@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.341.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.340.0",
+  "version": "0.341.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -465,6 +465,10 @@
       "types": "./dist/legal-pages/web/index.d.ts",
       "default": "./dist/legal-pages/web/index.js"
     },
+    "./waitlist": {
+      "types": "./dist/waitlist/index.d.ts",
+      "default": "./dist/waitlist/index.js"
+    },
     "./page-render": {
       "types": "./dist/page-render/index.d.ts",
       "default": "./dist/page-render/index.js"
@@ -499,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.340.0",
-    "@cosmicdrift/kumiko-framework": "0.340.0",
-    "@cosmicdrift/kumiko-headless": "0.340.0",
-    "@cosmicdrift/kumiko-renderer": "0.340.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.340.0",
-    "@cosmicdrift/kumiko-types": "0.340.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.341.0",
+    "@cosmicdrift/kumiko-framework": "0.341.0",
+    "@cosmicdrift/kumiko-headless": "0.341.0",
+    "@cosmicdrift/kumiko-renderer": "0.341.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.341.0",
+    "@cosmicdrift/kumiko-types": "0.341.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -975,6 +979,10 @@
         "types": "./dist/legal-pages/web/index.d.ts",
         "default": "./dist/legal-pages/web/index.js"
       },
+      "./waitlist": {
+        "types": "./dist/waitlist/index.d.ts",
+        "default": "./dist/waitlist/index.js"
+      },
       "./page-render": {
         "types": "./dist/page-render/index.d.ts",
         "default": "./dist/page-render/index.js"
@@ -1017,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.340.0",
-    "@cosmicdrift/kumiko-locale-es": "0.340.0",
+    "@cosmicdrift/kumiko-locale-de": "0.341.0",
+    "@cosmicdrift/kumiko-locale-es": "0.341.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "Invitations can carry a global role (SystemAdmin), granted only on accept",
+    "detail": "New system-only handler auth-email-password:write:system-invite-create and bootstrapTenants() for idempotent passwordless provisioning. Tenant admins cannot set global roles; a re-invite clears a pending one.",
+    "migration": "New column read_tenant_invitations.global_roles: run `kumiko schema generate` and apply the migration before deploying."
+  },
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "runBootstrap applies per-tenant config",
+    "detail": "BootstrapTenant.config sets tenant-scope config keys as system writes on every run; a value that already matches is not rewritten."
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "System invite refuses to reset an accepted invitation (invite_already_accepted)"
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "MFA required policy is writable by the system only",
+    "migration": "Tenant admins can no longer write auth-mfa:config:required (write access is now system-only). Set the app-wide default with createAuthMfaFeature({ requiredPolicy }) / the mfa options and per-tenant overrides with runBootstrap tenants[].config or a system write (createSystemUser). Code that wrote the key as TenantAdmin/Admin/SystemAdmin over HTTP must switch to one of these."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "App layout around termination pages, trailing-slash redirects, receipt greeting",
+    "detail": "`createContractTerminationRoutes` accepts a `wrapLayout`, the same function `createLegalPagesFeature` takes. It wraps every termination page (form, review, result, 429, error); the security headers stay with the framework. The layout also receives `alternates`, a map from locale to the path of the same page, so it can render a language switch from plain links. `page-render` exports the shared type `PublicPageWrapLayout`; `LegalPagesWrapLayout` is now an alias of it. The page body sits in `<div data-kumiko-page=\"contract-termination\">` with `data-kumiko-*` hooks on the form, field groups, buttons and review table. The page CSP keeps `script-src 'none'`, so a layout must not rely on JavaScript.\nThe default `wrapInLayout` stylesheet gains base rules for input, select, textarea and button, so unstyled forms stay readable.\nThe termination pages and every legal page now answer the other trailing-slash form of their path (`/legal/kuendigen/`, `/legal/impressum/`) with a 301 to the configured path for GET and HEAD, query string kept. POST has no alias.\nThe termination receipt mail text changed: it now starts with a greeting line (\"Hallo,\" / \"Hello,\") and the English sentence starts capitalized (\"We confirm receipt ...\"). The receipt content still depends only on the declarant's input."
+  },
   {
     "version": "0.340.0",
     "type": "improvement",

package/src/channel-telegram/changes.json

@@ -0,0 +1,9 @@
+[
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "Telegram apiBaseUrl must match allowedHosts and use https",
+    "detail": "`ctx.secrets.set` now runs the same `valueSchema` check as `secrets:write:set` and throws the same validation error (`secrets.errors.invalidValue`, never carrying the value) before anything is encrypted or stored. `createSecretsContext` takes a required `registry` option that supplies the declared schemas; `runProdApp`, `runDevApp` and `setupTestStack` setups pass the booted registry.\n`createChannelTelegramFeature` takes `allowedHosts` (default `[\"api.telegram.org\"]`) and `requireHttps` (default `true`), like the other chat channels. Boot fails when the host of `apiBaseUrl` is not in `allowedHosts` or the URL is not https while `requireHttps` is on. Before, the host of `apiBaseUrl` was its own allowlist and https was only required when the URL already started with `https:`.",
+    "migration": "An app that sets a custom apiBaseUrl (self-hosted Bot API server, local test server) must also pass allowedHosts: [\"<host>\"], plus requireHttps: false for plain http. Without it the app fails at boot."
+  }
+]

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "Chat channels deliver in production boot, ctx.notify returns a NotifyResult",
+    "detail": "Chat channels (slack, discord, teams, telegram) now deliver in production boot. `runProdApp`, `runDevApp` and `runWorkerApp` pass the tenant secrets to the delivery service and hand queued channels to the `delivery.render`/`delivery.send` jobs of the calling context's job runner. `delivery.render` now receives `ctx.secrets` as well. Without a job runner, queued channels still deliver inline, now with secrets. `runBootstrap` is a one-shot process whose queue nobody drains after it exits, so it keeps delivering queued channels inline (the SystemAdmin invitation goes out before the process ends).\n`NotifyFn` returns a `NotifyResult` (`{ deliveries }` with channel, recipientId, status `queued | sent | failed | skipped`, error and `deliveryAttemptId` per delivery) instead of `void`. `NotifyOptions.immediate` delivers queued channels inline for one call and bypasses job retry, for \"send test message\" handlers. `NotifyFactory` takes an optional job dispatcher as third argument, and `DeliveryService.notify` an optional per-call dispatcher.\nConsumers: `NotifyFn` implementations in tests and mocks must now return a `NotifyResult`, e.g. `async () => ({ deliveries: [] })`. When running the API without a worker (`runSingleInstance: false`), a dedicated worker must process the delivery jobs.",
+    "migration": "NotifyFn implementations in tests and mocks must return a NotifyResult, e.g. async () => ({ deliveries: [] }). Queued channels now run through the delivery jobs in production; an API-only deployment (runSingleInstance: false) needs a worker that mounts delivery and the channel features."
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/files/changes.json

@@ -1 +1,13 @@
-[]
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Uploads resolve a generic content type from the file content",
+    "detail": "POST /api/files now resolves application/octet-stream or a missing type from the bytes (PDF, XML, PNG, JPEG, GIF, WebP, ZIP) and falls back to the file extension. A concrete declared type is never overridden. The shared helper resolveContentType is exported from the files module."
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Uploads without entityId no longer produce an empty storage key segment"
+  }
+]

package/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Localized mail branding, locale through delivery, logoPath",
+    "detail": "`ctx.notify` accepts `locale`, and the locale now travels through the delivery jobs (`delivery.render`, `delivery.send`) to `NotificationRenderer.render`, where `RendererInput.locale` is available. Jobs queued before this release have no locale and keep working. The email channel and `renderer-simple` pass it on; the auth mails and the consumer-protection mails set it to the language they already translate their content into. This lands in the same release as the `NotifyOptions` change from #3508.\n`MailBranding` for `renderer-simple` can now be localized: `footerText`, `footerLinks[].label` and `footerLinks[].url` take a plain string or a map of locale to string. The renderer picks the exact locale, then the language part (`de-AT` falls back to `de`), then the new optional `MailBranding.defaultLocale`, then the first entry. Every URL in a map must be an absolute http(s) URL, otherwise `createSimpleRenderer` throws at boot. Without a locale and with plain strings the HTML is unchanged.\n`MailBranding` also gets `logoPath` and `baseUrl`, so an app can point at a raster logo on its own origin (`logoPath: \"/logo.png\"`, `baseUrl` the same base as `auth.mail.baseUrl`). `logoPath` and `logoUrl` exclude each other, `logoPath` needs a valid `baseUrl`, must start with a single `/` and must stay on the base origin; violations throw at boot. Use PNG or JPEG, because mail clients block SVG."
+  },
   {
     "version": "0.339.0",
     "type": "improvement",

package/src/secrets/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Chat channel secret values are validated on write",
+    "detail": "`r.secret` and `r.secretNamespace` accept a `valueSchema`. `secrets:write:set` checks the value against it after the key and role checks and answers a failure with a 400 validation error on field `value` (`secrets.errors.invalidValue`); the response never contains the value or the schema's issues. `secrets:write:delete` is unaffected.\nThe chat channels use it: Slack, Discord and Teams webhook secrets must be URLs that pass the channel's host allowlist (including the Discord `/api/webhooks/` path), and the Telegram bot token must have the `<bot id>:<secret>` shape. The allowlist comes from the same options as the channel, so `createChannelSlackFeature({ allowedHosts })` also governs what can be stored.\n`channel-slack`, `channel-discord`, `channel-teams` and `channel-telegram` now export their secret keys (`SLACK_SECRET_KEYS`, `DISCORD_SECRET_KEYS`, `TEAMS_SECRET_KEYS`, `TELEGRAM_SECRET_KEYS`), allowlist constants and `isTelegramChatId` / `isTelegramBotToken`. `delivery` exports `checkChatWebhookTarget`, `chatWebhookUrlSchema` and `resolveChatWebhookTarget`, so apps can validate an address or URL when a user creates a channel.\nExisting invalid secrets stay stored; only new writes are checked. Writes through `ctx.secrets.set` in feature code run through the same check."
+  },
+  {
+    "version": "0.341.0",
+    "type": "breaking",
+    "title": "ctx.secrets.set validates against the declared valueSchema",
+    "migration": "Code that calls createSecretsContext({ db, masterKeyProvider }) must also pass registry (the booted Registry). Programmatic ctx.secrets.set calls with a value that fails the key's valueSchema now throw a ValidationError instead of storing it."
+  },
   {
     "version": "0.337.0",
     "type": "breaking",

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Harden system role, invitations query, tenant teardown and addMember",
+    "detail": "The system role can no longer be minted into a session through a user's global roles. invitations.query returns an explicit field allowlist and exposes globalRoles only to a SystemAdmin. The tenant destruction sweep waits 60 seconds after the grace period ends so the teardown gate can settle. Behaviour change: tenant:write:addMember now adds members to a foreign tenant only from the framework system context; a SystemAdmin request user is limited to their own tenant and gets 403 otherwise."
+  },
   {
     "version": "0.336.1",
     "type": "fix",

package/src/waitlist/changes.json

@@ -0,0 +1,17 @@
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Waitlist submit is limited per email address"
+  },
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Add waitlist bundled feature: public signup intake with admin invite and reject, GDPR export and erasure"
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Waitlist re-invite and reject no longer touch an invitee who already accepted"
+  }
+]