@cosmicdrift/kumiko-bundled-features 0.342.0 → 0.344.0

package/dist/delivery/notify-factory.d.ts

@@ -0,0 +1,5 @@
+import type { NotifyFactory } from "@cosmicdrift/kumiko-framework/engine";
+import type { DeliveryService } from "./types.js";
+export declare function createDeliveryNotifyFactory(deliveryService: Pick<DeliveryService, "notify">, options?: {
+    readonly deliverQueuedInline?: boolean;
+}): NotifyFactory;

package/dist/delivery/notify-factory.js

@@ -0,0 +1,6 @@
+// The same binding runProdApp wires into the app context: the calling context's
+// job dispatcher is handed to notify() per call, so queued channels go through
+// the delivery jobs. deliverQueuedInline drops the dispatcher and sends inline.
+export function createDeliveryNotifyFactory(deliveryService, options = {}) {
+    return (user, tenantId, jobDispatcher) => (notificationType, notifyOptions) => deliveryService.notify(notificationType, notifyOptions, user, tenantId, options.deliverQueuedInline === true ? undefined : jobDispatcher);
+}

package/dist/delivery/public-names.d.ts

@@ -14,6 +14,10 @@ export declare const DeliveryQueries: {
 };
 export declare const DELIVERY_LOG_SCREEN_ID: "delivery-log";
 export declare const DELIVERY_STATUS_CELL_COMPONENT: "DeliveryStatusCell";
+export declare const DELIVERY_TYPE_CELL_COMPONENT: "DeliveryTypeCell";
+export declare const DELIVERY_CHANNEL_CELL_COMPONENT: "DeliveryChannelCell";
+export declare const DELIVERY_TIME_CELL_COMPONENT: "DeliveryTimeCell";
+export declare const DELIVERY_ERROR_CELL_COMPONENT: "DeliveryErrorCell";
 export declare const DeliveryErrors: {
     readonly noRecipient: "delivery_no_recipient";
     readonly channelFailed: "delivery_channel_failed";

package/dist/delivery/public-names.js

@@ -26,6 +26,10 @@ export const DELIVERY_LOG_SCREEN_ID = "delivery-log";
 // column — see `screen.columns[].renderer.react.__component` in feature.ts
 // and `deliveryClient()`'s `columnRenderers` map.
 export const DELIVERY_STATUS_CELL_COMPONENT = "DeliveryStatusCell";
+export const DELIVERY_TYPE_CELL_COMPONENT = "DeliveryTypeCell";
+export const DELIVERY_CHANNEL_CELL_COMPONENT = "DeliveryChannelCell";
+export const DELIVERY_TIME_CELL_COMPONENT = "DeliveryTimeCell";
+export const DELIVERY_ERROR_CELL_COMPONENT = "DeliveryErrorCell";
 export const DeliveryErrors = {
     noRecipient: "delivery_no_recipient",
     channelFailed: "delivery_channel_failed",

package/dist/delivery/tables.js

@@ -23,6 +23,8 @@ export const deliveryAttemptsTable = pgTable("store_delivery_attempts", {
     recipientAddress: text("recipient_address"),
     status: text("status").notNull().$type(),
     error: text("error"),
+    // false = provider accepted but did not confirm; null = confirmed or not applicable.
+    confirmed: boolean("confirmed"),
     // Default covers rows that predate the column; new rows always carry the
     // notify() priority from the event payload.
     priority: text("priority").notNull().default("normal").$type(),
@@ -48,6 +50,7 @@ export const deliveryAttemptsTableMeta = defineUnmanagedTable({
         { name: "recipient_address", pgType: "text", notNull: false },
         { name: "status", pgType: "text", notNull: true },
         { name: "error", pgType: "text", notNull: false },
+        { name: "confirmed", pgType: "boolean", notNull: false },
         { name: "priority", pgType: "text", notNull: true, defaultSql: "'normal'" },
         { name: "created_at", pgType: "timestamptz", notNull: true, defaultSql: "now()" },
     ],

package/dist/delivery/testing.d.ts

@@ -3,6 +3,7 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { EscapeHatchAuditSink, Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import type { Logger } from "@cosmicdrift/kumiko-framework/logging";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import type { KillSwitchResolver, RateLimitConfig } from "./delivery-service.js";
 import type { DeliveryService } from "./types.js";
@@ -13,6 +14,7 @@ export type CreateDeliveryTestContextOptions = {
     readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
     readonly log?: Logger;
     readonly jobRunner?: JobRunner;
+    readonly secrets?: SecretsContext;
 };
 /**
  * Helper for setupTestStack: creates a DeliveryService + _notifyFactory for the test context.

package/dist/delivery/testing.js

@@ -1,4 +1,5 @@
 import { collectChannels, createDeliveryService } from "./delivery-service.js";
+import { createDeliveryNotifyFactory } from "./notify-factory.js";
 /**
  * Helper for setupTestStack: creates a DeliveryService + _notifyFactory for the test context.
  * Abstracts the boilerplate that every Delivery-using test needs.
@@ -21,6 +22,6 @@ export function createDeliveryTestContext(deps, options = {}) {
     });
     return {
         deliveryService, // exposed so tests can inspect/call directly if needed
-        _notifyFactory: (user, tenantId) => (notificationType, notifyOptions) => deliveryService.notify(notificationType, notifyOptions, user, tenantId), // @cast-boundary engine-bridge
+        _notifyFactory: createDeliveryNotifyFactory(deliveryService),
     };
 }

package/dist/delivery/types.d.ts

@@ -1,6 +1,6 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import type { NotifyDeliveryStatus, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { DeliveryErrorCode, NotifyDeliveryStatus, NotifyJobDispatcher, NotifyOptions, NotifyPriority, NotifyResult, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 export type ChannelContext = {
@@ -19,7 +19,8 @@ export type ChannelMessage = {
 };
 export type ChannelResult = {
     readonly status: "sent" | "failed" | "skipped";
-    readonly error?: string;
+    readonly error?: DeliveryErrorCode;
+    readonly confirmed?: false;
     readonly address?: string;
 };
 export type RenderedMessage = {
@@ -51,8 +52,9 @@ export type DeliveryLogEntry = {
     readonly recipientId: string | null;
     readonly recipientAddress: string | null;
     readonly status: NotifyDeliveryStatus;
-    readonly error: string | null;
+    readonly error: DeliveryErrorCode | null;
     readonly priority: NotifyPriority;
+    readonly confirmed?: false;
 };
 export type DeliveryService = {
     notify(notificationType: string, options: NotifyOptions, user: SessionUser, tenantId: TenantId, jobDispatcher?: NotifyJobDispatcher): Promise<NotifyResult>;

package/dist/delivery/web/client-plugin.js

@@ -1,10 +1,18 @@
-import { DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT } from "../public-names.js";
+import { DELIVERY_CHANNEL_CELL_COMPONENT, DELIVERY_ERROR_CELL_COMPONENT, DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT, DELIVERY_TIME_CELL_COMPONENT, DELIVERY_TYPE_CELL_COMPONENT, } from "../public-names.js";
+import { DeliveryChannelCell } from "./delivery-channel-cell.js";
+import { DeliveryErrorCell } from "./delivery-error-cell.js";
 import { DeliveryStatusCell } from "./delivery-status-cell.js";
+import { DeliveryTimeCell } from "./delivery-time-cell.js";
+import { DeliveryTypeCell } from "./delivery-type-cell.js";
 export function deliveryClient(options) {
     return {
         name: DELIVERY_FEATURE,
         columnRenderers: {
             [DELIVERY_STATUS_CELL_COMPONENT]: DeliveryStatusCell,
+            [DELIVERY_TYPE_CELL_COMPONENT]: DeliveryTypeCell,
+            [DELIVERY_CHANNEL_CELL_COMPONENT]: DeliveryChannelCell,
+            [DELIVERY_TIME_CELL_COMPONENT]: DeliveryTimeCell,
+            [DELIVERY_ERROR_CELL_COMPONENT]: DeliveryErrorCell,
         },
         ...(options?.translations !== undefined && { translations: options.translations }),
     };

package/dist/delivery/web/delivery-channel-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryChannelCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-channel-cell.js

@@ -0,0 +1,10 @@
+// @runtime client
+// Channel column: the label comes from `delivery.channel.<name>`, registered by each
+// channel feature; unknown channels show their raw name.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+export function DeliveryChannelCell({ row }) {
+    const t = useTranslation();
+    const channel = typeof row["channel"] === "string" ? row["channel"] : "";
+    return translateOrRaw(t, `delivery.channel.${channel}`, channel);
+}

package/dist/delivery/web/delivery-error-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryErrorCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-error-cell.js

@@ -0,0 +1,16 @@
+// @runtime client
+// Error column. The log only carries fixed codes (`DeliveryErrorCode`); `http_<status>`
+// takes the status as a parameter, anything unknown shows as the raw value.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { HTTP_ERROR_CODE_PATTERN } from "@cosmicdrift/kumiko-types/handlers";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+export function DeliveryErrorCell({ row }) {
+    const t = useTranslation();
+    const error = row["error"];
+    if (typeof error !== "string" || error === "")
+        return null;
+    const http = HTTP_ERROR_CODE_PATTERN.exec(error);
+    if (http)
+        return t("delivery.error.http", { status: http[1] });
+    return translateOrRaw(t, `delivery.error.${error}`, error);
+}

package/dist/delivery/web/delivery-status-cell.d.ts

@@ -1,3 +1,3 @@
-import type { ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
 export declare function DeliveryStatusCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-status-cell.js

@@ -1,5 +1,12 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+// @runtime client
+// Column-renderer for the delivery-log screen's status column, registered
+// via `deliveryClient()`'s `columnRenderers` map (screen.columns[].renderer
+// in feature.ts). The list frame itself is the generic declarative
+// projectionList renderer — only this one cell stays TSX.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge } from "@cosmicdrift/kumiko-renderer-web";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 import { DeliveryStatus } from "../public-names.js";
 const STATUS_TONE = {
     [DeliveryStatus.sent]: "ok",
@@ -8,6 +15,9 @@ const STATUS_TONE = {
     [DeliveryStatus.skipped]: "muted",
 };
 export function DeliveryStatusCell({ row }) {
+    const t = useTranslation();
     const status = typeof row["status"] === "string" ? row["status"] : "";
-    return (_jsx(StatusBadge, { tone: STATUS_TONE[status] ?? "muted", testId: "delivery-status-cell", children: status }));
+    const unconfirmed = status === DeliveryStatus.sent && row["confirmed"] === false;
+    const labelKey = unconfirmed ? "delivery.status.sentUnconfirmed" : `delivery.status.${status}`;
+    return (_jsx(StatusBadge, { tone: unconfirmed ? "muted" : (STATUS_TONE[status] ?? "muted"), testId: "delivery-status-cell", children: translateOrRaw(t, labelKey, status) }));
 }

package/dist/delivery/web/delivery-time-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryTimeCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-time-cell.js

@@ -0,0 +1,6 @@
+// @runtime client
+import { formatWhen } from "@cosmicdrift/kumiko-renderer";
+export function DeliveryTimeCell({ row }) {
+    const createdAt = row["createdAt"];
+    return typeof createdAt === "string" ? formatWhen(createdAt) : "";
+}

package/dist/delivery/web/delivery-type-cell.d.ts

@@ -0,0 +1,3 @@
+import { type ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
+export declare function DeliveryTypeCell({ row }: ColumnRendererProps): ReactNode;

package/dist/delivery/web/delivery-type-cell.js

@@ -0,0 +1,17 @@
+// @runtime client
+// Notification type column. Types are QNs like `<scope>:notify:<name>`; the
+// translation key is `<scope>.notification.<name>`, registered by the app that
+// owns the notification (bundled features register none). Falls back to the short
+// name, or to the raw value for any other format.
+import { useTranslation } from "@cosmicdrift/kumiko-renderer";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
+const NOTIFICATION_QN_PATTERN = /^([^:]+):notify:(.+)$/;
+export function DeliveryTypeCell({ row }) {
+    const t = useTranslation();
+    const type = typeof row["type"] === "string" ? row["type"] : "";
+    const match = NOTIFICATION_QN_PATTERN.exec(type);
+    if (!match)
+        return type;
+    const [, scope, name] = match;
+    return translateOrRaw(t, `${scope}.notification.${name}`, name ?? type);
+}

package/dist/legal-pages/constants.d.ts

@@ -4,6 +4,8 @@ export type LegalPageRoute = {
     readonly slug: string;
     readonly lang: string;
     readonly titleFallback: string;
+    /** Prepend the page title as `<h1>` to the rendered body. Default false. */
+    readonly titleHeading?: boolean;
 };
 export type LegalRequiredBlock = {
     readonly slug: string;

package/dist/legal-pages/feature.js

@@ -1,5 +1,6 @@
 import { computeRevisionEtag, etagMatches } from "@cosmicdrift/kumiko-framework/api";
 import { defineFeature, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { escapeHtml } from "@cosmicdrift/kumiko-headless";
 import { cachedSecurePageResponse, redirectToCanonicalPath, slashVariantOf, } from "../page-render/index.js";
 import { LEGAL_REQUIRED_BLOCKS, LEGAL_ROUTES, } from "./constants.js";
 import { runLegalPagesBootCheck } from "./lib/boot-check.js";
@@ -85,9 +86,13 @@ export function createLegalPagesFeature(opts = {}) {
                             extra,
                         });
                     }
+                    const title = data.title || route.titleFallback;
+                    const renderedBody = renderMarkdownToHtml(data.content);
                     const html = wrapLayout({
-                        title: data.title || route.titleFallback,
-                        bodyHtml: renderMarkdownToHtml(data.content),
+                        title,
+                        bodyHtml: route.titleHeading
+                            ? `<h1>${escapeHtml(title)}</h1>${renderedBody}`
+                            : renderedBody,
                         lang: route.lang,
                         slug: route.slug,
                     });

package/dist/renderer-simple/simple-renderer.js

@@ -1,4 +1,5 @@
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+import { renderSafeMarkdown } from "../page-render/index.js";
 const DEFAULT_PRIMARY_COLOR = "#2563eb";
 const HEX_COLOR_PATTERN = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
 function isHttpUrl(value) {
@@ -95,6 +96,13 @@ function renderSection(section, primaryColor) {
     if ("text" in section) {
         return `<p style="margin:0 0 16px;color:#333;font-size:14px;line-height:1.5">${escapeHtml(section.text)}</p>`;
     }
+    if ("heading" in section) {
+        return `<h2 style="margin:24px 0 12px;color:#111;font-size:16px;font-weight:600">${escapeHtml(section.heading)}</h2>`;
+    }
+    if ("markdown" in section) {
+        const markdownHtml = renderSafeMarkdown(section.markdown);
+        return `<div style="color:#333;font-size:14px;line-height:1.5">${markdownHtml}</div>`;
+    }
     if ("button" in section) {
         return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:${escapeHtmlAttr(primaryColor)};color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
     }

package/dist/secrets/constants.d.ts

@@ -1,3 +1,9 @@
 import type { AccessRule } from "@cosmicdrift/kumiko-framework/engine";
 export declare const DEFAULT_SECRETS_ROLES: readonly ["TenantAdmin"];
 export declare const DEFAULT_SECRETS_ACCESS: AccessRule;
+export declare const SECRETS_ERROR_KEYS: {
+    readonly unknownKey: "secrets.errors.unknownKey";
+    readonly writeDenied: "secrets.errors.writeDenied";
+    readonly invalidValue: "secrets.errors.invalidValue";
+};
+export declare const INVALID_SECRET_VALUE_CODE: "invalid_secret_value";

package/dist/secrets/constants.js

@@ -7,3 +7,11 @@
 // design, not a per-tenant RBAC surface.
 export const DEFAULT_SECRETS_ROLES = ["TenantAdmin"];
 export const DEFAULT_SECRETS_ACCESS = { roles: DEFAULT_SECRETS_ROLES };
+// Error i18n keys of the secrets write path. Shared by the write gate, the
+// bundled translations and callers that need to recognise a specific failure.
+export const SECRETS_ERROR_KEYS = {
+    unknownKey: "secrets.errors.unknownKey",
+    writeDenied: "secrets.errors.writeDenied",
+    invalidValue: "secrets.errors.invalidValue",
+};
+export const INVALID_SECRET_VALUE_CODE = "invalid_secret_value";

package/dist/secrets/feature.d.ts

@@ -13,6 +13,9 @@ import * as z from "zod";
  * `KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION` pins one explicitly.
  */
 export declare const SECRETS_FEATURE_NAME = "secrets";
+/** Env keys that carry the KEK keyring. Optional when the app supplies its own
+ *  `masterKey` provider. */
+export declare const SECRETS_MASTER_KEK_ENV_KEYS: readonly ["KUMIKO_SECRETS_MASTER_KEY_V1"];
 export declare const secretsEnvSchema: z.ZodObject<{
     KUMIKO_SECRETS_MASTER_KEY_V1: z.ZodString;
     KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: z.ZodDefault<z.ZodString>;

package/dist/secrets/feature.js

@@ -23,6 +23,9 @@ const ROTATE_ESCAPE_HATCH_REASON = "re-encrypts every tenant's secrets with the
  * `KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION` pins one explicitly.
  */
 export const SECRETS_FEATURE_NAME = "secrets";
+/** Env keys that carry the KEK keyring. Optional when the app supplies its own
+ *  `masterKey` provider. */
+export const SECRETS_MASTER_KEK_ENV_KEYS = ["KUMIKO_SECRETS_MASTER_KEY_V1"];
 export const secretsEnvSchema = z.object({
     KUMIKO_SECRETS_MASTER_KEY_V1: z
         .string()

package/dist/secrets/i18n.js

@@ -1,13 +1,14 @@
+import { SECRETS_ERROR_KEYS } from "./constants.js";
 export const SECRETS_I18N = {
-    "secrets.errors.unknownKey": {
+    [SECRETS_ERROR_KEYS.unknownKey]: {
         en: "Unknown secret key.",
         de: "Unbekannter Geheimnis-Schlüssel.",
     },
-    "secrets.errors.writeDenied": {
+    [SECRETS_ERROR_KEYS.writeDenied]: {
         en: "You are not allowed to change this secret.",
         de: "Dieses Geheimnis darf nicht geändert werden.",
     },
-    "secrets.errors.invalidValue": {
+    [SECRETS_ERROR_KEYS.invalidValue]: {
         en: "This value is not valid for this secret.",
         de: "Dieser Wert ist für dieses Geheimnis nicht gültig.",
     },

package/dist/secrets/index.d.ts

@@ -1,6 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES } from "./constants.js";
-export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
+export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, type SecretsContext, type SecretsContextOptions, type SecretsFeatureOptions, type StoredEnvelope, type StoredMetadata, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";
 export { type RotateJobPayload, type RotateJobResult, rotateJob, } from "./handlers/rotate.job.js";
 export { createSetHandler } from "./handlers/set.write.js";
+export { isInvalidSecretValueError } from "./write-gate.js";

package/dist/secrets/index.js

@@ -1,6 +1,7 @@
-export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES } from "./constants.js";
-export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
+export { DEFAULT_SECRETS_ACCESS, DEFAULT_SECRETS_ROLES, INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS, } from "./constants.js";
+export { createSecretsContext, createSecretsFeature, requireSecretsContext, SECRETS_FEATURE_NAME, SECRETS_MASTER_KEK_ENV_KEYS, secretsEnvSchema, TENANT_SECRET_READ_EVENT, tenantSecretsTable, } from "./feature.js";
 export { createDeleteHandler } from "./handlers/delete.write.js";
 export { createListHandler } from "./handlers/list.query.js";
 export { rotateJob, } from "./handlers/rotate.job.js";
 export { createSetHandler } from "./handlers/set.write.js";
+export { isInvalidSecretValueError } from "./write-gate.js";

package/dist/secrets/write-gate.d.ts

@@ -10,5 +10,6 @@ export type SecretKeyWriteCheck = {
 export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;
 export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
 export declare function invalidSecretValueError(): ValidationError;
+export declare function isInvalidSecretValueError(err: unknown): err is ValidationError;
 export declare function isSecretValueValid(schemas: SecretValueSchemaSource, key: string, value: string): boolean;
 export declare function checkSecretValue(registry: SecretValueSchemaSource, key: string, value: string): WriteFailure | undefined;

package/dist/secrets/write-gate.js

@@ -1,8 +1,9 @@
-import { AccessDeniedError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { AccessDeniedError, isKumikoError, NotFoundError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { INVALID_SECRET_VALUE_CODE, SECRETS_ERROR_KEYS } from "./constants.js";
 function unknownKeyFailure(key) {
     return {
         ok: false,
-        failure: writeFailure(new NotFoundError("secretKey", key, { i18nKey: "secrets.errors.unknownKey" })),
+        failure: writeFailure(new NotFoundError("secretKey", key, { i18nKey: SECRETS_ERROR_KEYS.unknownKey })),
     };
 }
 function namespaceAcceptsKey(namespace, key) {
@@ -27,7 +28,7 @@ export function checkSecretKeyWrite(registry, userRoles, key) {
             ok: false,
             failure: writeFailure(new AccessDeniedError({
                 message: "secret write access denied",
-                i18nKey: "secrets.errors.writeDenied",
+                i18nKey: SECRETS_ERROR_KEYS.writeDenied,
                 details: { requiredRoles: writeRoles },
             })),
         };
@@ -40,11 +41,18 @@ export function invalidSecretValueError() {
         fields: [
             {
                 path: "value",
-                code: "invalid_secret_value",
-                i18nKey: "secrets.errors.invalidValue",
+                code: INVALID_SECRET_VALUE_CODE,
+                i18nKey: SECRETS_ERROR_KEYS.invalidValue,
             },
         ],
-    }, { i18nKey: "secrets.errors.invalidValue" });
+    }, { i18nKey: SECRETS_ERROR_KEYS.invalidValue });
+}
+// Matches on the i18n key and error code rather than instanceof, which is fragile
+// when the error crosses a package boundary with a duplicated framework copy.
+export function isInvalidSecretValueError(err) {
+    return (isKumikoError(err) &&
+        err.code === "validation_error" &&
+        err.i18nKey === SECRETS_ERROR_KEYS.invalidValue);
 }
 export function isSecretValueValid(schemas, key, value) {
     const valueSchema = schemas.getSecretKey(key)?.valueSchema ?? schemas.findSecretNamespace(key)?.valueSchema;

package/dist/shared/index.d.ts

@@ -12,6 +12,7 @@ export { createLockoutCounter, type LockoutCounterState } from "./lockout-counte
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/index.js

@@ -12,6 +12,7 @@ export { createLockoutCounter } from "./lockout-counter.js";
 export { mapWithConcurrency } from "./map-with-concurrency.js";
 export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisible, } from "./parent-visibility.js";
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
+export { redactBotTokens, redactEmailAddresses, redactErrorText, redactUrls, } from "./redact.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
 export { sessionLocaleField } from "./session-locale-field.js";

package/dist/shared/redact.d.ts

@@ -0,0 +1,4 @@
+export declare function redactEmailAddresses(text: string): string;
+export declare function redactUrls(text: string): string;
+export declare function redactBotTokens(text: string): string;
+export declare function redactErrorText(text: string): string;

package/dist/shared/redact.js

@@ -0,0 +1,21 @@
+// Adapter errors usually quote the rejected recipient ("550 <ops@example.com> rejected"); the
+// address must not outlive the crypto-shredded dispatch payload in logs.
+export function redactEmailAddresses(text) {
+    return text.replace(/[^\s<>,;"']+@[^\s<>,;"']+/g, "[redacted-address]");
+}
+// Provider URLs carry secrets in the path (Slack hook, Telegram bot token), the query or
+// the userinfo. The origin stays so the log still says which host failed. Any scheme
+// counts: smtp://user:pass@host carries credentials just like https.
+export function redactUrls(text) {
+    return text.replace(/([a-z][a-z0-9+.-]*:\/\/)([^\s/?#<>"']*)([^\s<>"']*)/gi, (_match, scheme, authority, rest) => {
+        const host = authority.slice(authority.lastIndexOf("@") + 1);
+        return rest.length > 0 && rest !== "/" ? `${scheme}${host}/[redacted]` : `${scheme}${host}`;
+    });
+}
+// Telegram-style bot tokens outside a URL ("<digits>:<35 chars>"). Times like 12:30 are too short to match.
+export function redactBotTokens(text) {
+    return text.replace(/\b\d{6,}:[A-Za-z0-9_-]{30,}\b/g, "[redacted-token]");
+}
+export function redactErrorText(text) {
+    return redactBotTokens(redactEmailAddresses(redactUrls(text)));
+}

package/dist/step-dispatcher/feature.js

@@ -12,7 +12,8 @@ import { defineFeature, STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_FAILED_TYPE,
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import * as z from "zod";
-import { mailSpecSchema, performMailDispatch, redactEmailAddresses, } from "./mail-runner.js";
+import { redactEmailAddresses } from "../shared/index.js";
+import { mailSpecSchema, performMailDispatch } from "./mail-runner.js";
 import { performWebhookDispatch, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS, webhookSpecSchema, } from "./webhook-runner.js";
 const log = createFallbackLogger("step-dispatcher");
 export const stepDispatcherEnvSchema = z.object({

package/dist/step-dispatcher/mail-runner.d.ts

@@ -15,4 +15,3 @@ export type MailDispatchResult = {
 };
 export declare function setMailRunner(fn: (spec: MailSpec) => Promise<MailDispatchResult>): void;
 export declare function performMailDispatch(spec: MailSpec): Promise<MailDispatchResult>;
-export declare function redactEmailAddresses(text: string): string;

package/dist/step-dispatcher/mail-runner.js

@@ -19,8 +19,3 @@ export function setMailRunner(fn) {
 export async function performMailDispatch(spec) {
     return mailRunner(spec);
 }
-// Adapter errors usually quote the rejected recipient ("550 <ops@example.com> rejected"); the
-// address must not outlive the crypto-shredded dispatch payload in logs.
-export function redactEmailAddresses(text) {
-    return text.replace(/[^\s<>,;"']+@[^\s<>,;"']+/g, "[redacted-address]");
-}

package/dist/tenant/web/member-roles-cell.js

@@ -3,7 +3,7 @@
 // `readonly string[]` on TeamRow (see team-list.query.ts), and DataTable has
 // no default array-to-cell formatting, so this joins it into one string.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
-import { translateOrRaw } from "./translate-or-raw.js";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 export function MemberRolesCell({ row }) {
     const t = useTranslation();
     const roles = row["roles"];

package/dist/tenant/web/member-status-cell.js

@@ -6,7 +6,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // projectionList renderer — only this one cell stays TSX.
 import { useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge } from "@cosmicdrift/kumiko-renderer-web";
-import { translateOrRaw } from "./translate-or-raw.js";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 const STATUS_TONE = {
     active: "ok",
     pending: "muted",

package/dist/tenant-lifecycle/feature.js

@@ -4,7 +4,7 @@ import { DESTRUCTION_CANCELLED_EVENT_SHORT, DESTRUCTION_REQUESTED_EVENT_SHORT, T
 import { destructionCancelledSchema, destructionRequestedSchema, tenantDestructionCompletedSchema, tenantDestructionFailedSchema, tenantDestructionStageAbandonedSchema, tenantDestructionStageFailedSchema, tenantDestructionStageStartedSchema, tenantDestructionStageSucceededSchema, tenantDestructionStartedSchema, } from "./events.js";
 import { cancelDestructionWrite } from "./handlers/cancel-destruction.write.js";
 import { requestDestructionWrite } from "./handlers/request-destruction.write.js";
-import { resolveTenantLifecycleGate, runTenantDestructionSweep } from "./run-tenant-destroy.js";
+import { hasTenantDestructionWork, resolveTenantLifecycleGate, runTenantDestructionSweep, } from "./run-tenant-destroy.js";
 const tenantLifecycleStatusPlugin = {
     async resolveStatus(tenantId, { db }) {
         const gate = await resolveTenantLifecycleGate(db, tenantId);
@@ -73,10 +73,16 @@ export function createTenantLifecycleFeature() {
                     throw new Error("run-tenant-destruction: ctx.registry required (JobContext incomplete)");
                 }
                 const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
+                const now = T.Now.instant();
+                // Without crossTenantReads (undeclared hatch) fall through to the sweep.
+                if (ctx.crossTenantReads && !(await hasTenantDestructionWork(ctx.crossTenantReads, now))) {
+                    // skip: no tenant is due, so the sweep would not touch anything
+                    return;
+                }
                 await runTenantDestructionSweep({
                     db: ctx.db.unsafeRaw(), // @cast-boundary db-operator — jobs never run inside a DbTx
                     registry: ctx.registry,
-                    now: T.Now.instant(),
+                    now,
                     log: (message) => ctx.log?.warn(message),
                     fileProviderResolver: ctx._fileProviderResolver,
                     escapeHatchAuditSink: ctx._escapeHatchAuditSink,

package/dist/tenant-lifecycle/run-tenant-destroy.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type EscapeHatchAuditSink, type Registry, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 export declare function runNextDestructionStage(args: {
@@ -15,6 +15,7 @@ export declare function runNextDestructionStage(args: {
     readonly error?: string;
     readonly halted?: boolean;
 }>;
+export declare function hasTenantDestructionWork(reads: Pick<TenantDb, "count">, now: Temporal.Instant): Promise<boolean>;
 /** Cron entry: start destruction for tenants past grace, then advance stages. */
 export declare function runTenantDestructionSweep(args: {
     readonly db: DbRunner;