@cosmicdrift/kumiko-bundled-features 0.336.0 → 0.336.1

package/dist/auth-email-password/handlers/login.write.js

@@ -179,8 +179,7 @@ export function createLoginHandler(opts = {}) {
             const statusGate = gateEnforceAccountStatus(found);
             if (!statusGate.ok)
                 return statusGate.result;
-            // Still needed for candidate ORDER (preferred tenant first) — the actual
-            // active/blocked/teardown decision comes from ctx.resolveActiveMembership below.
+            // Still needed for candidate ORDER (preferred tenant first) in gateResolveMembership.
             const memberships = (await ctx.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
                 userId: found.id,
             })); // @cast-boundary db-runner

package/dist/custom-fields/feature.js

@@ -79,8 +79,9 @@ function registerCustomFields(r, variant) {
     // Event-types — qualified als "custom-fields:event:<short-name>".
     // Returned EventDefs liefern .name als compile-time literal-typed string,
     // den Handler + MSP-keys konsumieren statt Template-Literal-Konstruktion.
-    // `value: z.unknown()` has no field-level schema to catalog under piiFields;
-    // "no PII" is a naming convention (#972), not an enforced guarantee — see #2776.
+    // `value: z.unknown()` has no field-level schema to catalog under piiFields
+    // (event PII covers string fields only), so "no PII" is a convention here,
+    // not an enforced guarantee.
     const setEvent = r.defineEvent(CUSTOM_FIELD_SET_EVENT, customFieldSetSchema, {
         piiFields: "none",
     });

package/dist/inbound-mail-foundation/feature.js

@@ -67,7 +67,7 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
     // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).
     // "displayName" stays plaintext (often the mailbox owner's real name for
     // personal accounts); encrypting it would break the entity-projection read
-    // path that carries it as `personal: false` (#2776).
+    // path that carries it as `personal: false`.
     r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
         piiFields: "none",
     });

package/dist/notes-history/feature.js

@@ -71,8 +71,8 @@ export function createNotesHistoryFeature(opts = {}) {
     // of passing an empty array.
     if (opts.parents !== undefined && opts.parents.length === 0) {
         throw new Error("createNotesHistoryFeature({ parents }): parents must not be an empty array — " +
-            "an empty allowlist rejects every add-note call. Omit `parents` to keep " +
-            "today's unrestricted behavior instead.");
+            "an empty allowlist rejects every add-note call. Omit `parents` to allow " +
+            "any registered entity the caller can read as a note parent.");
     }
     return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) => registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents));
 }

package/dist/notes-history/handlers/add-note.write.js

@@ -35,7 +35,8 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
             try {
                 // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
                 // Bun.SQL poisons the whole tx after any error inside it, even one that's
-                // caught — a bare try/catch here would take the note write down with it.
+                // caught — so the lookup runs in a savepoint where available, otherwise directly
+                // (pool statements are their own units).
                 authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(READ_AUTHOR_DISPLAY_NAME_REASON), async (sp) => {
                     const userRow = await fetchOne(sp, userTable, {
                         id: event.user.id,

package/dist/personal-access-tokens/schema/api-token.js

@@ -42,27 +42,27 @@ export const apiTokenEntity = createEntity({
         // store ciphertext while the resolver keeps querying for the plaintext
         // hash — every bearer-token request would 401 once a KMS is active.
         // Fixing that needs a blind-index-backed lookup (like email's
-        // find:"exact" companion column), a resolver.ts rewrite out of scope
-        // here — see PR body "Offene Fragen".
+        // find:"exact" companion column), a resolver.ts rewrite, so this stays
+        // unencrypted until a blind-index lookup exists.
         tokenHash: createTextField({
             required: true,
             maxLength: 64,
             access: { write: access.privileged },
             personal: false,
-            reason: "credential_hash_used_as_exact_lookup_key_2809",
+            reason: "credential_hash_used_as_exact_lookup_key",
         }),
         // Short displayable prefix ("your tokens" list) — not the secret itself,
         // but still identifies which of the user's tokens this row is. Kept
         // Klasse 1: list.query.ts returns `r.prefix` straight through with no
         // decrypt call (unlike `name`, which goes through decryptStoredPii) — a
         // subject annotation would leak ciphertext to the UI once a KMS is
-        // active. See PR body "Offene Fragen".
+        // active.
         prefix: createTextField({
             required: true,
             maxLength: 16,
             access: { write: access.privileged },
             personal: false,
-            reason: "credential_prefix_read_without_decrypt_2809",
+            reason: "credential_prefix_read_without_decrypt",
         }),
         // JSON-encoded string[] of granted scope names — mirrors the roles-column
         // convention (parseRoles-style text); the resolver JSON.parses it.

package/dist/subscription-mollie/plugin-methods.js

@@ -32,11 +32,9 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
             customerId = customer.id;
         }
         // mode "payment" (one-off top-up) → sequenceType.oneoff, no mandate
-        // setup. verify-webhook.ts's ensureSubscriptionForMandate already
-        // gates on sequenceType === "first" — a oneoff payment falls into
-        // its "not our domain" branch and creates NO Mollie subscription.
-        // Webhook resolution for oneoff payments is separate follow-up
-        // work (offlot#109), not part of this contract.
+        // setup. Oneoff payments carry no subscriptionId and are not
+        // sequenceType "first", so verifyAndParseMollieWebhook drops them before
+        // any mandate/subscription handling.
         const sequenceType = options.mode === "payment" ? SequenceType.oneoff : SequenceType.first;
         // payments.create ist overloaded (Promise OR void mit callback);
         // explicit cast auf Promise<Payment>-overload.

package/dist/subscription-stripe/plugin-methods.js

@@ -1,5 +1,6 @@
 // Stripe-Plugin-Methoden für die POST-tenant-resolution-Phase:
-// createCheckoutSession, createPortalSession, cancelSubscription.
+// createCheckoutSession, createPortalSession, cancelSubscription,
+// retrieveSubscription, retrievePrices, planSwitchSession.
 //
 // Werden vom Plugin-build (feature.ts) als methods auf dem
 // SubscriptionProviderPlugin registriert. Anders als
@@ -8,7 +9,7 @@
 // runtime auf (api-key aus system-secrets, audited), statt aus einem
 // mount-time-Closure. Key-Rotation wirkt damit ohne Redeploy.
 //
-// **Type-Ableitung:** die options-shapes der drei methods werden
+// **Type-Ableitung:** die options-shapes der methods werden
 // **direkt vom Plugin-Contract** abgeleitet (`Parameters<NonNullable
 // <SubscriptionProviderPlugin["...method"]>>[1]`). Wenn Foundation den
 // Contract erweitert (z.B. neuer optionaler Field), bemerkt der
@@ -18,6 +19,11 @@ import { KNOWN_RECURRING_INTERVALS, } from "@cosmicdrift/kumiko-bundled-features
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import Stripe from "stripe";
 import { isResourceMissingStripeError, mapStripeSubscriptionState } from "./verify-webhook.js";
+function isUnknownCustomerStripeError(error) {
+    return (isResourceMissingStripeError(error) &&
+        error instanceof Stripe.errors.StripeInvalidRequestError &&
+        error.param === "customer");
+}
 export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation = true } = {}) {
     return async (ctx, options) => {
         // #104-Invariante: ohne billing-live darf keine Stripe-Session
@@ -28,7 +34,7 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
         await runtime.assertBillingLive(ctx);
         const stripe = await runtime.clientForCtx(ctx);
         const mode = options.mode ?? "subscription";
-        const session = await stripe.checkout.sessions.create({
+        const sessionParams = (providerCustomerId) => ({
             mode,
             line_items: [{ price: options.priceId, quantity: 1 }],
             success_url: options.successUrl,
@@ -48,10 +54,22 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
                     // Without a customer, Stripe's default "if_required" makes a guest
                     // checkout when invoice_creation is off; the webhook then has no
                     // customer id and drops the paid payment as ignored.
-                    ...(!options.providerCustomerId && { customer_creation: "always" }),
+                    ...(!providerCustomerId && { customer_creation: "always" }),
                 }),
-            ...(options.providerCustomerId && { customer: options.providerCustomerId }),
+            ...(providerCustomerId && { customer: providerCustomerId }),
         });
+        let session;
+        try {
+            session = await stripe.checkout.sessions.create(sessionParams(options.providerCustomerId));
+        }
+        catch (error) {
+            if (!options.providerCustomerId || !isUnknownCustomerStripeError(error))
+                throw error;
+            // Stripe account switch (test -> live) or a customer deleted in the dashboard leaves a
+            // stored customer id Stripe no longer knows; checkout creates a fresh customer instead.
+            ctx.log?.warn("subscription-stripe: stored customer unknown to Stripe, retrying without it");
+            session = await stripe.checkout.sessions.create(sessionParams(undefined));
+        }
         if (!session.url) {
             // Defensive: Stripe returns a hosted url for both modes today —
             // guards against future API drift.

package/dist/tenant/handlers/member-directory.query.js

@@ -13,9 +13,14 @@ const KMS_POOL_CONCURRENCY = 4;
 // are decrypted and filtered in memory. The cap keeps a SystemAdmin's global
 // search from decrypting every user.
 const SEARCH_SCAN_CAP = 1000;
+// Display names are encrypted, so id is the only stable SQL-side key; uuid text
+// order equals the uuid column's byte order.
+function compareIds(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
 async function loadMemberUserIds(db, tenantId) {
     const memberships = await selectMany(db, tenantMembershipsTable, { tenantId });
-    return [...new Set(memberships.map((row) => String(row["userId"])))];
+    return [...new Set(memberships.map((row) => String(row["userId"])))].sort(compareIds);
 }
 // Label source behind every `user:user` reference column (fw#3107). The
 // entity-convention lookup, user:query:user:list, is a SystemAdmin
@@ -52,12 +57,20 @@ export const memberDirectoryQuery = definePagedQueryHandler({
         let users;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as user:query:user:list did");
-            users = await selectMany(db, userTable, undefined, { limit: scanLimit });
+            users = await selectMany(db, userTable, undefined, {
+                limit: scanLimit,
+                orderBy: { col: "id", direction: "asc" },
+            });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
             const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
-            users = userIds.length > 0 ? await selectMany(db, userTable, { id: [...userIds] }) : [];
+            users =
+                userIds.length > 0
+                    ? await selectMany(db, userTable, { id: [...userIds] }, {
+                        orderBy: { col: "id", direction: "asc" },
+                    })
+                    : [];
         }
         const resolved = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
             const id = String(user.id);

package/dist/tenant/handlers/tenant-directory.query.js

@@ -35,7 +35,13 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         let tenants;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did");
-            tenants = await selectMany(db, tenantTable, undefined, { limit: scanLimit });
+            tenants = await selectMany(db, tenantTable, undefined, {
+                limit: scanLimit,
+                orderBy: [
+                    { col: "name", direction: "asc" },
+                    { col: "id", direction: "asc" },
+                ],
+            });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);

package/dist/tenant-handover/feature.js

@@ -13,7 +13,7 @@ export function createTenantHandoverFeature(opts = {}) {
         r.describe("Try-before-signup ownership handover: claims the rows of a declared-transferable " +
             "entity graph (root plus its parentRef-linked children) from an anonymous/public " +
             "tenant into the caller's own tenant, legitimized by a row-bound grant the anonymous " +
-            "flow minted. Idempotent, audited via a `<entityType>.tenantHandover` domain event.");
+            "flow minted. Idempotent, audited via a `tenant-handover:event:claimed` event on its own `tenant-handover-claim` aggregate.");
         r.uiHints({
             displayLabel: "Tenant Handover",
             category: "identity",

package/dist/user/schema/user.js

@@ -72,12 +72,13 @@ export const userEntity = createEntity({
         // login-critical read stays raw, so verifyPassword would compare a
         // plaintext password against ciphertext and every login would fail once
         // a KMS is active. Already an irreversible one-way hash, access-gated to
-        // privileged read/write — see PR body "Offene Fragen".
+        // privileged read/write. Needs a blind-index lookup before this can be
+        // subject-encrypted.
         passwordHash: createTextField({
             maxLength: 255,
             access: { read: access.privileged, write: access.privileged },
             personal: false,
-            reason: "credential_hash_read_without_decrypt_2809",
+            reason: "credential_hash_read_without_decrypt",
         }),
         // Profile — user-editable. Real name in most apps → PII. Searchable via
         // the derived Meili index; events/projection stay ciphertext (#1610).
@@ -164,7 +165,7 @@ export const userEntity = createEntity({
             reason: "technical_reference",
         }),
     },
-    // fw#2134 — email is `personal: "self", find: "exact"`, so the column holds
+    // email is `personal: "self", find: "fuzzy"` (lookupable), so the column holds
     // per-row ciphertext: a plain unique index on it can't catch duplicates.
     // `unique: true` over a lookupable column makes buildEntityTable /
     // deriveEntityTableMeta emit a second, partial unique index over the

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -49,10 +49,10 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
         schema: z.object({ token: z.string().min(1) }),
         access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
         escapeHatch: {
-            reason: "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+            reason: "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
                 "...) to compute the grace period end — the anonymous token holder has no read access " +
-                "to that tenant-config projection. It also appends the user lifecycle event on the " +
-                "SYSTEM_TENANT_ID user stream.",
+                "to that tenant-config projection. startDeletionGracePeriod also appends the user " +
+                "lifecycle event on the SYSTEM_TENANT_ID user stream.",
         },
         agent: { expose: false },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -21,10 +21,10 @@ export function createRequestDeletionHandler(opts = {}) {
             },
         },
         escapeHatch: {
-            reason: "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+            reason: "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
                 "...) to compute the grace period end — the calling user's own identity has no read " +
-                "access to that tenant-config projection. It also appends the user lifecycle event on " +
-                "the SYSTEM_TENANT_ID user stream.",
+                "access to that tenant-config projection. startDeletionGracePeriod also appends the " +
+                "user lifecycle event on the SYSTEM_TENANT_ID user stream.",
         },
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.336.0",
+  "version": "0.336.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.336.0",
-    "@cosmicdrift/kumiko-framework": "0.336.0",
-    "@cosmicdrift/kumiko-headless": "0.336.0",
-    "@cosmicdrift/kumiko-renderer": "0.336.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.336.0",
-    "@cosmicdrift/kumiko-types": "0.336.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.336.1",
+    "@cosmicdrift/kumiko-framework": "0.336.1",
+    "@cosmicdrift/kumiko-headless": "0.336.1",
+    "@cosmicdrift/kumiko-renderer": "0.336.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.336.1",
+    "@cosmicdrift/kumiko-types": "0.336.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -985,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.336.0",
-    "@cosmicdrift/kumiko-locale-es": "0.336.0",
+    "@cosmicdrift/kumiko-locale-de": "0.336.1",
+    "@cosmicdrift/kumiko-locale-es": "0.336.1",
     "jsqr": "^1.4.0"
   }
 }

package/src/subscription-stripe/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.1",
+    "type": "fix",
+    "title": "Checkout retries without a customer id Stripe no longer knows",
+    "detail": "Stripe checkout now retries once without the customer when the stored customer id is unknown to Stripe (for example after switching from a test to a live account), instead of failing with \"No such customer\"."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.1",
+    "type": "fix",
+    "title": "Member and tenant directory lookups return a stable order under a limit",
+    "detail": "`tenant:query:member-directory` and `tenant:query:tenant-directory` now sort their rows (tenants by name then id, members by id), so a `limit` always keeps the same rows instead of whichever the database returned first."
+  },
   {
     "version": "0.335.0",
     "type": "fix",