@cosmicdrift/kumiko-bundled-features 0.350.0 → 0.352.0

package/dist/tier-engine/tier-option-gate.js

@@ -0,0 +1,62 @@
+// Tier-gated options of a select field: one spec drives the availability query the
+// renderer shows (disabled option + "from <tier>" hint) and the write-path check that
+// actually enforces it, so the two cannot drift apart.
+import { UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { isPlainObject } from "@cosmicdrift/kumiko-framework/utils";
+import { readPayloadField, } from "../cap-counter/index.js";
+function limitContextOf(ctx) {
+    return ctx.config ? { config: ctx.config } : {};
+}
+function recordIdOf(payload) {
+    return isPlainObject(payload) && typeof payload["id"] === "string" ? payload["id"] : undefined;
+}
+export function createTierOptionGate(deps) {
+    async function capsPerTier(context) {
+        return Promise.all(deps.tierOrder.map(async (tier) => ({ tier, caps: await deps.capsForTier(tier, context) })));
+    }
+    async function optionAvailability(db, context, spec, hintFor) {
+        const currentCaps = await deps.capsForTier(await deps.resolveTier(db), context);
+        const tiers = await capsPerTier(context);
+        return spec.options.map((value) => {
+            if (spec.isOptionAllowed(value, currentCaps))
+                return { value, disabled: false };
+            const required = tiers.find(({ caps }) => spec.isOptionAllowed(value, caps));
+            return required === undefined
+                ? { value, disabled: true }
+                : { value, disabled: true, hint: hintFor(required.tier) };
+        });
+    }
+    async function storedValueMatches(ctx, spec, value, recordId) {
+        if (spec.table === undefined || recordId === undefined)
+            return false;
+        const stored = await ctx.db.fetchOne(spec.table, { id: recordId });
+        return stored?.[spec.field] === value;
+    }
+    async function checkTierOption(ctx, value, spec, recordId) {
+        // skip: an absent or non-string value is the schema's business, not a tier violation.
+        if (typeof value !== "string")
+            return null;
+        const context = limitContextOf(ctx);
+        const currentCaps = await deps.capsForTier(await deps.resolveTier(ctx.db), context);
+        if (spec.isOptionAllowed(value, currentCaps))
+            return null;
+        if (await storedValueMatches(ctx, spec, value, recordId))
+            return null;
+        const required = (await capsPerTier(context)).find(({ caps }) => spec.isOptionAllowed(value, caps));
+        return writeFailure(new UnprocessableError(spec.code, {
+            i18nKey: spec.i18nKey,
+            details: { field: spec.field, value, requiredTier: required?.tier },
+        }));
+    }
+    function withTierOptionGate(handler, spec) {
+        return {
+            ...handler,
+            handler: async (event, ctx) => {
+                const value = readPayloadField(event.payload, spec.field);
+                const failure = await checkTierOption(ctx, value, spec, recordIdOf(event.payload));
+                return failure ?? handler.handler(event, ctx);
+            },
+        };
+    }
+    return { optionAvailability, checkTierOption, withTierOptionGate };
+}

package/dist/user/schema/user.d.ts

@@ -165,6 +165,7 @@ export declare const userEntity: import("@cosmicdrift/kumiko-types/fields").Enti
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -343,6 +344,7 @@ export declare const userTable: import("@cosmicdrift/kumiko-framework/db").Entit
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };

package/dist/user-data-rights/db/queries/export-jobs.d.ts

@@ -1,6 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { Temporal } from "temporal-polyfill";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export type ExportJobCleanupCandidate = {
     readonly id: string;
     readonly version: number;

package/dist/user-data-rights/db/queries/forget-cleanup.d.ts

@@ -1,5 +1,5 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { Temporal as TemporalPolyfill } from "temporal-polyfill";
-export declare function selectUsersDueForForgetCleanup(db: DbConnection, status: string, gracePeriodEndCutoff: InstanceType<typeof TemporalPolyfill.Instant> | string): Promise<readonly {
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+export declare function selectUsersDueForForgetCleanup(db: DbConnection, status: string, gracePeriodEndCutoff: Temporal.Instant | string): Promise<readonly {
     id: string;
 }[]>;

package/dist/user-data-rights/db/queries/forget-cleanup.js

@@ -1,15 +1,9 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-// Value-only import, aliased to avoid shadowing the ambient global
-// `Temporal` TYPE that gracePeriodEndCutoff's parameter type resolves
-// against (same #1438 dual-package-hazard pattern as event-store.ts).
-import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userTable } from "../../../user/index.js";
 export async function selectUsersDueForForgetCleanup(db, status, gracePeriodEndCutoff) {
-    // @cast-boundary temporal-polyfill-vs-ambient: same TC39 Temporal.Instant
-    // at runtime, distinct nominal types across the two .d.ts sources (see
-    // event-store.ts). Only ever consumed via the `lte` comparison below.
     const cutoff = typeof gracePeriodEndCutoff === "string"
-        ? TemporalPolyfill.Instant.from(gracePeriodEndCutoff)
+        ? Temporal.Instant.from(gracePeriodEndCutoff)
         : gracePeriodEndCutoff;
     return selectMany(db, userTable, {
         status,

package/dist/user-data-rights/deletion-token.d.ts

@@ -1,4 +1,4 @@
-import type { Temporal } from "temporal-polyfill";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { type RowBoundGrantResult } from "../shared/index.js";
 export declare function signDeletionToken(userId: string, requestId: string, ttlMinutes: number, secret: string, now?: Temporal.Instant): {
     readonly token: string;

package/dist/user-data-rights/email-templates.js

@@ -4,7 +4,7 @@
 // branding pass send*Email callbacks and these defaults do not run.
 import { mailT, registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export function normalizeGdprMailLocale(raw) {
     if (!raw)
         return undefined;

package/dist/user-data-rights/handlers/list-download-attempts.query.js

@@ -1,6 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 import { downloadAttemptsTable } from "../schema/download-attempt.js";
 // Operator-Query: invalid Download-Attempts (S2.U7).

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -1,7 +1,7 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 // DSGVO Art. 15 Selbstauskunft — User reads HIS OWN audit-log.
 // WHERE createdBy = ctx.user.id ist hard-coded (kein userId-Param,

package/dist/user-data-rights/schema/export-job.d.ts

@@ -74,6 +74,7 @@ export declare const exportJobEntity: import("@cosmicdrift/kumiko-types/fields")
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -249,6 +250,7 @@ export declare const exportJobsTable: import("@cosmicdrift/kumiko-framework/db")
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };

package/dist/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.js

@@ -1,4 +1,5 @@
-import { deliveryAttemptsTable } from "../../delivery/index.js";
+import { appendEventInTenantDb, getStreamVersionInTenantDb, } from "@cosmicdrift/kumiko-framework/event-store";
+import { DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT, deliveryAttemptsTable, } from "../../delivery/index.js";
 import { featureMounted } from "./feature-mounted.js";
 // userData-Hooks for delivery's attempt log (deferred from #797, closed by
 // #799). deliveryAttempt is an events-only aggregate — the export reads the
@@ -26,9 +27,27 @@ export const deliveryAttemptExportHook = async (ctx) => {
         })),
     };
 };
-export const deliveryAttemptDeleteHook = async () => {
-    // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
-    // erases the recipient's DEK, which makes recipientAddress unreadable in
-    // BOTH the append-only events and the projected rows (#799). A read-side
-    // UPDATE here would be wiped on the next projection rebuild anyway.
+// Both strategies erase the address. The DEK shredding of a forget covers KMS deployments; the
+// erase event also covers plaintext mode, and unlike a read-side UPDATE it survives a projection
+// rebuild. Rows without an address are skipped, which makes a second run a no-op.
+export const deliveryAttemptDeleteHook = async (ctx) => {
+    // skip: delivery not mounted — its table doesn't exist, nothing to erase.
+    if (!featureMounted(ctx, "delivery"))
+        return;
+    const rows = await ctx.db.selectMany(deliveryAttemptsTable, {
+        tenantId: ctx.tenantId,
+        recipientId: ctx.userId,
+    });
+    for (const row of rows) {
+        if (row.recipientAddress === null)
+            continue;
+        await appendEventInTenantDb(ctx.db, {
+            aggregateType: "deliveryAttempt",
+            aggregateId: row.id,
+            expectedVersion: await getStreamVersionInTenantDb(ctx.db, row.id),
+            type: DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT,
+            payload: {},
+            metadata: { userId: "system" },
+        }, { registry: ctx.registry });
+    }
 };

package/dist/waitlist/entity.d.ts

@@ -139,6 +139,7 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -355,6 +356,7 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };

package/dist/waitlist/handlers/invite.write.js

@@ -1,7 +1,7 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { AuthErrors, AuthHandlers } from "../../auth-email-password/index.js";
 import { TenantHandlers, tenantTable } from "../../tenant/index.js";
 import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors } from "../constants.js";

package/dist/waitlist/handlers/submit.write.js

@@ -1,7 +1,7 @@
 import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import { Temporal } from "temporal-polyfill";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../constants.js";
 import { normalizeEmail, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
 import { renderWaitlistAdminNoticeEmail, renderWaitlistConfirmationEmail, resolveWaitlistAdminMailLocale, resolveWaitlistMailLocale, } from "../mail.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.350.0",
+  "version": "0.352.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -503,12 +503,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.350.0",
-    "@cosmicdrift/kumiko-framework": "0.350.0",
-    "@cosmicdrift/kumiko-headless": "0.350.0",
-    "@cosmicdrift/kumiko-renderer": "0.350.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.350.0",
-    "@cosmicdrift/kumiko-types": "0.350.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.352.0",
+    "@cosmicdrift/kumiko-framework": "0.352.0",
+    "@cosmicdrift/kumiko-headless": "0.352.0",
+    "@cosmicdrift/kumiko-renderer": "0.352.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.352.0",
+    "@cosmicdrift/kumiko-types": "0.352.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -524,7 +524,7 @@
     "nodemailer": "^10.0.13",
     "qrcode": "^1.5.4",
     "react": "^19.2.6",
-    "sharp": "^0.35.4",
+    "sharp": "^0.35.5",
     "stripe": "^22.6.2",
     "tailwind-merge": "^3.6.0",
     "temporal-polyfill": "^0.3.2",
@@ -1025,8 +1025,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.350.0",
-    "@cosmicdrift/kumiko-locale-es": "0.350.0",
+    "@cosmicdrift/kumiko-locale-de": "0.352.0",
+    "@cosmicdrift/kumiko-locale-es": "0.352.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/cap-counter/changes.json

@@ -1,4 +1,32 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "breaking",
+    "title": "Calendar cap reservations are stored in the new store_cap_reservations table",
+    "detail": "Capped writes now insert and delete rows in store_cap_reservations, so they fail until the table exists.",
+    "migration": "Generate and apply a migration with `kumiko-schema generate` — capped writes fail without the new store_cap_reservations table"
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "Reservations expire after 60 minutes and are swept before the next reserve of the same cap"
+  },
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "withCapEnforcement keeps the wrapped handler's settings (rateLimit, additionalRateLimits) and composes with an inner reserveBeforeTransaction"
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "withRollingCapEnforcement reserves before the handler transaction and releases through the new rolling-released event, so rejected or failed writes no longer consume rolling cap"
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "createValueCapGuard rejects a written number outside the min and max of the tenant's tier",
+    "detail": "A number written by a handler can be bounded per tier\n`createValueCapGuard(resolveTierCaps)` returns `checkValueCap` and `withValueCap`. The spec names the payload field, optional `min` and `max` functions over the tier caps (`undefined` means unbounded), an error code and an i18n key. The value is read from the payload or, for entity updates, from `changes`; an absent or non-numeric value passes. A value below the minimum or above the maximum is rejected with `UnprocessableError` and `details: { field, value, min, max }`. `withValueCap` spreads the wrapped handler, so it composes with `withCapEnforcement`."
+  },
   {
     "version": "0.348.0",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "breaking",
+    "title": "Delivery attempt log stores masked recipient addresses; attempts older than 90 days are pruned",
+    "detail": "The log query, the export and the stored events show masked addresses, and the feature registers the daily attempt-log-retention job.",
+    "migration": "Read recipients from your own data, not from the attempt log, because it only shows masked addresses now. Set `attemptLogRetentionDays` on createDeliveryFeature to another number of days, or to `false` to keep the log, if 90 days does not fit. Schedule nothing extra, the feature registers the cron job itself. Existing full-address entries are removed by the retention job once they are older than the window, or erased when their user is forgotten."
+  },
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "Forgetting a user erases the recipient address of their delivery attempts in plaintext mode too, through an event that survives projection rebuilds"
+  },
   {
     "version": "0.343.0",
     "type": "improvement",

package/src/derivatives-sharp/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "sharp is bumped to 0.35.5 to pick up the librsvg security fix",
+    "detail": "Bump sharp to 0.35.5 (librsvg advisory GHSA-WQ5F-XC86-PV6W)"
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/legal-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "The legal-pages README imprint example uses a fictional demo identity",
+    "detail": "The legal-pages README seeds its imprint example with a fictional demo identity and address instead of a real person's details."
+  },
   {
     "version": "0.344.0",
     "type": "improvement",

package/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "Badge, stages track and chips for the simple mail renderer",
+    "detail": "Use badge, { stages } and { chips } in the template variables; the notification RenderResponse carries the matching plain text in text."
+  },
   {
     "version": "0.344.0",
     "type": "improvement",

package/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "createTierOptionGate builds the availability rows and gates select options by tier on write",
+    "detail": "withTierOptionGate rejects a disallowed option with the lowest tier that allows it and lets an unchanged stored value pass on update."
+  },
   {
     "version": "0.278.0",
     "type": "breaking",