@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.335.0

package/dist/auth-mfa/hmac-token-codec.js

@@ -3,6 +3,9 @@ import { Temporal } from "temporal-polyfill";
 function hmacSign(input, secret) {
     return createHmac("sha256", secret).update(input).digest("base64url");
 }
+// `domain` is part of the signed input: it is the only thing that stops a token
+// minted for one MFA step from verifying as another (e.g. a preauth-setup token
+// replayed as a challenge token), since both share the same secret and payload shape.
 export function createHmacTokenCodec(domain, isPayload) {
     function isEncodedBody(value) {
         if (typeof value !== "object" || value === null)

package/dist/auth-mfa/mfa-challenge-token.js

@@ -6,6 +6,10 @@ function isPayload(value) {
     const v = value;
     return typeof v["userId"] === "string" && typeof v["tenantId"] === "string";
 }
+// Domain-separated from mfa-preauth-setup (see hmac-token-codec). Single-use is
+// enforced by the consumer via burnToken (purpose "mfa-challenge"); this codec
+// only signs and verifies. Brute-forcing the code behind a valid token is
+// limited separately in mfa-verify-attempts.ts.
 const codec = createHmacTokenCodec("mfa-challenge", isPayload);
 export function signMfaChallengeToken(payload, ttlMinutes, secret, now = Temporal.Now.instant()) {
     return codec.sign(payload, ttlMinutes, secret, now);

package/dist/auth-mfa/mfa-preauth-setup-token.js

@@ -6,6 +6,9 @@ function isPayload(value) {
     const v = value;
     return typeof v["userId"] === "string" && typeof v["tenantId"] === "string";
 }
+// Domain "mfa-preauth-setup" must never equal the challenge domain: a setup
+// token has to fail verification as a challenge token and vice versa. The
+// challenge token secret is reused deliberately; the domain carries the separation.
 const codec = createHmacTokenCodec("mfa-preauth-setup", isPayload);
 export function signMfaPreauthSetupToken(payload, ttlMinutes, secret, now = Temporal.Now.instant()) {
     return codec.sign(payload, ttlMinutes, secret, now);

package/dist/auth-mfa/web/mfa-client.d.ts

@@ -1,4 +1,4 @@
-import type { LoginFailure, LoginResponse } from "../../auth-email-password/web/index.js";
+import { type LoginFailure, type LoginResponse } from "../../auth-email-password/web/index.js";
 export type MfaVerifyResult = {
     readonly kind: "success";
     readonly data: LoginResponse;

package/dist/auth-mfa/web/mfa-client.js

@@ -6,6 +6,8 @@
 // byte-identical to /auth/login's ({isSuccess, token, user} | {isSuccess:
 // false, error}) since auth-routes.ts mints via the same
 // mintSessionAndRespond() for both routes.
+// kumiko-lint-ignore cross-feature-import client-only types, the feature's server barrel has no web/ re-export
+import { toLoginResponse, } from "../../auth-email-password/web/index.js";
 export async function verifyMfaChallenge(challengeToken, code) {
     const res = await fetch("/api/auth/mfa/verify", {
         method: "POST",
@@ -21,11 +23,7 @@ export async function verifyMfaChallenge(challengeToken, code) {
     if (body.isSuccess === true && body.token !== undefined && body.user !== undefined) {
         return {
             kind: "success",
-            data: {
-                token: body.token,
-                user: body.user,
-                ...(typeof body.landingPath === "string" && { landingPath: body.landingPath }),
-            },
+            data: toLoginResponse(body.token, body.user, body.landingPath),
         };
     }
     const err = body.error;
@@ -109,11 +107,7 @@ export async function confirmMfaSetupPreauth(setupToken, code) {
     if (body.isSuccess === true && body.token !== undefined && body.user !== undefined) {
         return {
             kind: "success",
-            data: {
-                token: body.token,
-                user: body.user,
-                ...(typeof body.landingPath === "string" && { landingPath: body.landingPath }),
-            },
+            data: toLoginResponse(body.token, body.user, body.landingPath),
         };
     }
     const err = body.error;

package/dist/billing-foundation/billing-info-query.js

@@ -1,6 +1,6 @@
 // Generic billing-info query-handler-config factory. Extracted from the
 // near-identical billing-info.query.ts app copies in show-pony and
-// publicstatus (infra#446) — the only per-app variables were the
+// publicstatus — the only per-app variables were the
 // TTier union/resolver, the allowed roles, and how Stripe prices are read
 // off the app's extraContext.
 //

package/dist/billing-foundation/checkout-core.d.ts

@@ -19,11 +19,11 @@ export declare function findProviderPlugin(ctx: HandlerContext, providerName: st
 export declare function resolveProviderPlugin(ctx: HandlerContext, providerName: string): ResolvedProvider;
 /** Picks the catalog's provider — an explicit `catalog.providerName`, or the
  *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when no provider is available (unset `providerName` not
- *  registered, or no registered plugin exposes `priceToTier`) — a config
- *  state `billing-plans` renders as `enabled: false` instead of erroring.
- *  More than one candidate is a config bug, not a "no provider yet" state,
- *  and still throws `UnconfiguredError`. */
+ *  one. Returns null when `providerName` is unset and no registered plugin
+ *  exposes `priceToTier` — a state `billing-plans` renders as
+ *  `enabled: false` instead of erroring. An explicit `providerName` that is
+ *  not registered, or more than one candidate, is a config bug and throws
+ *  `UnconfiguredError`. */
 export declare function findCatalogProvider(ctx: HandlerContext, catalog: BillingPlanCatalog): ResolvedProvider | null;
 /** `findCatalogProvider` for callers that require a provider to proceed —
  *  start-plan-checkout and switch-plan. `FeatureDisabledError` (not

package/dist/billing-foundation/checkout-core.js

@@ -37,16 +37,20 @@ export function resolveProviderPlugin(ctx, providerName) {
 }
 /** Picks the catalog's provider — an explicit `catalog.providerName`, or the
  *  single registered provider exposing `priceToTier` when there is exactly
- *  one. Returns null when no provider is available (unset `providerName` not
- *  registered, or no registered plugin exposes `priceToTier`) — a config
- *  state `billing-plans` renders as `enabled: false` instead of erroring.
- *  More than one candidate is a config bug, not a "no provider yet" state,
- *  and still throws `UnconfiguredError`. */
+ *  one. Returns null when `providerName` is unset and no registered plugin
+ *  exposes `priceToTier` — a state `billing-plans` renders as
+ *  `enabled: false` instead of erroring. An explicit `providerName` that is
+ *  not registered, or more than one candidate, is a config bug and throws
+ *  `UnconfiguredError`. */
 export function findCatalogProvider(ctx, catalog) {
     if (catalog.providerName) {
         const found = findProviderPlugin(ctx, catalog.providerName);
         if (!found) {
-            ctx.log?.warn(`billing-foundation: catalog.providerName "${catalog.providerName}" is not a registered subscriptionProvider — billing-plans renders as disabled`);
+            throw new UnconfiguredError({
+                feature: "billing-foundation",
+                key: "catalog.providerName",
+                hint: `provider "${catalog.providerName}" not registered`,
+            });
         }
         return found;
     }

package/dist/billing-foundation/handlers/switch-plan.write.js

@@ -4,8 +4,8 @@
 // gets a `catalog`.
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { assertBillingEnabled, assertRedirectOrigins, isNonEmptyStringArray, joinBaseUrl, resolveCatalogProvider, resolveProviderPlugin, } from "../checkout-core.js";
-import { isSwitchableSubscriptionStatus, isTerminalSubscriptionStatus } from "../constants.js";
+import { assertBillingEnabled, assertRedirectOrigins, isNonEmptyStringArray, joinBaseUrl, resolveCatalogProvider, } from "../checkout-core.js";
+import { isSwitchableSubscriptionStatus } from "../constants.js";
 import { getSubscriptionForTenant } from "../get-subscription-for-tenant.js";
 import { purchaseRolesOf, resolvePlanPrices } from "../plan-catalog.js";
 export function createSwitchPlanHandler(options, catalog) {
@@ -25,9 +25,7 @@ export function createSwitchPlanHandler(options, catalog) {
             const { name: catalogProviderName, plugin } = resolveCatalogProvider(ctx, catalog, "switch-plan");
             await assertBillingEnabled(ctx, plugin, "switch-plan");
             const sub = await getSubscriptionForTenant(ctx, event.user.tenantId);
-            if (!sub ||
-                isTerminalSubscriptionStatus(sub.status) ||
-                !isSwitchableSubscriptionStatus(sub.status)) {
+            if (!sub || !isSwitchableSubscriptionStatus(sub.status)) {
                 throw new ConflictError({
                     i18nKey: "billing-foundation.errors.noActiveSubscription",
                     message: "tenant has no switchable subscription; use billing-foundation:write:start-plan-checkout to start one",
@@ -47,14 +45,13 @@ export function createSwitchPlanHandler(options, catalog) {
             }
             // providerSubscriptionId only exists at the subscription's own provider; after a
             // provider migration the catalog provider can differ, which is not a plan switch.
-            const { plugin: switchPlugin } = resolveProviderPlugin(ctx, sub.providerName);
             if (sub.providerName !== catalogProviderName) {
                 throw new ConflictError({
                     i18nKey: "billing-foundation.errors.providerMismatch",
                     message: `tenant's active subscription is on provider "${sub.providerName}", the catalog resolves provider "${catalogProviderName}" — switch-plan cannot switch across providers`,
                 });
             }
-            if (!switchPlugin.createPlanSwitchSession) {
+            if (!plugin.createPlanSwitchSession) {
                 throw new UnprocessableError("plan_switch_not_supported", {
                     i18nKey: "billing-foundation.errors.planSwitchNotSupported",
                     message: `subscription-foundation: provider "${sub.providerName}" has no createPlanSwitchSession-method`,
@@ -74,7 +71,7 @@ export function createSwitchPlanHandler(options, catalog) {
             const baseUrl = options.baseUrl ?? "";
             const returnUrl = joinBaseUrl(baseUrl, catalog.returnPath ?? catalog.successPath);
             assertRedirectOrigins([returnUrl], options.baseUrl);
-            const result = await switchPlugin.createPlanSwitchSession(ctx, {
+            const result = await plugin.createPlanSwitchSession(ctx, {
                 providerSubscriptionId: sub.providerSubscriptionId,
                 targetPriceId: target.priceId,
                 allowedPriceIds,

package/dist/cap-counter/book-cap-usage.js

@@ -8,19 +8,28 @@ import { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id.js"
 import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, ROLLING_INCREMENTED_EVENT_QN } from "./constants.js";
 import { capCounterEntity } from "./entity.js";
 const { table, executor } = createEntityExecutor("cap-counter", capCounterEntity);
-const capBookingSchema = z.object({
+// periodStartIso feeds the aggregate id and Temporal.Instant.from(); a non-instant string would
+// silently fork a counter row on update and throw a RangeError (500) on create.
+const capPeriodSchema = z.object({
     capName: z.string().min(1).max(100),
-    periodStartIso: z.string().min(1),
+    periodStartIso: z.iso.datetime({ offset: true }),
+});
+const capBookingSchema = capPeriodSchema.extend({
     amount: z.number().int().positive().default(1),
 });
 function isLostCounterRace(result) {
     return !result.isSuccess && result.error.code === "version_conflict";
 }
-// Each attempt writes event + projection atomically, so a conflict means another booker just committed — bounded by how many bookers run at once (pool max, default 10); this ceiling only guards against non-convergence.
+// Each attempt writes event + projection atomically, so a conflict means another booker just committed. Contention is bounded by the bookers running at once across ALL replicas on the same DB (not per pool), so the jittered backoff spreads out losers instead of letting them collide again in lockstep; the ceiling only guards against non-convergence.
 const MAX_COUNTER_WRITE_ATTEMPTS = 20;
+const BACKOFF_JITTER_MS_PER_ATTEMPT = 5;
+function sleepMs(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function retryCounterWriteOnVersionConflict(writeAttempt) {
     let result = await writeAttempt();
     for (let attempt = 1; attempt < MAX_COUNTER_WRITE_ATTEMPTS && isLostCounterRace(result); attempt++) {
+        await sleepMs(Math.random() * attempt * BACKOFF_JITTER_MS_PER_ATTEMPT);
         result = await writeAttempt();
     }
     return result;
@@ -64,11 +73,12 @@ export async function bookCapUsage(ctx, options) {
     return retryCounterWriteOnVersionConflict(() => attemptWrite(ctx.db));
 }
 export async function markCapSoftWarned(ctx, options) {
-    const aggregateId = capCounterAggregateId(ctx.user.tenantId, options.capName, options.periodStartIso);
+    const parsed = capPeriodSchema.parse(options);
+    const aggregateId = capCounterAggregateId(ctx.user.tenantId, parsed.capName, parsed.periodStartIso);
     return retryCounterWriteOnVersionConflict(async () => {
         const existing = await ctx.db.selectMany(table, { id: aggregateId }, { limit: 1 });
         if (existing.length === 0) {
-            throw new Error(`cap-counter: cannot mark-soft-warned, no counter found for tenant=${ctx.user.tenantId} cap=${options.capName} period=${options.periodStartIso}`);
+            throw new Error(`cap-counter: cannot mark-soft-warned, no counter found for tenant=${ctx.user.tenantId} cap=${parsed.capName} period=${parsed.periodStartIso}`);
         }
         const row = existing[0];
         if (!row) {

package/dist/cap-counter/enforce-cap.js

@@ -1,6 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
-import { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
+import { KumikoError, reraiseAsKumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { markCapSoftWarned, readRollingCapUsage } from "./book-cap-usage.js";
 import { capCounterEntity } from "./entity.js";
 // Temporal globally provided by the framework's polyfill init
@@ -48,6 +48,10 @@ export async function enforceCap(ctx, options) {
     if (!ctx.db) {
         throw new Error("cap-counter.enforceCap: ctx.db missing — run inside a handler context");
     }
+    const amount = options.amount ?? 1;
+    if (!Number.isInteger(amount) || amount < 1) {
+        throw new Error(`cap-counter.enforceCap: amount must be a positive integer, got ${options.amount}`);
+    }
     const tolerance = CAP_TOLERANCES[options.profile];
     const softThreshold = options.limit * tolerance.soft;
     const hardThreshold = options.limit * tolerance.hard;
@@ -55,7 +59,7 @@ export async function enforceCap(ctx, options) {
     const row = rows[0];
     const storedValue = row ? row["value"] : 0; // @cast-boundary db-row
     // The last of `amount` units sees this value before its own increment.
-    const value = storedValue + (options.amount ?? 1) - 1;
+    const value = storedValue + amount - 1;
     if (value >= hardThreshold) {
         throw new CapExceededError(options.capName, options.limit, value, tolerance);
     }
@@ -193,10 +197,12 @@ export async function enforceCapAndMaybeNotify(ctx, options) {
             tenantId: ctx.user.tenantId,
         });
         // Flip the soft-warned flag so the same period doesn't re-notify.
-        await markCapSoftWarned(ctx, {
+        const marked = await markCapSoftWarned(ctx, {
             capName: options.capName,
             periodStartIso: options.periodStartIso,
         });
+        if (!marked.isSuccess)
+            throw reraiseAsKumikoError(marked.error);
     }
     return result;
 }

package/dist/cap-counter/feature.js

@@ -91,7 +91,9 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         entity: "cap-counter",
         columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
         defaultSort: { field: "capName", dir: "asc" },
-        searchable: true,
+        // Search resolves against the caller's own tenant stream, so on this
+        // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.
+        searchable: false,
         access: { roles: ["SystemAdmin"] },
     });
     r.nav({
@@ -105,7 +107,6 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         keys: {
             ...CAP_COUNTER_I18N,
             "cap-counter:nav.cap-list": { de: "Limits", en: "Caps" },
-            "cap-counter:entity:cap-counter:field:tenantId": { de: "Mandant", en: "Tenant" },
         },
     });
 });

package/dist/cap-counter/i18n.d.ts

@@ -1,4 +1,5 @@
 type LocalizedString = {
+    readonly de: string;
     readonly en: string;
 };
 export declare const CAP_COUNTER_I18N: Readonly<Record<string, LocalizedString>>;

package/dist/cap-counter/i18n.js

@@ -1,10 +1,11 @@
 export const CAP_COUNTER_I18N = {
-    "screen:cap-list.title": { en: "Usage caps" },
-    "cap-counter:entity:cap-counter:field:tenantId": { en: "Tenant" },
-    "cap-counter:entity:cap-counter:field:capName": { en: "Cap" },
-    "cap-counter:entity:cap-counter:field:value": { en: "Value" },
-    "cap-counter:entity:cap-counter:field:periodStart": { en: "Period start" },
+    "screen:cap-list.title": { de: "Nutzungslimits", en: "Usage caps" },
+    "cap-counter:entity:cap-counter:field:tenantId": { de: "Mandant", en: "Tenant" },
+    "cap-counter:entity:cap-counter:field:capName": { de: "Limit", en: "Cap" },
+    "cap-counter:entity:cap-counter:field:value": { de: "Wert", en: "Value" },
+    "cap-counter:entity:cap-counter:field:periodStart": { de: "Periodenbeginn", en: "Period start" },
     "cap-counter:entity:cap-counter:field:lastSoftWarnedAt": {
+        de: "Letzte Soft-Warnung",
         en: "Last soft warning",
     },
 };

package/dist/cap-overview/handlers/caps-usage.query.js

@@ -51,30 +51,23 @@ export function createCapsUsageQuery(caps) {
             const rows = await Promise.all(caps.map(async (cap) => {
                 const used = await cap.usage(db, targetTenantId);
                 const limit = await cap.limit(tier, { config: ctx.config });
+                const base = {
+                    id: cap.id,
+                    label: cap.label,
+                    limit,
+                    ...(cap.icon !== undefined && { icon: cap.icon }),
+                    ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }),
+                };
                 if (used === null) {
-                    return {
-                        id: cap.id,
-                        label: cap.label,
-                        used: null,
-                        limit,
-                        fraction: 0,
-                        tone: "default",
-                        percent: null,
-                        ...(cap.icon !== undefined && { icon: cap.icon }),
-                        ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }),
-                    };
+                    return { ...base, used: null, fraction: 0, tone: "default", percent: null };
                 }
                 const fraction = computeFraction(used, limit);
                 return {
-                    id: cap.id,
-                    label: cap.label,
+                    ...base,
                     used,
-                    limit,
                     fraction,
                     tone: computeTone(fraction),
                     percent: limit === null ? null : Math.round(computeUnclampedFraction(used, limit) * 100),
-                    ...(cap.icon !== undefined && { icon: cap.icon }),
-                    ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }),
                 };
             }));
             return { rows };

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -52,6 +52,26 @@ function assertSupportedTierFilterOp(op) {
         });
     }
 }
+function extractTierFilter(filters) {
+    const tierFilters = filters.filter((f) => f.field === "tier");
+    if (tierFilters.length !== filters.length || tierFilters.length > 1) {
+        const unsupportedField = filters.find((f) => f.field !== "tier")?.field ?? "tier";
+        throw new ValidationError({
+            fields: [
+                {
+                    path: "filters",
+                    code: "unsupported_field",
+                    i18nKey: "cap-overview.errors.filterFieldUnsupported",
+                    params: { field: unsupportedField },
+                },
+            ],
+        });
+    }
+    const tierFilter = tierFilters[0];
+    if (tierFilter !== undefined)
+        assertSupportedTierFilterOp(tierFilter.op);
+    return tierFilter;
+}
 function matchesTierFilter(tier, filter) {
     if (filter === undefined)
         return true;
@@ -104,10 +124,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
             // query builder (only `like`, SQL-LIKE case-sensitive) — filtered here
             // in JS, same as tenant/team-list.query.ts's search.
             const search = query.payload.search?.trim().toLowerCase();
-            const filters = query.payload.filters ?? [];
-            const tierFilter = filters.find((f) => f.field === "tier");
-            if (tierFilter !== undefined)
-                assertSupportedTierFilterOp(tierFilter.op);
+            const tierFilter = extractTierFilter(query.payload.filters ?? []);
             const merged = tenants
                 .filter((tenant) => search === undefined || search === "" || tenant.name.toLowerCase().includes(search))
                 .map((tenant) => {
@@ -144,24 +161,33 @@ export function createTenantCapsListQuery(caps, listCaps) {
             // that the fix is a real combined read-projection, not a cursor
             // bolted onto this merge.
             const offset = query.payload.cursor ? Number(decodeCursor(query.payload.cursor)) : 0;
+            if (!Number.isInteger(offset) || offset < 0) {
+                throw new ValidationError({
+                    fields: [
+                        {
+                            path: "cursor",
+                            code: "invalid_cursor",
+                            i18nKey: "cap-overview.errors.invalidCursor",
+                        },
+                    ],
+                });
+            }
             const limit = query.payload.limit;
             const page = sorted.slice(offset, offset + limit);
-            // N+1 avoidance: usage is computed only for this page's tenant ids,
-            // never for the full tenant set.
+            // Usage is computed only for this page's tenant ids, never for the
+            // full tenant set; caps without usageBatch still cost one query per
+            // tenant of the page, so those run in parallel.
             const pageTenantIds = page.map((row) => row.tenantId);
             const usageByCap = new Map();
-            for (const cap of listedCaps) {
+            await Promise.all(listedCaps.map(async (cap) => {
                 if (cap.usageBatch) {
                     usageByCap.set(cap.id, await cap.usageBatch(db, pageTenantIds));
+                    // skip: batch result already stored, no per-tenant fallback needed
+                    return;
                 }
-                else {
-                    const perTenant = new Map();
-                    for (const tenantId of pageTenantIds) {
-                        perTenant.set(tenantId, await cap.usage(db, tenantId));
-                    }
-                    usageByCap.set(cap.id, perTenant);
-                }
-            }
+                const perTenantEntries = await Promise.all(pageTenantIds.map(async (tenantId) => [tenantId, await cap.usage(db, tenantId)]));
+                usageByCap.set(cap.id, new Map(perTenantEntries));
+            }));
             const limitByCapAndTier = await resolveLimitsByCapAndTier(listedCaps, new Set(page.map((row) => row.tier)), { config: ctx.config });
             const rows = page.map((row) => {
                 const capFields = {};

package/dist/cap-overview/i18n.js

@@ -11,9 +11,14 @@ export const CAP_OVERVIEW_I18N = {
     "cap-overview.cards.empty": { en: "No caps configured for this tenant." },
     "cap-overview.cards.loading": { en: "Loading usage…" },
     "cap-overview.notMeasured": { en: "Not measured yet" },
+    "cap-overview.unlimited": { en: "{used} · unlimited" },
     "cap-overview.errors.progressPrimitiveMissing": {
         en: "Usage bar unavailable — Progress primitive is not registered.",
     },
+    "cap-overview.errors.invalidCursor": { en: "The pagination cursor is invalid." },
+    "cap-overview.errors.filterFieldUnsupported": {
+        en: "Filtering by this field is not supported, or tier was filtered more than once.",
+    },
     "cap-overview.errors.sortFieldUnsupported": { en: "Sorting by this field is not supported." },
     "cap-overview.errors.tenantOverrideRequiresSystemAdmin": {
         en: "Only SystemAdmin may query another tenant's data.",

package/dist/cap-overview/web/cap-cards-panel.js

@@ -52,10 +52,13 @@ export function CapCardsPanel({ filterParams }) {
         // rule exists, since that file IS in the scanned surface.
         className: "grid gap-4 sm:grid-cols-2 lg:grid-cols-4", "data-testid": "cap-cards-panel", children: [query.loading && rows.length === 0 && (_jsx("div", { className: "text-sm text-muted-foreground", children: t("cap-overview.cards.loading") })), rows.map((cap) => {
                 const Icon = cap.icon !== undefined ? CAP_ICONS[cap.icon] : undefined;
+                // An unlimited, measured cap has neither a badge nor a bar; StatCard still
+                // wraps any defined child in a spacing div, so pass undefined then.
+                const body = !isMeasured(cap) || cap.limit !== null ? (_jsxs("div", { className: "flex flex-col gap-2", children: [cap.percent !== null && (_jsx("div", { className: "flex items-center justify-between gap-2", children: _jsx(StatusBadge, { tone: TONE_TO_STATUS[cap.tone], children: `${cap.percent}%` }) })), _jsx(CapUsageBar, { usage: cap, showLabel: false })] })) : undefined;
                 return (_jsx(StatCard, { icon: Icon !== undefined ? _jsx(Icon, { className: "size-4" }) : undefined, label: t(cap.label), value: !isMeasured(cap)
                         ? "—"
                         : cap.limit === null
                             ? String(cap.used)
-                            : `${cap.used} / ${cap.limit}`, ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }), testId: "cap-card", children: _jsxs("div", { className: "flex flex-col gap-2", children: [cap.percent !== null && (_jsx("div", { className: "flex items-center justify-between gap-2", children: _jsx(StatusBadge, { tone: TONE_TO_STATUS[cap.tone], children: `${cap.percent}%` }) })), _jsx(CapUsageBar, { usage: cap, showLabel: false })] }) }, cap.id));
+                            : `${cap.used} / ${cap.limit}`, ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }), testId: "cap-card", children: body }, cap.id));
             })] }));
 }

package/dist/cap-overview/web/cap-usage-bar.js

@@ -10,7 +10,7 @@ export function CapUsageBar({ usage, showLabel = true, }) {
     }
     if (usage.limit === null) {
         // A progress bar with no denominator says nothing — show the raw count instead.
-        return showLabel ? (_jsx(Text, { variant: "small", testId: "cap-usage-unlimited", children: String(usage.used) })) : null;
+        return showLabel ? (_jsx(Text, { variant: "small", testId: "cap-usage-unlimited", children: t("cap-overview.unlimited", { used: usage.used }) })) : null;
     }
     return (_jsxs("div", { className: "flex flex-col gap-1", children: [Progress ? (_jsx(Progress, { value: usage.fraction, tone: computeTone(usage.fraction), testId: "cap-usage-bar" })) : (_jsx(Banner, { variant: "error", testId: "cap-usage-bar-missing-primitive", children: t("cap-overview.errors.progressPrimitiveMissing") })), showLabel && _jsx(Text, { variant: "small", children: `${usage.used} / ${usage.limit}` })] }));
 }

package/dist/channel-email/email-channel.js

@@ -15,6 +15,10 @@ function stringHeaders(raw) {
     }
     return Object.keys(out).length > 0 ? out : undefined;
 }
+const UNSUBSCRIBE_HEADER_NAMES = new Set([
+    "list-unsubscribe",
+    "list-unsubscribe-post",
+]);
 // Only the framework's own unsubscribe route can honor a one-click POST.
 function listUnsubscribeHeaders(data) {
     const rawUrl = data?.["unsubscribeUrl"];
@@ -43,7 +47,14 @@ function emailEnvelopeFrom(data) {
     const replyTo = typeof data["replyTo"] === "string" ? data["replyTo"] : undefined;
     const autoHeaders = listUnsubscribeHeaders(data);
     const explicitHeaders = stringHeaders(data["headers"]);
-    const headers = autoHeaders || explicitHeaders ? { ...autoHeaders, ...explicitHeaders } : undefined;
+    // Header names are case-insensitive, and the auto pair only works together:
+    // an explicit override of either half must drop both, or a mail client would
+    // one-click POST to a URL that cannot handle it.
+    const overridesUnsubscribe = explicitHeaders !== undefined &&
+        Object.keys(explicitHeaders).some((name) => UNSUBSCRIBE_HEADER_NAMES.has(name.toLowerCase()));
+    const headers = (!overridesUnsubscribe && autoHeaders) || explicitHeaders
+        ? { ...(overridesUnsubscribe ? undefined : autoHeaders), ...explicitHeaders }
+        : undefined;
     return { ...(from && { from }), ...(replyTo && { replyTo }), ...(headers && { headers }) };
 }
 export function createEmailChannel(options) {

package/dist/channel-in-app/tables.js

@@ -1,4 +1,4 @@
-import { asEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
+import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import { boolean, instant, table as pgTable, serial, sql, text, uuid, } from "@cosmicdrift/kumiko-framework/db";
 export const inAppMessagesTable = pgTable("in_app_messages", {
     id: serial("id").primaryKey(),
@@ -14,8 +14,4 @@ export const inAppMessagesTable = pgTable("in_app_messages", {
 });
 // Derived from inAppMessagesTable (table() attaches the meta as a Symbol) so
 // the two can't drift, instead of hand-duplicating the column list.
-const derivedInAppMessagesTableMeta = asEntityTableMeta(inAppMessagesTable);
-if (!derivedInAppMessagesTableMeta) {
-    throw new Error("inAppMessagesTable: table carries no EntityTableMeta — built via table()?");
-}
-export const inAppMessagesTableMeta = derivedInAppMessagesTableMeta;
+export const inAppMessagesTableMeta = requireEntityTableMeta(inAppMessagesTable, "inAppMessagesTable");

package/dist/compliance-profiles/handlers/sub-processors.query.js

@@ -19,7 +19,7 @@ export const subProcessorsQuery = defineQueryHandler({
     name: "sub-processors",
     schema: z.object({}),
     access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     description: "Returns the publicly readable Kumiko sub-processor list split into active and planned entries, for the GDPR Art. 28(2) disclosure a privacy policy or data-processing agreement links to.",
     handler: async () => {
         return {

package/dist/config/db/queries/resolver.js

@@ -1,6 +1,8 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configValuesTable } from "../../table.js";
-// Method-form so a tenant-mode TenantDb stays filtered.
+// Method-form so a tenant-mode TenantDb stays filtered. Two parallel selects
+// (disjoint via userId IS NULL) instead of one OR query: the buckets don't share
+// a snapshot, so a concurrent config write can mix old scope and new user values.
 export async function selectConfigRowsForScope(db, systemTenantId, tenantId, userId) {
     const [scopeRows, userRows] = await Promise.all([
         selectMany(db, configValuesTable, {

package/dist/config/handlers/set.write.js

@@ -1,10 +1,11 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { ConfigScopes, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireConfigEncryption, requireSystemDb } from "../feature.js";
+import { MASKED } from "../read-redaction.js";
 import { configValueEntity, configValuesTable } from "../table.js";
 import { findConfigRow, prepareConfigWrite, resolvePiiSubject, validateBounds, validateExtensionPlugin, validatePattern, validateScope, validateType, } from "../write-helpers.js";
 const scopeEnum = z.enum([ConfigScopes.system, ConfigScopes.tenant, ConfigScopes.user]);
@@ -53,7 +54,7 @@ export const setWrite = defineWriteHandler({
         const typeError = validateType(event.payload.value, keyDef);
         if (typeError)
             return writeFailure(typeError);
-        const pluginError = validateExtensionPlugin(ctx.registry, event.payload.key, event.payload.value);
+        const pluginError = validateExtensionPlugin(ctx.registry, event.payload.key, event.payload.value, keyDef);
         if (pluginError)
             return writeFailure(pluginError);
         // Bounds enforcement: hard-reject (not silent-clamp). A caller that
@@ -66,6 +67,9 @@ export const setWrite = defineWriteHandler({
         const patternError = validatePattern(event.payload.value, keyDef);
         if (patternError)
             return writeFailure(patternError);
+        // The batch idempotency cache stores this result and only masks entity
+        // writeOnly fields, so an at-rest-encrypted value must not be echoed.
+        const echoedValue = isEncryptedAtRest(keyDef) ? MASKED : event.payload.value;
         // backing="secrets": persist into the secrets store (system tenant, own
         // envelope encryption + audit) instead of config_values. Same JSON
         // serialization as a config row so the read path round-trips via
@@ -82,7 +86,7 @@ export const setWrite = defineWriteHandler({
             });
             return {
                 isSuccess: true,
-                data: { key: event.payload.key, value: event.payload.value, scope },
+                data: { key: event.payload.key, value: echoedValue, scope },
             };
         }
         let serialized = JSON.stringify(event.payload.value);
@@ -139,7 +143,7 @@ export const setWrite = defineWriteHandler({
         }
         return {
             isSuccess: true,
-            data: { key: event.payload.key, value: event.payload.value, scope },
+            data: { key: event.payload.key, value: echoedValue, scope },
         };
     },
 });

package/dist/config/web/i18n.js

@@ -9,6 +9,7 @@
 export const defaultTranslations = {
     en: {
         "config.secrets.delete": "Remove",
+        "config.secrets.deleteConfirm": "Remove this secret? Anything using it stops working, and it cannot be restored.",
         "config.secrets.notSet": "Not set",
         "config.secrets.placeholder": "Enter a value",
         "config.secrets.replacePlaceholder": "Enter a new value to replace it",

package/dist/config/write-helpers.d.ts

@@ -38,7 +38,7 @@ export declare function resolveScopeIds(scope: ConfigScope, tenantId: TenantId,
     userId: string | null;
 };
 export declare function resolvePiiSubject(scope: Exclude<ConfigScope, "system">, tenantId: TenantId, userId: string | null): SubjectId;
-export declare function validateExtensionPlugin(registry: Registry, key: string, value: string | number | boolean): KumikoError | null;
+export declare function validateExtensionPlugin(registry: Pick<Registry, "getAllExtensionSelectors" | "getExtensionUsages">, key: string, value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validateType(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validateBounds(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validatePattern(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;