@cosmicdrift/kumiko-bundled-features 0.339.0 → 0.341.0

package/dist/legal-pages/lib/boot-check.js

@@ -0,0 +1,33 @@
+import { requireTemplateResolver, TEXT_BLOCK_KIND, } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { LEGAL_REQUIRED_BLOCKS } from "../constants.js";
+// Missing required blocks fail the boot only in production; elsewhere they warn,
+// so a dev setup without seeded legal texts still starts. A complete set logs
+// info on purpose, so a skipped check is visible.
+export async function runLegalPagesBootCheck(ctx, requiredBlocks = LEGAL_REQUIRED_BLOCKS) {
+    const templateResolver = requireTemplateResolver(ctx, "legal-pages-boot-check");
+    const missing = [];
+    for (const required of requiredBlocks) {
+        const block = await templateResolver.findExact({
+            tenantId: SYSTEM_TENANT_ID,
+            slug: required.slug,
+            kind: TEXT_BLOCK_KIND,
+            locale: required.lang,
+        });
+        if (!block?.content) {
+            missing.push({ slug: required.slug, lang: required.lang });
+        }
+    }
+    if (missing.length === 0) {
+        ctx.log?.info?.("legal-pages boot-check: alle Pflicht-Blocks vorhanden");
+    }
+    else {
+        const message = `legal-pages: missing ${missing.length} required text-block(s) in SYSTEM_TENANT: ` +
+            missing.map((m) => `${m.slug}/${m.lang}`).join(", ") +
+            ". Seed via template-resolver:write:set or the seedTextBlock helper.";
+        if (process.env["NODE_ENV"] === "production") {
+            throw new Error(`Boot-Validation failed: ${message}`);
+        }
+        ctx.log?.warn?.(message);
+    }
+}

package/dist/legal-pages/lib/validate-routes.d.ts

@@ -0,0 +1,2 @@
+import type { LegalPageRoute } from "../constants.js";
+export declare function validateRoutes(routes: readonly LegalPageRoute[]): void;

package/dist/legal-pages/lib/validate-routes.js

@@ -0,0 +1,17 @@
+// Validated once at feature-build time (not per-request) so a config typo
+// fails app startup instead of surfacing as a confusing 404 later.
+export function validateRoutes(routes) {
+    const seenPaths = new Set();
+    for (const route of routes) {
+        if (!route.path || !route.slug || !route.lang) {
+            throw new Error(`legal-pages: route is missing a required field (path/slug/lang): ${JSON.stringify(route)}`);
+        }
+        if (!route.path.startsWith("/")) {
+            throw new Error(`legal-pages: route path must start with "/", got "${route.path}"`);
+        }
+        if (seenPaths.has(route.path)) {
+            throw new Error(`legal-pages: duplicate route path "${route.path}"`);
+        }
+        seenPaths.add(route.path);
+    }
+}

package/dist/page-render/index.d.ts

@@ -1,6 +1,7 @@
 export { type BrandingTokens, brandingHeaderHtml, brandingStyleBlock, EMPTY_BRANDING, isSafeHexColor, isSafeHttpsUrl, layoutMaxWidth, } from "./branding.js";
 export { type CachedSecurePageResponseInit, cachedSecurePageResponse, } from "./cached-page-response.js";
 export { sanitizeTenantCss } from "./css-sanitize.js";
-export { type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
+export { type PublicPageWrapLayout, type SeoHeadInput, TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
 export { renderSafeMarkdown } from "./markdown.js";
 export { securePageHeaders } from "./security-headers.js";
+export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.js";

package/dist/page-render/index.js

@@ -4,3 +4,4 @@ export { sanitizeTenantCss } from "./css-sanitize.js";
 export { TENANT_CONTENT_ATTR, tenantStyleBlock, wrapInLayout, } from "./layout.js";
 export { renderSafeMarkdown } from "./markdown.js";
 export { securePageHeaders } from "./security-headers.js";
+export { redirectToCanonicalPath, slashVariantOf } from "./trailing-slash.js";

package/dist/page-render/layout.d.ts

@@ -1,6 +1,13 @@
 import { type ApexHead } from "@cosmicdrift/kumiko-headless/apex";
 import { type BrandingTokens } from "./branding.js";
 export type SeoHeadInput = Omit<ApexHead, "title" | "description" | "lang">;
+export type PublicPageWrapLayout = (opts: {
+    readonly title: string;
+    readonly bodyHtml: string;
+    readonly lang: string;
+    readonly slug?: string;
+    readonly alternates?: Readonly<Record<string, string>>;
+}) => string;
 export declare const TENANT_CONTENT_ATTR = "data-tenant-content";
 export declare function tenantStyleBlock(customCss: string): string;
 export declare function wrapInLayout(opts: {

package/dist/page-render/layout.js

@@ -81,6 +81,11 @@ ${headHtml}
   a { color: var(--accent); }
   code { background: #f4f4f4; padding: 0.1rem 0.3rem; border-radius: 3px; }
   hr { border: 0; border-top: 1px solid #ddd; margin: 2rem 0; }
+  input, select, textarea, button { font: inherit; color: inherit; padding: 0.4rem 0.6rem;
+         border: 1px solid #bbb; border-radius: 4px; box-sizing: border-box; }
+  input:not([type="radio"]):not([type="checkbox"]):not([type="hidden"]), select, textarea {
+         width: 100%; max-width: 100%; }
+  button { cursor: pointer; background: #f4f4f4; }
   .brand-header { position: relative; z-index: 1; display: flex; align-items: center;
                   gap: 0.6rem; margin-bottom: 1.5rem; }
   .brand-header a { display: flex; align-items: center; gap: 0.6rem; color: inherit; text-decoration: none; }

package/dist/page-render/trailing-slash.d.ts

@@ -0,0 +1,2 @@
+export declare function slashVariantOf(path: string): string | null;
+export declare function redirectToCanonicalPath(requestUrl: string, canonicalPath: string): Response;

package/dist/page-render/trailing-slash.js

@@ -0,0 +1,15 @@
+// The other trailing-slash form of a path, or null for the root path (it has
+// no distinct variant).
+export function slashVariantOf(path) {
+    if (path === "/")
+        return null;
+    return path.endsWith("/") ? path.slice(0, -1) : `${path}/`;
+}
+// Hono matches strictly, so the slash variant of a page would 404. A 301 keeps
+// one canonical URL; the query string is carried over.
+export function redirectToCanonicalPath(requestUrl, canonicalPath) {
+    return new Response(null, {
+        status: 301,
+        headers: { location: `${canonicalPath}${new URL(requestUrl).search}` },
+    });
+}

package/dist/renderer-simple/feature.js

@@ -19,6 +19,7 @@ export async function adaptToFoundation(req, ctx, renderer = simpleRenderer) {
     const html = await renderer.render({
         template: req.payload.template ?? "",
         variables,
+        locale: req.payload.locale,
     });
     return { kind: "notification", html };
 }

package/dist/renderer-simple/index.d.ts

@@ -1,2 +1,2 @@
 export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
-export { createSimpleRenderer, type MailBranding, simpleRenderer } from "./simple-renderer.js";
+export { createSimpleRenderer, type LocalizedText, type MailBranding, simpleRenderer, } from "./simple-renderer.js";

package/dist/renderer-simple/index.js

@@ -1,2 +1,2 @@
 export { createRendererSimpleFeature } from "./feature.js";
-export { createSimpleRenderer, simpleRenderer } from "./simple-renderer.js";
+export { createSimpleRenderer, simpleRenderer, } from "./simple-renderer.js";

package/dist/renderer-simple/simple-renderer.d.ts

@@ -4,14 +4,21 @@ export type MailBranding = {
     readonly productName?: string;
     /** Hex color (#rgb, #rrggbb, #rrggbbaa); used for buttons and the header accent. */
     readonly primaryColor?: string;
-    /** Absolute http(s) URL; anything else is dropped. */
+    /** Absolute http(s) URL; anything else is dropped. Mutually exclusive with `logoPath`. */
     readonly logoUrl?: string;
-    readonly footerText?: string;
-    /** Absolute http(s) URLs only; other entries are dropped. */
+    /** Absolute path on `baseUrl` (e.g. "/logo.png"); use PNG/JPEG, mail clients block SVG. */
+    readonly logoPath?: string;
+    /** Absolute http(s) origin that `logoPath` is resolved against; same base as `auth.mail.baseUrl`. */
+    readonly baseUrl?: string;
+    /** Locale tried after the exact and language-part match when a localized field has no entry. */
+    readonly defaultLocale?: string;
+    readonly footerText?: LocalizedText;
+    /** Absolute http(s) URLs only; string URLs that are not are dropped, localized ones fail at boot. */
     readonly footerLinks?: readonly {
-        readonly label: string;
-        readonly url: string;
+        readonly label: LocalizedText;
+        readonly url: LocalizedText;
     }[];
 };
+export type LocalizedText = string | Readonly<Record<string, string>>;
 export declare function createSimpleRenderer(branding?: MailBranding): NotificationRenderer;
 export declare const simpleRenderer: NotificationRenderer;

package/dist/renderer-simple/simple-renderer.js

@@ -10,14 +10,61 @@ function isHttpUrl(value) {
         return false;
     }
 }
+function languagePart(locale) {
+    return locale.split("-")[0] ?? locale;
+}
+function pickByLocale(entries, locale) {
+    // Own keys only: a locale like "constructor" must not hit Object.prototype.
+    const ownEntry = (key) => Object.hasOwn(entries, key) ? entries[key] : undefined;
+    return ownEntry(locale) ?? ownEntry(languagePart(locale));
+}
+function resolveLocalized(value, locale, defaultLocale) {
+    if (value === undefined || typeof value === "string")
+        return value;
+    return ((locale !== undefined ? pickByLocale(value, locale) : undefined) ??
+        (defaultLocale !== undefined ? pickByLocale(value, defaultLocale) : undefined) ??
+        Object.values(value)[0]);
+}
+function assertLocalizedUrlsAreHttp(branding) {
+    for (const link of branding.footerLinks ?? []) {
+        if (typeof link.url === "string")
+            continue;
+        for (const [locale, url] of Object.entries(link.url)) {
+            if (!isHttpUrl(url)) {
+                throw new Error(`createSimpleRenderer: footerLinks url for locale "${locale}" must be an absolute http(s) URL`);
+            }
+        }
+    }
+}
+function resolveLogoUrl(branding) {
+    if (!branding)
+        return undefined;
+    const { logoUrl, logoPath, baseUrl } = branding;
+    if (logoPath === undefined) {
+        return logoUrl && isHttpUrl(logoUrl) ? logoUrl : undefined;
+    }
+    if (logoUrl !== undefined) {
+        throw new Error("createSimpleRenderer: logoPath and logoUrl are mutually exclusive");
+    }
+    if (baseUrl === undefined || !isHttpUrl(baseUrl)) {
+        throw new Error("createSimpleRenderer: logoPath requires an absolute http(s) baseUrl");
+    }
+    if (!/^\/(?![/\\])/.test(logoPath) || logoPath.includes("\\")) {
+        throw new Error('createSimpleRenderer: logoPath must start with a single "/"');
+    }
+    const resolved = new URL(logoPath, baseUrl);
+    if (resolved.origin !== new URL(baseUrl).origin) {
+        throw new Error("createSimpleRenderer: logoPath must stay on the baseUrl origin");
+    }
+    return resolved.href;
+}
 function resolvePrimaryColor(branding) {
     const color = branding?.primaryColor;
     return color && HEX_COLOR_PATTERN.test(color) ? color : DEFAULT_PRIMARY_COLOR;
 }
-function renderBrandingHeader(branding, primaryColor) {
+function renderBrandingHeader(branding, primaryColor, logoUrl) {
     if (!branding)
         return "";
-    const logoUrl = branding.logoUrl && isHttpUrl(branding.logoUrl) ? branding.logoUrl : undefined;
     if (!logoUrl && !branding.productName)
         return "";
     const logo = logoUrl
@@ -25,16 +72,20 @@ function renderBrandingHeader(branding, primaryColor) {
         : `<span style="font-size:18px;font-weight:700;color:${escapeHtmlAttr(primaryColor)}">${escapeHtml(branding.productName ?? "")}</span>`;
     return `<div style="margin:0 0 24px;padding:0 0 16px;border-bottom:3px solid ${escapeHtmlAttr(primaryColor)}">${logo}</div>`;
 }
-function renderBrandingFooter(branding) {
+function renderBrandingFooter(branding, locale) {
     if (!branding)
         return "";
-    const links = (branding.footerLinks ?? [])
-        .filter((link) => isHttpUrl(link.url))
-        .map((link) => `<a href="${escapeHtmlAttr(link.url)}" style="color:#999">${escapeHtml(link.label)}</a>`);
-    const footerPartsHtml = [
-        branding.footerText ? escapeHtml(branding.footerText) : "",
-        links.join(" · "),
-    ].filter((part) => part !== "");
+    const pick = (value) => resolveLocalized(value, locale, branding.defaultLocale);
+    const links = (branding.footerLinks ?? []).flatMap((link) => {
+        const url = pick(link.url);
+        if (url === undefined || !isHttpUrl(url))
+            return [];
+        return [
+            `<a href="${escapeHtmlAttr(url)}" style="color:#999">${escapeHtml(pick(link.label) ?? "")}</a>`,
+        ];
+    });
+    const footerText = pick(branding.footerText);
+    const footerPartsHtml = [footerText ? escapeHtml(footerText) : "", links.join(" · ")].filter((part) => part !== "");
     if (footerPartsHtml.length === 0)
         return "";
     const footerHtml = footerPartsHtml.join("<br />");
@@ -53,6 +104,9 @@ function renderSection(section, primaryColor) {
 // No external dependencies, no template engine — just string concatenation.
 export function createSimpleRenderer(branding) {
     const primaryColor = resolvePrimaryColor(branding);
+    const logoUrl = resolveLogoUrl(branding);
+    if (branding)
+        assertLocalizedUrlsAreHttp(branding);
     return {
         name: "simple",
         async render(input) {
@@ -63,7 +117,7 @@ export function createSimpleRenderer(branding) {
             const parts = [];
             parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
             parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
-            parts.push(renderBrandingHeader(branding, primaryColor));
+            parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
             if (header) {
                 parts.push(`<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`);
             }
@@ -75,7 +129,7 @@ export function createSimpleRenderer(branding) {
             if (data.footer) {
                 parts.push(`<p style="margin:24px 0 0;color:#999;font-size:12px;border-top:1px solid #eee;padding-top:16px">${escapeHtml(data.footer)}</p>`);
             }
-            parts.push(renderBrandingFooter(branding));
+            parts.push(renderBrandingFooter(branding, input.locale));
             parts.push("</div></body></html>");
             return parts.join("");
         },

package/dist/secrets/announce-secret-change.d.ts

@@ -0,0 +1,8 @@
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type CacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
+type AnnouncingContext = {
+    readonly cacheSync?: CacheSyncBus;
+    readonly scheduleAfterCommit?: (hook: () => Promise<void>) => void;
+};
+export declare function announceSecretChange(ctx: AnnouncingContext, tenantId: TenantId, key: string): void;
+export {};

package/dist/secrets/announce-secret-change.js

@@ -0,0 +1,18 @@
+import { CACHE_SYNC_TOPICS, } from "@cosmicdrift/kumiko-framework/redis";
+// Secret writes bypass config:write:*, yet provider caches (e.g. the S3 secret
+// key) depend on them: announce on the tenant-config topic, after commit so a
+// replica reloading on the message sees the new value.
+export function announceSecretChange(ctx, tenantId, key) {
+    const bus = ctx.cacheSync;
+    // skip: no bus wired (single-process setup), nothing to announce
+    if (!bus)
+        return;
+    const message = { tenantId, key };
+    const publish = async () => {
+        bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+    };
+    if (ctx.scheduleAfterCommit)
+        ctx.scheduleAfterCommit(publish);
+    else
+        bus.publish(CACHE_SYNC_TOPICS.tenantConfig, message);
+}

package/dist/secrets/feature.js

@@ -54,7 +54,7 @@ export function requireSecretsContext(ctx, handlerName) {
     if (!ctx.secrets) {
         throw new InternalError({
             message: `[${handlerName}] ctx.secrets missing — pass ` +
-                "createSecretsContext({db, masterKeyProvider}) via extraContext.secrets at boot.",
+                "createSecretsContext({db, masterKeyProvider, registry}) via extraContext.secrets at boot.",
         });
     }
     const raw = ctx.secrets;

package/dist/secrets/handlers/delete.write.js

@@ -1,6 +1,7 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
 import { checkSecretKeyWrite } from "../write-gate.js";
@@ -23,6 +24,7 @@ export function createDeleteHandler(access = DEFAULT_SECRETS_ACCESS) {
             });
             if (!removed)
                 return failNotFound("tenant-secret", event.payload.key);
+            announceSecretChange(ctx, event.user.tenantId, event.payload.key);
             return { isSuccess: true, data: { key: event.payload.key } };
         },
     });

package/dist/secrets/handlers/set.write.js

@@ -1,8 +1,9 @@
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { announceSecretChange } from "../announce-secret-change.js";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
-import { checkSecretKeyWrite } from "../write-gate.js";
+import { checkSecretKeyWrite, checkSecretValue } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
         name: "set",
@@ -30,6 +31,9 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, key);
             if (!gate.ok)
                 return gate.failure;
+            const invalidValue = checkSecretValue(ctx.registry, key, value);
+            if (invalidValue)
+                return invalidValue;
             const featureRedact = gate.keyDef?.redact;
             const redactFn = redactedPreview
                 ? () => redactedPreview
@@ -39,6 +43,7 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
                 ...(hint ? { hint } : {}),
                 updatedBy: event.user.id,
             });
+            announceSecretChange(ctx, event.user.tenantId, key);
             return {
                 isSuccess: true,
                 data: { key, redactedPreview: redactedPreview ?? redactFn(value) },

package/dist/secrets/i18n.d.ts

@@ -7,4 +7,8 @@ export declare const SECRETS_I18N: {
         readonly en: "You are not allowed to change this secret.";
         readonly de: "Dieses Geheimnis darf nicht geändert werden.";
     };
+    readonly "secrets.errors.invalidValue": {
+        readonly en: "This value is not valid for this secret.";
+        readonly de: "Dieser Wert ist für dieses Geheimnis nicht gültig.";
+    };
 };

package/dist/secrets/i18n.js

@@ -7,4 +7,8 @@ export const SECRETS_I18N = {
         en: "You are not allowed to change this secret.",
         de: "Dieses Geheimnis darf nicht geändert werden.",
     },
+    "secrets.errors.invalidValue": {
+        en: "This value is not valid for this secret.",
+        de: "Dieser Wert ist für dieses Geheimnis nicht gültig.",
+    },
 };

package/dist/secrets/secrets-context.d.ts

@@ -1,10 +1,12 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type DekCache, type MasterKeyProvider, type SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import * as z from "zod";
+import { type SecretValueSchemaSource } from "./write-gate.js";
 export type { Secret, SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 export type SecretsContextOptions = {
     readonly db: DbConnection;
     readonly masterKeyProvider: MasterKeyProvider;
+    readonly registry: SecretValueSchemaSource;
     readonly dekCache?: DekCache;
 };
 export declare const TENANT_SECRET_READ_EVENT = "secrets:event:read";

package/dist/secrets/secrets-context.js

@@ -20,6 +20,7 @@ import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { selectTenantSecretEnvelope } from "./db/queries/read.js";
 import { tenantSecretEntity, tenantSecretsTable, } from "./table.js";
+import { invalidSecretValueError, isSecretValueValid, } from "./write-gate.js";
 // Synthetic actor identity for set/delete — the executor wants a full
 // SessionUser, but the secrets-context API takes only a user-id string
 // (via opts.updatedBy / opts.deletedBy). `system`-role mirrors how jobs
@@ -114,6 +115,8 @@ export function createSecretsContext(opts) {
         },
         async set(tenantId, keyOrHandle, value, setOpts = {}) {
             const key = resolveKey(keyOrHandle);
+            if (!isSecretValueValid(opts.registry, key, value))
+                throw invalidSecretValueError();
             const envelope = await encryptValue(value, masterKeyProvider);
             const stored = encodeStoredEnvelope(envelope);
             const metadata = {

package/dist/secrets/write-gate.d.ts

@@ -1,5 +1,5 @@
 import type { Registry, SecretKeyDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { ValidationError, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
 export type SecretKeyWriteCheck = {
     readonly ok: true;
     readonly keyDef: SecretKeyDefinition | undefined;
@@ -8,3 +8,7 @@ export type SecretKeyWriteCheck = {
     readonly failure: WriteFailure;
 };
 export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;
+export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
+export declare function invalidSecretValueError(): ValidationError;
+export declare function isSecretValueValid(schemas: SecretValueSchemaSource, key: string, value: string): boolean;
+export declare function checkSecretValue(registry: SecretValueSchemaSource, key: string, value: string): WriteFailure | undefined;

package/dist/secrets/write-gate.js

@@ -1,4 +1,4 @@
-import { AccessDeniedError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 function unknownKeyFailure(key) {
     return {
         ok: false,
@@ -34,3 +34,26 @@ export function checkSecretKeyWrite(registry, userRoles, key) {
     }
     return { ok: true, keyDef };
 }
+// Carries neither the value nor the schema's issues.
+export function invalidSecretValueError() {
+    return new ValidationError({
+        fields: [
+            {
+                path: "value",
+                code: "invalid_secret_value",
+                i18nKey: "secrets.errors.invalidValue",
+            },
+        ],
+    }, { i18nKey: "secrets.errors.invalidValue" });
+}
+export function isSecretValueValid(schemas, key, value) {
+    const valueSchema = schemas.getSecretKey(key)?.valueSchema ?? schemas.findSecretNamespace(key)?.valueSchema;
+    return valueSchema === undefined || valueSchema.safeParse(value).success;
+}
+// Runs after checkSecretKeyWrite, so a caller without the write role never learns
+// whether a value would have passed.
+export function checkSecretValue(registry, key, value) {
+    if (isSecretValueValid(registry, key, value))
+        return undefined;
+    return writeFailure(invalidSecretValueError());
+}

package/dist/tenant/constants.d.ts

@@ -39,4 +39,5 @@ export declare const TenantErrors: {
     readonly membershipAlreadyExists: "membership_already_exists";
     readonly lastTenantAdmin: "last_tenant_admin";
     readonly invitationSuperseded: "invitation_superseded";
+    readonly crossTenantMembershipDenied: "cross_tenant_membership_denied";
 };

package/dist/tenant/constants.js

@@ -65,4 +65,5 @@ export const TenantErrors = {
     membershipAlreadyExists: "membership_already_exists",
     lastTenantAdmin: "last_tenant_admin",
     invitationSuperseded: "invitation_superseded",
+    crossTenantMembershipDenied: "cross_tenant_membership_denied",
 };

package/dist/tenant/handlers/add-member.write.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler, SYSTEM_ROLE, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, ConflictError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { TenantErrors } from "../constants.js";
 import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles.js";
@@ -9,6 +9,11 @@ import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-ta
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
     entityName: "tenant-membership",
 });
+// Both halves: test stacks can mint JWTs with the "system" role, but only the
+// framework operator carries SYSTEM_USER_ID.
+function isFrameworkSystemUser(user) {
+    return user.id === SYSTEM_USER_ID && user.roles.includes(SYSTEM_ROLE);
+}
 export const addMemberWrite = defineWriteHandler({
     name: "addMember",
     schema: z.object({
@@ -16,7 +21,7 @@ export const addMemberWrite = defineWriteHandler({
         tenantId: z.string(),
         roles: z.array(z.string()).min(1),
     }),
-    access: { roles: ["SystemAdmin"] },
+    access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
     description: "Grants an existing user membership in a tenant with the given roles, refusing reserved role names and a user who is already a member; use it to add someone to a workspace without going through an invitation.",
     handler: async (event, ctx) => {
         if (!ctx.systemDb) {
@@ -25,6 +30,12 @@ export const addMemberWrite = defineWriteHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin manages memberships across tenants");
+        if (!isFrameworkSystemUser(event.user) && event.payload.tenantId !== event.user.tenantId) {
+            return writeFailure(new AccessDeniedError({
+                message: "only the system context may add members to another tenant",
+                details: { reason: TenantErrors.crossTenantMembershipDenied },
+            }));
+        }
         const forbidden = findForbiddenMembershipRole(event.payload.roles);
         if (forbidden !== undefined)
             return writeFailure(reservedMembershipRoleError(forbidden));

package/dist/tenant/handlers/invitations.query.d.ts

@@ -1,5 +1,13 @@
 import * as z from "zod";
 export declare const invitationsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"invitations", z.ZodObject<{}, z.core.$strip>, {
+    id: unknown;
+    tenantId: unknown;
     email: unknown;
+    role: unknown;
+    status: unknown;
     invitedBy: unknown;
+    expiresAt: unknown;
+    insertedAt: unknown;
+    version: unknown;
+    globalRoles?: unknown;
 }[], import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/tenant/handlers/invitations.query.js

@@ -4,6 +4,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
+import { isSystemAdmin } from "./is-system-admin.js";
 // Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
 // own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
 // one call per row unbounded and exhausts the pool once invitation counts
@@ -46,7 +47,20 @@ export const invitationsQuery = defineQueryHandler({
             const decryptedInvitedBy = typeof invitedBy === "string"
                 ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
                 : invitedBy;
-            return { ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy };
+            // Explicit allowlist: the raw row also carries blind-index columns and
+            // globalRoles, which only a SystemAdmin may see.
+            return {
+                id: row["id"],
+                tenantId: row["tenantId"],
+                email: decryptedEmail,
+                role: row["role"],
+                status: row["status"],
+                invitedBy: decryptedInvitedBy,
+                expiresAt: row["expiresAt"],
+                insertedAt: row["insertedAt"],
+                version: row["version"],
+                ...(isSystemAdmin(query.user) && { globalRoles: row["globalRoles"] }),
+            };
         });
     },
 });

package/dist/tenant/index.d.ts

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";

package/dist/tenant/index.js

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";

package/dist/tenant/invitation-table.d.ts

@@ -49,6 +49,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    globalRoles: import("@cosmicdrift/kumiko-types/fields").MultiSelectFieldDef<readonly ["SystemAdmin"]>;
     status: {
         readonly type: "select";
         readonly description?: string;
@@ -151,6 +152,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    globalRoles: import("@cosmicdrift/kumiko-types/fields").MultiSelectFieldDef<readonly ["SystemAdmin"]>;
     status: {
         readonly type: "select";
         readonly description?: string;

package/dist/tenant/invitation-table.js

@@ -22,7 +22,9 @@
 // pending → re-use existing row + refresh Redis-token + send mail
 // (analog zu signup-Resend).
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { createEntity, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { createEntity, createMultiSelectField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 // Status-const-Object damit Handler-Code keine Magic-Strings nutzt.
 // Bei rename (z.B. "cancelled" → "revoked") fällt jeder caller auf
 // einmal auf statt verstreut über 5 Stellen.
@@ -57,6 +59,13 @@ export const tenantInvitationEntity = createEntity({
             personal: false,
             reason: "technical_reference",
         }),
+        // Global (users.roles) roles granted on accept, on top of the membership
+        // role. Only the system-only invite variant sets them; every tenant-admin
+        // re-invite resets them to [] so a resend can never carry them over.
+        globalRoles: createMultiSelectField({
+            options: GLOBAL_ROLE_OPTIONS,
+            default: [],
+        }),
         // Lifecycle-State. Default "pending"; transitions:
         //   pending → accepted | cancelled | expired
         status: createSelectField({