@cosmicdrift/kumiko-bundled-features 0.342.0 → 0.344.0

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -167,14 +167,25 @@ export async function runNextDestructionStage(args) {
         return { done: false, error: message };
     }
 }
+function destroyRequestedDueWhere(now) {
+    return {
+        status: "destroyRequested",
+        gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
+    };
+}
+const destroyingWhere = { status: "destroying" };
+export async function hasTenantDestructionWork(reads, now) {
+    const [due, destroying] = await Promise.all([
+        reads.count(tenantTable, destroyRequestedDueWhere(now)),
+        reads.count(tenantTable, destroyingWhere),
+    ]);
+    return due > 0 || destroying > 0;
+}
 /** Cron entry: start destruction for tenants past grace, then advance stages. */
 export async function runTenantDestructionSweep(args) {
     const T = getTemporal();
     const now = args.now ?? T.Now.instant();
-    const due = await selectMany(args.db, tenantTable, {
-        status: "destroyRequested",
-        gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
-    });
+    const due = await selectMany(args.db, tenantTable, destroyRequestedDueWhere(now));
     let triggered = 0;
     for (const row of due) {
         const tenantId = row.id;
@@ -195,9 +206,7 @@ export async function runTenantDestructionSweep(args) {
         triggered++;
     }
     let advanced = 0;
-    const destroying = await selectMany(args.db, tenantTable, {
-        status: "destroying",
-    });
+    const destroying = await selectMany(args.db, tenantTable, destroyingWhere);
     for (const row of destroying) {
         try {
             const result = await runNextDestructionStage({

package/dist/user/index.d.ts

@@ -3,5 +3,6 @@ export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants
 export { backfillUserStreamTenants, type UserStreamBackfillResult, } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
 export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export type { UserStatus } from "./schema/user.js";
 export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/index.js

@@ -3,4 +3,5 @@ export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants
 export { backfillUserStreamTenants, } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
 export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";

package/dist/user/resolve-display-names.d.ts

@@ -0,0 +1,2 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+export declare function resolveUserDisplayNames(db: TenantDb, userIds: readonly string[]): Promise<ReadonlyMap<string, string>>;

package/dist/user/resolve-display-names.js

@@ -0,0 +1,24 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
+import { userTable } from "./schema/user.js";
+// Shares the KMS adapter's small dedicated pool, same as member-directory.
+const KMS_POOL_CONCURRENCY = 4;
+// One batched lookup for a page of user ids. Users that are missing, have no
+// display name, or whose name cannot be decrypted (e.g. crypto-shredded) are
+// left out, so callers fall back to the raw id instead of failing the page.
+export async function resolveUserDisplayNames(db, userIds) {
+    const names = new Map();
+    if (userIds.length === 0)
+        return names;
+    const users = await selectMany(db, userTable, { id: [...userIds] });
+    const named = users.filter((user) => typeof user.displayName === "string");
+    await mapWithConcurrency(named, KMS_POOL_CONCURRENCY, async (user) => {
+        try {
+            names.set(String(user.id), await decryptStoredPii(String(user.displayName), "displayName", "user:resolve-display-names"));
+        }
+        catch {
+            // Unreadable name: the caller's fallback applies.
+        }
+    });
+    return names;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.342.0",
+  "version": "0.344.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -503,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.342.0",
-    "@cosmicdrift/kumiko-framework": "0.342.0",
-    "@cosmicdrift/kumiko-headless": "0.342.0",
-    "@cosmicdrift/kumiko-renderer": "0.342.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.342.0",
-    "@cosmicdrift/kumiko-types": "0.342.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.344.0",
+    "@cosmicdrift/kumiko-framework": "0.344.0",
+    "@cosmicdrift/kumiko-headless": "0.344.0",
+    "@cosmicdrift/kumiko-renderer": "0.344.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.344.0",
+    "@cosmicdrift/kumiko-types": "0.344.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1025,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.342.0",
-    "@cosmicdrift/kumiko-locale-es": "0.342.0",
+    "@cosmicdrift/kumiko-locale-de": "0.344.0",
+    "@cosmicdrift/kumiko-locale-es": "0.344.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "escape-hatch retention follows the tenant compliance profile",
+    "detail": "The audit job `escape-hatch-retention` now deletes `escapeHatchUse` events after the `auditLog.retention` of the tenant's compliance profile. A tenant override can only lengthen that period, never go below the base retention of the selected profile. Cross-tenant audits (with `targetTenantId`, e.g. `identity-switch`) additionally follow the profile of the target tenant. The config key `audit:config:escape-hatch-retention-days` is only the fallback when compliance-profiles is not mounted.\n`pruneEvents` gains the optional `aggregateIds` option to restrict the prune to specific aggregates. `@cosmicdrift/kumiko-framework/compliance` exports `subtractRetentionSpec` and the `RetentionSpec` type for calendar-aware cutoffs (months and years)."
+  },
   {
     "version": "0.313.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Mail expiry shows duration and local time with time zone",
+    "detail": "Auth mails state the link validity as a duration and in the user's time zone\nThe five token mail renderers replace the UTC timestamp with `{duration}` (for example \"1 day\") and `{when}` (medium date and short time with zone abbreviation, in the recipient's locale). `RenderTokenContentArgs` gains `issuedAt` (default now) and `timeZone` (default UTC; an invalid zone falls back to UTC); the handlers pass the token issue time and `ctx.tz.user`. German strings use \"Konto\" instead of \"Account\".",
+    "migration": "Custom `auth.mail.*.expiry` translations should use the new `{duration}` and `{when}` placeholders; `{when}` now includes the time and zone abbreviation instead of a UTC timestamp."
+  },
   {
     "version": "0.342.0",
     "type": "improvement",

package/src/billing-foundation/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.344.0",
+    "type": "breaking",
+    "title": "Consumer-protection gaps - per-locale legal links, gate order, confirmation mail, exports",
+    "detail": "All changes below apply only when `createBillingFoundationFeature` gets `consumerProtection`. Apps without it behave as before.\n`ConsumerProtectionOptions.legalLinks` takes either one `LegalLinkSet` or one set per consent locale (`{ de, en }`, both required). `BillingPlansResult.consumerProtection.legalLinks` is now always `Record<\"de\" | \"en\", LegalLinkSet>`; a single set is returned for both locales. Code that reads `legalLinks.terms` from the billing-plans result must read `legalLinks[locale].terms`. `CheckoutConsentDialog` picks the set for the consent locale.\n`FALLBACK_CONSENT_LOCALE` is now `\"en\"` (was `\"de\"`). A locale other than de/en, or none, resolves to English in `resolveConsentLocale`, the consent gate, the confirmation mail's VAT note and the termination record.\n`create-checkout-session` with consumer protection now checks in this order: provider, billing enabled, redirect origins, price and subscription gates, then the live price (new `UnprocessableError` `price_unavailable` when the provider cannot return it), then the consent, then the provider call. A missing consent no longer hides a disabled provider, an existing subscription or an unknown price. Its payload schema is strict, so unknown fields are rejected. `assertCheckoutAllowed` and `startProviderCheckout` split `openCheckout` in checkout-core.\nNew option `ConsumerProtectionOptions.oneOffItemLabel(ctx, priceId)`: the server resolves the label of a one-off item (for example a credit pack). It is stored on the consent event as `itemLabelKey` / `itemLabelParams` and shown in the confirmation mail as \"Leistung\" / \"Item\". The client cannot set it.\nThe terms text block is read from the system tenant, not from the buyer's tenant, in the consent gate and the confirmation mail. A tenant-owned block with the same slug no longer changes `termsHash` or the mailed text.\nThe confirmation mail shows dates in the recipient's time zone (user zone, else tenant zone, else UTC) with the zone name, renders the terms as Markdown with real headings and shows the translated plan name (`catalog.tierLabelKey`, looked up through the registry i18n, so the key must be qualified with the registering feature; untranslated keys fall back to the raw tier). Its opening sentence starts with a capital letter.\nNew exports: `consentPayloadSchema`, `ConsentPayload`, `OrderItem`, `CONSENT_LOCALES`, `ConsentLocale`, `resolveConsentLocale`, `LegalLinkSet`. The `/web` entry adds `CheckoutConsentDialog`, `CheckoutConsentDialogProps`, `CheckoutConsentPayload`, `CONSENT_TEXT_OUTDATED_CODE`, `resolveConsentLocale`, `ConsentLocale` and `LegalLinkSet`. `CheckoutConsentDialog` `price.count` is optional, and the \"cancel at any time\" note only shows for a recurring price (`price.renewalKey` set).\nThe checkout and cancel dialogs no longer repeat the modal title as a heading, and the cancel-contract button is hidden once a cancellation is scheduled.",
+    "migration": "Only apps that pass consumerProtection are affected. BillingPlansResult.consumerProtection.legalLinks is now keyed by locale (legalLinks.de / legalLinks.en). FALLBACK_CONSENT_LOCALE changed from de to en. create-checkout-session rejects unknown payload fields when consumer protection is on."
+  },
   {
     "version": "0.341.0",
     "type": "improvement",

package/src/channel-teams/changes.json

@@ -0,0 +1,8 @@
+[
+  {
+    "version": "0.343.0",
+    "type": "fix",
+    "title": "Teams no longer reports any 2xx as delivered",
+    "detail": "`channel-teams` no longer reports every 2xx answer as sent. A 200 with the body `1` (classic Office connector) is a confirmed send. A 202 (Power Automate / Workflows endpoints) means the message was accepted but not confirmed: the attempt is `sent` and `NotifyResult.deliveries[].confirmed` is `false`. Any other 2xx, including an empty 200 as a made-up URL returns, fails with `unexpected_response`.\n`NotifyDelivery.confirmed` and `ChannelResult.confirmed` are new and only ever `false`. `createChatWebhookChannel` takes an optional `classifyResponse`, which `postChatWebhook` calls for 2xx answers with a status and a lazy `readBodyPrefix()` (at most 64 bytes; the body is always cancelled afterwards). `ChatSendResult` success now carries `confirmed`. `confirmed` is returned for inline delivery only; jobs do not carry it yet."
+  }
+]

package/src/delivery/changes.json

@@ -1,4 +1,36 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Delivery log marks sends the provider did not confirm",
+    "detail": "The delivery log now records when a provider accepted a send without confirming delivery (for example a Teams webhook answering 202). `store_delivery_attempts` gets a nullable boolean column `confirmed`: `false` means accepted but unconfirmed, `null` means confirmed or not applicable. The `deliveryAttempt` event carries `confirmed: false` on both the inline and the job path, `delivery:query:log` returns `confirmed` per row, and the status cell shows \"Sent (unconfirmed)\" for such rows.",
+    "migration": "New nullable column store_delivery_attempts.confirmed. Consumers generate the migration with the generator (kumiko-schema generate) and apply it; existing rows stay null."
+  },
+  {
+    "version": "0.343.0",
+    "type": "breaking",
+    "title": "Delivery errors are fixed codes instead of raw messages",
+    "detail": "Delivery stores and returns only fixed error codes, never raw error messages. `delivery_attempts.error`, the `deliveryAttempt` event, `NotifyResult.deliveries[].error` and the job failure now hold one of `DELIVERY_FAILURE_CODES` (`timeout`, `network_error`, `redirect_blocked`, `host_not_allowed`, `missing_credentials`, `invalid_address`, `unexpected_response`, `render_failed`, `send_failed`, `channel_error`), one of `DELIVERY_SKIP_REASONS`, or `http_<status>`. A throwing channel ends as `send_failed` or `render_failed`; a failure around resolve or dispatch ends as `channel_error`. The full error goes to the log with URLs and email addresses redacted. `redactUrls` and `redactErrorText` are new next to `redactEmailAddresses`, which moved out of the step dispatcher.\n`@cosmicdrift/kumiko-framework/engine` exports `DELIVERY_FAILURE_CODES`, `DELIVERY_SKIP_REASONS`, `isDeliveryErrorCode` and the types `DeliveryErrorCode`, `DeliveryFailureCode`, `DeliverySkipReason` and `ChatSendFailureCode`. `NotifyDelivery.error`, `ChannelResult.error` and `DeliveryLogEntry.error` are now `DeliveryErrorCode`. `delivery:query:log` returns `channel_error` for stored rows that still hold free text.",
+    "migration": "NotifyDelivery.error is now a DeliveryErrorCode. Code that matches on error text must match the code instead (for example send_failed). Custom channels must return a DeliveryErrorCode in ChannelResult.error. Existing attempt events keep their free text; reading them through delivery:query:log masks it as channel_error."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Delivery log shows time and error and translates its values",
+    "detail": "The delivery log screen shows the time and the error of each attempt and translates type, channel, status and error. Error codes map to `delivery.error.<code>` (`http_<status>` to `delivery.error.http` with a `status` parameter), statuses to `delivery.status.<status>`, channels to `delivery.channel.<name>`. Every bundled channel feature registers its own channel label. Notification types are shown through `<scope>.notification.<name>` for a type `<scope>:notify:<name>`; apps register those labels, and the short name is shown when none exists. English, German and Spanish texts are included for the bundled keys.\n`translateOrRaw` moved from the tenant web folder to `shared/web`; it is internal."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Delivery log shows the recipient name",
+    "detail": "`delivery:query:log` returns a `recipientLabel` per row and the delivery log screen shows it in the recipient column: the user's display name, else the decrypted address, else the recipient id. Names are resolved with one batched lookup per page, and only when the user feature is mounted. The new `resolveUserDisplayNames(db, userIds)` is exported from the user feature. The recipient column is not sortable."
+  },
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "createDeliveryTestContext matches production notify",
+    "detail": "`createDeliveryTestContext` now behaves like the production `ctx.notify`. It takes a `secrets` option for inline-delivered chat channels and passes the calling context's job dispatcher to `notify()` on every call. Queued channels now go through the delivery jobs when the stack has a job consumer (`jobs: { consumerLane: \"worker\" }`); call `stack.drainJobs()` before asserting on the result. With `jobs: {}` and no `consumerLane` the attempts stay queued and `drainJobs()` never finishes. Without `jobs` they still deliver inline.\nNew export `createDeliveryNotifyFactory(deliveryService, { deliverQueuedInline? })` builds this `NotifyFactory` for custom setups."
+  },
   {
     "version": "0.341.0",
     "type": "breaking",

package/src/jobs/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "ctx.crossTenantReads for read-only cross-tenant job reads",
+    "detail": "Jobs whose `escapeHatch` grants `unsafeRaw` get `ctx.crossTenantReads` with `selectMany`, `fetchOne` and `count` across all tenants, read-only. Each call is reported as the new escape-hatch kind `cross-tenant-read`; system crons audit it once per process and the metric `kumiko_escape_hatch_uses_total` counts every call. `EscapeHatchKind` and the `escape-hatch-used` audit schema gain `cross-tenant-read`.\n`tenant-lifecycle:job:run-tenant-destruction` checks through `ctx.crossTenantReads` whether a tenant is due and only then calls `ctx.db.unsafeRaw()`, so idle minutes no longer write an `unsafe-raw` audit event."
+  },
   {
     "version": "0.336.0",
     "type": "improvement",

package/src/legal-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.344.0",
+    "type": "improvement",
+    "title": "Optional title heading on legal pages",
+    "detail": "`LegalPageRoute` has an optional `titleHeading` flag. When `true`, the page body starts with an `<h1>` holding the escaped page title. The default (`false`) leaves the body unchanged."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.344.0",
+    "type": "improvement",
+    "title": "Heading and Markdown sections in the simple mail renderer",
+    "detail": "`createSimpleRenderer` accepts two more section kinds: `{ heading: string }` (rendered as an escaped `<h2>`) and `{ markdown: string }` (rendered with the hardened Markdown renderer; raw HTML is escaped and unsafe link targets are replaced by `#`). Existing section kinds render as before."
+  },
   {
     "version": "0.341.0",
     "type": "improvement",

package/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.343.0",
+    "type": "improvement",
+    "title": "Recognise the invalid-secret-value error",
+    "detail": "`secrets` exports `isInvalidSecretValueError`, which recognises the validation error that `secrets:write:set` and `ctx.secrets.set` raise when a value fails the key's `valueSchema`. It also exports `SECRETS_ERROR_KEYS` (the i18n keys of the secrets write errors) and `INVALID_SECRET_VALUE_CODE` (the field error code), so callers can map the failure to their own message instead of matching strings."
+  },
   {
     "version": "0.341.0",
     "type": "improvement",