@cosmicdrift/kumiko-bundled-features 0.340.0 → 0.342.0

package/dist/tier-engine/feature.js

@@ -44,6 +44,8 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable, createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
 import { defineEntityCreateHandler, defineEntityListHandler, defineEntityUpdateHandler, defineFeature, defineQueryHandler, HookPhases, SYSTEM_TENANT_ID, TENANT_TIER_RESOLVER_EXT, } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { CACHE_SYNC_TOPICS, isTierAssignmentSyncMessage, } from "@cosmicdrift/kumiko-framework/redis";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { tenantTable } from "../tenant/index.js";
@@ -59,6 +61,7 @@ import { isTrialActive } from "./trial.js";
 // from the entity definition — same shape buildEntityTable would produce
 // in the App's drizzle/schema.generated.ts.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+const log = createFallbackLogger("tier-engine");
 // Event-store-executor für direct-write aus dem auto-default-tier-hook.
 // Pattern wie tenant/seeding.ts: hook sieht AppContext (kein ctx.write),
 // muss aber atomisch mit tenant-create im selben TX schreiben → executor
@@ -146,10 +149,9 @@ export function createTierEngineFeature(opts = {}) {
         // Cross-tenant set + read f\u00fcr den tier-admin-Screen. tier-options liefert
         // dem Client die App-Tier-Namen aus der tierMap-Closure (sonst hartkodiert).
         //
-        // onAssigned h\u00e4lt den Resolver-Cache nach einem direkten Executor-Write
-        // warm (der den postSave-Hook NICHT feuert). Late-bind via Holder: ohne
-        // tierMap bleibt es no-op (kein Resolver), im tierMap-Block unten wird
-        // die echte Cache-Update-Funktion eingeh\u00e4ngt \u2014 analog alwaysOnHolder.
+        // onAssigned runs after commit (the direct executor write fires no postSave
+        // hook). Late-bound: without tierMap it stays a no-op, the tierMap block
+        // below installs the real cache update + publish.
         const onTierAssigned = { fn: () => { } };
         r.writeHandler(createSetTenantTierWrite({
             onAssigned: (tenantId, tier) => onTierAssigned.fn(tenantId, tier),
@@ -223,6 +225,21 @@ export function createTierEngineFeature(opts = {}) {
         // mergeAlwaysOn-calls — Late-bind via mutable holder, gefüllt vor allen
         // Requests (build läuft pre-listen via runDevApp/runProdApp-pickup).
         const alwaysOnHolder = { set: new Set() };
+        // Bus handed to build(); hooks fire outside build and publish through it.
+        const busHolder = { bus: undefined };
+        // Out-of-order guard: every cache mutation or reload start takes a ticket; a
+        // reload result is applied only while its ticket is still the tenant's latest.
+        let ticketCounter = 0;
+        const latestTicket = new Map();
+        const takeTicket = (tenantId) => {
+            ticketCounter += 1;
+            latestTicket.set(tenantId, ticketCounter);
+            return ticketCounter;
+        };
+        const publishAssignmentChange = (tenantId) => {
+            const message = { tenantId };
+            busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message);
+        };
         // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
         // Feature-Gate geprüft — NICHT im Resolver-Cache. Der Resolver ist
         // boot-cached + synchron und sieht weder frische Signups noch den
@@ -237,15 +254,15 @@ export function createTierEngineFeature(opts = {}) {
             ? featuresForTier(tierMap, opts.trial.tier)
             : new Set();
         const nowMs = () => getTemporal().Now.instant().epochMilliseconds;
-        // set-tenant-tier schreibt direkt über den Executor → der postSave-Hook
-        // unten feuert dabei NICHT. Diese Funktion repliziert den Cache-Update
-        // des Hooks, damit ein manueller Grant das effektive Feature-Set sofort
-        // ändert (nicht nur die Projektion). Selber Cache, selbe mergeAlwaysOn-
-        // Semantik wie der Hook.
-        onTierAssigned.fn = (tenantId, tier) => {
+        // Immediate local visibility on the writing pod; other pods learn via the
+        // bus and re-read the row.
+        const applyAssignment = (tenantId, tier) => {
+            takeTicket(tenantId);
             cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, tier)));
+            publishAssignmentChange(tenantId);
         };
-        // Invalidation: tier-assignment events update the cache.
+        onTierAssigned.fn = applyAssignment;
+        // Invalidation: tier-assignment CRUD events (e.g. the billing webhook) update the cache.
         r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
             // result.data has tenantId + tier (after entity-update merge)
             const data = result.data; // @cast-boundary engine-payload
@@ -256,15 +273,17 @@ export function createTierEngineFeature(opts = {}) {
             // blocken (afterCommit-pattern, side-effect-best-effort).
             if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
                 return;
-            const tenantId = data.tenantId;
-            cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, data.tier)));
+            applyAssignment(data.tenantId, data.tier);
         });
         r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
             const data = payload.data; // @cast-boundary engine-payload
             // skip: gleiche type-guard semantik wie postSave-hook oben.
             if (typeof data.tenantId !== "string")
                 return;
-            cache.delete(data.tenantId);
+            const tenantId = data.tenantId;
+            takeTicket(tenantId);
+            cache.delete(tenantId);
+            publishAssignmentChange(tenantId);
         });
         // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
         // mit tenant-create rollback), schreibt tier-assignment via Direct-
@@ -359,6 +378,56 @@ export function createTierEngineFeature(opts = {}) {
                 for (const row of rows) {
                     cache.set(row.tenantId, mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)));
                 }
+                // Read first, then set — never clear-then-refill: a cache miss falls back
+                // to the default tier, which would lock paying tenants out meanwhile.
+                const reloadTenant = async (tenantId) => {
+                    const ticket = takeTicket(tenantId);
+                    const row = await fetchOne(deps.db, tierAssignmentTable, { tenantId });
+                    // skip: a newer write or reload for this tenant started meanwhile and owns the entry
+                    if (latestTicket.get(tenantId) !== ticket)
+                        return;
+                    if (row) {
+                        cache.set(tenantId, mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)));
+                    }
+                    else {
+                        cache.delete(tenantId);
+                    }
+                };
+                const reloadAllTenants = async () => {
+                    ticketCounter += 1;
+                    const startedAtTicket = ticketCounter;
+                    const current = await selectMany(deps.db, tierAssignmentTable);
+                    const loaded = new Map();
+                    for (const row of current) {
+                        loaded.set(row.tenantId, mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)));
+                    }
+                    const isNewerThanSnapshot = (tenantId) => (latestTicket.get(tenantId) ?? 0) > startedAtTicket;
+                    for (const tenantId of [...cache.keys()]) {
+                        if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId))
+                            cache.delete(tenantId);
+                    }
+                    for (const [tenantId, features] of loaded) {
+                        if (!isNewerThanSnapshot(tenantId))
+                            cache.set(tenantId, features);
+                    }
+                };
+                busHolder.bus = deps.cacheSync;
+                deps.cacheSync?.subscribe(CACHE_SYNC_TOPICS.tierAssignment, (message) => {
+                    // skip: malformed message from another process
+                    if (!isTierAssignmentSyncMessage(message))
+                        return;
+                    reloadTenant(message.tenantId).catch((err) => {
+                        log.error("tier reload failed, keeping cached set", {
+                            tenantId: message.tenantId,
+                            err,
+                        });
+                    });
+                });
+                deps.cacheSync?.onResync(() => {
+                    reloadAllTenants().catch((err) => {
+                        log.error("tier resync failed, keeping cached sets", { err });
+                    });
+                });
                 // Synchronous resolver-callback for dispatcher hot-path.
                 const resolver = (tenantId) => {
                     // Operator-tooling + async-event-dispatch convention: SYSTEM_TENANT_ID

package/dist/tier-engine/handlers/set-tenant-tier.write.d.ts

@@ -1,9 +1,9 @@
 import { type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 export type SetTenantTierOptions = {
-    /** Nach erfolgreichem Write aufgerufen, damit feature.ts den Resolver-
-     *  Cache aktualisieren kann (der Executor-Write feuert den postSave-Hook
-     *  nicht). Ohne tierMap kein Resolver → no-op. */
+    /** Runs after the write commits so feature.ts can update the resolver cache
+     *  and notify the other processes. Without a tierMap there is no resolver
+     *  and this is a no-op. */
     readonly onAssigned?: (tenantId: TenantId, tier: string) => void;
     /** Tier-Namen aus der tierMap-Closure — ohne sie (storage-only-Mode) bleibt
      *  `tier` unvalidiert außer Length/Non-Empty. Mit ihr rejected der Handler

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -19,14 +19,13 @@ import { tierAssignmentEntity } from "../entity.js";
 // `source: "manual"` markiert den Grant, damit ein späterer Stripe→Tier-Sync ihn
 // nicht plättet. Upsert: ein Aggregat pro Tenant (deterministische aggregate-id).
 //
-// **Effective-Set-Invalidation (kritisch):** der Executor-Write feuert NICHT
-// den `tier-assignment:postSave`-entityHook (Hooks laufen nur im Entity-
-// Handler-Pfad, nicht bei direktem executor.create/update). Ohne Cache-Update
-// bliebe das Feature-Gate auf dem alten Tier hängen — die Projektion zeigt
-// "pro", das Gate verhält sich weiter wie "free", bis der Prozess neu startet.
-// Daher ruft der Handler nach erfolgreichem Write `opts.onAssigned(tenantId,
-// tier)`; feature.ts verdrahtet das auf denselben Cache-Update wie der Hook
-// (storage-only ohne tierMap = no-op).
+// Effective-set invalidation: the executor write does not fire the
+// `tier-assignment:postSave` entity hook, and a per-handler postSave would not
+// fire either because this handler returns no lifecycle result (kind "save").
+// Without an explicit update the feature gate would stay on the old tier, so
+// `opts.onAssigned(tenantId, tier)` runs after commit (ctx.scheduleAfterCommit).
+// feature.ts uses it to update its cache and notify the other processes; in
+// storage-only mode without a tierMap it is a no-op.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEntity, {
     entityName: "tier-assignment",
@@ -50,6 +49,14 @@ export function createSetTenantTierWrite(opts = {}) {
             reason: SET_TENANT_TIER_REASON,
         },
         handler: async (event, ctx) => {
+            // Without a commit sink (unit harness) there is no transaction to wait for.
+            const afterCommit = (tenantId, tier) => {
+                const notify = async () => opts.onAssigned?.(tenantId, tier);
+                if (ctx.scheduleAfterCommit)
+                    ctx.scheduleAfterCommit(notify);
+                else
+                    opts.onAssigned?.(tenantId, tier);
+            };
             const tenantId = event.payload.tenantId; // @cast-boundary engine-bridge
             const rawDb = ctx.db.unsafeRaw();
             const tdb = createTenantDb(rawDb, tenantId, "system");
@@ -64,13 +71,13 @@ export function createSetTenantTierWrite(opts = {}) {
                 }, systemUser, tdb);
                 if (!result.isSuccess)
                     return result;
-                opts.onAssigned?.(tenantId, tier);
+                afterCommit(tenantId, tier);
                 return { isSuccess: true, data: { tenantId, tier, isNew: false } };
             }
             const result = await executor.create({ id: tierAssignmentAggregateId(tenantId), tier, source: "manual", tenantId }, systemUser, tdb);
             if (!result.isSuccess)
                 return result;
-            opts.onAssigned?.(tenantId, tier);
+            afterCommit(tenantId, tier);
             return { isSuccess: true, data: { tenantId, tier, isNew: true } };
         },
     });

package/dist/user/invited-global-roles.d.ts

@@ -0,0 +1,14 @@
+import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+export declare function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[];
+export declare function grantInvitedGlobalRoles(db: DbRunner, options: {
+    readonly userId: string;
+    readonly globalRoles: readonly string[];
+}): Promise<import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure | {
+    readonly isSuccess: true;
+    readonly data: {
+        readonly roles: readonly string[];
+    };
+}>;
+export {};

package/dist/user/invited-global-roles.js

@@ -0,0 +1,35 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+import { userEntity, userTable } from "./schema/user.js";
+const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+function isGlobalRole(role) {
+    return GLOBAL_ROLE_OPTIONS.some((option) => option === role);
+}
+// Reads the invitation's stored globalRoles column, keeping only assignable
+// global roles — a hand-edited row cannot smuggle "system" into users.roles.
+export function parseInvitedGlobalRoles(raw) {
+    return parseRoles(raw).filter(isGlobalRole);
+}
+// Add-only: an accepted invitation never removes a global role the user
+// already holds. Users live on SYSTEM_TENANT_ID (tenancy "global").
+export async function grantInvitedGlobalRoles(db, options) {
+    const existing = await fetchOne(db, userTable, { id: options.userId });
+    if (!existing)
+        return writeFailure(new NotFoundError("user", options.userId));
+    const currentRoles = parseRoles(existing.roles);
+    const missingRoles = options.globalRoles.filter((role) => !currentRoles.includes(role));
+    if (missingRoles.length === 0)
+        return grantedGlobalRoles(currentRoles);
+    const roles = [...currentRoles, ...missingRoles];
+    const updateResult = await userExecutor.update({ id: existing.id, version: existing.version, changes: { roles } }, createSystemUser(SYSTEM_TENANT_ID), createTenantDb(db, SYSTEM_TENANT_ID, "system"));
+    if (!updateResult.isSuccess)
+        return updateResult;
+    return grantedGlobalRoles(roles);
+}
+function grantedGlobalRoles(roles) {
+    return { isSuccess: true, data: { roles } };
+}

package/dist/user-data-rights/feature.js

@@ -308,6 +308,9 @@ export function createUserDataRightsFeature(opts = {}) {
             method: "GET",
             path: "/user-export/by-token",
             anonymous: true,
+            // Entry point of the emailed download link; cheap static page, but
+            // anonymous and token-bearing, so bound per-IP probing.
+            rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
             handler: async (c) => {
                 return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
                     "content-type": "text/html; charset=utf-8",

package/dist/waitlist/constants.d.ts

@@ -0,0 +1,33 @@
+export declare const WAITLIST_FEATURE: "waitlist";
+export declare const WAITLIST_STATUS: {
+    readonly Pending: "pending";
+    readonly Invited: "invited";
+    readonly Rejected: "rejected";
+};
+export type WaitlistStatus = (typeof WAITLIST_STATUS)[keyof typeof WAITLIST_STATUS];
+export declare const WaitlistHandlers: {
+    readonly submit: "waitlist:write:submit";
+    readonly invite: "waitlist:write:invite";
+    readonly reject: "waitlist:write:reject";
+};
+export declare const WaitlistQueries: {
+    readonly list: "waitlist:query:waitlist-entry:list";
+};
+export declare const WaitlistErrors: {
+    readonly notInvitable: "waitlist_not_invitable";
+    readonly notRejectable: "waitlist_not_rejectable";
+};
+export declare const WAITLIST_NOTIFICATION_TYPES: {
+    readonly confirmation: "waitlist:notify:confirmation";
+    readonly adminNotice: "waitlist:notify:admin-notice";
+};
+export declare const DEFAULT_OWN_TENANT_INVITE_ROLE = "TenantAdmin";
+export declare const WAITLIST_FIELD_LIMITS: {
+    readonly name: 120;
+    readonly email: 254;
+    readonly company: 200;
+    readonly portfolio: 200;
+    readonly message: 2000;
+    readonly locale: 35;
+    readonly honeypot: 500;
+};

package/dist/waitlist/constants.js

@@ -0,0 +1,35 @@
+// @runtime client
+// Pure string constants, safe for browser code (see auth-email-password/constants.ts).
+export const WAITLIST_FEATURE = "waitlist";
+export const WAITLIST_STATUS = {
+    Pending: "pending",
+    Invited: "invited",
+    Rejected: "rejected",
+};
+export const WaitlistHandlers = {
+    submit: "waitlist:write:submit",
+    invite: "waitlist:write:invite",
+    reject: "waitlist:write:reject",
+};
+// Entity-convention list QN: entityList screens resolve their query by this shape.
+export const WaitlistQueries = {
+    list: "waitlist:query:waitlist-entry:list",
+};
+export const WaitlistErrors = {
+    notInvitable: "waitlist_not_invitable",
+    notRejectable: "waitlist_not_rejectable",
+};
+export const WAITLIST_NOTIFICATION_TYPES = {
+    confirmation: "waitlist:notify:confirmation",
+    adminNotice: "waitlist:notify:admin-notice",
+};
+export const DEFAULT_OWN_TENANT_INVITE_ROLE = "TenantAdmin";
+export const WAITLIST_FIELD_LIMITS = {
+    name: 120,
+    email: 254,
+    company: 200,
+    portfolio: 200,
+    message: 2000,
+    locale: 35,
+    honeypot: 500,
+};