@cosmicdrift/kumiko-bundled-features 0.339.0 → 0.341.0

package/dist/waitlist/entity.d.ts

@@ -0,0 +1,433 @@
+export declare function isOpenWaitlistStatus(status: unknown): boolean;
+export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
+    name: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    email: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    company: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    portfolio: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    message: {
+        readonly type: "longText";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    locale: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    status: {
+        readonly type: "select";
+        readonly description?: string;
+        readonly options: readonly ["pending", "invited", "rejected"];
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: "invited" | "pending" | "rejected" | undefined;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly display?: "radio" | "dropdown";
+        readonly optionTones?: {
+            readonly invited?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly rejected?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+        } | undefined;
+        readonly optionsQuery?: string;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    submittedAt: {
+        readonly type: "timestamp";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly locatedBy?: string;
+        readonly min?: string;
+        readonly max?: string;
+        readonly locale?: string;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    invitedAt: {
+        readonly type: "timestamp";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly locatedBy?: string;
+        readonly min?: string;
+        readonly max?: string;
+        readonly locale?: string;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    invitedBy: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    linkedTenantId: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+}, "global">;
+export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
+    name: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    email: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    company: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    portfolio: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    message: {
+        readonly type: "longText";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    locale: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    status: {
+        readonly type: "select";
+        readonly description?: string;
+        readonly options: readonly ["pending", "invited", "rejected"];
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly default?: "invited" | "pending" | "rejected" | undefined;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly display?: "radio" | "dropdown";
+        readonly optionTones?: {
+            readonly invited?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly pending?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+            readonly rejected?: import("@cosmicdrift/kumiko-types/fields").SelectOptionTone | undefined;
+        } | undefined;
+        readonly optionsQuery?: string;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    submittedAt: {
+        readonly type: "timestamp";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly locatedBy?: string;
+        readonly min?: string;
+        readonly max?: string;
+        readonly locale?: string;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: true;
+    };
+    invitedAt: {
+        readonly type: "timestamp";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly locatedBy?: string;
+        readonly min?: string;
+        readonly max?: string;
+        readonly locale?: string;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    invitedBy: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+    linkedTenantId: {
+        readonly type: "text";
+        readonly description?: string;
+        readonly maxLength?: number;
+        readonly required?: boolean;
+        readonly searchable?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly encrypted?: boolean;
+        readonly sensitive?: boolean;
+        readonly writeOnly?: boolean;
+        readonly readAsInstruction?: boolean;
+        readonly format?: "email" | "url" | "phone" | "password";
+        readonly default?: string;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly multiline?: boolean | {
+            readonly rows?: number;
+        };
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
+}, "global">>;

package/dist/waitlist/entity.js

@@ -0,0 +1,64 @@
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import { createEntity, createLongTextField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { WAITLIST_STATUS } from "./constants.js";
+const WAITLIST_STATUS_OPTIONS = [
+    WAITLIST_STATUS.Pending,
+    WAITLIST_STATUS.Invited,
+    WAITLIST_STATUS.Rejected,
+];
+const OPEN_WAITLIST_STATUSES = [
+    WAITLIST_STATUS.Pending,
+    WAITLIST_STATUS.Invited,
+];
+// Entries still awaiting a decision; rejected is terminal.
+export function isOpenWaitlistStatus(status) {
+    return OPEN_WAITLIST_STATUSES.some((open) => open === status);
+}
+// An entrant has no user account, so name/email/message are personal: "self" —
+// the row's own id is its crypto-shredding subject. find: "fuzzy" keeps the
+// blind-index equality lookup (dedupe, GDPR export by email) and full-text
+// search alive; sortable stays off, the boot validator rejects it on subject fields.
+// tenancy "global" + systemStream: entries are platform-wide and live on
+// SYSTEM_TENANT_ID, which also lets the per-tenant GDPR hooks read them.
+export const waitlistEntryEntity = createEntity({
+    table: "read_waitlist_entries",
+    description: "A prospect's signup on the platform waitlist, tracked through pending, invited and rejected status as admins process it; name, email and message are the entry's own personal data.",
+    systemStream: true,
+    tenancy: "global",
+    fields: {
+        name: createTextField({ required: true, personal: "self", find: "fuzzy", searchable: true }),
+        email: createTextField({ required: true, personal: "self", find: "fuzzy", searchable: true }),
+        company: createTextField({
+            personal: false,
+            reason: "is_business_data",
+            searchable: true,
+            sortable: true,
+        }),
+        portfolio: createTextField({ personal: false, reason: "is_business_data" }),
+        message: createLongTextField({ personal: "self", find: "none" }),
+        locale: createTextField({
+            required: true,
+            personal: false,
+            reason: "is_ui_language_preference",
+            sortable: true,
+        }),
+        status: createSelectField({
+            options: WAITLIST_STATUS_OPTIONS,
+            required: true,
+            default: WAITLIST_STATUS.Pending,
+            filterable: true,
+            sortable: true,
+        }),
+        submittedAt: createTimestampField({
+            personal: false,
+            sortable: true,
+            required: true,
+            reason: "is_submission_timestamp",
+        }),
+        invitedAt: createTimestampField(),
+        invitedBy: createTextField({ personal: false, reason: "is_admin_audit_id" }),
+        // Not named tenantId: that is the framework's physical tenant column.
+        linkedTenantId: createTextField({ personal: false, reason: "is_tenant_reference" }),
+    },
+});
+export const waitlistEntryTable = buildEntityTable("waitlistEntry", waitlistEntryEntity);

package/dist/waitlist/feature.d.ts

@@ -0,0 +1,3 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { WaitlistOptions } from "./options.js";
+export declare function createWaitlistFeature(opts?: WaitlistOptions): FeatureDefinition;

package/dist/waitlist/feature.js

@@ -0,0 +1,38 @@
+import { defineFeature, EXT_USER_DATA, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
+import { WAITLIST_FEATURE } from "./constants.js";
+import { waitlistEntryEntity } from "./entity.js";
+import { createInviteHandler } from "./handlers/invite.write.js";
+import { listQuery } from "./handlers/list.query.js";
+import { rejectHandler } from "./handlers/reject.write.js";
+import { createSubmitHandler } from "./handlers/submit.write.js";
+import { WAITLIST_I18N } from "./i18n.js";
+import { adminAccess } from "./lib.js";
+import { waitlistListScreen } from "./screens.js";
+import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
+export function createWaitlistFeature(opts = {}) {
+    return defineFeature(WAITLIST_FEATURE, (r) => {
+        r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response never reveals whether an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
+        r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
+        r.systemScope();
+        r.requires("tenant", "auth-email-password", "user-data-rights");
+        r.translations({ keys: WAITLIST_I18N });
+        r.entity("waitlistEntry", waitlistEntryEntity);
+        r.writeHandler(createSubmitHandler(opts));
+        r.writeHandler(createInviteHandler(opts.invite));
+        r.writeHandler(rejectHandler);
+        r.queryHandler(listQuery);
+        r.screen(waitlistListScreen);
+        r.nav({
+            id: "waitlist",
+            label: i18nKey("waitlist.nav.waitlist"),
+            screen: "waitlist:screen:waitlist-list",
+            icon: "users",
+            order: 15,
+            access: adminAccess,
+        });
+        r.useExtension(EXT_USER_DATA, "waitlistEntry", {
+            export: waitlistEntryExportHook,
+            delete: waitlistEntryDeleteHook,
+        });
+    });
+}

package/dist/waitlist/handlers/invite.write.d.ts

@@ -0,0 +1,9 @@
+import type { WaitlistInviteOptions } from "../options.js";
+export type WaitlistInviteData = {
+    readonly kind: "invited";
+    readonly id: string;
+    readonly tenantId: string;
+};
+export declare function createInviteHandler(invite?: WaitlistInviteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite", import("zod").ZodObject<{
+    id: import("zod").ZodUUID;
+}, import("zod/v4/core").$strict>, WaitlistInviteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/waitlist/handlers/invite.write.js

@@ -0,0 +1,119 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { Temporal } from "temporal-polyfill";
+import { AuthErrors, AuthHandlers } from "../../auth-email-password/index.js";
+import { TenantHandlers, tenantTable } from "../../tenant/index.js";
+import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
+import { isOpenWaitlistStatus } from "../entity.js";
+import { adminAccess, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
+import { WaitlistIdSchema } from "../payloads.js";
+const DEFAULT_INVITE = {
+    mode: "own-tenant",
+    role: DEFAULT_OWN_TENANT_INVITE_ROLE,
+};
+// Derived from the entry id so a retry finds the tenant a half-failed run created.
+function tenantKeyForEntry(entryId) {
+    return `waitlist-${entryId}`;
+}
+function readEntryRow(row) {
+    const { id, version, email, name, company, linkedTenantId } = row;
+    if (typeof id !== "string" ||
+        typeof version !== "number" ||
+        typeof email !== "string" ||
+        typeof name !== "string") {
+        throw new InternalError({ message: "waitlist:invite: malformed waitlist row" });
+    }
+    return {
+        id,
+        version,
+        status: row["status"],
+        email,
+        name,
+        company: typeof company === "string" && company !== "" ? company : null,
+        linkedTenantId: typeof linkedTenantId === "string" ? linkedTenantId : null,
+    };
+}
+function isInviteAlreadyAccepted(details) {
+    return (typeof details === "object" &&
+        details !== null &&
+        "reason" in details &&
+        details.reason === AuthErrors.inviteAlreadyAccepted);
+}
+async function ensureOwnTenant(entry, ctx) {
+    const linked = entry.linkedTenantId === null ? null : parseTenantId(entry.linkedTenantId);
+    if (linked)
+        return linked;
+    const key = tenantKeyForEntry(entry.id);
+    const existing = await fetchOne(waitlistDb(ctx), tenantTable, { key });
+    const existingId = existing ? parseTenantId(existing.id) : null;
+    if (existingId)
+        return existingId;
+    const newTenantId = parseTenantId(crypto.randomUUID());
+    if (!newTenantId)
+        throw new InternalError({ message: "waitlist:invite: tenant id mint failed" });
+    const created = await ctx.writeAs(createSystemUser(newTenantId), TenantHandlers.create, {
+        id: newTenantId,
+        key,
+        name: entry.company ?? entry.name,
+    });
+    return created.isSuccess ? newTenantId : created;
+}
+async function resolveInviteTarget(invite, entry, ctx) {
+    if (invite.mode === "shared-tenant")
+        return { tenantId: invite.tenantId, role: invite.role };
+    const tenantId = await ensureOwnTenant(entry, ctx);
+    if (typeof tenantId !== "string")
+        return tenantId;
+    return { tenantId, role: invite.role ?? DEFAULT_OWN_TENANT_INVITE_ROLE };
+}
+export function createInviteHandler(invite = DEFAULT_INVITE) {
+    return defineWriteHandler({
+        name: "invite",
+        schema: WaitlistIdSchema,
+        access: adminAccess,
+        description: "Invites a pending or already-invited waitlist entry: creates its tenant (or uses the configured shared tenant), mails the entrant a fresh accept link with the configured role and marks the entry invited; rejected entries cannot be invited. The invitee never receives a global role.",
+        // Sends an invite link by email, which cannot be recalled.
+        agent: { risk: "high" },
+        handler: async (event, ctx) => {
+            const db = waitlistDb(ctx);
+            const row = await waitlistExecutor.detail({ id: event.payload.id }, platformActor(), db);
+            if (!row)
+                return writeFailure(new NotFoundError("waitlistEntry", event.payload.id));
+            const entry = readEntryRow(row);
+            if (!isOpenWaitlistStatus(entry.status)) {
+                return writeFailure(new UnprocessableError(WaitlistErrors.notInvitable));
+            }
+            const target = await resolveInviteTarget(invite, entry, ctx);
+            if ("isSuccess" in target)
+                return target;
+            // inviteCreate is admin-only (no system role); the system variant with an
+            // empty globalRoles list is the only in-process path, and a waitlist
+            // invite must never grant a global role.
+            const invited = await ctx.writeAs(createSystemUser(target.tenantId), AuthHandlers.systemInviteCreate, { email: entry.email.toLowerCase(), role: target.role, globalRoles: [] });
+            if (!invited.isSuccess) {
+                // Re-inviting a person who already accepted would reset their live invitation.
+                if (isInviteAlreadyAccepted(invited.error.details)) {
+                    return writeFailure(new UnprocessableError(WaitlistErrors.notInvitable));
+                }
+                return invited;
+            }
+            const updated = await waitlistExecutor.update({
+                id: entry.id,
+                version: entry.version,
+                changes: {
+                    status: WAITLIST_STATUS.Invited,
+                    invitedAt: Temporal.Now.instant(),
+                    invitedBy: event.user.id,
+                    linkedTenantId: target.tenantId,
+                },
+            }, platformActor(), db);
+            if (!updated.isSuccess)
+                return updated;
+            return {
+                isSuccess: true,
+                data: { kind: "invited", id: entry.id, tenantId: target.tenantId },
+            };
+        },
+    });
+}

package/dist/waitlist/handlers/list.query.d.ts

@@ -0,0 +1 @@
+export declare const listQuery: import("@cosmicdrift/kumiko-types/handlers").QueryHandlerDef;