@cosmicdrift/kumiko-bundled-features 0.341.0 → 0.343.0

package/dist/delivery/web/client-plugin.js

@@ -1,10 +1,18 @@
-import { DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT } from "../public-names.js";
+import { DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, } from "../public-names.js";
+import { DeliveryChannelCell } from "./delivery-channel-cell.js";
+import { DeliveryErrorCell } from "./delivery-error-cell.js";
 import { DeliveryStatusCell } from "./delivery-status-cell.js";
+import { DeliveryTimeCell } from "./delivery-time-cell.js";
+import { DeliveryTypeCell } from "./delivery-type-cell.js";
 export function deliveryClient(options) {
     return {
         name: DELIVERY_FEATURE,
         columnRenderers: {
             [DELIVERY_STATUS_CELL_COMPONENT]: DeliveryStatusCell,
+            [DELIVERY_TYPE_CELL_COMPONENT]: DeliveryTypeCell,
+            [DELIVERY_CHANNEL_CELL_COMPONENT]: DeliveryChannelCell,
+            [DELIVERY_TIME_CELL_COMPONENT]: DeliveryTimeCell,
+            [DELIVERY_ERROR_CELL_COMPONENT]: DeliveryErrorCell,
         },
         ...(options?.translations !== undefined && { translations: options.translations }),
     };

package/dist/delivery/web/delivery-channel-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryChannelCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-channel-cell.js

@@ -0,0 +1,10 @@
+// @runtime client
+// Channel column: the label comes from `delivery.channel.<name>`, registered by each
+// channel feature; unknown channels show their raw name.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+export function DeliveryChannelCell({ row }) {
+    const t = useTranslation();
+    const channel = typeof row["channel"] === "string" ? row["channel"] : "";
+    return translateOrRaw(t, `delivery.channel.${channel}`, channel);
+}

package/dist/delivery/web/delivery-error-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryErrorCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-error-cell.js

@@ -0,0 +1,16 @@
+// @runtime client
+// Error column. The log only carries fixed codes (`DeliveryErrorCode`); `http_<status>`
+// takes the status as a parameter, anything unknown shows as the raw value.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { HTTP_ERROR_CODE_PATTERN } from "@cosmicdrift/kumiko-types/handlers";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+export function DeliveryErrorCell({ row }) {
+    const t = useTranslation();
+    const error = row["error"];
+    if (typeof error !== "string" || error === "")
+        return null;
+    const http = HTTP_ERROR_CODE_PATTERN.exec(error);
+    if (http)
+        return t("delivery.error.http", { status: http[1] });
+    return translateOrRaw(t, `delivery.error.${error}`, error);
+}

package/dist/delivery/web/delivery-status-cell.d.ts

@@ -1,3 +1,3 @@
-import type { ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
 export declare function DeliveryStatusCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-status-cell.js

@@ -1,5 +1,12 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+// @runtime client
+// Column-renderer for the delivery-log screen's status column, registered
+// via `deliveryClient()`'s `columnRenderers` map (screen.columns[].renderer
+// in feature.ts). The list frame itself is the generic declarative
+// projectionList renderer — only this one cell stays TSX.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge } from "@cosmicdrift/kumiko-renderer-web";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 import { DeliveryStatus } from "../public-names.js";
 const STATUS_TONE = {
     [DeliveryStatus.sent]: "ok",
@@ -8,6 +15,9 @@ const STATUS_TONE = {
     [DeliveryStatus.skipped]: "muted",
 };
 export function DeliveryStatusCell({ row }) {
+    const t = useTranslation();
     const status = typeof row["status"] === "string" ? row["status"] : "";
-    return (_jsx(StatusBadge, { tone: STATUS_TONE[status] ?? "muted", testId: "delivery-status-cell", children: status }));
+    const unconfirmed = status === DeliveryStatus.sent && row["confirmed"] === false;
+    const labelKey = unconfirmed ? "delivery.status.sentUnconfirmed" : `delivery.status.${status}`;
+    return (_jsx(StatusBadge, { tone: unconfirmed ? "muted" : (STATUS_TONE[status] ?? "muted"), testId: "delivery-status-cell", children: translateOrRaw(t, labelKey, status) }));
 }

package/dist/delivery/web/delivery-time-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryTimeCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-time-cell.js

@@ -0,0 +1,6 @@
+// @runtime client
+import { formatWhen } from "@cosmicdrift/kumiko-renderer";
+export function DeliveryTimeCell({ row }) {
+    const createdAt = row["createdAt"];
+    return typeof createdAt === "string" ? formatWhen(createdAt) : "";
+}

package/dist/delivery/web/delivery-type-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryTypeCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-type-cell.js

@@ -0,0 +1,17 @@
+// @runtime client
+// Notification type column. Types are QNs like `<scope>:notify:<name>`; the
+// translation key is `<scope>.notification.<name>`, registered by the app that
+// owns the notification (bundled features register none). Falls back to the short
+// name, or to the raw value for any other format.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+const NOTIFICATION_QN_PATTERN = /^([^:]+):notify:(.+)$/;
+export function DeliveryTypeCell({ row }) {
+    const t = useTranslation();
+    const type = typeof row["type"] === "string" ? row["type"] : "";
+    const match = NOTIFICATION_QN_PATTERN.exec(type);
+    if (!match)
+        return type;
+    const [, scope, name] = match;
+    return translateOrRaw(t, `${scope}.notification.${name}`, name ?? type);
+}

package/dist/secrets/constants.d.ts

@@ -1,3 +1,9 @@
 import type { AccessRule } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DEFAULT_SECRETS_ROLES: readonly ["TenantAdmin"];
 export declare const DEFAULT_SECRETS_ACCESS: AccessRule;
+export declare const SECRETS_ERROR_KEYS: {
+    readonly unknownKey: "secrets.errors.unknownKey";
+    readonly writeDenied: "secrets.errors.writeDenied";
+    readonly invalidValue: "secrets.errors.invalidValue";
+};
+export declare const INVALID_SECRET_VALUE_CODE: "invalid_secret_value";

package/dist/secrets/constants.js

@@ -7,3 +7,11 @@
 // design, not a per-tenant RBAC surface.
 export const DEFAULT_SECRETS_ROLES = ["TenantAdmin"];
 export const DEFAULT_SECRETS_ACCESS = { roles: DEFAULT_SECRETS_ROLES };
+// Error i18n keys of the secrets write path. Shared by the write gate, the
+// bundled translations and callers that need to recognise a specific failure.
+export const SECRETS_ERROR_KEYS = {
+    unknownKey: "secrets.errors.unknownKey",
+    writeDenied: "secrets.errors.writeDenied",
+    invalidValue: "secrets.errors.invalidValue",
+};
+export const INVALID_SECRET_VALUE_CODE = "invalid_secret_value";

package/dist/secrets/feature.d.ts

@@ -13,6 +13,9 @@ import * as z from "zod";
  * `KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION` pins one explicitly.
  */
 export declare const SECRETS_FEATURE_NAME = "secrets";
+/** Env keys that carry the KEK keyring. Optional when the app supplies its own
+ *  `masterKey` provider. */
+export declare const SECRETS_MASTER_KEK_ENV_KEYS: readonly ["KUMIKO_SECRETS_MASTER_KEY_V1"];
 export declare const secretsEnvSchema: z.ZodObject<{
     KUMIKO_SECRETS_MASTER_KEY_V1: z.ZodString;
     KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: z.ZodDefault<z.ZodString>;

package/dist/secrets/feature.js

@@ -23,6 +23,9 @@ const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the
  * `KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION` pins one explicitly.
  */
 export const SECRETS_FEATURE_NAME = "secrets";
+/** Env keys that carry the KEK keyring. Optional when the app supplies its own
+ *  `masterKey` provider. */
+export const SECRETS_MASTER_KEK_ENV_KEYS = ["KUMIKO_SECRETS_MASTER_KEY_V1"];
 export const secretsEnvSchema = z.object({
     KUMIKO_SECRETS_MASTER_KEY_V1: z
         .string()

package/dist/secrets/i18n.js

@@ -1,13 +1,14 @@
+import { SECRETS_ERROR_KEYS } from "./constants.js";
 export const SECRETS_I18N = {
-    "secrets.errors.unknownKey": {
+    [SECRETS_ERROR_KEYS.unknownKey]: {
         en: "Unknown secret key.",
         de: "Unbekannter Geheimnis-Schlüssel.",
     },
-    "secrets.errors.writeDenied": {
+    [SECRETS_ERROR_KEYS.writeDenied]: {
         en: "You are not allowed to change this secret.",
         de: "Dieses Geheimnis darf nicht geändert werden.",
     },
-    "secrets.errors.invalidValue": {
+    [SECRETS_ERROR_KEYS.invalidValue]: {
         en: "This value is not valid for this secret.",
         de: "Dieser Wert ist für dieses Geheimnis nicht gültig.",
     },

package/dist/secrets/index.d.ts

@@ -1,6 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES } from "./constants.js";
-export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
+export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";
 export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.js";
 export { createSetHandler } from "./handlers/set.write.js";
+export { isInvalidSecretValueError } from "./write-gate.js";

package/dist/secrets/index.js

@@ -1,6 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES } from "./constants.js";
-export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
+export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";
 export { rotateJob, } from "./handlers/rotate.job.js";
 export { createSetHandler } from "./handlers/set.write.js";
+export { isInvalidSecretValueError } from "./write-gate.js";

package/dist/secrets/write-gate.d.ts

@@ -10,5 +10,6 @@ export type SecretKeyWriteCheck = {
 export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;
 export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
 export declare function invalidSecretValueError(): ValidationError;
+export declare function isInvalidSecretValueError(err: unknown): err is ValidationError;
 export declare function isSecretValueValid(schemas: SecretValueSchemaSource, key: string, value: string): boolean;
 export declare function checkSecretValue(registry: SecretValueSchemaSource, key: string, value: string): WriteFailure | undefined;

package/dist/secrets/write-gate.js

@@ -1,8 +1,9 @@
-import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { AccessDeniedError, isKumikoError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./constants.js";
 function unknownKeyFailure(key) {
     return {
         ok: false,
-        failure: writeFailure(new NotFoundError("secretKey", key, { i18nKey: "secrets.errors.unknownKey" })),
+        failure: writeFailure(new NotFoundError("secretKey", key, { i18nKey: SECRETS_ERROR_KEYS.unknownKey })),
     };
 }
 function namespaceAcceptsKey(namespace, key) {
@@ -27,7 +28,7 @@ export function checkSecretKeyWrite(registry, userRoles, key) {
             ok: false,
             failure: writeFailure(new AccessDeniedError({
                 message: "secret write access denied",
-                i18nKey: "secrets.errors.writeDenied",
+                i18nKey: SECRETS_ERROR_KEYS.writeDenied,
                 details: { requiredRoles: writeRoles },
             })),
         };
@@ -40,11 +41,18 @@ export function invalidSecretValueError() {
         fields: [
             {
                 path: "value",
-                code: "invalid_secret_value",
-                i18nKey: "secrets.errors.invalidValue",
+                code: INVALID_SECRET_VALUE_CODE,
+                i18nKey: SECRETS_ERROR_KEYS.invalidValue,
             },
         ],
-    }, { i18nKey: "secrets.errors.invalidValue" });
+    }, { i18nKey: SECRETS_ERROR_KEYS.invalidValue });
+}
+// Matches on the i18n key and error code rather than instanceof, which is fragile
+// when the error crosses a package boundary with a duplicated framework copy.
+export function isInvalidSecretValueError(err) {
+    return (isKumikoError(err) &&
+        err.code === "validation_error" &&
+        err.i18nKey === SECRETS_ERROR_KEYS.invalidValue);
 }
 export function isSecretValueValid(schemas, key, value) {
     const valueSchema = schemas.getSecretKey(key)?.valueSchema ?? schemas.findSecretNamespace(key)?.valueSchema;

package/dist/shared/index.d.ts

@@ -12,6 +12,7 @@ export { createLockoutCounter, type LockoutCounterState } from "./lockout-counte
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/index.js

@@ -12,6 +12,7 @@ export { createLockoutCounter } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/redact.d.ts

@@ -0,0 +1,4 @@
+export declare function redactEmailAddresses(text: string): string;
+export declare function redactUrls(text: string): string;
+export declare function redactBotTokens(text: string): string;
+export declare function redactErrorText(text: string): string;

package/dist/shared/redact.js

@@ -0,0 +1,21 @@
+// Adapter errors usually quote the rejected recipient ("550 <ops@example.com> rejected"); the
+// address must not outlive the crypto-shredded dispatch payload in logs.
+export function redactEmailAddresses(text) {
+    return text.replace(/[^\s<>,;"']+@[^\s<>,;"']+/g, "[redacted-address]");
+}
+// Provider URLs carry secrets in the path (Slack hook, Telegram bot token), the query or
+// the userinfo. The origin stays so the log still says which host failed. Any scheme
+// counts: smtp://user:pass@host carries credentials just like https.
+export function redactUrls(text) {
+    return text.replace(/([a-z][a-z0-9+.-]*:\/\/)([^\s/?#<>"']*)([^\s<>"']*)/gi, (_match, scheme, authority, rest) => {
+        const host = authority.slice(authority.lastIndexOf("@") + 1);
+        return rest.length > 0 && rest !== "/" ? `${scheme}${host}/[redacted]` : `${scheme}${host}`;
+    });
+}
+// Telegram-style bot tokens outside a URL ("<digits>:<35 chars>"). Times like 12:30 are too short to match.
+export function redactBotTokens(text) {
+    return text.replace(/\b\d{6,}:[A-Za-z0-9_-]{30,}\b/g, "[redacted-token]");
+}
+export function redactErrorText(text) {
+    return redactBotTokens(redactEmailAddresses(redactUrls(text)));
+}

package/dist/step-dispatcher/feature.js

@@ -12,7 +12,8 @@ import { defineFeature, STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_FAILED_TYPE,
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import * as z from "zod";
-import { mailSpecSchema, performMailDispatch, redactEmailAddresses, } from "./mail-runner.js";
+import { redactEmailAddresses } from "../shared/index.js";
+import { mailSpecSchema, performMailDispatch } from "./mail-runner.js";
 import { performWebhookDispatch, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS, webhookSpecSchema, } from "./webhook-runner.js";
 const log = createFallbackLogger("step-dispatcher");
 export const stepDispatcherEnvSchema = z.object({

package/dist/step-dispatcher/mail-runner.d.ts

@@ -15,4 +15,3 @@ export type MailDispatchResult = {
 };
 export declare function setMailRunner(fn: (spec: MailSpec) => Promise<MailDispatchResult>): void;
 export declare function performMailDispatch(spec: MailSpec): Promise<MailDispatchResult>;
-export declare function redactEmailAddresses(text: string): string;

package/dist/step-dispatcher/mail-runner.js

@@ -19,8 +19,3 @@ export function setMailRunner(fn) {
 export async function performMailDispatch(spec) {
     return mailRunner(spec);
 }
-// Adapter errors usually quote the rejected recipient ("550 <ops@example.com> rejected"); the
-// address must not outlive the crypto-shredded dispatch payload in logs.
-export function redactEmailAddresses(text) {
-    return text.replace(/[^\s<>,;"']+@[^\s<>,;"']+/g, "[redacted-address]");
-}

package/dist/tenant/web/member-roles-cell.js

@@ -3,7 +3,7 @@
 // `readonly string[]` on TeamRow (see team-list.query.ts), and DataTable has
 // no default array-to-cell formatting, so this joins it into one string.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { translateOrRaw } from "./translate-or-raw.js";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 export function MemberRolesCell({ row }) {
     const t = useTranslation();
     const roles = row["roles"];

package/dist/tenant/web/member-status-cell.js

@@ -6,7 +6,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // projectionList renderer — only this one cell stays TSX.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge } from "@cosmicdrift/kumiko-renderer-web";
-import { translateOrRaw } from "./translate-or-raw.js";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 const STATUS_TONE = {
     active: "ok",
     pending: "muted",

package/dist/tenant-lifecycle/feature.js

@@ -4,7 +4,7 @@ import { DESTRUCTION_CANCELLED_EVENT_SHORT, DESTRUCTION_REQUESTED_EVENT_SHORT, T
 import { destructionCancelledSchema, destructionRequestedSchema, tenantDestructionCompletedSchema, tenantDestructionFailedSchema, tenantDestructionStageAbandonedSchema, tenantDestructionStageFailedSchema, tenantDestructionStageStartedSchema, tenantDestructionStageSucceededSchema, tenantDestructionStartedSchema, } from "./events.js";
 import { cancelDestructionWrite } from "./handlers/cancel-destruction.write.js";
 import { requestDestructionWrite } from "./handlers/request-destruction.write.js";
-import { resolveTenantLifecycleGate, runTenantDestructionSweep } from "./run-tenant-destroy.js";
+import { hasTenantDestructionWork, resolveTenantLifecycleGate, runTenantDestructionSweep, } from "./run-tenant-destroy.js";
 const tenantLifecycleStatusPlugin = {
     async resolveStatus(tenantId, { db }) {
         const gate = await resolveTenantLifecycleGate(db, tenantId);
@@ -73,10 +73,16 @@ export function createTenantLifecycleFeature() {
                     throw new Error("run-tenant-destruction: ctx.registry required (JobContext incomplete)");
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
+                const now = T.Now.instant();
+                // Without crossTenantReads (undeclared hatch) fall through to the sweep.
+                if (ctx.crossTenantReads && !(await hasTenantDestructionWork(ctx.crossTenantReads, now))) {
+                    // skip: no tenant is due, so the sweep would not touch anything
+                    return;
+                }
                 await runTenantDestructionSweep({
                     db: ctx.db.unsafeRaw(), // @cast-boundary db-operator — jobs never run inside a DbTx
                     registry: ctx.registry,
-                    now: T.Now.instant(),
+                    now,
                     log: (message) => ctx.log?.warn(message),
                     fileProviderResolver: ctx._fileProviderResolver,
                     escapeHatchAuditSink: ctx._escapeHatchAuditSink,

package/dist/tenant-lifecycle/run-tenant-destroy.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 export declare function runNextDestructionStage(args: {
@@ -15,6 +15,7 @@ export declare function runNextDestructionStage(args: {
     readonly error?: string;
     readonly halted?: boolean;
 }>;
+export declare function hasTenantDestructionWork(reads: Pick<TenantDb, "count">, now: Temporal.Instant): Promise<boolean>;
 /** Cron entry: start destruction for tenants past grace, then advance stages. */
 export declare function runTenantDestructionSweep(args: {
     readonly db: DbRunner;

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -167,14 +167,25 @@ export async function runNextDestructionStage(args) {
         return { done: false, error: message };
     }
 }
+function destroyRequestedDueWhere(now) {
+    return {
+        status: "destroyRequested",
+        gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
+    };
+}
+const destroyingWhere = { status: "destroying" };
+export async function hasTenantDestructionWork(reads, now) {
+    const [due, destroying] = await Promise.all([
+        reads.count(tenantTable, destroyRequestedDueWhere(now)),
+        reads.count(tenantTable, destroyingWhere),
+    ]);
+    return due > 0 || destroying > 0;
+}
 /** Cron entry: start destruction for tenants past grace, then advance stages. */
 export async function runTenantDestructionSweep(args) {
     const T = getTemporal();
     const now = args.now ?? T.Now.instant();
-    const due = await selectMany(args.db, tenantTable, {
-        status: "destroyRequested",
-        gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
-    });
+    const due = await selectMany(args.db, tenantTable, destroyRequestedDueWhere(now));
     let triggered = 0;
     for (const row of due) {
         const tenantId = row.id;
@@ -195,9 +206,7 @@ export async function runTenantDestructionSweep(args) {
         triggered++;
     }
     let advanced = 0;
-    const destroying = await selectMany(args.db, tenantTable, {
-        status: "destroying",
-    });
+    const destroying = await selectMany(args.db, tenantTable, destroyingWhere);
     for (const row of destroying) {
         try {
             const result = await runNextDestructionStage({

package/dist/user/index.d.ts

@@ -3,5 +3,6 @@ export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants
 export { backfillUserStreamTenants, type UserStreamBackfillResult, } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
 export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export type { UserStatus } from "./schema/user.js";
 export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/index.js

@@ -3,4 +3,5 @@ export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants
 export { backfillUserStreamTenants, } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
 export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/resolve-display-names.d.ts

@@ -0,0 +1,2 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+export declare function resolveUserDisplayNames(db: TenantDb, userIds: readonly string[]): Promise<ReadonlyMap<string, string>>;

package/dist/user/resolve-display-names.js

@@ -0,0 +1,24 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
+import { userTable } from "./schema/user.js";
+// Shares the KMS adapter's small dedicated pool, same as member-directory.
+const KMS_POOL_CONCURRENCY = 4;
+// One batched lookup for a page of user ids. Users that are missing, have no
+// display name, or whose name cannot be decrypted (e.g. crypto-shredded) are
+// left out, so callers fall back to the raw id instead of failing the page.
+export async function resolveUserDisplayNames(db, userIds) {
+    const names = new Map();
+    if (userIds.length === 0)
+        return names;
+    const users = await selectMany(db, userTable, { id: [...userIds] });
+    const named = users.filter((user) => typeof user.displayName === "string");
+    await mapWithConcurrency(named, KMS_POOL_CONCURRENCY, async (user) => {
+        try {
+            names.set(String(user.id), await decryptStoredPii(String(user.displayName), "displayName", "user:resolve-display-names"));
+        }
+        catch {
+            // Unreadable name: the caller's fallback applies.
+        }
+    });
+    return names;
+}

package/dist/waitlist/handlers/submit.write.js

@@ -89,7 +89,7 @@ export function createSubmitHandler(opts) {
                 locale: resolveWaitlistMailLocale(payload.locale),
             }));
             await sendBestEffort(ctx, "admin notice", async (notify) => {
-                const adminRecipient = opts.notifyRecipient?.(ctx);
+                const adminRecipient = await opts.notifyRecipient?.(ctx);
                 // skip: no admin recipient configured
                 if (!adminRecipient)
                     return;

package/dist/waitlist/options.d.ts

@@ -13,8 +13,9 @@ export type WaitlistInviteOptions = {
 };
 export type WaitlistOptions = {
     /** Address for an admin notification mail on each new entry. Null, an empty
-     *  string or an absent option sends none. Best effort, never fails the submit. */
-    readonly notifyRecipient?: (ctx: HandlerContext) => string | null;
+     *  string or an absent option sends none. Best effort, never fails the submit,
+     *  also when the resolver throws or rejects. */
+    readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
     /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
     readonly invite?: WaitlistInviteOptions;
     /** Default: 5 submits per IP per 10 minutes. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.341.0",
+  "version": "0.343.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -503,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.341.0",
-    "@cosmicdrift/kumiko-framework": "0.341.0",
-    "@cosmicdrift/kumiko-headless": "0.341.0",
-    "@cosmicdrift/kumiko-renderer": "0.341.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.341.0",
-    "@cosmicdrift/kumiko-types": "0.341.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.343.0",
+    "@cosmicdrift/kumiko-framework": "0.343.0",
+    "@cosmicdrift/kumiko-headless": "0.343.0",
+    "@cosmicdrift/kumiko-renderer": "0.343.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.343.0",
+    "@cosmicdrift/kumiko-types": "0.343.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1025,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.341.0",
-    "@cosmicdrift/kumiko-locale-es": "0.341.0",
+    "@cosmicdrift/kumiko-locale-de": "0.343.0",
+    "@cosmicdrift/kumiko-locale-es": "0.343.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "escape-hatch retention follows the tenant compliance profile",
+    "detail": "The audit job `escape-hatch-retention` now deletes `escapeHatchUse` events after the `auditLog.retention` of the tenant's compliance profile. A tenant override can only lengthen that period, never go below the base retention of the selected profile. Cross-tenant audits (with `targetTenantId`, e.g. `identity-switch`) additionally follow the profile of the target tenant. The config key `audit:config:escape-hatch-retention-days` is only the fallback when compliance-profiles is not mounted.\n`pruneEvents` gains the optional `aggregateIds` option to restrict the prune to specific aggregates. `@cosmicdrift/kumiko-framework/compliance` exports `subtractRetentionSpec` and the `RetentionSpec` type for calendar-aware cutoffs (months and years)."
+  },
   {
     "version": "0.313.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Mail expiry shows duration and local time with time zone",
+    "detail": "Auth mails state the link validity as a duration and in the user's time zone\nThe five token mail renderers replace the UTC timestamp with `{duration}` (for example \"1 day\") and `{when}` (medium date and short time with zone abbreviation, in the recipient's locale). `RenderTokenContentArgs` gains `issuedAt` (default now) and `timeZone` (default UTC; an invalid zone falls back to UTC); the handlers pass the token issue time and `ctx.tz.user`. German strings use \"Konto\" instead of \"Account\".",
+    "migration": "Custom `auth.mail.*.expiry` translations should use the new `{duration}` and `{when}` placeholders; `{when}` now includes the time and zone abbreviation instead of a UTC timestamp."
+  },
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "AuthCard styling hooks (className, headerClassName, titleClassName, bodyClassName)",
+    "detail": "AuthCard takes className, headerClassName, titleClassName and bodyClassName\n`AuthCard` renders the body wrapper (`p-6 pt-0 flex flex-col gap-4`) itself and accepts `className` (Card), `headerClassName`, `titleClassName` and `bodyClassName`, merged with tailwind-merge over the defaults. The auth-email-password and auth-mfa screens no longer carry their own body wrapper; the rendered DOM stays the same. The session bootstrap error screen keeps its former bottom padding through `bodyClassName`."
+  },
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "Bootstrap seed can write with app tenant roles",
+    "detail": "Bootstrap seed gets `dispatchWriteAs` to write with app tenant roles instead of SystemAdmin."
+  },
   {
     "version": "0.341.0",
     "type": "breaking",

package/src/channel-email/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "EmailMessage.fromName sets the From display name",
+    "detail": "channel-email: fromName sets the display name of the From header\n`EmailMessage` gets an optional `fromName`, and the email channel passes `data.fromName` through like `replyTo`. The SMTP transport combines it with the address of `message.from` or the transport default, so `from: \"App <noreply@x>\"` plus `fromName: \"Tenant via veridom\"` sends from `noreply@x` under the new name. Control characters in the name are replaced by spaces before sending, and an empty name behaves like no name. The PII ciphertext guard refuses a ciphertext `fromName`."
+  },
   {
     "version": "0.335.0",
     "type": "fix",