@cosmicdrift/kumiko-bundled-features 0.344.0 → 0.345.0

package/dist/audit/run-escape-hatch-retention.js

@@ -1,4 +1,4 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { aggregateWhere, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { COMPLIANCE_PROFILES, subtractRetentionSpec, } from "@cosmicdrift/kumiko-framework/compliance";
 import { parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -38,10 +38,14 @@ function targetTenantOf(payload) {
     const parsed = escapeHatchUsedSchema.safeParse(payload);
     return parsed.success ? parseTenantId(parsed.data.targetTenantId) : null;
 }
-async function pruneByTenantProfiles(db) {
-    const rows = await selectMany(db, eventsTable, {
-        aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE,
+async function storingTenantIds(db) {
+    const groups = await aggregateWhere(db, eventsTable, { measure: { fn: "count" }, groupBy: [{ field: "tenantId" }] }, { aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE });
+    return groups.flatMap((group) => {
+        const tenantId = parseTenantId(group.keys[0]);
+        return tenantId ? [tenantId] : [];
     });
+}
+async function pruneByTenantProfiles(db) {
     const now = getTemporal().Now.instant();
     const cutoffByTenant = new Map();
     const cutoffOf = async (tenantId) => {
@@ -52,15 +56,24 @@ async function pruneByTenantProfiles(db) {
         cutoffByTenant.set(tenantId, cutoff);
         return cutoff;
     };
+    // The effective cutoff is never later than the storing tenant's, so only rows older than
+    // that one can expire; everything younger stays in the database.
     const expiredAggregateIds = [];
-    for (const row of rows) {
-        const targetTenantId = targetTenantOf(row.payload);
-        const storeCutoff = await cutoffOf(row.tenantId);
-        const cutoff = targetTenantId
-            ? earlierInstant(storeCutoff, await cutoffOf(targetTenantId))
-            : storeCutoff;
-        if (Temporal.Instant.compare(row.createdAt, cutoff) < 0) {
-            expiredAggregateIds.push(row.aggregateId);
+    for (const storingTenantId of await storingTenantIds(db)) {
+        const storeCutoff = await cutoffOf(storingTenantId);
+        const candidates = await selectMany(db, eventsTable, {
+            aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE,
+            tenantId: storingTenantId,
+            createdAt: { lt: storeCutoff },
+        });
+        for (const row of candidates) {
+            const targetTenantId = targetTenantOf(row.payload);
+            const cutoff = targetTenantId
+                ? earlierInstant(storeCutoff, await cutoffOf(targetTenantId))
+                : storeCutoff;
+            if (Temporal.Instant.compare(row.createdAt, cutoff) < 0) {
+                expiredAggregateIds.push(row.aggregateId);
+            }
         }
     }
     let deletedCount = 0;

package/dist/auth-email-password/constants.d.ts

@@ -17,6 +17,7 @@ export declare const AuthHandlers: {
     readonly inviteAccept: "auth-email-password:write:invite-accept";
     readonly inviteAcceptWithLogin: "auth-email-password:write:invite-accept-with-login";
     readonly inviteSignupComplete: "auth-email-password:write:invite-signup-complete";
+    readonly switchTenantMfaGate: "auth-email-password:write:switch-tenant-mfa-gate";
     readonly inviteCancel: "auth-email-password:write:invite-cancel";
 };
 export declare const AuthQueries: {

package/dist/auth-email-password/constants.js

@@ -44,6 +44,7 @@ export const AuthHandlers = {
     inviteAccept: "auth-email-password:write:invite-accept",
     inviteAcceptWithLogin: "auth-email-password:write:invite-accept-with-login",
     inviteSignupComplete: "auth-email-password:write:invite-signup-complete",
+    switchTenantMfaGate: "auth-email-password:write:switch-tenant-mfa-gate",
     inviteCancel: "auth-email-password:write:invite-cancel",
 };
 // Qualified query names. Anonymous-readable status so the (unauthenticated)

package/dist/auth-email-password/feature.js

@@ -17,6 +17,7 @@ import { createResetPasswordHandler } from "./handlers/reset-password.write.js";
 import { selfRegistrationStatusQuery } from "./handlers/self-registration-status.query.js";
 import { createSignupConfirmHandler } from "./handlers/signup-confirm.write.js";
 import { createSignupRequestHandler, } from "./handlers/signup-request.write.js";
+import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
 /**
  * Env-vars contract for the `auth-email-password` feature.
@@ -101,6 +102,9 @@ export function createAuthEmailPasswordFeature(opts = {}) {
             changePassword: r.writeHandler(changePasswordWrite),
             logout: r.writeHandler(logoutWrite),
         };
+        if (opts.mfaStatusChecker) {
+            r.writeHandler(createSwitchTenantMfaGateHandler({ mfaStatusChecker: opts.mfaStatusChecker }));
+        }
         if (opts.passwordReset) {
             r.writeHandler(createRequestPasswordResetHandler(opts.passwordReset));
             r.writeHandler(createResetPasswordHandler(opts.passwordReset));
@@ -119,7 +123,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
         };
         if (opts.signup) {
             r.writeHandler(createSignupRequestHandler(opts.signup));
-            r.writeHandler(createSignupConfirmHandler());
+            r.writeHandler(createSignupConfirmHandler({ mfaStatusChecker: opts.mfaStatusChecker }));
         }
         if (opts.invite) {
             r.writeHandler(createInviteCreateHandler(opts.invite));
@@ -132,7 +136,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
                 accountLockout: opts.accountLockout,
                 strictEmailVerification: strictVerification,
             }));
-            r.writeHandler(createInviteSignupCompleteHandler());
+            r.writeHandler(createInviteSignupCompleteHandler({ mfaStatusChecker: opts.mfaStatusChecker }));
         }
         if (opts.accountUnlock) {
             r.writeHandler(createRequestAccountUnlockHandler(opts.accountUnlock));

package/dist/auth-email-password/handlers/invite-signup-complete.write.d.ts

@@ -1,12 +1,16 @@
 import { type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { type LoginHandlerOptions, type LoginResult } from "./login.write.js";
 export type InviteSignupCompleteData = {
     readonly kind: "auth-session";
     readonly session: SessionUser;
     readonly tenantId: TenantId;
     readonly role: string;
-};
-export declare function createInviteSignupCompleteHandler(): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-signup-complete", z.ZodObject<{
+} | Exclude<LoginResult, {
+    readonly kind: "auth-session";
+}>;
+export type InviteSignupCompleteOptions = Pick<LoginHandlerOptions, "mfaStatusChecker">;
+export declare function createInviteSignupCompleteHandler(opts?: InviteSignupCompleteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-signup-complete", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
 }, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/auth-email-password/handlers/invite-signup-complete.write.js

@@ -37,13 +37,14 @@ import { burnInviteToken, deleteInviteToken, getInvitationIdForToken, unburnInvi
 import { passwordSchema } from "../password-policy.js";
 // kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
 import { seedUserWithPassword } from "../seeding.js";
+import { gateEnforceMfa } from "./login.write.js";
 const InviteSignupCompleteSchema = z.object({
     token: z.string().min(1),
     password: passwordSchema,
 });
 const invitationExecutor = createEventStoreExecutor(tenantInvitationsTable, tenantInvitationEntity, { entityName: "tenant-invitation" });
 const INVITE_SIGNUP_COMPLETE_ESCAPE_HATCH_REASON = "reads the pending invitation by id; the invitee is not yet a member of the invitation's tenant. Creates the user and adds the membership and accepts the invitation in the invitation's tenant, before any caller tenant context exists.";
-export function createInviteSignupCompleteHandler() {
+export function createInviteSignupCompleteHandler(opts = {}) {
     return defineWriteHandler({
         name: "invite-signup-complete",
         schema: InviteSignupCompleteSchema,
@@ -119,13 +120,22 @@ export function createInviteSignupCompleteHandler() {
                 }, createSystemUser(invitationTenantId), invitationTdb);
                 if (!updateResult.isSuccess)
                     return updateResult;
+                // buildSessionRoles calls stripForbiddenMembershipRoles internally —
+                // a reserved role on the invitation itself must never reach the session.
+                const mergedRoles = buildSessionRoles(invitationGlobalRoles, [invitationRole]);
+                // Same gate as invite-accept-with-login: the account exists after this
+                // call, but an MFA-gated role gets the MFA step instead of a session.
+                // It runs before the token is deleted so a throwing check leaves the link retryable.
+                const mfaGate = await gateEnforceMfa(ctx, { mfaStatusChecker: opts.mfaStatusChecker }, userId, invitationTenantId, mergedRoles);
                 await deleteInviteToken(ctx.redis, { invitationId, token: event.payload.token });
+                if (mfaGate !== undefined) {
+                    committed = true;
+                    return { isSuccess: true, data: mfaGate };
+                }
                 const session = {
                     id: userId,
                     tenantId: invitationTenantId,
-                    // buildSessionRoles calls stripForbiddenMembershipRoles internally —
-                    // a reserved role on the invitation itself must never reach the session.
-                    roles: buildSessionRoles(invitationGlobalRoles, [invitationRole]),
+                    roles: mergedRoles,
                 };
                 committed = true;
                 return {

package/dist/auth-email-password/handlers/signup-confirm.write.d.ts

@@ -1,5 +1,6 @@
 import { type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { type LoginHandlerOptions, type LoginResult } from "./login.write.js";
 export type SignupConfirmData = {
     readonly kind: "auth-session";
     readonly session: SessionUser;
@@ -8,8 +9,11 @@ export type SignupConfirmData = {
         readonly entityType: string;
         readonly id: string;
     };
-};
-export declare function createSignupConfirmHandler(): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"signup-confirm", z.ZodObject<{
+} | Exclude<LoginResult, {
+    readonly kind: "auth-session";
+}>;
+export type SignupConfirmOptions = Pick<LoginHandlerOptions, "mfaStatusChecker">;
+export declare function createSignupConfirmHandler(opts?: SignupConfirmOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"signup-confirm", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
 }, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/auth-email-password/handlers/signup-confirm.write.js

@@ -32,6 +32,7 @@ import { passwordSchema } from "../password-policy.js";
 // kumiko-lint-ignore cross-feature-import provisioning needs cross-feature seeding helpers
 import { INITIAL_SIGNUP_ROLES, provisionSignupAccount } from "../seeding.js";
 import { burnSignupToken, deleteSignupHandover, deleteSignupToken, getEmailForSignupToken, getSignupHandover, unburnSignupToken, } from "../signup-token-store.js";
+import { gateEnforceMfa } from "./login.write.js";
 const SignupConfirmSchema = z.object({
     token: z.string().min(8),
     password: passwordSchema,
@@ -70,7 +71,7 @@ async function claimBoundHandover(ctx, session, binding) {
     });
     return undefined;
 }
-export function createSignupConfirmHandler() {
+export function createSignupConfirmHandler(opts = {}) {
     return defineWriteHandler({
         name: "signup-confirm",
         schema: SignupConfirmSchema,
@@ -158,11 +159,17 @@ export function createSignupConfirmHandler() {
                 const handover = handoverBinding
                     ? await claimBoundHandover(ctx, session, handoverBinding)
                     : undefined;
+                // Before the token keys go: a throwing MFA check must leave the link retryable.
+                const mfaGate = await gateEnforceMfa(ctx, { mfaStatusChecker: opts.mfaStatusChecker }, provisioned.userId, provisioned.tenantId, session.roles);
                 // Drop both token lookup keys; the burn key stays for its remaining
                 // TTL as replay protection.
                 await deleteSignupToken(ctx.redis, { email, token: event.payload.token });
                 if (handoverBinding)
                     await deleteSignupHandover(ctx.redis, event.payload.token);
+                if (mfaGate !== undefined) {
+                    committed = true;
+                    return { isSuccess: true, data: mfaGate };
+                }
                 committed = true;
                 return {
                     isSuccess: true,

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -0,0 +1,9 @@
+import * as z from "zod";
+import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.js";
+export type SwitchTenantMfaGateData = {
+    readonly kind: "mfa-gate-clear";
+} | NonNullable<Awaited<ReturnType<typeof gateEnforceMfa>>>;
+export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
+    userId: z.ZodString;
+    tenantId: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.js

@@ -0,0 +1,39 @@
+import { buildSessionRoles, createSystemUser, defineWriteHandler, SYSTEM_ROLE, } from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import * as z from "zod";
+import { UserQueries } from "../../user/index.js";
+import { parseAuthUserRow } from "../auth-user-row.js";
+import { noMembership } from "../errors.js";
+import { gateEnforceMfa } from "./login.write.js";
+const SwitchTenantMfaGateSchema = z.object({
+    userId: z.string().min(1),
+    tenantId: z
+        .string()
+        .min(1)
+        .transform((id) => id),
+});
+// Dispatched by POST /auth/switch-tenant with the system identity. The handler
+// resolves membership and roles itself, so the gate never trusts caller-supplied
+// roles; system-only access keeps it out of reach of /api/write callers.
+export function createSwitchTenantMfaGateHandler(opts) {
+    return defineWriteHandler({
+        name: "switch-tenant-mfa-gate",
+        schema: SwitchTenantMfaGateSchema,
+        access: { roles: [SYSTEM_ROLE] },
+        escapeHatch: {
+            reason: "reads the MFA enrollment of the switch target tenant, not the caller's current tenant, via the mfaStatusChecker callback (it uses ctx.db.unsafeRaw())",
+        },
+        agent: { expose: false },
+        description: "Runs the MFA gate of the login for a tenant switch and answers with an MFA challenge, a setup requirement, or clearance.",
+        handler: async (event, ctx) => {
+            const { userId, tenantId } = event.payload;
+            const active = await ctx.resolveActiveMembership(userId, tenantId);
+            if (active.kind === "rejected")
+                return noMembership();
+            const userRow = parseAuthUserRow(await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, { id: userId }));
+            const roles = buildSessionRoles(parseRoles(userRow?.roles ?? null), active.membership.roles);
+            const mfaGate = await gateEnforceMfa(ctx, opts, userId, tenantId, roles);
+            return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear" } };
+        },
+    });
+}

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -13,6 +13,7 @@
 // spec rather than duplicated across two near-identical handler bodies.
 import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.js";
 import { parseAuthUserRow } from "../auth-user-row.js";
@@ -20,6 +21,11 @@ import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-m
 const RequestTokenSchema = z.object({
     email: z.email(),
 });
+// The requester is anonymous, so ctx.tz.user is only the tenant default; the recipient's
+// own profile zone is the one the expiry should be read in.
+function recipientTimeZone(user, fallbackTimeZone) {
+    return user.timezone && isValidIanaTimeZone(user.timezone) ? user.timezone : fallbackTimeZone;
+}
 export function createTokenRequestHandler(spec, opts) {
     const ttl = opts.tokenTtlMinutes ?? spec.defaultTtlMinutes;
     return defineWriteHandler({
@@ -69,7 +75,7 @@ export function createTokenRequestHandler(spec, opts) {
                 token,
                 expiresAt: expiresAt.toString(),
                 issuedAt,
-                timeZone: ctx.tz.user,
+                timeZone: recipientTimeZone(user, ctx.tz.user),
                 ...(opts.appName !== undefined && { appName: opts.appName }),
                 locale,
             });

package/dist/auth-email-password/i18n.js

@@ -99,6 +99,7 @@ export const defaultTranslations = {
         "auth.signupComplete.submit": "Activate account",
         "auth.signupComplete.submitting": "…",
         "auth.signupComplete.missingToken": "Activation link is missing a token. Please request a new one.",
+        "auth.signupComplete.activatedMfaPending": "Your account is active. Sign in to set up two-factor authentication.",
         "auth.signupComplete.activatedTitle": "Account activated",
         "auth.signupComplete.activated": "Your account is active and you're signed in.",
         "auth.signupComplete.continue": "Continue",

package/dist/auth-email-password/web/auth-client.d.ts

@@ -112,9 +112,14 @@ export type SignupConfirmSuccess = {
     };
     readonly landingPath?: string;
 };
+export type SignupConfirmResult = ({
+    readonly kind: "signed-in";
+} & SignupConfirmSuccess) | {
+    readonly kind: "mfa-pending";
+};
 export declare function confirmSignup(token: string, password: string): Promise<{
     ok: true;
-    data: SignupConfirmSuccess;
+    data: SignupConfirmResult;
 } | {
     ok: false;
     error: AuthTokenFailure;

package/dist/auth-email-password/web/auth-client.js

@@ -229,8 +229,12 @@ export async function confirmSignup(token, password) {
         body: JSON.stringify({ token, password }),
     });
     if (res.ok) {
-        const body = (await res.json()); // @cast-boundary engine-payload
-        return { ok: true, data: body };
+        // @cast-boundary engine-payload
+        const body = (await res.json());
+        if (body.mfaRequired === true || body.mfaSetupRequired === true) {
+            return { ok: true, data: { kind: "mfa-pending" } };
+        }
+        return { ok: true, data: { kind: "signed-in", ...body } };
     }
     return { ok: false, error: await parseTokenFailure(res) };
 }

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -31,6 +31,7 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
     const [submitting, setSubmitting] = useState(false);
     const [error, setError] = useState(null);
     const [continueHref, setContinueHref] = useState(null);
+    const [mfaPending, setMfaPending] = useState(false);
     const doSubmit = async () => {
         setError(null);
         const issue = passwordPairIssue(password, confirmPassword);
@@ -46,6 +47,11 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
         const res = await confirmSignup(token, password);
         setSubmitting(false);
         if (res.ok) {
+            if (res.data.kind === "mfa-pending") {
+                setMfaPending(true);
+                setContinueHref(loginHref);
+                return;
+            }
             // Cookies are already set (auto-login). Show a confirmation with an
             // explicit continue button instead of navigating away silently —
             // the user otherwise gets no signal that activation worked.
@@ -80,7 +86,9 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
         return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.signup.haveAccount") })] }));
     }
     if (continueHref !== null) {
-        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t("auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }));
+        return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", role: "status", children: t(mfaPending
+                        ? "auth.signupComplete.activatedMfaPending"
+                        : "auth.signupComplete.activated") }), _jsx(Link, { href: continueHref, variant: "button", children: t("auth.signupComplete.continue") })] }));
     }
     return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.signupComplete.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "signup-password", label: t("auth.signupComplete.password"), required: true, children: _jsx(Input, { kind: "password", id: "signup-password", name: "signup-password", value: password, onChange: setPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "signup-confirm-password", label: t("auth.signupComplete.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "signup-confirm-password", name: "signup-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.signupComplete.submitting") : t("auth.signupComplete.submit") })] })] }));
 }

package/dist/step-dispatcher/feature.js

@@ -144,7 +144,7 @@ function buildDispatchSpec(payload, fields) {
 }
 export function createStepDispatcherFeature() {
     return defineFeature("step-dispatcher", (r) => {
-        r.describe("Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`.");
+        r.describe("Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.");
         r.secretNamespace("webhook-auth", WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS);
         r.uiHints({
             displayLabel: "Step Dispatcher · Deferred Side-Effects",
@@ -206,6 +206,7 @@ export function createStepDispatcherFeature() {
                             tenantId: event.tenantId,
                             userId: event.metadata.userId || SYSTEM_USER_ID,
                             secrets: ctx.secrets,
+                            idempotencyKey: event.aggregateId,
                         })
                         : await performMailDispatch(dispatchSpec.spec);
                     if (result.ok) {

package/dist/step-dispatcher/webhook-runner.d.ts

@@ -45,5 +45,7 @@ export type WebhookDispatchDeps = {
     readonly tenantId: TenantId;
     readonly userId: string;
     readonly secrets: SecretsContext | undefined;
+    readonly idempotencyKey: string;
 };
+export declare const WEBHOOK_IDEMPOTENCY_KEY_HEADER = "idempotency-key";
 export declare function performWebhookDispatch(spec: WebhookSpec, deps: WebhookDispatchDeps): Promise<WebhookDispatchResult>;

package/dist/step-dispatcher/webhook-runner.js

@@ -83,8 +83,15 @@ export function setWebhookFetch(fn) {
 // tenant-chosen name, but the error still reaches the tenant via the
 // dispatch-failed event, so it stays generic.
 const WEBHOOK_AUTH_SECRET_UNAVAILABLE_ERROR = "webhook auth secret is not available";
+export const WEBHOOK_IDEMPOTENCY_KEY_HEADER = "idempotency-key";
+function hasIdempotencyKeyHeader(headers) {
+    return Object.keys(headers).some((name) => name.toLowerCase() === WEBHOOK_IDEMPOTENCY_KEY_HEADER);
+}
 async function buildWebhookHeaders(spec, deps) {
     const headers = { "content-type": "application/json", ...spec.headers };
+    if (!hasIdempotencyKeyHeader(headers)) {
+        headers[WEBHOOK_IDEMPOTENCY_KEY_HEADER] = deps.idempotencyKey;
+    }
     if (!spec.auth)
         return { ok: true, headers };
     if (!deps.secrets)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.344.0",
+  "version": "0.345.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -503,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.344.0",
-    "@cosmicdrift/kumiko-framework": "0.344.0",
-    "@cosmicdrift/kumiko-headless": "0.344.0",
-    "@cosmicdrift/kumiko-renderer": "0.344.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.344.0",
-    "@cosmicdrift/kumiko-types": "0.344.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.345.0",
+    "@cosmicdrift/kumiko-framework": "0.345.0",
+    "@cosmicdrift/kumiko-headless": "0.345.0",
+    "@cosmicdrift/kumiko-renderer": "0.345.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.345.0",
+    "@cosmicdrift/kumiko-types": "0.345.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -1025,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.344.0",
-    "@cosmicdrift/kumiko-locale-es": "0.344.0",
+    "@cosmicdrift/kumiko-locale-de": "0.345.0",
+    "@cosmicdrift/kumiko-locale-es": "0.345.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.345.0",
+    "type": "fix",
+    "title": "Escape-hatch retention loads only expirable rows",
+    "detail": "Escape-hatch audit retention loads only rows that can expire\nThe retention job used to load every escapeHatchUse event to decide which ones to prune. It now reads the storing tenants with one grouped query and loads only events older than each storing tenant's cutoff. The same rows are pruned as before."
+  },
   {
     "version": "0.343.0",
     "type": "improvement",

package/src/auth-email-password/changes.json

@@ -1,4 +1,28 @@
 [
+  {
+    "version": "0.345.0",
+    "type": "fix",
+    "title": "invite-signup-complete enforces the MFA gate before issuing a session",
+    "detail": "`invite-signup-complete` now applies the same MFA gate as `invite-accept-with-login`. The account is still created and the invitation accepted, but an invitee whose role requires MFA (for example an admin invitation under the `admins` policy) receives the MFA step instead of a session. Member invitations keep receiving a session directly."
+  },
+  {
+    "version": "0.345.0",
+    "type": "fix",
+    "title": "signup-confirm enforces the MFA gate before issuing a session",
+    "detail": "`POST /auth/signup-confirm` now runs the login's MFA gate before it issues the first session. Self-signup makes the new user TenantAdmin of a fresh tenant, so under an MFA policy that covers admins the route used to hand out an admin session without a second factor. The account, the tenant and a bound handover claim are still created, but when the gate applies the route answers with the login contract (`mfaSetupRequired` plus `preauthSetupToken`, or `mfaRequired` plus `challengeToken`) and sets no cookies. `SignupCompleteScreen` then tells the user the account is active and sends them to sign in, where they set up the second factor. Without `mfaStatusChecker` nothing changes. Two exported types change shape: `SignupConfirmData` gains the two MFA variants, and `confirmSignup` now resolves to `SignupConfirmResult` with `kind: \"signed-in\"` (the previous `SignupConfirmSuccess` fields) or `kind: \"mfa-pending\"`. The handler and `invite-signup-complete` also run the gate before they delete the token, so an error in the MFA check leaves the link usable for a retry."
+  },
+  {
+    "version": "0.345.0",
+    "type": "fix",
+    "title": "switch-tenant enforces the MFA gate before issuing a session",
+    "detail": "`POST /auth/switch-tenant` now runs the same MFA gate as login before it issues the new session. A user who is a plain member in one tenant and an admin in another can no longer reach an admin session without a second factor by switching. When the target tenant requires MFA the route answers with the login contract (`mfaRequired` plus `challengeToken`, or `mfaSetupRequired` plus `preauthSetupToken`) and sets no cookies. The gate runs in a new system-only handler, `auth-email-password:write:switch-tenant-mfa-gate`, which resolves the membership and roles itself; `runDevApp` and `runProdApp` wire it as `switchTenantMfaGateHandler` whenever auth-mfa is mounted."
+  },
+  {
+    "version": "0.345.0",
+    "type": "fix",
+    "title": "Token mail expiry uses the recipient's profile time zone",
+    "detail": "Token mails show the expiry in the recipient's own time zone\nPassword reset, email verification and account unlock are requested anonymously, so `ctx.tz.user` only held the tenant default or UTC. These mails now use the recipient's profile time zone when it is a valid IANA zone and fall back to the previous value otherwise. Signup and invite mails keep the fallback because the recipient has no profile yet."
+  },
   {
     "version": "0.343.0",
     "type": "improvement",

package/src/step-dispatcher/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.345.0",
+    "type": "improvement",
+    "title": "Webhook sends carry an Idempotency-Key header that is stable across redeliveries",
+    "detail": "Webhook sends carry an Idempotency-Key header\nEvery `r.step.webhook.send` request now has `Idempotency-Key: <dispatch stream id>`. The value stays the same when the same dispatch request is delivered again, so receivers can deduplicate. An explicit `Idempotency-Key` in `headers` (any casing) takes precedence."
+  },
   {
     "version": "0.335.0",
     "type": "fix",