw on every call, not only on the first valid redemption.
+    if (typeof args.commitAnchor !== "function" && !args.commitAnchor.unsafeSkip.reason.trim()) {
+        throw new Error("row-bound grant: unsafeSkip needs a non-empty reason");
+    }
     if (!args.secret)
         return FAILED;
     const subject = peekTokenSubject(args.token);
@@ -52,7 +60,13 @@ export async function redeemRowBoundGrant(args) {
     try {
         anchor = await args.loadAnchor(subject);
     }
-    catch {
+    catch (error) {
+        // Name/code only: driver messages can echo the attacker-supplied subject.
+        // Logged so an infrastructure outage doesn't look like an expired link.
+        log.warn("row-bound grant anchor lookup failed", {
+            errorName: error instanceof Error ? error.name : typeof error,
+            code: error instanceof Error && "code" in error ? String(error.code) : undefined,
+        });
         return FAILED;
     }
     if (!anchor)
@@ -67,8 +81,5 @@ export async function redeemRowBoundGrant(args) {
         if (!spent)
             return FAILED;
     }
-    else if (!args.commitAnchor.unsafeSkip.reason.trim()) {
-        throw new Error("row-bound grant: unsafeSkip needs a non-empty reason");
-    }
     return { ok: true, subject, expiresAtMs: verified.expiresAtMs };
 }

package/dist/shared/single-use-token-store.js

@@ -1,21 +1,13 @@
 // Generic Redis-backed pre-activation token store: bidirectional
 // token↔subject mapping plus single-use burn/unburn semantics. Extracted
 // from auth-email-password/signup-token-store.ts and
-// auth-email-password/invite-token-store.ts (infra#446) — both were the
-// same Redis layout, differing only in their key prefixes and which field
-// (email vs. invitationId) plays the "subject" role.
+// auth-email-password/invite-token-store.ts — both were the same Redis
+// layout, differing only in their key prefixes and which field (email vs.
+// invitationId) plays the "subject" role.
 //
 // Public subpath export (./shared/single-use-token-store in package.json):
-// offlot-app (a separate repo, external consumer) carries its own copy of
-// this exact logic under `src/features/waitlist/signup-token-store.ts`,
-// with a comment noting it "must stay byte-compatible with
-// auth-email-password/signup-token-store" because signup-confirm resolves
-// tokens via the same Redis key layout. offlot-app#418 (separate issue,
-// after this ships) will replace that copy with
-// `createSingleUseTokenStore({ tokenPrefix: "signup:by-token:", subjectPrefix:
-// "signup:by-email:", burnPrefix: "signup:burn:" })` — i.e. the exact same
-// prefix strings the framework's own signup store below uses, so both stay
-// byte-compatible by construction instead of by hand-copied logic.
+// external consumers share the signup key layout, so the prefixes must stay
+// byte-identical.
 //
 // Token material: opaque random 256-bit (e.g. crypto.randomBytes,
 // base64url-encoded). Not designed for human typing — the subject clicks a

package/dist/step-dispatcher/webhook-runner.d.ts

@@ -3,8 +3,6 @@ import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import * as z from "zod";
 export declare const WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_WEBHOOK_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export declare function readAllowedPrivateWebhookHostsFromEnv(env?: Readonly<Record<string, string | undefined>>): readonly string[];
 export declare function setWebhookHostLookup(fn: typeof lookup | undefined): void;
 export declare const WEBHOOK_AUTH_SECRET_KEY_PREFIX = "step-dispatcher:webhook-auth.";

package/dist/step-dispatcher/webhook-runner.js

@@ -22,18 +22,11 @@
 import { BlockedHostError, buildPinnedRequest, HostResolutionError, resolvePublicHostname, } from "@cosmicdrift/kumiko-framework/http";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
+import { isHostAllowlisted, readHostAllowlistFromEnv } from "../foundation-shared/index.js";
 const log = createFallbackLogger("step-dispatcher");
 export const WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_WEBHOOK_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export function readAllowedPrivateWebhookHostsFromEnv(env = process.env) {
-    const raw = env[WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-    if (!raw)
-        return [];
-    return raw
-        .split(",")
-        .map((host) => host.trim())
-        .filter((host) => host.length > 0);
+    return readHostAllowlistFromEnv(WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, env);
 }
 // Test-only DNS seam — production never calls this, resolvePublicHostname
 // defaults to the real resolver. Reset it in afterEach/afterAll — this is
@@ -87,14 +80,23 @@ async function buildWebhookHeaders(spec, deps) {
         return { ok: true, headers };
     if (!deps.secrets)
         return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
-    const revealed = await deps.secrets.get(deps.tenantId, webhookAuthSecretKey(spec.auth.secret), {
-        userId: deps.userId,
-        handlerName: "step-dispatcher:webhook.send",
-    });
-    if (!revealed) {
+    // A throwing get (corrupt envelope, rotated key, KMS error) must become a
+    // dispatch-failed event; rethrowing would retry and dead-letter the whole
+    // step-dispatcher consumer for every tenant.
+    let secret;
+    try {
+        const revealed = await deps.secrets.get(deps.tenantId, webhookAuthSecretKey(spec.auth.secret), {
+            userId: deps.userId,
+            handlerName: "step-dispatcher:webhook.send",
+        });
+        if (!revealed)
+            return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
+        secret = revealed.reveal();
+    }
+    catch {
+        log.warn("webhook auth secret lookup failed", { tenantId: deps.tenantId });
         return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
     }
-    const secret = revealed.reveal();
     if (spec.auth.kind === "bearer") {
         headers["authorization"] = `Bearer ${secret}`;
     }
@@ -104,8 +106,7 @@ async function buildWebhookHeaders(spec, deps) {
     return { ok: true, headers };
 }
 async function resolveWebhookFetchTarget(rawUrl, url, headers) {
-    const isAllowedPrivateHost = readAllowedPrivateWebhookHostsFromEnv().some((candidate) => candidate.toLowerCase() === url.hostname.toLowerCase());
-    if (isAllowedPrivateHost)
+    if (isHostAllowlisted(url.hostname, readAllowedPrivateWebhookHostsFromEnv()))
         return { ok: true, fetchUrl: rawUrl, requestInit: { headers } };
     try {
         const resolved = await resolvePublicHostname(url.hostname, webhookHostLookup);

package/dist/subscription-mollie/plugin-methods.d.ts

@@ -8,8 +8,9 @@ export type MolliePriceConfig = {
     /** Mollie-format: 2-decimal string, z.B. `"9.99"`. */
     readonly amountValue: string;
     readonly amountCurrency: string;
-    /** Mollie-format: `1 month` / `1 year` / `14 days`. */
-    readonly interval: string;
+    /** Mollie-format: `1 month` / `1 year` / `14 days`. Required for
+     *  subscription prices; omit for one-off prices (`mode: "payment"`). */
+    readonly interval?: string;
     readonly description: string;
 };
 export declare function createMollieCheckoutSession(client: MollieClient, priceToConfig: Readonly<Record<string, MolliePriceConfig>>, appWebhookUrl: string): (_ctx: HandlerContext, options: MollieCheckoutOptions) => Promise<{

package/dist/subscription-mollie/plugin-methods.js

@@ -19,6 +19,11 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
         if (!priceCfg) {
             throw new Error(`subscription-mollie: priceId "${options.priceId}" not in priceToConfig-Map`);
         }
+        // A first payment without an interval would set up a mandate that
+        // verify-webhook can't turn into a subscription — fail before charging.
+        if (options.mode !== "payment" && !priceCfg.interval) {
+            throw new Error(`subscription-mollie: priceId "${options.priceId}" has no interval but is booked as a subscription (mode is not "payment")`);
+        }
         let customerId = options.providerCustomerId;
         if (!customerId) {
             const customer = await client.customers.create({
@@ -50,7 +55,8 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
         })); // @cast-boundary engine-bridge
         const checkoutHref = payment.getCheckoutUrl();
         if (!checkoutHref) {
-            throw new Error("subscription-mollie: payment.getCheckoutUrl() returned null — first-payment-mandates ggf. nicht aktiviert");
+            const mandateHint = sequenceType === SequenceType.first ? " — first-payment-mandates ggf. nicht aktiviert" : "";
+            throw new Error(`subscription-mollie: payment.getCheckoutUrl() returned null (sequenceType=${sequenceType})${mandateHint}`);
         }
         return { url: checkoutHref };
     };

package/dist/subscription-mollie/verify-webhook.js

@@ -14,8 +14,10 @@
 // das im Plugin (idempotent via list-check), damit Foundation einen
 // Created-Event mit subscription-id bekommt.
 import { SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { Temporal } from "temporal-polyfill";
 import { MOLLIE_PROVIDER_NAME } from "./constants.js";
+const log = createFallbackLogger("subscription-mollie");
 export function verifyAndParseMollieWebhook(client, options) {
     return async (rawBody, headers) => {
         const id = extractMollieId(rawBody, headers);
@@ -115,6 +117,10 @@ async function ensureSubscriptionForMandate(client, options, payment) {
     const priceCfg = options.priceToConfig[priceId];
     if (!priceCfg)
         return null;
+    if (!priceCfg.interval) {
+        log.warn("price has no interval, no subscription created", { priceId });
+        return null;
+    }
     const existing = await client.customerSubscriptions.list(customerId);
     const matchingExisting = existing.find((sub) => sub.metadata?.["priceId"] === priceId && // @cast-boundary engine-bridge
         (sub.status === "active" || sub.status === "pending"));

package/dist/subscription-stripe/feature.js

@@ -135,9 +135,9 @@ export function createSubscriptionStripeFeature(options = {}) {
         });
         r.translations({
             keys: {
-                "subscription-stripe.api-key": { en: "Stripe API Key" },
-                "subscription-stripe.webhook-secret": { en: "Stripe Webhook Secret" },
-                "subscription-stripe.billing-live": { en: "Stripe Billing Live" },
+                "subscription-stripe.api-key": { en: "Stripe API key" },
+                "subscription-stripe.webhook-secret": { en: "Stripe webhook secret" },
+                "subscription-stripe.billing-live": { en: "Live billing" },
                 "subscription-stripe.settings": { en: "Stripe" },
                 "screen:subscription-stripe-system.title": { en: "Stripe" },
             },

package/dist/subscription-stripe/plugin-methods.js

@@ -45,6 +45,10 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
                 : {
                     payment_intent_data: { metadata: { tenantId: options.tenantId } },
                     invoice_creation: { enabled: paymentInvoiceCreation },
+                    // Without a customer, Stripe's default "if_required" makes a guest
+                    // checkout when invoice_creation is off; the webhook then has no
+                    // customer id and drops the paid payment as ignored.
+                    ...(!options.providerCustomerId && { customer_creation: "always" }),
                 }),
             ...(options.providerCustomerId && { customer: options.providerCustomerId }),
         });
@@ -113,12 +117,14 @@ function isKnownRecurringInterval(interval) {
 }
 function mapStripePrice(price) {
     const interval = price.recurring?.interval;
+    const knownInterval = isKnownRecurringInterval(interval) ? interval : null;
     return {
         priceId: price.id,
         unitAmount: price.unit_amount,
         currency: price.currency,
-        interval: isKnownRecurringInterval(interval) ? interval : null,
-        intervalCount: price.recurring?.interval_count ?? null,
+        interval: knownInterval,
+        // Kept consistent with `interval`: a count without an interval would read as a half-recurring price.
+        intervalCount: knownInterval ? (price.recurring?.interval_count ?? null) : null,
         active: price.active,
         metadata: price.metadata ?? {},
     };
@@ -162,11 +168,23 @@ async function resolvePricesViaCache(runtime, cache, ctx, priceIds) {
     }
 }
 export function createStripeRetrievePrices(runtime, cache) {
+    const warnedUnknownIntervalPriceIds = new Set();
     return async (ctx, priceIds) => {
         await resolvePricesViaCache(runtime, cache, ctx, priceIds);
         return priceIds.flatMap((priceId) => {
             const price = cache.get(priceId);
-            return price ? [mapStripePrice(price)] : [];
+            if (!price)
+                return [];
+            const mapped = mapStripePrice(price);
+            const rawInterval = price.recurring?.interval;
+            if (rawInterval && mapped.interval === null && !warnedUnknownIntervalPriceIds.has(priceId)) {
+                warnedUnknownIntervalPriceIds.add(priceId);
+                ctx.log?.warn("subscription-stripe: price has an unknown recurring interval", {
+                    priceId,
+                    interval: rawInterval,
+                });
+            }
+            return [mapped];
         });
     };
 }
@@ -175,7 +193,7 @@ function resolveProductId(product) {
     return typeof product === "string" ? product : product.id;
 }
 /** Both our own pre-Stripe-call product+interval collision check and a live
- *  `StripeInvalidRequestError` from `configurations.create()`/`sessions.create()`
+ *  `StripeInvalidRequestError` from `configurations.create()`
  *  surface the same underlying misconfiguration (two plan tiers sharing one
  *  Stripe product) — mapped to the same `UnprocessableError` so the panel
  *  only needs one i18nKey to translate. */
@@ -336,8 +354,9 @@ export function createStripePlanSwitchSession(runtime, cache, portalConfigCache)
             // out-of-band) must not poison every subsequent switch for the same
             // price-set — evict it so the next call re-searches/re-creates.
             portalConfigCache.delete(hash);
-            if (isPlanTiersShareProductStripeError(error))
-                throw planTiersShareProductError(error);
+            // Not mapped to plan_tiers_share_product: a sessions.create error under
+            // flow_data.subscription_update_confirm.* is a different problem (inactive
+            // target price, wrong item) and mapping it would hide the real cause.
             throw error;
         }
     };

package/dist/subscription-stripe/verify-webhook.js

@@ -33,9 +33,11 @@
 // redelivers.
 import { BillingEventKinds, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { ExtraRouteRejection } from "@cosmicdrift/kumiko-framework/api";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import Stripe from "stripe";
 import { Temporal } from "temporal-polyfill";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes } from "./constants.js";
+const log = createFallbackLogger("subscription-stripe");
 export function isResourceMissingStripeError(error) {
     return (error instanceof Stripe.errors.StripeInvalidRequestError && error.code === "resource_missing");
 }
@@ -259,6 +261,12 @@ function isCheckoutSessionEventType(stripeType) {
     return (stripeType === StripeEventTypes.checkoutSessionCompleted ||
         stripeType === StripeEventTypes.checkoutSessionAsyncPaymentSucceeded);
 }
+// The session is already paid, so a silent drop means money collected with no
+// credit — warn (ids and reason only, no PII) so operators can spot it.
+function dropPaidSession(event, session, reason) {
+    log.warn("paid checkout session dropped", { eventId: event.id, sessionId: session.id, reason });
+    return null;
+}
 /** Parses a checkout.session.completed / .async_payment_succeeded event into
  *  a PaymentEvent, or null if it isn't a paid one-off-payment session. */
 async function parsePaymentEvent(event, stripe) {
@@ -296,17 +304,16 @@ async function parsePaymentEvent(event, stripe) {
     const paymentIntent = expanded.payment_intent;
     if (!paymentIntent || typeof paymentIntent === "string") {
         // Not expanded (Stripe-API-drift) or absent — no verified tenant-claim
-        // to trust. Drop silent, same as the subscription-path's missing-
-        // metadata case.
-        return null;
+        // to trust.
+        return dropPaidSession(event, session, "payment_intent_not_expanded");
     }
     const tenantId = paymentIntent.metadata?.["tenantId"];
     if (!tenantId || tenantId.length === 0) {
-        return null;
+        return dropPaidSession(event, session, "missing_tenant_id");
     }
     const priceId = expanded.line_items?.data[0]?.price?.id;
     if (!priceId) {
-        return null;
+        return dropPaidSession(event, session, "missing_price_id");
     }
     // providerCustomerId: session.customer is null for guest checkouts (no
     // customer_creation configured) — fall back to the PaymentIntent's own
@@ -317,7 +324,7 @@ async function parsePaymentEvent(event, stripe) {
             ? paymentIntent.customer
             : paymentIntent.customer?.id);
     if (!providerCustomerId) {
-        return null;
+        return dropPaidSession(event, session, "missing_customer");
     }
     return {
         kind: BillingEventKinds.payment,