@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.335.0

package/dist/shared/row-bound-grant.js

@@ -3,11 +3,13 @@
 // user-data-rights' confirm-deletion-by-token and any "you just created this
 // row, now enrich it" flow.
 //
-// The row's own anchor (a value that moves on when the row is consumed: a
-// request id, a status, a version) is mixed INTO the HMAC purpose rather
-// than carried in the token. Verification recomputes it from the row's
-// CURRENT anchor, so a replayed token dies the moment the row moves on —
-// single-use semantics without a burn key or Redis. Minting and redeeming
+// The row's own anchor (a value that moves on when the row is consumed) is
+// mixed INTO the HMAC purpose rather than carried in the token. It must be
+// unique per cycle and never recur (request id, UUID, monotonic version): a
+// status can return to an earlier value and revive an old grant (ABA replay).
+// Verification recomputes it from the row's CURRENT anchor, so a replayed
+// token dies the moment the row moves on — single-use semantics without a
+// burn key or Redis. Minting and redeeming
 // share one purpose-building function so the two can't drift apart; that
 // coupling is the whole point of this module, since an unanchored purpose
 // silently degrades to a bearer token valid for the full TTL.
@@ -27,7 +29,9 @@
 // clear. A grant on a row therefore exposes that row's id to whoever holds
 // the link. Where the id itself must stay hidden, use an opaque handle
 // (single-use-token-store) instead.
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { peekTokenSubject, signToken, verifyToken } from "./signed-token.js";
+const log = createFallbackLogger("row-bound-grant");
 const FAILED = { ok: false };
 function anchoredPurpose(purpose, anchor) {
     return `${purpose}:${anchor}`;
@@ -40,6 +44,10 @@ export function signRowBoundGrant(args) {
 // hand an attacker a row-existence oracle on an endpoint that is open to
 // anonymous callers.
 export async function redeemRowBoundGrant(args) {
+    // Misconfiguration must throw on every call, not only on the first valid redemption.
+    if (typeof args.commitAnchor !== "function" && !args.commitAnchor.unsafeSkip.reason.trim()) {
+        throw new Error("row-bound grant: unsafeSkip needs a non-empty reason");
+    }
     if (!args.secret)
         return FAILED;
     const subject = peekTokenSubject(args.token);
@@ -52,7 +60,13 @@ export async function redeemRowBoundGrant(args) {
     try {
         anchor = await args.loadAnchor(subject);
     }
-    catch {
+    catch (error) {
+        // Name/code only: driver messages can echo the attacker-supplied subject.
+        // Logged so an infrastructure outage doesn't look like an expired link.
+        log.warn("row-bound grant anchor lookup failed", {
+            errorName: error instanceof Error ? error.name : typeof error,
+            code: error instanceof Error && "code" in error ? String(error.code) : undefined,
+        });
         return FAILED;
     }
     if (!anchor)
@@ -67,8 +81,5 @@ export async function redeemRowBoundGrant(args) {
         if (!spent)
             return FAILED;
     }
-    else if (!args.commitAnchor.unsafeSkip.reason.trim()) {
-        throw new Error("row-bound grant: unsafeSkip needs a non-empty reason");
-    }
     return { ok: true, subject, expiresAtMs: verified.expiresAtMs };
 }

package/dist/shared/single-use-token-store.js

@@ -1,21 +1,13 @@
 // Generic Redis-backed pre-activation token store: bidirectional
 // token↔subject mapping plus single-use burn/unburn semantics. Extracted
 // from auth-email-password/signup-token-store.ts and
-// auth-email-password/invite-token-store.ts (infra#446) — both were the
-// same Redis layout, differing only in their key prefixes and which field
-// (email vs. invitationId) plays the "subject" role.
+// auth-email-password/invite-token-store.ts — both were the same Redis
+// layout, differing only in their key prefixes and which field (email vs.
+// invitationId) plays the "subject" role.
 //
 // Public subpath export (./shared/single-use-token-store in package.json):
-// offlot-app (a separate repo, external consumer) carries its own copy of
-// this exact logic under `src/features/waitlist/signup-token-store.ts`,
-// with a comment noting it "must stay byte-compatible with
-// auth-email-password/signup-token-store" because signup-confirm resolves
-// tokens via the same Redis key layout. offlot-app#418 (separate issue,
-// after this ships) will replace that copy with
-// `createSingleUseTokenStore({ tokenPrefix: "signup:by-token:", subjectPrefix:
-// "signup:by-email:", burnPrefix: "signup:burn:" })` — i.e. the exact same
-// prefix strings the framework's own signup store below uses, so both stay
-// byte-compatible by construction instead of by hand-copied logic.
+// external consumers share the signup key layout, so the prefixes must stay
+// byte-identical.
 //
 // Token material: opaque random 256-bit (e.g. crypto.randomBytes,
 // base64url-encoded). Not designed for human typing — the subject clicks a

package/dist/step-dispatcher/webhook-runner.d.ts

@@ -3,8 +3,6 @@ import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { TenantId } from "@cosmicdrift/kumiko-types/identifiers";
 import * as z from "zod";
 export declare const WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_WEBHOOK_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export declare function readAllowedPrivateWebhookHostsFromEnv(env?: Readonly<Record<string, string | undefined>>): readonly string[];
 export declare function setWebhookHostLookup(fn: typeof lookup | undefined): void;
 export declare const WEBHOOK_AUTH_SECRET_KEY_PREFIX = "step-dispatcher:webhook-auth.";

package/dist/step-dispatcher/webhook-runner.js

@@ -22,18 +22,11 @@
 import { BlockedHostError, buildPinnedRequest, HostResolutionError, resolvePublicHostname, } from "@cosmicdrift/kumiko-framework/http";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
+import { isHostAllowlisted, readHostAllowlistFromEnv } from "../foundation-shared/index.js";
 const log = createFallbackLogger("step-dispatcher");
 export const WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR = "KUMIKO_WEBHOOK_ALLOWED_PRIVATE_HOSTS";
-/** Parses the comma-separated operator allowlist env var. Never throws —
- *  an unset or empty value just means no bypass. */
 export function readAllowedPrivateWebhookHostsFromEnv(env = process.env) {
-    const raw = env[WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR];
-    if (!raw)
-        return [];
-    return raw
-        .split(",")
-        .map((host) => host.trim())
-        .filter((host) => host.length > 0);
+    return readHostAllowlistFromEnv(WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, env);
 }
 // Test-only DNS seam — production never calls this, resolvePublicHostname
 // defaults to the real resolver. Reset it in afterEach/afterAll — this is
@@ -87,14 +80,23 @@ async function buildWebhookHeaders(spec, deps) {
         return { ok: true, headers };
     if (!deps.secrets)
         return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
-    const revealed = await deps.secrets.get(deps.tenantId, webhookAuthSecretKey(spec.auth.secret), {
-        userId: deps.userId,
-        handlerName: "step-dispatcher:webhook.send",
-    });
-    if (!revealed) {
+    // A throwing get (corrupt envelope, rotated key, KMS error) must become a
+    // dispatch-failed event; rethrowing would retry and dead-letter the whole
+    // step-dispatcher consumer for every tenant.
+    let secret;
+    try {
+        const revealed = await deps.secrets.get(deps.tenantId, webhookAuthSecretKey(spec.auth.secret), {
+            userId: deps.userId,
+            handlerName: "step-dispatcher:webhook.send",
+        });
+        if (!revealed)
+            return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
+        secret = revealed.reveal();
+    }
+    catch {
+        log.warn("webhook auth secret lookup failed", { tenantId: deps.tenantId });
         return { ok: false, error: WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR };
     }
-    const secret = revealed.reveal();
     if (spec.auth.kind === "bearer") {
         headers["authorization"] = `Bearer ${secret}`;
     }
@@ -104,8 +106,7 @@ async function buildWebhookHeaders(spec, deps) {
     return { ok: true, headers };
 }
 async function resolveWebhookFetchTarget(rawUrl, url, headers) {
-    const isAllowedPrivateHost = readAllowedPrivateWebhookHostsFromEnv().some((candidate) => candidate.toLowerCase() === url.hostname.toLowerCase());
-    if (isAllowedPrivateHost)
+    if (isHostAllowlisted(url.hostname, readAllowedPrivateWebhookHostsFromEnv()))
         return { ok: true, fetchUrl: rawUrl, requestInit: { headers } };
     try {
         const resolved = await resolvePublicHostname(url.hostname, webhookHostLookup);

package/dist/subscription-mollie/plugin-methods.d.ts

@@ -8,8 +8,9 @@ export type MolliePriceConfig = {
     /** Mollie-format: 2-decimal string, z.B. `"9.99"`. */
     readonly amountValue: string;
     readonly amountCurrency: string;
-    /** Mollie-format: `1 month` / `1 year` / `14 days`. */
-    readonly interval: string;
+    /** Mollie-format: `1 month` / `1 year` / `14 days`. Required for
+     *  subscription prices; omit for one-off prices (`mode: "payment"`). */
+    readonly interval?: string;
     readonly description: string;
 };
 export declare function createMollieCheckoutSession(client: MollieClient, priceToConfig: Readonly<Record<string, MolliePriceConfig>>, appWebhookUrl: string): (_ctx: HandlerContext, options: MollieCheckoutOptions) => Promise<{

package/dist/subscription-mollie/plugin-methods.js

@@ -19,6 +19,11 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
         if (!priceCfg) {
             throw new Error(`subscription-mollie: priceId "${options.priceId}" not in priceToConfig-Map`);
         }
+        // A first payment without an interval would set up a mandate that
+        // verify-webhook can't turn into a subscription — fail before charging.
+        if (options.mode !== "payment" && !priceCfg.interval) {
+            throw new Error(`subscription-mollie: priceId "${options.priceId}" has no interval but is booked as a subscription (mode is not "payment")`);
+        }
         let customerId = options.providerCustomerId;
         if (!customerId) {
             const customer = await client.customers.create({
@@ -50,7 +55,8 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
         })); // @cast-boundary engine-bridge
         const checkoutHref = payment.getCheckoutUrl();
         if (!checkoutHref) {
-            throw new Error("subscription-mollie: payment.getCheckoutUrl() returned null — first-payment-mandates ggf. nicht aktiviert");
+            const mandateHint = sequenceType === SequenceType.first ? " — first-payment-mandates ggf. nicht aktiviert" : "";
+            throw new Error(`subscription-mollie: payment.getCheckoutUrl() returned null (sequenceType=${sequenceType})${mandateHint}`);
         }
         return { url: checkoutHref };
     };

package/dist/subscription-mollie/verify-webhook.js

@@ -14,8 +14,10 @@
 // das im Plugin (idempotent via list-check), damit Foundation einen
 // Created-Event mit subscription-id bekommt.
 import { SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { Temporal } from "temporal-polyfill";
 import { MOLLIE_PROVIDER_NAME } from "./constants.js";
+const log = createFallbackLogger("subscription-mollie");
 export function verifyAndParseMollieWebhook(client, options) {
     return async (rawBody, headers) => {
         const id = extractMollieId(rawBody, headers);
@@ -115,6 +117,10 @@ async function ensureSubscriptionForMandate(client, options, payment) {
     const priceCfg = options.priceToConfig[priceId];
     if (!priceCfg)
         return null;
+    if (!priceCfg.interval) {
+        log.warn("price has no interval, no subscription created", { priceId });
+        return null;
+    }
     const existing = await client.customerSubscriptions.list(customerId);
     const matchingExisting = existing.find((sub) => sub.metadata?.["priceId"] === priceId && // @cast-boundary engine-bridge
         (sub.status === "active" || sub.status === "pending"));

package/dist/subscription-stripe/plugin-methods.js

@@ -45,6 +45,10 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
                 : {
                     payment_intent_data: { metadata: { tenantId: options.tenantId } },
                     invoice_creation: { enabled: paymentInvoiceCreation },
+                    // Without a customer, Stripe's default "if_required" makes a guest
+                    // checkout when invoice_creation is off; the webhook then has no
+                    // customer id and drops the paid payment as ignored.
+                    ...(!options.providerCustomerId && { customer_creation: "always" }),
                 }),
             ...(options.providerCustomerId && { customer: options.providerCustomerId }),
         });
@@ -113,12 +117,14 @@ function isKnownRecurringInterval(interval) {
 }
 function mapStripePrice(price) {
     const interval = price.recurring?.interval;
+    const knownInterval = isKnownRecurringInterval(interval) ? interval : null;
     return {
         priceId: price.id,
         unitAmount: price.unit_amount,
         currency: price.currency,
-        interval: isKnownRecurringInterval(interval) ? interval : null,
-        intervalCount: price.recurring?.interval_count ?? null,
+        interval: knownInterval,
+        // Kept consistent with `interval`: a count without an interval would read as a half-recurring price.
+        intervalCount: knownInterval ? (price.recurring?.interval_count ?? null) : null,
         active: price.active,
         metadata: price.metadata ?? {},
     };
@@ -162,11 +168,23 @@ async function resolvePricesViaCache(runtime, cache, ctx, priceIds) {
     }
 }
 export function createStripeRetrievePrices(runtime, cache) {
+    const warnedUnknownIntervalPriceIds = new Set();
     return async (ctx, priceIds) => {
         await resolvePricesViaCache(runtime, cache, ctx, priceIds);
         return priceIds.flatMap((priceId) => {
             const price = cache.get(priceId);
-            return price ? [mapStripePrice(price)] : [];
+            if (!price)
+                return [];
+            const mapped = mapStripePrice(price);
+            const rawInterval = price.recurring?.interval;
+            if (rawInterval && mapped.interval === null && !warnedUnknownIntervalPriceIds.has(priceId)) {
+                warnedUnknownIntervalPriceIds.add(priceId);
+                ctx.log?.warn("subscription-stripe: price has an unknown recurring interval", {
+                    priceId,
+                    interval: rawInterval,
+                });
+            }
+            return [mapped];
         });
     };
 }
@@ -175,7 +193,7 @@ function resolveProductId(product) {
     return typeof product === "string" ? product : product.id;
 }
 /** Both our own pre-Stripe-call product+interval collision check and a live
- *  `StripeInvalidRequestError` from `configurations.create()`/`sessions.create()`
+ *  `StripeInvalidRequestError` from `configurations.create()`
  *  surface the same underlying misconfiguration (two plan tiers sharing one
  *  Stripe product) — mapped to the same `UnprocessableError` so the panel
  *  only needs one i18nKey to translate. */
@@ -336,8 +354,9 @@ export function createStripePlanSwitchSession(runtime, cache, portalConfigCache)
             // out-of-band) must not poison every subsequent switch for the same
             // price-set — evict it so the next call re-searches/re-creates.
             portalConfigCache.delete(hash);
-            if (isPlanTiersShareProductStripeError(error))
-                throw planTiersShareProductError(error);
+            // Not mapped to plan_tiers_share_product: a sessions.create error under
+            // flow_data.subscription_update_confirm.* is a different problem (inactive
+            // target price, wrong item) and mapping it would hide the real cause.
             throw error;
         }
     };

package/dist/subscription-stripe/verify-webhook.js

@@ -33,9 +33,11 @@
 // redelivers.
 import { BillingEventKinds, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { ExtraRouteRejection } from "@cosmicdrift/kumiko-framework/api";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import Stripe from "stripe";
 import { Temporal } from "temporal-polyfill";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes } from "./constants.js";
+const log = createFallbackLogger("subscription-stripe");
 export function isResourceMissingStripeError(error) {
     return (error instanceof Stripe.errors.StripeInvalidRequestError && error.code === "resource_missing");
 }
@@ -259,6 +261,12 @@ function isCheckoutSessionEventType(stripeType) {
     return (stripeType === StripeEventTypes.checkoutSessionCompleted ||
         stripeType === StripeEventTypes.checkoutSessionAsyncPaymentSucceeded);
 }
+// The session is already paid, so a silent drop means money collected with no
+// credit — warn (ids and reason only, no PII) so operators can spot it.
+function dropPaidSession(event, session, reason) {
+    log.warn("paid checkout session dropped", { eventId: event.id, sessionId: session.id, reason });
+    return null;
+}
 /** Parses a checkout.session.completed / .async_payment_succeeded event into
  *  a PaymentEvent, or null if it isn't a paid one-off-payment session. */
 async function parsePaymentEvent(event, stripe) {
@@ -296,17 +304,16 @@ async function parsePaymentEvent(event, stripe) {
     const paymentIntent = expanded.payment_intent;
     if (!paymentIntent || typeof paymentIntent === "string") {
         // Not expanded (Stripe-API-drift) or absent — no verified tenant-claim
-        // to trust. Drop silent, same as the subscription-path's missing-
-        // metadata case.
-        return null;
+        // to trust.
+        return dropPaidSession(event, session, "payment_intent_not_expanded");
     }
     const tenantId = paymentIntent.metadata?.["tenantId"];
     if (!tenantId || tenantId.length === 0) {
-        return null;
+        return dropPaidSession(event, session, "missing_tenant_id");
     }
     const priceId = expanded.line_items?.data[0]?.price?.id;
     if (!priceId) {
-        return null;
+        return dropPaidSession(event, session, "missing_price_id");
     }
     // providerCustomerId: session.customer is null for guest checkouts (no
     // customer_creation configured) — fall back to the PaymentIntent's own
@@ -317,7 +324,7 @@ async function parsePaymentEvent(event, stripe) {
             ? paymentIntent.customer
             : paymentIntent.customer?.id);
     if (!providerCustomerId) {
-        return null;
+        return dropPaidSession(event, session, "missing_customer");
     }
     return {
         kind: BillingEventKinds.payment,

package/dist/tags/handlers/assign-tag.write.js

@@ -1,5 +1,5 @@
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tagAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagAssignmentExecutor, tagExecutor } from "../executor.js";
@@ -33,15 +33,9 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
         description: "Attaches an existing catalog tag to one host entity addressed by its type and id, reporting success when the tag was already attached; use it to tag a record, not to create the tag.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown tag —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
             const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
             if (existing) {

package/dist/tags/handlers/remove-tag.write.js

@@ -1,5 +1,4 @@
-import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { joinRowParentIsVisible } from "../../shared/index.js";
+import { denyUnlessJoinRowParentVisible } from "../../shared/index.js";
 import { tagAssignmentAggregateId } from "../aggregate-id.js";
 import { DEFAULT_TAG_ACCESS } from "../constants.js";
 import { tagAssignmentExecutor } from "../executor.js";
@@ -19,15 +18,9 @@ export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS) {
         description: "Detaches one catalog tag from one host entity, reporting success when it was not attached; use it to untag a single record while the tag itself stays in the catalog.",
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
-            // entityType/entityId are client input: the caller must be able to see
-            // the host row through that entity's own read path (tenant scope plus its
-            // `access.read` ownership) before its assignment row may be written.
-            // Checked FIRST, ahead of every lookup below, so a denied caller can't tell
-            // an invisible parent apart from a missing assignment or an unknown tag —
-            // every path answers with the same NotFoundError.
-            if (!(await joinRowParentIsVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db))) {
-                return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
-            }
+            const denied = await denyUnlessJoinRowParentVisible(ctx.registry, "tag-assignment", payload, event.user, ctx.db);
+            if (denied)
+                return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
             const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
             if (!existing) {

package/dist/template-resolver/api.d.ts

@@ -1,5 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
 import type { ContentFormat, TemplateKind } from "./constants.js";
 export type TemplateResource = {
     readonly id: string;
@@ -17,7 +18,7 @@ export type TemplateResource = {
     readonly scope: "system" | "tenant";
     readonly parentTemplateId: string | null;
     readonly status: "draft" | "active" | "archived";
-    readonly updatedAt: Date;
+    readonly modifiedAt: Temporal.Instant | null;
 };
 export type ResolveRequest = {
     readonly tenantId: TenantId;

package/dist/template-resolver/api.js

@@ -70,7 +70,7 @@ function toPublic(row) {
         scope,
         parentTemplateId: row.parentTemplateId,
         status,
-        updatedAt: row.updatedAt,
+        modifiedAt: row.modifiedAt,
     };
 }
 function parseJson(raw) {

package/dist/template-resolver/handlers/by-slug.query.d.ts

@@ -10,5 +10,5 @@ export declare const bySlugQuery: import("@cosmicdrift/kumiko-types/define-handl
     content: string | null;
     contentFormat: string;
     folder: string | null;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 } | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/by-slug.query.js

@@ -24,7 +24,7 @@ export const bySlugQuery = defineQueryHandler({
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Reads one text-block of a tenant by slug and locale together with its body and format; it is pinned to the text-block kind so mail templates and AI prompts in the same table stay unreachable through this anonymous-capable path.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
@@ -47,7 +47,7 @@ export const bySlugQuery = defineQueryHandler({
             content: row.content,
             contentFormat: row.contentFormat,
             folder: row.folder,
-            updatedAt: row.updatedAt,
+            modifiedAt: row.modifiedAt,
         };
     },
 });

package/dist/template-resolver/handlers/by-tenant.query.d.ts

@@ -1,3 +1,4 @@
+import type { Temporal } from "temporal-polyfill";
 import * as z from "zod";
 export type TextBlockSummary = {
     readonly slug: string;
@@ -5,7 +6,7 @@ export type TextBlockSummary = {
     readonly title: string | null;
     readonly content: string | null;
     readonly folder: string | null;
-    readonly updatedAt: Date;
+    readonly modifiedAt: Temporal.Instant | null;
 };
 export declare const byTenantQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"by-tenant", z.ZodObject<{
     tenantIdOverride: z.ZodOptional<z.ZodString>;
@@ -16,6 +17,6 @@ export declare const byTenantQuery: import("@cosmicdrift/kumiko-types/define-han
         title: string | null;
         content: string | null;
         folder: string | null;
-        updatedAt: Date;
+        modifiedAt: Temporal.Instant | null;
     }[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/by-tenant.query.js

@@ -11,7 +11,7 @@ export const byTenantQuery = defineQueryHandler({
         tenantIdOverride: z.string().min(1).optional(),
     }),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
-    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
     description: "Lists every text-block of a tenant with slug, locale, title and body so a public content tree can be rendered in one call; use it for the whole sidebar, and by-slug when only one block is needed.",
     handler: async (query, ctx) => {
         const override = query.payload.tenantIdOverride;
@@ -27,7 +27,7 @@ export const byTenantQuery = defineQueryHandler({
                 title: row.title,
                 content: row.content,
                 folder: row.folder,
-                updatedAt: row.updatedAt,
+                modifiedAt: row.modifiedAt,
             })),
         };
     },

package/dist/template-resolver/handlers/collection-item.query.d.ts

@@ -11,5 +11,5 @@ export declare function makeCollectionItemQuery(collection: ContentCollectionDef
     content: string | null;
     contentFormat: string;
     folder: string | null;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 } | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/collection-list.query.d.ts

@@ -10,6 +10,6 @@ export declare function makeCollectionListQuery(collection: ContentCollectionDef
         content: string | null;
         contentFormat: string;
         folder: string | null;
-        updatedAt: Date;
+        modifiedAt: import("temporal-spec").Temporal.Instant | null;
     }[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/collection-shared.d.ts

@@ -1,5 +1,6 @@
 import type { EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import type { AccessRule, ContentCollectionDefinition, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
 import { templateResourcesTable } from "../table.js";
 import { userContentEntriesTable } from "../user-content-table.js";
 export declare const DEFAULT_COLLECTION_ACCESS: AccessRule;
@@ -12,7 +13,7 @@ export type CollectionEntryRow = {
     readonly content: string | null;
     readonly contentFormat: string;
     readonly folder: string | null;
-    readonly updatedAt: Date;
+    readonly modifiedAt: Temporal.Instant | null;
 };
 export type CollectionStore = {
     readonly table: typeof templateResourcesTable | typeof userContentEntriesTable;
@@ -30,5 +31,5 @@ export declare function toCollectionEntry(row: CollectionEntryRow): {
     content: string | null;
     contentFormat: string;
     folder: string | null;
-    updatedAt: Date;
+    modifiedAt: Temporal.Instant | null;
 };

package/dist/template-resolver/handlers/collection-shared.js

@@ -45,6 +45,6 @@ export function toCollectionEntry(row) {
         content: row.content,
         contentFormat: row.contentFormat,
         folder: row.folder,
-        updatedAt: row.updatedAt,
+        modifiedAt: row.modifiedAt,
     };
 }

package/dist/template-resolver/handlers/find-by-id.query.d.ts

@@ -15,5 +15,5 @@ export declare const findByIdQuery: import("@cosmicdrift/kumiko-types/define-han
     scope: string;
     parentTemplateId: string | null;
     status: string;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 } | null, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/find-by-id.query.js

@@ -37,7 +37,7 @@ export const findByIdQuery = defineQueryHandler({
             scope: row.scope,
             parentTemplateId: row.parentTemplateId,
             status: row.status,
-            updatedAt: row.updatedAt,
+            modifiedAt: row.modifiedAt,
         };
     },
 });

package/dist/template-resolver/handlers/list.query.d.ts

@@ -22,5 +22,5 @@ export declare const listQuery: import("@cosmicdrift/kumiko-types/define-handler
     scope: string;
     status: string;
     contentFormat: string;
-    updatedAt: Date;
+    modifiedAt: import("temporal-spec").Temporal.Instant | null;
 }[], import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/list.query.js

@@ -48,7 +48,7 @@ export const listQuery = defineQueryHandler({
             scope: row.scope,
             status: row.status,
             contentFormat: row.contentFormat,
-            updatedAt: row.updatedAt,
+            modifiedAt: row.modifiedAt,
         }));
     },
 });