@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.339.0

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable, decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
-import { definePagedQueryHandler, MAX_LIST_LIMIT } from "@cosmicdrift/kumiko-framework/engine";
+import { definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation/index.js";
@@ -21,11 +21,16 @@ function billingLabel(subscription, tierSource) {
 }
 const FILTER_OP = z.enum(["eq", "ne", "lt", "gt", "in"]);
 const SORTABLE_FIELDS = ["name", "tier", "billing"];
-function capTierKey(capId, tier) {
-    return JSON.stringify([capId, tier]);
+function tenantCapKey(tenantId, capId) {
+    return JSON.stringify([tenantId, capId]);
 }
-async function resolveLimitsByCapAndTier(caps, tiers, context) {
-    const entries = await Promise.all(caps.flatMap((cap) => [...tiers].map(async (tier) => [capTierKey(cap.id, tier), await cap.limit(tier, context)])));
+// One config accessor per tenant: limits may read tenant-scoped config keys, so
+// a limit shared across tenants of the same tier would show the wrong value.
+async function resolveLimitsByTenantAndCap(caps, tenants, configFor) {
+    const entries = await Promise.all(tenants.flatMap(({ tenantId, tier }) => {
+        const context = { config: configFor?.(tenantId) };
+        return caps.map(async (cap) => [tenantCapKey(tenantId, cap.id), await cap.limit(tier, context)]);
+    }));
     return new Map(entries);
 }
 function isSortableField(field) {
@@ -183,7 +188,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
                 const perTenantEntries = await Promise.all(pageTenantIds.map(async (tenantId) => [tenantId, await cap.usage(db, tenantId)]));
                 usageByCap.set(cap.id, new Map(perTenantEntries));
             }));
-            const limitByCapAndTier = await resolveLimitsByCapAndTier(listedCaps, new Set(page.map((row) => row.tier)), { config: ctx.config });
+            const limitByTenantAndCap = await resolveLimitsByTenantAndCap(listedCaps, page, ctx.configFor);
             const rows = page.map((row) => {
                 const capFields = {};
                 for (const cap of listedCaps) {
@@ -191,7 +196,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
                     // only an explicit `null` value means "not measured".
                     const rawUsed = usageByCap.get(cap.id)?.get(row.tenantId);
                     const used = rawUsed === undefined ? 0 : rawUsed;
-                    const limit = limitByCapAndTier.get(capTierKey(cap.id, row.tier)) ?? null;
+                    const limit = limitByTenantAndCap.get(tenantCapKey(row.tenantId, cap.id)) ?? null;
                     capFields[capFieldName(cap.id)] =
                         used === null
                             ? { used: null, limit, fraction: 0 }

package/dist/cap-overview/index.d.ts

@@ -1,6 +1,6 @@
-export { MY_CAPS_ACCESS_ROLES } from "./access.js";
+export { DEFAULT_CAP_USAGE_ROLES } from "./access.js";
 export { CAP_CARDS_PANEL_COMPONENT, CAP_OVERVIEW_FEATURE, CAP_USAGE_CELL_COMPONENT, CapOverviewQueries, capFieldName, MY_CAPS_SCREEN_ID, PLATFORM_TENANT_CAPS_SCREEN_ID, TENANT_CAP_LIST_SCREEN_ID, } from "./constants.js";
 export { type CreateCapOverviewOptions, createCapOverviewFeature } from "./feature.js";
-export { createTenantCapListScreen, myCapsScreen, platformTenantCapsScreen, } from "./screens.js";
+export { createMyCapsScreen, createTenantCapListScreen, platformTenantCapsScreen, } from "./screens.js";
 export type { CapSpec, CapUsage, CapUsageTone, CapUsageWithMeta } from "./types.js";
 export { computeFraction, computeTone } from "./usage-math.js";

package/dist/cap-overview/index.js

@@ -1,6 +1,6 @@
 // Public API of the cap-overview bundled-feature.
-export { MY_CAPS_ACCESS_ROLES } from "./access.js";
+export { DEFAULT_CAP_USAGE_ROLES } from "./access.js";
 export { CAP_CARDS_PANEL_COMPONENT, CAP_OVERVIEW_FEATURE, CAP_USAGE_CELL_COMPONENT, CapOverviewQueries, capFieldName, MY_CAPS_SCREEN_ID, PLATFORM_TENANT_CAPS_SCREEN_ID, TENANT_CAP_LIST_SCREEN_ID, } from "./constants.js";
 export { createCapOverviewFeature } from "./feature.js";
-export { createTenantCapListScreen, myCapsScreen, platformTenantCapsScreen, } from "./screens.js";
+export { createMyCapsScreen, createTenantCapListScreen, platformTenantCapsScreen, } from "./screens.js";
 export { computeFraction, computeTone } from "./usage-math.js";

package/dist/cap-overview/screens.d.ts

@@ -1,5 +1,5 @@
 import type { ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import type { CapSpec } from "./types.js";
 export declare function createTenantCapListScreen(caps: readonly CapSpec[], listCaps: readonly string[], tiers?: readonly string[]): ScreenDefinition;
-export declare const myCapsScreen: ScreenDefinition;
+export declare function createMyCapsScreen(usageRoles: readonly string[]): ScreenDefinition;
 export declare const platformTenantCapsScreen: ScreenDefinition;

package/dist/cap-overview/screens.js

@@ -1,4 +1,3 @@
-import { MY_CAPS_ACCESS_ROLES } from "./access.js";
 import { CAP_CARDS_PANEL_COMPONENT, CAP_USAGE_CELL_COMPONENT, CapOverviewQueries, capFieldName, MY_CAPS_SCREEN_ID, PLATFORM_TENANT_CAPS_SCREEN_ID, TENANT_CAP_LIST_SCREEN_ID, } from "./constants.js";
 // `tiers` has no room for a separate per-tier display label (it's just
 // `readonly string[]`) — tier-engine itself has no enumerated tier list to
@@ -55,21 +54,23 @@ export function createTenantCapListScreen(caps, listCaps, tiers) {
         dormant: true,
     };
 }
-export const myCapsScreen = {
-    id: MY_CAPS_SCREEN_ID,
-    type: "dashboard",
-    panels: [
-        {
-            kind: "custom",
-            id: "cap-cards",
-            component: { react: { __component: CAP_CARDS_PANEL_COMPONENT } },
-        },
-    ],
-    access: { roles: MY_CAPS_ACCESS_ROLES },
-    // No nav wiring yet (see feature.ts header) — no nav area to resolve in
-    // isolation.
-    dormant: true,
-};
+export function createMyCapsScreen(usageRoles) {
+    return {
+        id: MY_CAPS_SCREEN_ID,
+        type: "dashboard",
+        panels: [
+            {
+                kind: "custom",
+                id: "cap-cards",
+                component: { react: { __component: CAP_CARDS_PANEL_COMPONENT } },
+            },
+        ],
+        access: { roles: usageRoles },
+        // No nav wiring yet (see feature.ts header) — no nav area to resolve in
+        // isolation.
+        dormant: true,
+    };
+}
 export const platformTenantCapsScreen = {
     id: PLATFORM_TENANT_CAPS_SCREEN_ID,
     type: "dashboard",

package/dist/channel-discord/discord-channel.d.ts

@@ -0,0 +1,6 @@
+import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
+export type DiscordChannelOptions = ChatWebhookChannelOptions;
+export declare const DISCORD_DEFAULT_ALLOWED_HOSTS: readonly ["discord.com", "discordapp.com"];
+export declare const DISCORD_WEBHOOK_PATH_PREFIX = "/api/webhooks/";
+export declare const DISCORD_CONTENT_MAX_CHARS = 2000;
+export declare function createDiscordChannel(options: DiscordChannelOptions, keyFor: (connection: string) => string): DeliveryChannel;

package/dist/channel-discord/discord-channel.js

@@ -0,0 +1,19 @@
+import { chatMessageText, createChatWebhookChannel, truncateChars, } from "../delivery/index.js";
+export const DISCORD_DEFAULT_ALLOWED_HOSTS = ["discord.com", "discordapp.com"];
+export const DISCORD_WEBHOOK_PATH_PREFIX = "/api/webhooks/";
+export const DISCORD_CONTENT_MAX_CHARS = 2000;
+export function createDiscordChannel(options, keyFor) {
+    return createChatWebhookChannel({
+        name: "discord",
+        featureName: "channel-discord",
+        defaultAllowedHosts: DISCORD_DEFAULT_ALLOWED_HOSTS,
+        requiredPathPrefix: DISCORD_WEBHOOK_PATH_PREFIX,
+        keyFor,
+        // parse: [] keeps @everyone / @here / role and user mentions in the text inert.
+        buildBody: (message) => ({
+            content: truncateChars(chatMessageText(message), DISCORD_CONTENT_MAX_CHARS),
+            allowed_mentions: { parse: [] },
+        }),
+        options,
+    });
+}

package/dist/channel-discord/feature.d.ts

@@ -0,0 +1,3 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type DiscordChannelOptions } from "./discord-channel.js";
+export declare function createChannelDiscordFeature(options?: DiscordChannelOptions): FeatureDefinition;

package/dist/channel-discord/feature.js

@@ -0,0 +1,30 @@
+import { chatConnectionNameSchema, DELIVERY_CHANNEL_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createDiscordChannel } from "./discord-channel.js";
+export function createChannelDiscordFeature(options = {}) {
+    return defineFeature("channel-discord", (r) => {
+        r.describe('Posts delivery notifications to a Discord webhook, registered as the `discord` channel in the delivery system. Tenant-owned chat target: reach it only via `ctx.notify(type, { route: { discord: "<connection name>" } })`. The webhook URL is a tenant secret under `channel-discord:webhooks.<connection name>`; only the connection name is logged. Mentions are disabled and content is cut to 2000 characters. Requires `delivery` and `secrets`. Host allowlist (discord.com, discordapp.com, path /api/webhooks/), https-only and the request timeout are app options of `createChannelDiscordFeature(opts)`, never tenant config.');
+        r.uiHints({
+            displayLabel: "Discord Channel",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires("delivery");
+        r.requires("secrets");
+        const webhooks = r.secretNamespace("webhooks", {
+            label: { en: "Discord webhooks", de: "Discord-Webhooks", es: "Webhooks de Discord" },
+            hint: {
+                en: 'One secret per connection name; the value is the Discord webhook URL. Address it with route: { discord: "<connection name>" }.',
+                de: 'Ein Secret pro Verbindungsname; der Wert ist die Discord-Webhook-URL. Adressierung mit route: { discord: "<Verbindungsname>" }.',
+                es: 'Un secreto por nombre de conexión; el valor es la URL del webhook de Discord. Se usa con route: { discord: "<nombre de conexión>" }.',
+            },
+            scope: "tenant",
+            nameSchema: chatConnectionNameSchema,
+        });
+        const channel = createDiscordChannel(options, webhooks.keyFor);
+        r.useExtension(DELIVERY_CHANNEL_EXTENSION, "discord", {
+            mode: channel.mode,
+            send: channel.send,
+        });
+    });
+}

package/dist/channel-discord/index.d.ts

@@ -0,0 +1,2 @@
+export { createDiscordChannel, type DiscordChannelOptions } from "./discord-channel.js";
+export { createChannelDiscordFeature } from "./feature.js";

package/dist/channel-discord/index.js

@@ -0,0 +1,2 @@
+export { createDiscordChannel } from "./discord-channel.js";
+export { createChannelDiscordFeature } from "./feature.js";

package/dist/channel-slack/feature.d.ts

@@ -0,0 +1,3 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type SlackChannelOptions } from "./slack-channel.js";
+export declare function createChannelSlackFeature(options?: SlackChannelOptions): FeatureDefinition;

package/dist/channel-slack/feature.js

@@ -0,0 +1,30 @@
+import { chatConnectionNameSchema, DELIVERY_CHANNEL_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createSlackChannel } from "./slack-channel.js";
+export function createChannelSlackFeature(options = {}) {
+    return defineFeature("channel-slack", (r) => {
+        r.describe('Posts delivery notifications to a Slack incoming webhook, registered as the `slack` channel in the delivery system. Tenant-owned chat target: reach it only via `ctx.notify(type, { route: { slack: "<connection name>" } })`. The webhook URL is a tenant secret under `channel-slack:webhooks.<connection name>`; only the connection name is logged. Requires `delivery` and `secrets`. Host allowlist (hooks.slack.com), https-only and the request timeout are app options of `createChannelSlackFeature(opts)`, never tenant config.');
+        r.uiHints({
+            displayLabel: "Slack Channel",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires("delivery");
+        r.requires("secrets");
+        const webhooks = r.secretNamespace("webhooks", {
+            label: { en: "Slack webhooks", de: "Slack-Webhooks", es: "Webhooks de Slack" },
+            hint: {
+                en: 'One secret per connection name; the value is the Slack webhook URL. Address it with route: { slack: "<connection name>" }.',
+                de: 'Ein Secret pro Verbindungsname; der Wert ist die Slack-Webhook-URL. Adressierung mit route: { slack: "<Verbindungsname>" }.',
+                es: 'Un secreto por nombre de conexión; el valor es la URL del webhook de Slack. Se usa con route: { slack: "<nombre de conexión>" }.',
+            },
+            scope: "tenant",
+            nameSchema: chatConnectionNameSchema,
+        });
+        const channel = createSlackChannel(options, webhooks.keyFor);
+        r.useExtension(DELIVERY_CHANNEL_EXTENSION, "slack", {
+            mode: channel.mode,
+            send: channel.send,
+        });
+    });
+}

package/dist/channel-slack/index.d.ts

@@ -0,0 +1,2 @@
+export { createChannelSlackFeature } from "./feature.js";
+export { createSlackChannel, type SlackChannelOptions } from "./slack-channel.js";

package/dist/channel-slack/index.js

@@ -0,0 +1,2 @@
+export { createChannelSlackFeature } from "./feature.js";
+export { createSlackChannel } from "./slack-channel.js";

package/dist/channel-slack/slack-channel.d.ts

@@ -0,0 +1,5 @@
+import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
+export type SlackChannelOptions = ChatWebhookChannelOptions;
+export declare const SLACK_DEFAULT_ALLOWED_HOSTS: readonly ["hooks.slack.com"];
+export declare function escapeSlackText(text: string): string;
+export declare function createSlackChannel(options: SlackChannelOptions, keyFor: (connection: string) => string): DeliveryChannel;

package/dist/channel-slack/slack-channel.js

@@ -0,0 +1,16 @@
+import { chatMessageText, createChatWebhookChannel, } from "../delivery/index.js";
+export const SLACK_DEFAULT_ALLOWED_HOSTS = ["hooks.slack.com"];
+// Slack mrkdwn treats & < > as control characters (links, @-mentions via <!channel>).
+export function escapeSlackText(text) {
+    return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+export function createSlackChannel(options, keyFor) {
+    return createChatWebhookChannel({
+        name: "slack",
+        featureName: "channel-slack",
+        defaultAllowedHosts: SLACK_DEFAULT_ALLOWED_HOSTS,
+        keyFor,
+        buildBody: (message) => ({ text: escapeSlackText(chatMessageText(message)) }),
+        options,
+    });
+}

package/dist/channel-teams/feature.d.ts

@@ -0,0 +1,3 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type TeamsChannelOptions } from "./teams-channel.js";
+export declare function createChannelTeamsFeature(options?: TeamsChannelOptions): FeatureDefinition;

package/dist/channel-teams/feature.js

@@ -0,0 +1,34 @@
+import { chatConnectionNameSchema, DELIVERY_CHANNEL_EXTENSION, } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createTeamsChannel } from "./teams-channel.js";
+export function createChannelTeamsFeature(options = {}) {
+    return defineFeature("channel-teams", (r) => {
+        r.describe('Posts delivery notifications to a Microsoft Teams webhook (Workflows or connector) as an Adaptive Card, registered as the `teams` channel in the delivery system. Tenant-owned chat target: reach it only via `ctx.notify(type, { route: { teams: "<connection name>" } })`. The webhook URL is a tenant secret under `channel-teams:webhooks.<connection name>`; only the connection name is logged. Requires `delivery` and `secrets`. Host allowlist (.webhook.office.com, .logic.azure.com, .powerplatform.com), https-only and the request timeout are app options of `createChannelTeamsFeature(opts)`, never tenant config.');
+        r.uiHints({
+            displayLabel: "Microsoft Teams Channel",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires("delivery");
+        r.requires("secrets");
+        const webhooks = r.secretNamespace("webhooks", {
+            label: {
+                en: "Microsoft Teams webhooks",
+                de: "Microsoft Teams-Webhooks",
+                es: "Webhooks de Microsoft Teams",
+            },
+            hint: {
+                en: 'One secret per connection name; the value is the Microsoft Teams webhook URL. Address it with route: { teams: "<connection name>" }.',
+                de: 'Ein Secret pro Verbindungsname; der Wert ist die Microsoft Teams-Webhook-URL. Adressierung mit route: { teams: "<Verbindungsname>" }.',
+                es: 'Un secreto por nombre de conexión; el valor es la URL del webhook de Microsoft Teams. Se usa con route: { teams: "<nombre de conexión>" }.',
+            },
+            scope: "tenant",
+            nameSchema: chatConnectionNameSchema,
+        });
+        const channel = createTeamsChannel(options, webhooks.keyFor);
+        r.useExtension(DELIVERY_CHANNEL_EXTENSION, "teams", {
+            mode: channel.mode,
+            send: channel.send,
+        });
+    });
+}

package/dist/channel-teams/index.d.ts

@@ -0,0 +1,2 @@
+export { createChannelTeamsFeature } from "./feature.js";
+export { createTeamsChannel, type TeamsChannelOptions } from "./teams-channel.js";

package/dist/channel-teams/index.js

@@ -0,0 +1,2 @@
+export { createChannelTeamsFeature } from "./feature.js";
+export { createTeamsChannel } from "./teams-channel.js";

package/dist/channel-teams/teams-channel.d.ts

@@ -0,0 +1,5 @@
+import { type ChatWebhookChannelOptions, type DeliveryChannel } from "../delivery/index.js";
+export type TeamsChannelOptions = ChatWebhookChannelOptions;
+export declare const TEAMS_DEFAULT_ALLOWED_HOSTS: readonly [".webhook.office.com", ".logic.azure.com", ".powerplatform.com"];
+export declare function buildTeamsAdaptiveCard(title: string, body: string | undefined): unknown;
+export declare function createTeamsChannel(options: TeamsChannelOptions, keyFor: (connection: string) => string): DeliveryChannel;

package/dist/channel-teams/teams-channel.js

@@ -0,0 +1,38 @@
+import { createChatWebhookChannel, } from "../delivery/index.js";
+export const TEAMS_DEFAULT_ALLOWED_HOSTS = [
+    ".webhook.office.com",
+    ".logic.azure.com",
+    ".powerplatform.com",
+];
+// Text only ever goes into TextBlocks (no markup interpretation of titles/bodies
+// beyond Adaptive Card's own text rendering).
+export function buildTeamsAdaptiveCard(title, body) {
+    return {
+        type: "message",
+        attachments: [
+            {
+                contentType: "application/vnd.microsoft.card.adaptive",
+                contentUrl: null,
+                content: {
+                    $schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+                    type: "AdaptiveCard",
+                    version: "1.4",
+                    body: [
+                        { type: "TextBlock", text: title, weight: "Bolder", wrap: true },
+                        ...(body ? [{ type: "TextBlock", text: body, wrap: true }] : []),
+                    ],
+                },
+            },
+        ],
+    };
+}
+export function createTeamsChannel(options, keyFor) {
+    return createChatWebhookChannel({
+        name: "teams",
+        featureName: "channel-teams",
+        defaultAllowedHosts: TEAMS_DEFAULT_ALLOWED_HOSTS,
+        keyFor,
+        buildBody: (message) => buildTeamsAdaptiveCard(message.title, message.body),
+        options,
+    });
+}

package/dist/channel-telegram/feature.d.ts

@@ -0,0 +1,3 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type TelegramChannelOptions } from "./telegram-channel.js";
+export declare function createChannelTelegramFeature(options?: TelegramChannelOptions): FeatureDefinition;

package/dist/channel-telegram/feature.js

@@ -0,0 +1,28 @@
+import { DELIVERY_CHANNEL_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/delivery";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { createTelegramChannel } from "./telegram-channel.js";
+export function createChannelTelegramFeature(options = {}) {
+    return defineFeature("channel-telegram", (r) => {
+        r.describe('Sends delivery notifications through the Telegram Bot API (`sendMessage`, plain text), registered as the `telegram` channel in the delivery system. Tenant-owned chat target: reach it only via `ctx.notify(type, { route: { telegram: "<chat id or @channel>" } })`. The bot token is the tenant secret `channel-telegram:secret:bot-token`; the token never reaches logs or delivery attempts. Requires `delivery` and `secrets`. The API base URL and request timeout are app options of `createChannelTelegramFeature(opts)`, never tenant config.');
+        r.uiHints({
+            displayLabel: "Telegram Channel",
+            category: "notifications",
+            recommended: false,
+        });
+        r.requires("delivery");
+        r.requires("secrets");
+        const botToken = r.secret("botToken", {
+            label: { en: "Telegram bot token" },
+            hint: {
+                en: 'Token from @BotFather. Used for every Telegram chat the tenant addresses via route: { telegram: "<chat id>" }.',
+            },
+            redact: () => "••••••••",
+            scope: "tenant",
+        });
+        const channel = createTelegramChannel(options, botToken.name);
+        r.useExtension(DELIVERY_CHANNEL_EXTENSION, "telegram", {
+            mode: channel.mode,
+            send: channel.send,
+        });
+    });
+}

package/dist/channel-telegram/index.d.ts

@@ -0,0 +1,2 @@
+export { createChannelTelegramFeature } from "./feature.js";
+export { createTelegramChannel, type TelegramChannelOptions } from "./telegram-channel.js";

package/dist/channel-telegram/index.js

@@ -0,0 +1,2 @@
+export { createChannelTelegramFeature } from "./feature.js";
+export { createTelegramChannel } from "./telegram-channel.js";

package/dist/channel-telegram/telegram-channel.d.ts

@@ -0,0 +1,8 @@
+import { type DeliveryChannel } from "../delivery/index.js";
+export type TelegramChannelOptions = {
+    readonly apiBaseUrl?: string;
+    readonly timeoutMs?: number;
+};
+export declare const TELEGRAM_DEFAULT_API_BASE_URL = "https://api.telegram.org";
+export declare const TELEGRAM_TEXT_MAX_CHARS = 4096;
+export declare function createTelegramChannel(options: TelegramChannelOptions, botTokenKey: string): DeliveryChannel;

package/dist/channel-telegram/telegram-channel.js

@@ -0,0 +1,54 @@
+import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
+import { chatMessageText, DEFAULT_CHAT_TIMEOUT_MS, postChatWebhook, toChannelResult, truncateChars, } from "../delivery/index.js";
+export const TELEGRAM_DEFAULT_API_BASE_URL = "https://api.telegram.org";
+export const TELEGRAM_TEXT_MAX_CHARS = 4096;
+// Numeric chat/group id (groups and channels are negative) or a public @channelname.
+const TELEGRAM_CHAT_ID_PATTERN = /^(-?\d{1,20}|@[A-Za-z][A-Za-z0-9_]{3,31})$/;
+// `<bot id>:<secret>`; the token is spliced into the URL path, so only the real shape passes.
+const TELEGRAM_BOT_TOKEN_PATTERN = /^\d{1,20}:[A-Za-z0-9_-]{10,}$/;
+export function createTelegramChannel(options, botTokenKey) {
+    const apiBaseUrl = options.apiBaseUrl ?? TELEGRAM_DEFAULT_API_BASE_URL;
+    return {
+        name: "telegram",
+        mode: "queued",
+        async send(address, message, ctx) {
+            if (!TELEGRAM_CHAT_ID_PATTERN.test(address)) {
+                return toChannelResult(address, { ok: false, code: "invalid_address" });
+            }
+            let token;
+            try {
+                const revealed = await ctx.secrets?.get(ctx.tenantId, botTokenKey, {
+                    userId: SYSTEM_USER_ID,
+                    handlerName: "channel-telegram:send",
+                });
+                token = revealed?.reveal();
+            }
+            catch {
+                token = undefined;
+            }
+            if (!token || !TELEGRAM_BOT_TOKEN_PATTERN.test(token)) {
+                return toChannelResult(address, { ok: false, code: "missing_credentials" });
+            }
+            // The base URL is the allowlist: only its own host is reachable.
+            let baseHost;
+            try {
+                baseHost = new URL(apiBaseUrl).hostname;
+            }
+            catch {
+                return toChannelResult(address, { ok: false, code: "host_not_allowed" });
+            }
+            const result = await postChatWebhook({
+                url: `${apiBaseUrl.replace(/\/+$/, "")}/bot${token}/sendMessage`,
+                allowedHosts: [baseHost],
+                requireHttps: apiBaseUrl.startsWith("https:"),
+                timeoutMs: options.timeoutMs ?? DEFAULT_CHAT_TIMEOUT_MS,
+                // No parse_mode: Telegram renders the text literally.
+                body: {
+                    chat_id: address,
+                    text: truncateChars(chatMessageText(message), TELEGRAM_TEXT_MAX_CHARS),
+                },
+            });
+            return toChannelResult(address, result);
+        },
+    };
+}

package/dist/config/handlers/set.write.js

@@ -2,7 +2,7 @@ import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
-import { InternalError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, isKumikoError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireConfigEncryption, requireSystemDb } from "../feature.js";
 import { MASKED } from "../read-redaction.js";
@@ -14,7 +14,7 @@ const executor = createEventStoreExecutor(configValuesTable, configValueEntity,
 });
 export const setWrite = defineWriteHandler({
     name: "set",
-    description: "Stores a config value for one key at the requested scope (user, tenant or system) after type, bounds and pattern validation, encrypting it when the key declares that; use it to change a setting.",
+    description: "Stores a config value for one key at the requested scope (user, tenant or system) after type, bounds, pattern and the key's own validator, encrypting it when the key declares that; use it to change a setting.",
     schema: z.object({
         key: z.string(),
         value: z.union([z.string(), z.number(), z.boolean()]),
@@ -67,6 +67,22 @@ export const setWrite = defineWriteHandler({
         const patternError = validatePattern(event.payload.value, keyDef);
         if (patternError)
             return writeFailure(patternError);
+        if (keyDef.validate) {
+            try {
+                await keyDef.validate(event.payload.value, {
+                    key: event.payload.key,
+                    scope,
+                    tenantId,
+                    userId,
+                    db,
+                });
+            }
+            catch (error) {
+                if (isKumikoError(error))
+                    return writeFailure(error);
+                throw error;
+            }
+        }
         // The batch idempotency cache stores this result and only masks entity
         // writeOnly fields, so an at-rest-encrypted value must not be echoed.
         const echoedValue = isEncryptedAtRest(keyDef) ? MASKED : event.payload.value;

package/dist/crypto-shredding/feature.js

@@ -8,8 +8,9 @@ export function createCryptoShreddingFeature() {
             displayLabel: "Crypto-Shredding",
             category: "compliance",
         });
-        // `reason` is operator free text and may name the subject; encrypting it under
-        // the subject key is pointless (that key is being erased) — see #2776.
+        // `reason` is operator free text and may name the subject, yet stays plaintext: the forget
+        // erases the subject key before the audit append, so a forget of the actor's own tenant
+        // would fail to seal the reason under that tenant's key.
         r.defineEvent("subject-forgotten", subjectForgottenSchema, { piiFields: "none" });
         r.defineEvent("forget-denied", subjectForgetDeniedSchema, { piiFields: "none" });
         r.writeHandler(forgetSubjectWrite);

package/dist/crypto-shredding/handlers/forget-subject.write.d.ts

@@ -21,7 +21,7 @@ export declare const subjectForgottenSchema: z.ZodObject<{
     forgottenBy: z.ZodString;
 }, z.core.$strip>;
 export declare const subjectForgetDeniedSchema: z.ZodObject<{
-    subjectKeyDigest: z.ZodString;
+    subjectKeyDigest: z.ZodOptional<z.ZodString>;
     subjectKind: z.ZodEnum<{
         record: "record";
         tenant: "tenant";