@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.341.0

package/dist/secrets/write-gate.js

@@ -1,4 +1,4 @@
-import { AccessDeniedError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 function unknownKeyFailure(key) {
     return {
         ok: false,
@@ -34,3 +34,26 @@ export function checkSecretKeyWrite(registry, userRoles, key) {
     }
     return { ok: true, keyDef };
 }
+// Carries neither the value nor the schema's issues.
+export function invalidSecretValueError() {
+    return new ValidationError({
+        fields: [
+            {
+                path: "value",
+                code: "invalid_secret_value",
+                i18nKey: "secrets.errors.invalidValue",
+            },
+        ],
+    }, { i18nKey: "secrets.errors.invalidValue" });
+}
+export function isSecretValueValid(schemas, key, value) {
+    const valueSchema = schemas.getSecretKey(key)?.valueSchema ?? schemas.findSecretNamespace(key)?.valueSchema;
+    return valueSchema === undefined || valueSchema.safeParse(value).success;
+}
+// Runs after checkSecretKeyWrite, so a caller without the write role never learns
+// whether a value would have passed.
+export function checkSecretValue(registry, key, value) {
+    if (isSecretValueValid(registry, key, value))
+        return undefined;
+    return writeFailure(invalidSecretValueError());
+}

package/dist/tenant/constants.d.ts

@@ -39,4 +39,5 @@ export declare const TenantErrors: {
     readonly membershipAlreadyExists: "membership_already_exists";
     readonly lastTenantAdmin: "last_tenant_admin";
     readonly invitationSuperseded: "invitation_superseded";
+    readonly crossTenantMembershipDenied: "cross_tenant_membership_denied";
 };

package/dist/tenant/constants.js

@@ -65,4 +65,5 @@ export const TenantErrors = {
     membershipAlreadyExists: "membership_already_exists",
     lastTenantAdmin: "last_tenant_admin",
     invitationSuperseded: "invitation_superseded",
+    crossTenantMembershipDenied: "cross_tenant_membership_denied",
 };

package/dist/tenant/handlers/add-member.write.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { defineWriteHandler, SYSTEM_ROLE, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError, ConflictError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { TenantErrors } from "../constants.js";
 import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles.js";
@@ -9,6 +9,11 @@ import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-ta
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
     entityName: "tenant-membership",
 });
+// Both halves: test stacks can mint JWTs with the "system" role, but only the
+// framework operator carries SYSTEM_USER_ID.
+function isFrameworkSystemUser(user) {
+    return user.id === SYSTEM_USER_ID && user.roles.includes(SYSTEM_ROLE);
+}
 export const addMemberWrite = defineWriteHandler({
     name: "addMember",
     schema: z.object({
@@ -16,7 +21,7 @@ export const addMemberWrite = defineWriteHandler({
         tenantId: z.string(),
         roles: z.array(z.string()).min(1),
     }),
-    access: { roles: ["SystemAdmin"] },
+    access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
     description: "Grants an existing user membership in a tenant with the given roles, refusing reserved role names and a user who is already a member; use it to add someone to a workspace without going through an invitation.",
     handler: async (event, ctx) => {
         if (!ctx.systemDb) {
@@ -25,6 +30,12 @@ export const addMemberWrite = defineWriteHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin manages memberships across tenants");
+        if (!isFrameworkSystemUser(event.user) && event.payload.tenantId !== event.user.tenantId) {
+            return writeFailure(new AccessDeniedError({
+                message: "only the system context may add members to another tenant",
+                details: { reason: TenantErrors.crossTenantMembershipDenied },
+            }));
+        }
         const forbidden = findForbiddenMembershipRole(event.payload.roles);
         if (forbidden !== undefined)
             return writeFailure(reservedMembershipRoleError(forbidden));

package/dist/tenant/handlers/invitations.query.d.ts

@@ -1,5 +1,13 @@
 import * as z from "zod";
 export declare const invitationsQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"invitations", z.ZodObject<{}, z.core.$strip>, {
+    id: unknown;
+    tenantId: unknown;
     email: unknown;
+    role: unknown;
+    status: unknown;
     invitedBy: unknown;
+    expiresAt: unknown;
+    insertedAt: unknown;
+    version: unknown;
+    globalRoles?: unknown;
 }[], import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/tenant/handlers/invitations.query.js

@@ -4,6 +4,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
+import { isSystemAdmin } from "./is-system-admin.js";
 // Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
 // own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
 // one call per row unbounded and exhausts the pool once invitation counts
@@ -46,7 +47,20 @@ export const invitationsQuery = defineQueryHandler({
             const decryptedInvitedBy = typeof invitedBy === "string"
                 ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
                 : invitedBy;
-            return { ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy };
+            // Explicit allowlist: the raw row also carries blind-index columns and
+            // globalRoles, which only a SystemAdmin may see.
+            return {
+                id: row["id"],
+                tenantId: row["tenantId"],
+                email: decryptedEmail,
+                role: row["role"],
+                status: row["status"],
+                invitedBy: decryptedInvitedBy,
+                expiresAt: row["expiresAt"],
+                insertedAt: row["insertedAt"],
+                version: row["version"],
+                ...(isSystemAdmin(query.user) && { globalRoles: row["globalRoles"] }),
+            };
         });
     },
 });

package/dist/tenant/index.d.ts

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";

package/dist/tenant/index.js

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export { OWNER_INVITE_ROLE_OPTIONS, TENANT_FEATURE, TenantErrors, TenantHandlers, TenantQueries, } from "./constants.js";
 export { collectAssignableAppRoles, createTenantFeature } from "./feature.js";

package/dist/tenant/invitation-table.d.ts

@@ -49,6 +49,7 @@ export declare const tenantInvitationEntity: import("@cosmicdrift/kumiko-types/f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    globalRoles: import("@cosmicdrift/kumiko-types/fields").MultiSelectFieldDef<readonly ["SystemAdmin"]>;
     status: {
         readonly type: "select";
         readonly description?: string;
@@ -151,6 +152,7 @@ export declare const tenantInvitationsTable: import("@cosmicdrift/kumiko-framewo
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
+    globalRoles: import("@cosmicdrift/kumiko-types/fields").MultiSelectFieldDef<readonly ["SystemAdmin"]>;
     status: {
         readonly type: "select";
         readonly description?: string;

package/dist/tenant/invitation-table.js

@@ -22,7 +22,9 @@
 // pending → re-use existing row + refresh Redis-token + send mail
 // (analog zu signup-Resend).
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
-import { createEntity, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+import { createEntity, createMultiSelectField, createSelectField, createTextField, createTimestampField, } from "@cosmicdrift/kumiko-framework/engine";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 // Status-const-Object damit Handler-Code keine Magic-Strings nutzt.
 // Bei rename (z.B. "cancelled" → "revoked") fällt jeder caller auf
 // einmal auf statt verstreut über 5 Stellen.
@@ -57,6 +59,13 @@ export const tenantInvitationEntity = createEntity({
             personal: false,
             reason: "technical_reference",
         }),
+        // Global (users.roles) roles granted on accept, on top of the membership
+        // role. Only the system-only invite variant sets them; every tenant-admin
+        // re-invite resets them to [] so a resend can never carry them over.
+        globalRoles: createMultiSelectField({
+            options: GLOBAL_ROLE_OPTIONS,
+            default: [],
+        }),
         // Lifecycle-State. Default "pending"; transitions:
         //   pending → accepted | cancelled | expired
         status: createSelectField({

package/dist/tenant-lifecycle/lifecycle-gate.d.ts

@@ -4,6 +4,7 @@ export type TenantLifecycleGate = {
     readonly status: string;
     readonly gracePeriodEnd: string | null;
 };
+export declare const TEARDOWN_GATE_SETTLE_MS = 60000;
 /** @internal exported for the bounded-cache test */
 export declare const GATE_CACHE_MAX_ENTRIES = 5000;
 export declare function invalidateTenantLifecycleGate(tenantId: TenantId): void;

package/dist/tenant-lifecycle/lifecycle-gate.js

@@ -15,6 +15,8 @@ import { tenantTable } from "../tenant/index.js";
 // (cached as null) must not grow the Map without bound: past the cap, expired
 // entries are swept and, if still full, the oldest-inserted entries are evicted.
 const GATE_TTL_MS = 3000;
+// Covers other pods' GATE_TTL_MS plus requests still in flight when the grace period (0 under a compliance override) ends.
+export const TEARDOWN_GATE_SETTLE_MS = 60_000;
 /** @internal exported for the bounded-cache test */
 export const GATE_CACHE_MAX_ENTRIES = 5000;
 const gateCache = new Map();

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -6,7 +6,7 @@ import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumik
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantTable } from "../tenant/index.js";
 import { TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_COMPLETED_EVENT_QN, TENANT_DESTRUCTION_FAILED_EVENT_QN, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
-import { invalidateTenantLifecycleGate } from "./lifecycle-gate.js";
+import { invalidateTenantLifecycleGate, TEARDOWN_GATE_SETTLE_MS } from "./lifecycle-gate.js";
 import { isDestructionPipelineComplete, pickNextStage, } from "./stages.js";
 const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
 const FEATURE_PREFIX = "tenant-lifecycle:event:";
@@ -173,7 +173,7 @@ export async function runTenantDestructionSweep(args) {
     const now = args.now ?? T.Now.instant();
     const due = await selectMany(args.db, tenantTable, {
         status: "destroyRequested",
-        gracePeriodEnd: { lte: now },
+        gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
     });
     let triggered = 0;
     for (const row of due) {

package/dist/tier-engine/feature.js

@@ -44,6 +44,8 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable, createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
 import { defineEntityCreateHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, defineQueryHandler, HookPhases, SYSTEM_TENANT_ID, TENANT_TIER_RESOLVER_EXT, } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { CACHE_SYNC_TOPICS, isTierAssignmentSyncMessage, } from "@cosmicdrift/kumiko-framework/redis";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { tenantTable } from "../tenant/index.js";
@@ -59,6 +61,7 @@ import { isTrialActive } from "./trial.js";
 // from the entity definition — same shape buildEntityTable would produce
 // in the App's drizzle/schema.generated.ts.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+const log = createFallbackLogger("tier-engine");
 // Event-store-executor für direct-write aus dem auto-default-tier-hook.
 // Pattern wie tenant/seeding.ts: hook sieht AppContext (kein ctx.write),
 // muss aber atomisch mit tenant-create im selben TX schreiben → executor
@@ -146,10 +149,9 @@ export function createTierEngineFeature(opts = {}) {
         // Cross-tenant set + read f\u00fcr den tier-admin-Screen. tier-options liefert
         // dem Client die App-Tier-Namen aus der tierMap-Closure (sonst hartkodiert).
         //
-        // onAssigned h\u00e4lt den Resolver-Cache nach einem direkten Executor-Write
-        // warm (der den postSave-Hook NICHT feuert). Late-bind via Holder: ohne
-        // tierMap bleibt es no-op (kein Resolver), im tierMap-Block unten wird
-        // die echte Cache-Update-Funktion eingeh\u00e4ngt \u2014 analog alwaysOnHolder.
+        // onAssigned runs after commit (the direct executor write fires no postSave
+        // hook). Late-bound: without tierMap it stays a no-op, the tierMap block
+        // below installs the real cache update + publish.
         const onTierAssigned = { fn: () => { } };
         r.writeHandler(createSetTenantTierWrite({
             onAssigned: (tenantId, tier) => onTierAssigned.fn(tenantId, tier),
@@ -223,6 +225,21 @@ export function createTierEngineFeature(opts = {}) {
         // mergeAlwaysOn-calls — Late-bind via mutable holder, gefüllt vor allen
         // Requests (build läuft pre-listen via runDevApp/runProdApp-pickup).
         const alwaysOnHolder = { set: new Set() };
+        // Bus handed to build(); hooks fire outside build and publish through it.
+        const busHolder = { bus: undefined };
+        // Out-of-order guard: every cache mutation or reload start takes a ticket; a
+        // reload result is applied only while its ticket is still the tenant's latest.
+        let ticketCounter = 0;
+        const latestTicket = new Map();
+        const takeTicket = (tenantId) => {
+            ticketCounter += 1;
+            latestTicket.set(tenantId, ticketCounter);
+            return ticketCounter;
+        };
+        const publishAssignmentChange = (tenantId) => {
+            const message = { tenantId };
+            busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message);
+        };
         // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
         // Feature-Gate geprüft — NICHT im Resolver-Cache. Der Resolver ist
         // boot-cached + synchron und sieht weder frische Signups noch den
@@ -237,15 +254,15 @@ export function createTierEngineFeature(opts = {}) {
             ? featuresForTier(tierMap, opts.trial.tier)
             : new Set();
         const nowMs = () => getTemporal().Now.instant().epochMilliseconds;
-        // set-tenant-tier schreibt direkt über den Executor → der postSave-Hook
-        // unten feuert dabei NICHT. Diese Funktion repliziert den Cache-Update
-        // des Hooks, damit ein manueller Grant das effektive Feature-Set sofort
-        // ändert (nicht nur die Projektion). Selber Cache, selbe mergeAlwaysOn-
-        // Semantik wie der Hook.
-        onTierAssigned.fn = (tenantId, tier) => {
+        // Immediate local visibility on the writing pod; other pods learn via the
+        // bus and re-read the row.
+        const applyAssignment = (tenantId, tier) => {
+            takeTicket(tenantId);
             cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, tier)));
+            publishAssignmentChange(tenantId);
         };
-        // Invalidation: tier-assignment events update the cache.
+        onTierAssigned.fn = applyAssignment;
+        // Invalidation: tier-assignment CRUD events (e.g. the billing webhook) update the cache.
         r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
             // result.data has tenantId + tier (after entity-update merge)
             const data = result.data; // @cast-boundary engine-payload
@@ -256,15 +273,17 @@ export function createTierEngineFeature(opts = {}) {
             // blocken (afterCommit-pattern, side-effect-best-effort).
             if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
                 return;
-            const tenantId = data.tenantId;
-            cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, data.tier)));
+            applyAssignment(data.tenantId, data.tier);
         });
         r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
             const data = payload.data; // @cast-boundary engine-payload
             // skip: gleiche type-guard semantik wie postSave-hook oben.
             if (typeof data.tenantId !== "string")
                 return;
-            cache.delete(data.tenantId);
+            const tenantId = data.tenantId;
+            takeTicket(tenantId);
+            cache.delete(tenantId);
+            publishAssignmentChange(tenantId);
         });
         // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
         // mit tenant-create rollback), schreibt tier-assignment via Direct-
@@ -359,6 +378,56 @@ export function createTierEngineFeature(opts = {}) {
                 for (const row of rows) {
                     cache.set(row.tenantId, mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)));
                 }
+                // Read first, then set — never clear-then-refill: a cache miss falls back
+                // to the default tier, which would lock paying tenants out meanwhile.
+                const reloadTenant = async (tenantId) => {
+                    const ticket = takeTicket(tenantId);
+                    const row = await fetchOne(deps.db, tierAssignmentTable, { tenantId });
+                    // skip: a newer write or reload for this tenant started meanwhile and owns the entry
+                    if (latestTicket.get(tenantId) !== ticket)
+                        return;
+                    if (row) {
+                        cache.set(tenantId, mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)));
+                    }
+                    else {
+                        cache.delete(tenantId);
+                    }
+                };
+                const reloadAllTenants = async () => {
+                    ticketCounter += 1;
+                    const startedAtTicket = ticketCounter;
+                    const current = await selectMany(deps.db, tierAssignmentTable);
+                    const loaded = new Map();
+                    for (const row of current) {
+                        loaded.set(row.tenantId, mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)));
+                    }
+                    const isNewerThanSnapshot = (tenantId) => (latestTicket.get(tenantId) ?? 0) > startedAtTicket;
+                    for (const tenantId of [...cache.keys()]) {
+                        if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId))
+                            cache.delete(tenantId);
+                    }
+                    for (const [tenantId, features] of loaded) {
+                        if (!isNewerThanSnapshot(tenantId))
+                            cache.set(tenantId, features);
+                    }
+                };
+                busHolder.bus = deps.cacheSync;
+                deps.cacheSync?.subscribe(CACHE_SYNC_TOPICS.tierAssignment, (message) => {
+                    // skip: malformed message from another process
+                    if (!isTierAssignmentSyncMessage(message))
+                        return;
+                    reloadTenant(message.tenantId).catch((err) => {
+                        log.error("tier reload failed, keeping cached set", {
+                            tenantId: message.tenantId,
+                            err,
+                        });
+                    });
+                });
+                deps.cacheSync?.onResync(() => {
+                    reloadAllTenants().catch((err) => {
+                        log.error("tier resync failed, keeping cached sets", { err });
+                    });
+                });
                 // Synchronous resolver-callback for dispatcher hot-path.
                 const resolver = (tenantId) => {
                     // Operator-tooling + async-event-dispatch convention: SYSTEM_TENANT_ID

package/dist/tier-engine/handlers/set-tenant-tier.write.d.ts

@@ -1,9 +1,9 @@
 import { type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 export type SetTenantTierOptions = {
-    /** Nach erfolgreichem Write aufgerufen, damit feature.ts den Resolver-
-     *  Cache aktualisieren kann (der Executor-Write feuert den postSave-Hook
-     *  nicht). Ohne tierMap kein Resolver → no-op. */
+    /** Runs after the write commits so feature.ts can update the resolver cache
+     *  and notify the other processes. Without a tierMap there is no resolver
+     *  and this is a no-op. */
     readonly onAssigned?: (tenantId: TenantId, tier: string) => void;
     /** Tier-Namen aus der tierMap-Closure — ohne sie (storage-only-Mode) bleibt
      *  `tier` unvalidiert außer Length/Non-Empty. Mit ihr rejected der Handler

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -19,14 +19,13 @@ import { tierAssignmentEntity } from "../entity.js";
 // `source: "manual"` markiert den Grant, damit ein späterer Stripe→Tier-Sync ihn
 // nicht plättet. Upsert: ein Aggregat pro Tenant (deterministische aggregate-id).
 //
-// **Effective-Set-Invalidation (kritisch):** der Executor-Write feuert NICHT
-// den `tier-assignment:postSave`-entityHook (Hooks laufen nur im Entity-
-// Handler-Pfad, nicht bei direktem executor.create/update). Ohne Cache-Update
-// bliebe das Feature-Gate auf dem alten Tier hängen — die Projektion zeigt
-// "pro", das Gate verhält sich weiter wie "free", bis der Prozess neu startet.
-// Daher ruft der Handler nach erfolgreichem Write `opts.onAssigned(tenantId,
-// tier)`; feature.ts verdrahtet das auf denselben Cache-Update wie der Hook
-// (storage-only ohne tierMap = no-op).
+// Effective-set invalidation: the executor write does not fire the
+// `tier-assignment:postSave` entity hook, and a per-handler postSave would not
+// fire either because this handler returns no lifecycle result (kind "save").
+// Without an explicit update the feature gate would stay on the old tier, so
+// `opts.onAssigned(tenantId, tier)` runs after commit (ctx.scheduleAfterCommit).
+// feature.ts uses it to update its cache and notify the other processes; in
+// storage-only mode without a tierMap it is a no-op.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEntity, {
     entityName: "tier-assignment",
@@ -50,6 +49,14 @@ export function createSetTenantTierWrite(opts = {}) {
             reason: SET_TENANT_TIER_REASON,
         },
         handler: async (event, ctx) => {
+            // Without a commit sink (unit harness) there is no transaction to wait for.
+            const afterCommit = (tenantId, tier) => {
+                const notify = async () => opts.onAssigned?.(tenantId, tier);
+                if (ctx.scheduleAfterCommit)
+                    ctx.scheduleAfterCommit(notify);
+                else
+                    opts.onAssigned?.(tenantId, tier);
+            };
             const tenantId = event.payload.tenantId; // @cast-boundary engine-bridge
             const rawDb = ctx.db.unsafeRaw();
             const tdb = createTenantDb(rawDb, tenantId, "system");
@@ -64,13 +71,13 @@ export function createSetTenantTierWrite(opts = {}) {
                 }, systemUser, tdb);
                 if (!result.isSuccess)
                     return result;
-                opts.onAssigned?.(tenantId, tier);
+                afterCommit(tenantId, tier);
                 return { isSuccess: true, data: { tenantId, tier, isNew: false } };
             }
             const result = await executor.create({ id: tierAssignmentAggregateId(tenantId), tier, source: "manual", tenantId }, systemUser, tdb);
             if (!result.isSuccess)
                 return result;
-            opts.onAssigned?.(tenantId, tier);
+            afterCommit(tenantId, tier);
             return { isSuccess: true, data: { tenantId, tier, isNew: true } };
         },
     });

package/dist/user/invited-global-roles.d.ts

@@ -0,0 +1,14 @@
+import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+export declare function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[];
+export declare function grantInvitedGlobalRoles(db: DbRunner, options: {
+    readonly userId: string;
+    readonly globalRoles: readonly string[];
+}): Promise<import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure | {
+    readonly isSuccess: true;
+    readonly data: {
+        readonly roles: readonly string[];
+    };
+}>;
+export {};

package/dist/user/invited-global-roles.js

@@ -0,0 +1,35 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+import { userEntity, userTable } from "./schema/user.js";
+const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+function isGlobalRole(role) {
+    return GLOBAL_ROLE_OPTIONS.some((option) => option === role);
+}
+// Reads the invitation's stored globalRoles column, keeping only assignable
+// global roles — a hand-edited row cannot smuggle "system" into users.roles.
+export function parseInvitedGlobalRoles(raw) {
+    return parseRoles(raw).filter(isGlobalRole);
+}
+// Add-only: an accepted invitation never removes a global role the user
+// already holds. Users live on SYSTEM_TENANT_ID (tenancy "global").
+export async function grantInvitedGlobalRoles(db, options) {
+    const existing = await fetchOne(db, userTable, { id: options.userId });
+    if (!existing)
+        return writeFailure(new NotFoundError("user", options.userId));
+    const currentRoles = parseRoles(existing.roles);
+    const missingRoles = options.globalRoles.filter((role) => !currentRoles.includes(role));
+    if (missingRoles.length === 0)
+        return grantedGlobalRoles(currentRoles);
+    const roles = [...currentRoles, ...missingRoles];
+    const updateResult = await userExecutor.update({ id: existing.id, version: existing.version, changes: { roles } }, createSystemUser(SYSTEM_TENANT_ID), createTenantDb(db, SYSTEM_TENANT_ID, "system"));
+    if (!updateResult.isSuccess)
+        return updateResult;
+    return grantedGlobalRoles(roles);
+}
+function grantedGlobalRoles(roles) {
+    return { isSuccess: true, data: { roles } };
+}

package/dist/user-data-rights/feature.js

@@ -308,6 +308,9 @@ export function createUserDataRightsFeature(opts = {}) {
             method: "GET",
             path: "/user-export/by-token",
             anonymous: true,
+            // Entry point of the emailed download link; cheap static page, but
+            // anonymous and token-bearing, so bound per-IP probing.
+            rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
             handler: async (c) => {
                 return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
                     "content-type": "text/html; charset=utf-8",

package/dist/waitlist/constants.d.ts

@@ -0,0 +1,33 @@
+export declare const WAITLIST_FEATURE: "waitlist";
+export declare const WAITLIST_STATUS: {
+    readonly Pending: "pending";
+    readonly Invited: "invited";
+    readonly Rejected: "rejected";
+};
+export type WaitlistStatus = (typeof WAITLIST_STATUS)[keyof typeof WAITLIST_STATUS];
+export declare const WaitlistHandlers: {
+    readonly submit: "waitlist:write:submit";
+    readonly invite: "waitlist:write:invite";
+    readonly reject: "waitlist:write:reject";
+};
+export declare const WaitlistQueries: {
+    readonly list: "waitlist:query:waitlist-entry:list";
+};
+export declare const WaitlistErrors: {
+    readonly notInvitable: "waitlist_not_invitable";
+    readonly notRejectable: "waitlist_not_rejectable";
+};
+export declare const WAITLIST_NOTIFICATION_TYPES: {
+    readonly confirmation: "waitlist:notify:confirmation";
+    readonly adminNotice: "waitlist:notify:admin-notice";
+};
+export declare const DEFAULT_OWN_TENANT_INVITE_ROLE = "TenantAdmin";
+export declare const WAITLIST_FIELD_LIMITS: {
+    readonly name: 120;
+    readonly email: 254;
+    readonly company: 200;
+    readonly portfolio: 200;
+    readonly message: 2000;
+    readonly locale: 35;
+    readonly honeypot: 500;
+};

package/dist/waitlist/constants.js

@@ -0,0 +1,35 @@
+// @runtime client
+// Pure string constants, safe for browser code (see auth-email-password/constants.ts).
+export const WAITLIST_FEATURE = "waitlist";
+export const WAITLIST_STATUS = {
+    Pending: "pending",
+    Invited: "invited",
+    Rejected: "rejected",
+};
+export const WaitlistHandlers = {
+    submit: "waitlist:write:submit",
+    invite: "waitlist:write:invite",
+    reject: "waitlist:write:reject",
+};
+// Entity-convention list QN: entityList screens resolve their query by this shape.
+export const WaitlistQueries = {
+    list: "waitlist:query:waitlist-entry:list",
+};
+export const WaitlistErrors = {
+    notInvitable: "waitlist_not_invitable",
+    notRejectable: "waitlist_not_rejectable",
+};
+export const WAITLIST_NOTIFICATION_TYPES = {
+    confirmation: "waitlist:notify:confirmation",
+    adminNotice: "waitlist:notify:admin-notice",
+};
+export const DEFAULT_OWN_TENANT_INVITE_ROLE = "TenantAdmin";
+export const WAITLIST_FIELD_LIMITS = {
+    name: 120,
+    email: 254,
+    company: 200,
+    portfolio: 200,
+    message: 2000,
+    locale: 35,
+    honeypot: 500,
+};