@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.342.0

package/dist/audit/constants.d.ts

@@ -13,3 +13,6 @@ export declare const AuditQueries: {
 export declare const AUDIT_LOG_SCREEN_ID: "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export declare const AUDIT_LOG_DETAIL_SCREEN_ID: "audit-log-detail";
+/** Config key (system scope) for how long `escapeHatchUse` audit events are kept. */
+export declare const ESCAPE_HATCH_RETENTION_DAYS_KEY: "audit:config:escape-hatch-retention-days";
+export declare const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/constants.js

@@ -18,3 +18,6 @@ export const AuditQueries = {
 export const AUDIT_LOG_SCREEN_ID = "audit-log";
 /** Single-event detail screen, breadcrumb-linked to the audit-log list. */
 export const AUDIT_LOG_DETAIL_SCREEN_ID = "audit-log-detail";
+/** Config key (system scope) for how long `escapeHatchUse` audit events are kept. */
+export const ESCAPE_HATCH_RETENTION_DAYS_KEY = "audit:config:escape-hatch-retention-days";
+export const DEFAULT_ESCAPE_HATCH_RETENTION_DAYS = 90;

package/dist/audit/feature.js

@@ -1,9 +1,10 @@
-import { access, defineFeature, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries } from "./constants.js";
+import { access, createSystemConfig, defineFeature, i18nKey, SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { AUDIT_LOG_DETAIL_SCREEN_ID, AUDIT_LOG_SCREEN_ID, AuditQueries, DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, } from "./constants.js";
 import { escapeHatchUsedSchema } from "./escape-hatch-audit-sink.js";
 import { detailsQuery } from "./handlers/details.query.js";
 import { listQuery } from "./handlers/list.query.js";
 import { AUDIT_I18N } from "./i18n.js";
+import { runEscapeHatchRetention } from "./run-escape-hatch-retention.js";
 // Audit feature — exposes a filtered read over the framework's event log.
 //
 // Design: the event-store IS the audit trail (every entity write produces
@@ -12,10 +13,11 @@ import { AUDIT_I18N } from "./i18n.js";
 // the existing `events` table. See handlers/list.query.ts for the filter
 // surface.
 //
-// Retention lives elsewhere. Events are kept indefinitely as the source of
-// truth for state; archive or compress policies are a separate concern
-// (tracked with the snapshot/archive infrastructure that already exists in
-// the framework).
+// Retention: only `escapeHatchUse` events are pruned (daily job, config key
+// `escapeHatchRetentionDays`). All other events stay as the source of truth
+// for state; archive or compress policies are a separate concern (tracked
+// with the snapshot/archive infrastructure that already exists in the
+// framework).
 export function createAuditFeature() {
     return defineFeature("audit", (r) => {
         r.describe("Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection \u2014 the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).");
@@ -25,9 +27,34 @@ export function createAuditFeature() {
             recommended: false,
         });
         r.translations({ keys: AUDIT_I18N });
-        r.requires("tenant", "user");
+        r.requires("tenant", "user", "config");
         // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
         r.defineEvent("escape-hatch-used", escapeHatchUsedSchema, { piiFields: "none" });
+        r.config("escapeHatchRetentionDays", createSystemConfig("number", {
+            default: DEFAULT_ESCAPE_HATCH_RETENTION_DAYS,
+            bounds: { min: 1 },
+        }));
+        r.job({
+            name: "escape-hatch-retention",
+            trigger: { cron: "30 3 * * *" },
+            concurrency: "skip",
+            // pruneEvents needs a transaction-capable connection, which only unsafeRaw() hands a job.
+            escapeHatch: {
+                reason: "prunes expired escapeHatchUse audit events through pruneEvents",
+                grants: ["unsafeRaw"],
+            },
+            handler: async (_payload, ctx) => {
+                if (!ctx.registry) {
+                    throw new Error("escape-hatch-retention: ctx.registry required (JobContext incomplete)");
+                }
+                await runEscapeHatchRetention({
+                    db: ctx.db.unsafeRaw(),
+                    registry: ctx.registry,
+                    configResolver: ctx.configResolver,
+                    userId: ctx._userId ?? SYSTEM_USER_ID,
+                });
+            },
+        });
         const queries = {
             list: r.queryHandler(listQuery),
             details: r.queryHandler(detailsQuery),

package/dist/audit/run-escape-hatch-retention.d.ts

@@ -0,0 +1,10 @@
+import type { DbConnection, DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type ConfigResolver, type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { type PruneEventsResult } from "@cosmicdrift/kumiko-framework/pipeline";
+export declare function isDbConnection(runner: DbRunner): runner is DbConnection;
+export declare function runEscapeHatchRetention(args: {
+    readonly db: DbRunner;
+    readonly registry: Registry;
+    readonly configResolver: ConfigResolver | undefined;
+    readonly userId: string;
+}): Promise<PruneEventsResult>;

package/dist/audit/run-escape-hatch-retention.js

@@ -0,0 +1,27 @@
+import { SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { pruneEvents } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createConfigAccessor } from "../config/index.js";
+import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, } from "./constants.js";
+import { ESCAPE_HATCH_USE_AGGREGATE_TYPE } from "./escape-hatch-audit-sink.js";
+// pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
+export function isDbConnection(runner) {
+    return "begin" in runner && typeof runner.begin === "function";
+}
+async function resolveRetentionDays(args) {
+    if (!args.configResolver)
+        return DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
+    const config = createConfigAccessor(args.registry, args.configResolver, SYSTEM_TENANT_ID, args.userId, args.db);
+    const raw = await config(ESCAPE_HATCH_RETENTION_DAYS_KEY);
+    return typeof raw === "number" && raw >= 1 ? raw : DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
+}
+export async function runEscapeHatchRetention(args) {
+    const { db } = args;
+    if (!isDbConnection(db)) {
+        throw new Error("audit escape-hatch retention: a transaction-free DbConnection is required");
+    }
+    const olderThanDays = await resolveRetentionDays({ ...args, db });
+    return pruneEvents(db, {
+        aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+        olderThanDays,
+    });
+}

package/dist/auth-email-password/bootstrap.d.ts

@@ -0,0 +1,80 @@
+import { makeDispatchSystemWrite, type SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
+import type { Redis } from "ioredis";
+import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+export type BootstrapInvite = {
+    readonly email: string;
+    /** Membership role in the tenant, validated like a tenant-admin invite
+     *  (reserved roles such as SystemAdmin are rejected here). */
+    readonly role: string;
+};
+export type BootstrapSeedDeps = {
+    readonly tenantId: TenantId;
+    readonly db: DbConnection;
+    readonly dispatchSystemWrite: ReturnType<typeof makeDispatchSystemWrite>;
+    /** Writes as the system user with the given tenant roles in the seeded
+     *  tenant; use it when the app gates tenant data on its own roles rather
+     *  than SystemAdmin. */
+    readonly dispatchWriteAs: (args: Pick<SystemDispatchArgs, "handlerQn" | "payload"> & {
+        readonly roles: readonly string[];
+    }) => Promise<WriteResult>;
+};
+export type BootstrapConfigValue = string | number | boolean;
+export type BootstrapTenant = {
+    readonly id: TenantId;
+    readonly key: string;
+    readonly name: string;
+    /** Tenant-scope config values by qualified key (e.g.
+     *  `"auth-mfa:config:required": "admins"`), written as system writes on
+     *  EVERY run: config is declarative, so a rerun converges to the plan and
+     *  a value that already matches is not rewritten. Unlike `seed` it also
+     *  applies to tenants that already exist. */
+    readonly config?: Readonly<Record<string, BootstrapConfigValue>>;
+    readonly invites?: readonly BootstrapInvite[];
+};
+export type BootstrapSystemAdmin = {
+    readonly email: string;
+    /** Home tenant: login needs a membership, so the SystemAdmin is invited
+     *  into this tenant with `role` and receives the global role on accept. */
+    readonly tenantId: TenantId;
+    readonly role: string;
+};
+export type BootstrapPlan = {
+    readonly tenants: readonly BootstrapTenant[];
+    readonly systemAdmins?: readonly BootstrapSystemAdmin[];
+    /** Runs for each tenant right after this run created it. An existing
+     *  tenant is never seeded again — also not when a previous run failed
+     *  inside the seed (that run fails; clean up by hand). */
+    readonly seed?: (deps: BootstrapSeedDeps) => Promise<void>;
+};
+export type BootstrapDeps = {
+    readonly db: DbConnection;
+    readonly redis: Redis;
+    readonly dispatcher: Dispatcher;
+};
+export type BootstrapTenantOutcome = "created" | "exists";
+export type BootstrapInviteOutcome = "invited" | "resent" | "pending" | "active" | "cancelled" | "role-mismatch";
+export type BootstrapReport = {
+    readonly tenants: ReadonlyArray<{
+        readonly id: TenantId;
+        readonly outcome: BootstrapTenantOutcome;
+        readonly seeded: boolean;
+        /** Qualified keys this run wrote (new or changed); empty on a no-op rerun. */
+        readonly configApplied: readonly string[];
+    }>;
+    readonly invites: ReadonlyArray<{
+        readonly tenantId: TenantId;
+        readonly email: string;
+        readonly globalRoles: readonly GlobalRole[];
+        readonly outcome: BootstrapInviteOutcome;
+    }>;
+};
+export declare class BootstrapPlanError extends Error {
+}
+export declare class BootstrapWriteError extends Error {
+}
+export declare function bootstrapTenants(deps: BootstrapDeps, plan: BootstrapPlan): Promise<BootstrapReport>;
+export {};

package/dist/auth-email-password/bootstrap.js

@@ -0,0 +1,170 @@
+// Passwordless, idempotent first-run provisioning: tenants plus invitations
+// (optionally carrying global roles such as SystemAdmin). Every write goes
+// through the dispatcher as the system user, so hooks, events and jobs fire
+// exactly as for any other writer. Nobody gets a role before accepting: the
+// invitation row holds membership role + global roles until the invitee
+// accepts through the regular invite-accept routes.
+import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+// kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
+import { ConfigHandlers } from "../config/constants.js";
+// kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
+import { findConfigRow } from "../config/write-helpers.js";
+// kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
+import { TenantHandlers } from "../tenant/constants.js";
+// kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
+import { INVITATION_STATUS, tenantInvitationsTable } from "../tenant/invitation-table.js";
+// kumiko-lint-ignore cross-feature-import bootstrap checks existing memberships
+import { tenantMembershipsTable } from "../tenant/membership-table.js";
+// kumiko-lint-ignore cross-feature-import bootstrap checks for an existing tenant
+import { tenantTable } from "../tenant/schema/tenant.js";
+// kumiko-lint-ignore cross-feature-import bootstrap skips already activated users
+import { userTable } from "../user/schema/user.js";
+import { AuthHandlers } from "./constants.js";
+import { hasLiveInviteToken } from "./invite-token-store.js";
+export class BootstrapPlanError extends Error {
+}
+export class BootstrapWriteError extends Error {
+}
+function planInvites(plan) {
+    const tenantIds = new Set(plan.tenants.map((t) => t.id));
+    const invites = [];
+    for (const admin of plan.systemAdmins ?? []) {
+        if (!tenantIds.has(admin.tenantId)) {
+            throw new BootstrapPlanError(`systemAdmins: ${admin.email} references tenant ${admin.tenantId}, which is not in tenants`);
+        }
+        invites.push({
+            tenantId: admin.tenantId,
+            email: admin.email.toLowerCase(),
+            role: admin.role,
+            globalRoles: ["SystemAdmin"],
+        });
+    }
+    for (const tenant of plan.tenants) {
+        for (const invite of tenant.invites ?? []) {
+            invites.push({
+                tenantId: tenant.id,
+                email: invite.email.toLowerCase(),
+                role: invite.role,
+                globalRoles: [],
+            });
+        }
+    }
+    // One invitation row per (tenant, email): a second entry would overwrite
+    // the first one's role or global roles.
+    const seen = new Set();
+    for (const invite of invites) {
+        const key = `${invite.tenantId}\u0000${invite.email}`;
+        if (seen.has(key)) {
+            throw new BootstrapPlanError(`${invite.email} is listed twice for tenant ${invite.tenantId} (systemAdmins and tenants[].invites share one invitation per tenant)`);
+        }
+        seen.add(key);
+    }
+    return invites;
+}
+async function ensureTenant(deps, tenant) {
+    const existing = await fetchOne(deps.db, tenantTable, { id: tenant.id });
+    if (existing)
+        return "exists";
+    const result = await deps.dispatcher.write(TenantHandlers.create, { id: tenant.id, key: tenant.key, name: tenant.name }, createSystemUser(tenant.id));
+    if (!result.isSuccess) {
+        throw new BootstrapWriteError(`creating tenant ${tenant.key} (${tenant.id}) failed: ${result.error.code} — ${result.error.message}`);
+    }
+    return "created";
+}
+async function applyTenantConfig(deps, tenant) {
+    const applied = [];
+    for (const [key, value] of Object.entries(tenant.config ?? {})) {
+        const existing = await findConfigRow(deps.db, key, tenant.id, null);
+        if (existing?.value === JSON.stringify(value))
+            continue;
+        const result = await deps.dispatcher.write(ConfigHandlers.set, { key, value, scope: ConfigScopes.tenant }, 
+        // SystemAdmin on top of the system role: keys with the default tenant
+        // write access (admin roles) reject a bare system user, system-only keys
+        // accept it.
+        createSystemUser(tenant.id, ["SystemAdmin"]));
+        if (!result.isSuccess) {
+            throw new BootstrapWriteError(`setting config ${key} for tenant ${tenant.id} failed: ${result.error.code} — ${result.error.message}`);
+        }
+        applied.push(key);
+    }
+    return applied;
+}
+async function holdsInvitedAccess(deps, invite) {
+    const user = await fetchOne(deps.db, userTable, {
+        email: invite.email,
+        isDeleted: false,
+    });
+    if (!user)
+        return false;
+    const membership = await fetchOne(deps.db, tenantMembershipsTable, {
+        userId: user.id,
+        tenantId: invite.tenantId,
+    });
+    if (!membership)
+        return false;
+    const userGlobalRoles = parseRoles(user.roles);
+    return invite.globalRoles.every((role) => userGlobalRoles.includes(role));
+}
+async function decideInvite(deps, invite) {
+    if (await holdsInvitedAccess(deps, invite))
+        return "active";
+    const invitation = await fetchOne(deps.db, tenantInvitationsTable, {
+        tenantId: invite.tenantId,
+        email: invite.email,
+    });
+    if (!invitation)
+        return "invited";
+    if (invitation.status === INVITATION_STATUS.cancelled)
+        return "cancelled";
+    const storedGlobalRoles = parseRoles(invitation.globalRoles);
+    if (!invite.globalRoles.every((role) => storedGlobalRoles.includes(role))) {
+        return "role-mismatch";
+    }
+    if (invitation.status === INVITATION_STATUS.accepted)
+        return "active";
+    if (await hasLiveInviteToken(deps.redis, invitation.id))
+        return "pending";
+    return "resent";
+}
+function isMailingOutcome(outcome) {
+    return outcome === "invited" || outcome === "resent";
+}
+export async function bootstrapTenants(deps, plan) {
+    const plannedInvites = planInvites(plan);
+    const dispatchSystemWrite = makeDispatchSystemWrite(deps.dispatcher);
+    const tenants = [];
+    for (const tenant of plan.tenants) {
+        const outcome = await ensureTenant(deps, tenant);
+        const shouldSeed = outcome === "created" && plan.seed !== undefined;
+        if (shouldSeed) {
+            await plan.seed?.({
+                tenantId: tenant.id,
+                db: deps.db,
+                dispatchSystemWrite,
+                dispatchWriteAs: ({ handlerQn, payload, roles }) => deps.dispatcher.write(handlerQn, payload, createSystemUser(tenant.id, roles)),
+            });
+        }
+        const configApplied = await applyTenantConfig(deps, tenant);
+        tenants.push({ id: tenant.id, outcome, seeded: shouldSeed, configApplied });
+    }
+    const invites = [];
+    for (const invite of plannedInvites) {
+        const outcome = await decideInvite(deps, invite);
+        if (isMailingOutcome(outcome)) {
+            const result = await deps.dispatcher.write(AuthHandlers.systemInviteCreate, { email: invite.email, role: invite.role, globalRoles: invite.globalRoles }, createSystemUser(invite.tenantId));
+            if (!result.isSuccess) {
+                throw new BootstrapWriteError(`inviting ${invite.email} into tenant ${invite.tenantId} failed: ${result.error.code} — ${result.error.message}`);
+            }
+        }
+        invites.push({
+            tenantId: invite.tenantId,
+            email: invite.email,
+            globalRoles: invite.globalRoles,
+            outcome,
+        });
+    }
+    return { tenants, invites };
+}

package/dist/auth-email-password/constants.d.ts

@@ -13,6 +13,7 @@ export declare const AuthHandlers: {
     readonly signupRequest: "auth-email-password:write:signup-request";
     readonly signupConfirm: "auth-email-password:write:signup-confirm";
     readonly inviteCreate: "auth-email-password:write:invite-create";
+    readonly systemInviteCreate: "auth-email-password:write:system-invite-create";
     readonly inviteAccept: "auth-email-password:write:invite-accept";
     readonly inviteAcceptWithLogin: "auth-email-password:write:invite-accept-with-login";
     readonly inviteSignupComplete: "auth-email-password:write:invite-signup-complete";
@@ -38,6 +39,7 @@ export declare const AuthErrors: {
     readonly invalidInviteToken: "invalid_invite_token";
     readonly inviteEmailMismatch: "invite_email_mismatch";
     readonly inviteAlreadyMember: "invite_already_member";
+    readonly inviteAlreadyAccepted: "invite_already_accepted";
     readonly accountLocked: "account_locked";
     readonly accountRestricted: "account_restricted";
 };

package/dist/auth-email-password/constants.js

@@ -38,6 +38,9 @@ export const AuthHandlers = {
     //   inviteSignupComplete: anon user with new email → POST token + password
     //   inviteCancel: admin cancels a pending invite
     inviteCreate: "auth-email-password:write:invite-create",
+    // System-only variant (access.system) that may carry global roles — see
+    // invite-create.write.ts. Dispatched in-process by runBootstrap.
+    systemInviteCreate: "auth-email-password:write:system-invite-create",
     inviteAccept: "auth-email-password:write:invite-accept",
     inviteAcceptWithLogin: "auth-email-password:write:invite-accept-with-login",
     inviteSignupComplete: "auth-email-password:write:invite-signup-complete",
@@ -92,6 +95,8 @@ export const AuthErrors = {
     invalidInviteToken: "invalid_invite_token",
     inviteEmailMismatch: "invite_email_mismatch",
     inviteAlreadyMember: "invite_already_member",
+    // System invite (waitlist) refuses to reset an invitation the invitee already accepted.
+    inviteAlreadyAccepted: "invite_already_accepted",
     // Account-lockout: login refuses with this code when the user's streak of
     // failed attempts has crossed the configured threshold. The error detail
     // carries `retryAfterSeconds` so the UI can show a countdown. Returning a

package/dist/auth-email-password/errors.d.ts

@@ -1,6 +1,7 @@
 export declare function invalidCredentials(): import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure;
 export declare function invalidInviteToken(): import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure;
 export declare function inviteEmailMismatch(): import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure;
+export declare function inviteAlreadyAccepted(): import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure;
 export declare function invalidResetToken(): import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure;
 export declare function invalidUnlockToken(): import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure;
 export declare function invalidVerificationToken(): import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure;

package/dist/auth-email-password/errors.js

@@ -19,6 +19,12 @@ export function inviteEmailMismatch() {
     }));
 }
 // @wrapper-known error-helper
+export function inviteAlreadyAccepted() {
+    return writeFailure(new UnprocessableError(AuthErrors.inviteAlreadyAccepted, {
+        i18nKey: "auth.errors.inviteAlreadyAccepted",
+    }));
+}
+// @wrapper-known error-helper
 export function invalidResetToken() {
     return writeFailure(new UnprocessableError(AuthErrors.invalidResetToken, {
         i18nKey: "auth.errors.invalidResetToken",

package/dist/auth-email-password/feature.js

@@ -5,7 +5,7 @@ import { changePasswordWrite } from "./handlers/change-password.write.js";
 import { createConfirmAccountUnlockHandler } from "./handlers/confirm-account-unlock.write.js";
 import { createInviteAcceptHandler } from "./handlers/invite-accept.write.js";
 import { createInviteAcceptWithLoginHandler } from "./handlers/invite-accept-with-login.write.js";
-import { createInviteCreateHandler, } from "./handlers/invite-create.write.js";
+import { createInviteCreateHandler, createSystemInviteCreateHandler, } from "./handlers/invite-create.write.js";
 import { inviteInfoQuery } from "./handlers/invite-info.query.js";
 import { createInviteSignupCompleteHandler } from "./handlers/invite-signup-complete.write.js";
 import { createLoginHandler } from "./handlers/login.write.js";
@@ -123,6 +123,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
         }
         if (opts.invite) {
             r.writeHandler(createInviteCreateHandler(opts.invite));
+            r.writeHandler(createSystemInviteCreateHandler(opts.invite));
             r.writeHandler(createInviteAcceptHandler());
             // Same gates as the `login` handler above (lockout, password,
             // email-verified, account-status, MFA) — see invite-accept-with-login.write.ts.

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -30,6 +30,8 @@ import { decryptStoredPii, sessionLocaleField, sessionTimezoneField } from "../.
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add
 import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership.js";
+// kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
+import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import login-style password-check
 import { userTable } from "../../user/schema/user.js";
 import { AUTH_LOCKOUT_DEFAULT_DURATION_MINUTES, AUTH_LOCKOUT_DEFAULT_MAX_FAILED_ATTEMPTS, } from "../constants.js";
@@ -120,6 +122,12 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 });
                 if (!grant.isSuccess)
                     return grant;
+                const globalGrant = await grantInvitedGlobalRoles(dbConn, {
+                    userId,
+                    globalRoles: parseInvitedGlobalRoles(invitation.globalRoles),
+                });
+                if (!globalGrant.isSuccess)
+                    return globalGrant;
                 // Invitation → accepted: TenantDb for the invitation's tenant.
                 const invitationTdb = createTenantDb(dbConn, invitationTenantId, "system");
                 const updateResult = await invitationExecutor.update({
@@ -132,7 +140,7 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
                 await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
                 // buildSessionRoles calls stripForbiddenMembershipRoles internally —
                 // a reserved role on an existing membership must never reach the session.
-                const mergedRoles = buildSessionRoles([], grant.data.roles);
+                const mergedRoles = buildSessionRoles(globalGrant.data.roles, grant.data.roles);
                 // MFA gate runs after membership is granted (mirrors login.write.ts's
                 // own order: membership resolution before MFA) — a challenge halts
                 // the session mint, not the invite acceptance itself.

package/dist/auth-email-password/handlers/invite-accept.write.js

@@ -24,6 +24,8 @@ import { decryptStoredPii } from "../../shared/index.js";
 import { INVITATION_STATUS, tenantInvitationEntity, tenantInvitationsTable, } from "../../tenant/invitation-table.js";
 // kumiko-lint-ignore cross-feature-import membership grant for a privileged cross-tenant add (like provisionSignupAccount)
 import { grantInvitedMembershipRole, invitationIssuedAt } from "../../tenant/invited-membership.js";
+// kumiko-lint-ignore cross-feature-import global roles granted on invite accept live on the user row
+import { grantInvitedGlobalRoles, parseInvitedGlobalRoles, } from "../../user/invited-global-roles.js";
 // kumiko-lint-ignore cross-feature-import auth handler reads user-row für email-match
 import { userTable } from "../../user/schema/user.js";
 import { invalidInviteToken, inviteEmailMismatch } from "../errors.js";
@@ -96,6 +98,12 @@ export function createInviteAcceptHandler() {
                 if (!grant.isSuccess)
                     return grant;
                 const { alreadyMember } = grant.data;
+                const globalGrant = await grantInvitedGlobalRoles(dbConn, {
+                    userId: event.user.id,
+                    globalRoles: parseInvitedGlobalRoles(invitation.globalRoles),
+                });
+                if (!globalGrant.isSuccess)
+                    return globalGrant;
                 // Invitation-Status → accepted via event-store-executor.
                 // Tenant-scoping: ctx.db ist auf event.user.tenantId gescopt
                 // (= NICHT der invitation-tenant). Eigene TenantDb für den

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -1,11 +1,14 @@
 import * as z from "zod";
+import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
 import type { AuthMailLocale } from "../email-templates.js";
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 export type InviteCreateData = {
     readonly kind: "invite-created";
     readonly invitationId: string;
     readonly tenantId: string;
     readonly email: string;
     readonly role: string;
+    readonly globalRoles: readonly GlobalRole[];
     readonly expiresAt: string;
 };
 export type InviteCreateOptions = {
@@ -31,3 +34,11 @@ export declare function createInviteCreateHandler(opts: InviteCreateOptions): im
     email: z.ZodEmail;
     role: z.ZodString;
 }, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare function createSystemInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"system-invite-create", z.ZodObject<{
+    email: z.ZodEmail;
+    role: z.ZodString;
+    globalRoles: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        SystemAdmin: "SystemAdmin";
+    }>>>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export {};