@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.338.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.337.1",
+  "version": "0.338.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.337.1",
-    "@cosmicdrift/kumiko-framework": "0.337.1",
-    "@cosmicdrift/kumiko-headless": "0.337.1",
-    "@cosmicdrift/kumiko-renderer": "0.337.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.337.1",
-    "@cosmicdrift/kumiko-types": "0.337.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.338.0",
+    "@cosmicdrift/kumiko-framework": "0.338.0",
+    "@cosmicdrift/kumiko-headless": "0.338.0",
+    "@cosmicdrift/kumiko-renderer": "0.338.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.338.0",
+    "@cosmicdrift/kumiko-types": "0.338.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -985,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.337.1",
-    "@cosmicdrift/kumiko-locale-es": "0.337.1",
+    "@cosmicdrift/kumiko-locale-de": "0.338.0",
+    "@cosmicdrift/kumiko-locale-es": "0.338.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/agent-tools/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "entity get/list tools honour agent.risk, PII-bearing system lists are high risk",
+    "detail": "agent-tools: `get_<entity>` and `list_<entity>` take their risk from the entity handler's `agent.risk` instead of a hard-coded `low`. The SystemAdmin `user:list`, `user:detail` and `download-attempt:list` handlers declare `risk: \"high\"`.",
+    "migration": "No action needed: handlers without an agent.risk hint stay low risk."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "agent entity tools no longer filter on read-restricted fields",
+    "detail": "agent-tools: `list_<entity>` filters and `find_<entity>_by_<field>` tools only offer filterable fields that every caller role may read without a row condition. A role- or ownership-restricted filterable field can no longer be probed through `totalCount` or hit/miss results.",
+    "migration": "No action needed: fields whose access.read is not unconditionally open to the agent's roles drop out of list filters and find-by tools."
+  },
   {
     "version": "0.337.0",
     "type": "fix",

package/src/billing-foundation/changes.json

@@ -1,4 +1,53 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "Contract confirmation mail after a recorded checkout consent",
+    "detail": "With `consumerProtection`, four event-triggered jobs (`confirm-on-subscription-created`, `confirm-on-subscription-updated`, `confirm-on-invoice-paid`, `confirm-on-payment-received`) call the system-only `billing-foundation:write:issue-contract-confirmation` (`consentId`, `sourceAggregateId`, optional `currentPeriodEndIso`) for events carrying a `consentId`; subscription events only count with status `active` or `trialing`. The handler only reads the caller tenant's own subscription or payment stream, finds the `checkout-consent-recorded` event, appends `contract-confirmation-issued` (`consentId`, `issuedAtIso`, `locale`, `termsTemplateVersion`) at the fetched stream version and then notifies `billing-foundation:contract-confirmation` (critical priority) to the consenting user's email. A second run returns `{ issued: false, reason: \"already_issued\" }` or fails with a version conflict; an unknown consent returns `consent_not_found` and sends nothing. The mail is rendered in German or English (fallback German) as structured header/sections content for the email channel's renderer.",
+    "migration": "Enabling `consumerProtection` additionally requires the `user` feature, and an email channel plus renderer must be mounted for the mail to go out."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "Optional consumer-protection consent gate on checkout",
+    "detail": "`BillingFoundationOptions.consumerProtection` (`termsTextBlock`, `vatNote` with `de` and `en`, `operatorEmail`, `legalLinks`) requires `baseUrl` and additionally requires the `template-resolver` and `delivery` features. When set, `start-plan-checkout` and `create-checkout-session` take a strict `consent` object (`earlyPerformanceRequested: true`, `withdrawalLossAcknowledged: true`, `consentTextVersion`, `locale`); a missing or unchecked consent fails validation (400). The consent texts and their version (first 16 hex characters of the SHA-256 of the early-performance and withdrawal-loss texts) are owned by the framework in German and English. After the provider returned the checkout URL, `checkout-consent-recorded` is appended (no email, no IP). `billing-plans` returns `consumerProtection: { consentTexts, legalLinks }` so a client can render and echo the version.",
+    "migration": "No code change needed unless you enable consumerProtection; then callers of start-plan-checkout/create-checkout-session must send `consent`."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "Consent dialog and cancel-contract button in the billing panel",
+    "detail": "The checkout CTA opens `CheckoutConsentDialog` when `billing-plans` returns `consumerProtection`; `start-plan-checkout` then receives `consent: { earlyPerformanceRequested, withdrawalLossAcknowledged, consentTextVersion, locale }`. The locale rule (`resolveConsentLocale`) moved to the crypto-free `consumer-protection/consent-locale.ts` and is still re-exported from `consent-text.ts`. `CancelContractDialog` calls `billing-foundation:write:terminate-contract`. New English i18n keys under `billing-foundation.consent.*` and `billing-foundation.cancel.*`.",
+    "migration": "No action. Apps that translate the panel add the new `billing-foundation.consent.*` and `billing-foundation.cancel.*` keys to their locale bundles."
+  },
+  {
+    "version": "0.338.0",
+    "type": "breaking",
+    "title": "SubscriptionProviderPlugin.cancelSubscription takes { providerSubscriptionId, when }",
+    "detail": "`cancelSubscription(ctx, { providerSubscriptionId, when })` replaces the positional `providerSubscriptionId` argument. `when` is `SubscriptionCancelTimings.periodEnd` (`\"period-end\"`, the subscription runs to the end of the paid period) or `SubscriptionCancelTimings.immediately` (`\"immediately\"`). `createCheckoutSession` options gain optional `consentId`, `locale` and `submitMessage`; `SubscriptionEvent` and `PaymentEvent` gain an optional `consentId`, validated by `parseProviderConsentId` (max 100 characters of `A-Z a-z 0-9 _ -`), and `subscription` / `payment` event payloads store it.",
+    "migration": "Custom provider plugins that implement `cancelSubscription` change the signature to `(ctx, { providerSubscriptionId, when })` and honor `when`. A provider that can only cancel immediately may treat both values the same or leave the method out. Callers pass `{ providerSubscriptionId, when: SubscriptionCancelTimings.immediately }` to keep the old behavior."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "§ 312k cancellation pages and handlers with consumerProtection",
+    "detail": "`contract-termination-requested` (on the tenant's subscription stream: `requestId`, `declarationType` termination|withdrawal, `terminationKind` ordinary|extraordinary, `channel` public|account, `receivedAtIso`, `effectiveAtIso`, `providerCancel` period-end|immediately|none) and `contract-termination-unmatched` (system-tenant stream, `matchResult` none|ambiguous) are appended by the system-only `record-contract-termination` and `record-unmatched-contract-termination` handlers. `billing-foundation:write:request-contract-termination` is anonymous and answers `{ requestId, receivedAtIso }` for every outcome; `billing-foundation:write:terminate-contract` (purchase roles) answers `{ requestId, receivedAtIso, effectiveAtIso, providerCancel }`. Provider errors or a provider without `cancelSubscription` still record the declaration (`providerCancel: none`) and notify the operator. `consumerProtection` now also requires the `tenant` and `user` features.",
+    "migration": "Add `createContractTerminationRoutes()` from billing-foundation to the app's `extraRoutes`, make sure `anonymousAccess` is configured, and link `/legal/kuendigen` (or `/legal/cancel`) in the page footer."
+  },
+  {
+    "version": "0.338.0",
+    "type": "breaking",
+    "title": "Remove rawPayload from provider events and event headers",
+    "detail": "`rawPayload` is removed from `SubscriptionEvent`, `PaymentEvent`, `ProviderSubscriptionSnapshot`, the `process-event` and `process-payment-event` schemas and `SubscriptionEventHeaders` / `PaymentEventHeaders`. New events carry `providerEventId` and `providerName` in their headers; payment events also carry the optional `providerCheckoutId` (Stripe checkout session id).",
+    "migration": "Custom subscription provider plugins must stop returning `rawPayload`; TypeScript flags the removed field. Code that read the checkout session id out of `headers.rawPayload` reads `headers.providerCheckoutId` instead. Events already stored keep their old `rawPayload` header; this release does not rewrite stored events."
+  },
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "late events of a superseded provider subscription no longer overwrite the live row",
+    "detail": "billing-foundation: `process-event` drops a non-`created` provider event that belongs to a different subscription than the one the tenant's row currently tracks, while that row still blocks checkout. A late webhook retry of a superseded subscription can no longer flip the live subscription to `canceled`. The webhook answers 200 with `stale: true`.",
+    "migration": "No action needed: events of the tracked subscription and `created` events behave as before."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/cap-counter/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "corrected the documented reason rolling cap booking needs SystemAdmin",
+    "detail": "cap-counter: corrected the documented reason why rolling cap booking still needs a `SystemAdmin` identity. The event-ownership check only guards `appendDomainEventCore`, not the entity-executor path, so the earlier \"ownership rule rejects in-process appends\" wording was inaccurate. Behavior is unchanged.",
+    "migration": "No action needed: behavior is unchanged."
+  },
   {
     "version": "0.336.0",
     "type": "fix",

package/src/cap-overview/changes.json

@@ -1,4 +1,18 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "breaking",
+    "title": "caps:usage and my-caps default to admin roles; widen with usageVisibleTo",
+    "detail": "`createCapOverviewFeature` gets `usageVisibleTo?: readonly string[]`. Without it, the `caps:usage` query and the `my-caps` screen accept `access.admin` (TenantAdmin, Admin, SystemAdmin) instead of every tenant member. The screen and the query share the resolved roles. Only built-in roles are accepted (User, Member, Editor, Admin, TenantAdmin, SystemAdmin); an unknown or empty list throws at feature definition. The SystemAdmin `tenantId` override and the platform-wide screens are unchanged. The `MY_CAPS_ACCESS_ROLES` export is replaced by `DEFAULT_CAP_USAGE_ROLES` (the admin default), and `myCapsScreen` by `createMyCapsScreen(roles)`.",
+    "migration": "Apps whose regular members should keep seeing their usage pass `createCapOverviewFeature({ ..., usageVisibleTo: [\"User\", \"Editor\", \"Admin\", \"TenantAdmin\", \"SystemAdmin\"] })`. Code that imported `MY_CAPS_ACCESS_ROLES` (handlers or nav entries mirroring the screen rule) imports `DEFAULT_CAP_USAGE_ROLES` for the admin default, or reuses the same `usageVisibleTo` array it passed to the feature."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Cross-tenant cap limits read the target tenant's config",
+    "detail": "`caps:usage` with a SystemAdmin `tenantId` override and `tenant-caps:list` passed the caller's config accessor to `CapSpec.limit`, so a limit that reads a tenant-scoped config key showed the caller's value for every tenant. Both now resolve one accessor per target tenant through `ctx.configFor`, and `tenant-caps:list` resolves each tenant's limit separately instead of once per tier.",
+    "migration": "No code change needed."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/config/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "config keys can declare an async write validator that rejects with a KumikoError",
+    "detail": "Config key definitions accept a new async `validate(value, ctx)` function. `config:write:set` runs it after the type, bounds and pattern checks and before the value is stored, for every scope and backing. A validator rejects the write by throwing a `KumikoError`, for example an `UnprocessableError`. The feature manifest reports `validated` per key.",
+    "migration": "No action needed: keys without `validate` behave as before."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "forget-denied audit digest is keyed and omitted without a blind-index key",
+    "detail": "crypto-shredding: the forget-denied audit event now stores `subjectKeyDigest` as a keyed blind-index HMAC instead of a bare SHA-256 of the subject key, so a candidate id cannot be matched against it. Without a configured blind-index key the digest is omitted (`subjectKeyDigest` is now optional in the payload).",
+    "migration": "No action needed. Existing denial events keep their old digest; configure the blind-index key to get a digest on new ones."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "forget-subject tenant check falls back to event-store provenance",
+    "detail": "forget-subject now accepts a record subject for a DPO when the owning tenant is proven by the event stream, not only by a projection row. A record whose row was already deleted, or a custom aggregate without a registered entity, can be shredded by the DPO of the tenant that owns it. A DPO of another tenant is still denied, and so is any DPO when events for the same aggregate id exist in more than one tenant."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/custom-fields/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "field-definition list keeps TenantAdmin when fieldDefinitionWriteRoles is set",
+    "detail": "custom-fields: the field-definition list roles always include the default `TenantAdmin`, also when `fieldDefinitionWriteRoles` is set. `TenantAdmin` keeps saving values by default, so the form section must keep loading for it; `fieldDefinitionWriteRoles: []` no longer locks out the list.",
+    "migration": "No action needed. Set fieldDefinitionListRoles explicitly to narrow the list roles."
+  },
   {
     "version": "0.146.0",
     "type": "improvement",

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "tenant broadcast recipient query no longer reads across tenants through ctx.db",
+    "detail": "delivery: the `tenantUserIdsQuery` handler of a tenant broadcast now always gets a tenant-filtered `ctx.db` and `ctx.dbOutsideTransaction`, also when it is declared `r.systemScope()`. A systemScope handler could previously read the memberships of every tenant through `ctx.db` and notify users of foreign tenants. Cross-tenant reads stay available through `ctx.systemDb`.",
+    "migration": "No action needed for handlers that resolve recipients through `ctx.systemDb`, like `tenant:query:resolveUserIds`. A systemScope handler that read `ctx.db` unfiltered now sees only the broadcast tenant's rows."
+  },
   {
     "version": "0.336.0",
     "type": "fix",

package/src/notes-history/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "add-note rejects mentions of non-members; mention export lists mentioning notes",
+    "detail": "notes-history: `add-note` now rejects `mentions` of users who are not members of the current tenant, because their forget run only visits tenants they belong to and would never reach such a note. The notes-history user-data export hook now lists the notes that mention the exporting user.",
+    "migration": "No action needed unless a client mentions user ids that are not members of the tenant; those writes now fail validation."
+  },
   {
     "version": "0.308.0",
     "type": "breaking",

package/src/subscription-mollie/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "Mollie checkout carries consentId through payment and subscription metadata",
+    "detail": "`consentId` from the checkout options is stored in the first payment's metadata, copied onto the subscription created from it, and returned as `SubscriptionEvent.consentId` when valid. `cancelSubscription` stays unimplemented for Mollie.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Mollie webhooks no longer archive the subscription and payment objects",
+    "detail": "Subscription events parsed from Mollie webhooks no longer include the serialized subscription and trigger payment, which can carry consumer name and account data."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "improvement",
+    "title": "Stripe checkout sets submit_type, locale, submit text and consentId; cancel can run to period end",
+    "detail": "Checkout sessions in both modes set `submit_type: \"pay\"`. `locale` maps to a Stripe checkout locale (exact match, else the language part such as `de-AT` to `de`, else `\"auto\"`), and `submitMessage` becomes `custom_text.submit.message` (capped at Stripe's 1200 characters). `consentId` is written to `subscription_data.metadata` or `payment_intent_data.metadata` next to `tenantId` and read back from the same place on the webhook. `cancelSubscription` with `when: \"period-end\"` sets `cancel_at_period_end`; `\"immediately\"` cancels the subscription.",
+    "migration": "No code change needed."
+  },
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Stripe webhooks no longer archive the full provider event",
+    "detail": "Subscription and one-off-payment events parsed from Stripe webhooks, and the snapshot returned by sync-subscriptions, no longer include the serialized Stripe event, so customer details never land in the event store."
+  },
   {
     "version": "0.337.0",
     "type": "fix",

package/src/tags/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "breaking",
+    "title": "ownership.write applies to assign-tag, remove-tag and add-note",
+    "detail": "tags and notes-history: `ownership.write` is now enforced by `assign-tag`, `remove-tag` and `add-note`. Each feature instance builds its write executor from the entity it registers; before, the handlers used a module-level executor without the mount's ownership, so a `from()` write rule never applied to them. The `delete-tag` cascade stays ungated.",
+    "migration": "Mounts that set `ownership.write` now see ownership_denied for callers the rule does not cover. Make sure the rule covers every role that tags or notes, or leave it unset."
+  },
   {
     "version": "0.246.0",
     "type": "improvement",

package/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.338.0",
+    "type": "fix",
+    "title": "Forget cleanup covers tenants the user already left",
+    "detail": "`runForgetCleanup` builds the per-user tenant list from live memberships plus the user's `tenant-membership.created` history (read from the event payload, so cross-tenant SystemAdmin adds count too), deduplicated. Delete hooks, such as the notes-history mention shred, therefore also run in tenants the user left before the request. The `tenantIdsBeforeDelete` list passed to the deletion-executed mail still contains only the live memberships. Mentions written before notes recorded structured mention rows for non-members are not covered."
+  },
   {
     "version": "0.335.0",
     "type": "fix",