@cosmicdrift/kumiko-bundled-features 0.356.0 → 0.358.0

package/dist/auth-mfa/i18n.js

@@ -19,6 +19,7 @@ export const AUTH_MFA_FEATURE_I18N = {
     "mfa.enable.reveal.qr": { en: "Scan this QR code" },
     "mfa.enable.reveal.secret": { en: "Or enter this code manually" },
     "mfa.enable.reveal.recoveryCodes": { en: "Recovery codes" },
+    "mfa.enable.reveal.savedCodes": { en: "I have saved my recovery codes." },
     "mfa.enable.confirm.submit": { en: "Enable" },
     "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },
     "screen:auth-mfa-disable.title": { en: "Disable two-factor authentication" },

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -4,6 +4,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -102,6 +105,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -124,6 +128,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -146,6 +151,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/auth-mfa/screens.js

@@ -23,6 +23,7 @@ export const mfaEnableScreen = {
     reveal: {
         title: i18nKey("mfa.enable.reveal.title"),
         warning: i18nKey("mfa.enable.reveal.warning"),
+        acknowledge: i18nKey("mfa.enable.reveal.savedCodes"),
         fields: [
             {
                 field: "otpauthUri",
@@ -47,7 +48,13 @@ export const mfaEnableScreen = {
     confirm: {
         handler: AuthMfaHandlers.enableConfirm,
         fields: {
-            code: { type: "text", required: true, minLength: 6, maxLength: 6 },
+            code: {
+                type: "text",
+                required: true,
+                minLength: 6,
+                maxLength: 6,
+                autoComplete: "one-time-code",
+            },
         },
         layout: { sections: [{ fields: ["code"] }] },
         carry: ["setupToken"],

package/dist/billing-foundation/entities.d.ts

@@ -4,6 +4,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -92,6 +96,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -147,6 +152,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -169,6 +175,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -191,6 +198,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/billing-foundation/projection.d.ts

@@ -4,6 +4,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -26,6 +27,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -48,6 +50,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -70,6 +73,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -92,6 +96,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -146,6 +151,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -168,6 +174,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;
@@ -190,6 +197,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly description?: string;
         readonly maxLength?: number;
         readonly minLength?: number;
+        readonly autoComplete?: string;
         readonly required?: boolean;
         readonly searchable?: boolean;
         readonly sortable?: boolean;

package/dist/cap-counter/book-cap-usage.d.ts

@@ -1,5 +1,5 @@
 import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { type HandlerContext, type SessionUser, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type HandlerContext, type JobContext, type SessionUser, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 export declare function retryCounterWriteOnVersionConflict(writeAttempt: () => Promise<WriteResult>): Promise<WriteResult>;
 export declare function retryOnStreamVersionConflict<T>(attempt: () => Promise<T>): Promise<T>;
 export type BookCapUsageOptions = {
@@ -9,16 +9,22 @@ export type BookCapUsageOptions = {
     readonly outsideTransaction?: boolean;
     readonly guardCurrentValue?: (currentValue: number) => void;
 };
-export declare function requireOutsideTransactionDb(ctx: HandlerContext): TenantDb;
-export declare function bookCapUsage(ctx: HandlerContext, options: BookCapUsageOptions): Promise<WriteResult>;
-export declare function releaseCapUsage(ctx: HandlerContext, options: Omit<BookCapUsageOptions, "guardCurrentValue">): Promise<WriteResult>;
+export type CapCounterContext = HandlerContext | JobContext;
+export type CapCounterScope = {
+    readonly user: SessionUser;
+    readonly readDb: TenantDb;
+    readonly writeDb: TenantDb;
+};
+export declare function resolveCapCounterScope(ctx: CapCounterContext, outsideTransaction: boolean): CapCounterScope;
+export declare function bookCapUsage(ctx: CapCounterContext, options: BookCapUsageOptions): Promise<WriteResult>;
+export declare function releaseCapUsage(ctx: CapCounterContext, options: Omit<BookCapUsageOptions, "guardCurrentValue">): Promise<WriteResult>;
 export declare function applyCapDeltaOn(db: TenantDb, user: SessionUser, options: BookCapUsageOptions, direction: "add" | "subtract"): Promise<WriteResult>;
 export type MarkCapSoftWarnedOptions = {
     readonly capName: string;
     readonly periodStartIso: string;
     readonly outsideTransaction?: boolean;
 };
-export declare function markCapSoftWarned(ctx: HandlerContext, options: MarkCapSoftWarnedOptions): Promise<WriteResult>;
+export declare function markCapSoftWarned(ctx: CapCounterContext, options: MarkCapSoftWarnedOptions): Promise<WriteResult>;
 export type ReadRollingCapUsageOptions = {
     readonly capName: string;
     readonly windowDays: number;

package/dist/cap-counter/book-cap-usage.js

@@ -1,6 +1,7 @@
 // In-process cap booking for the caller's own tenant; no SystemAdmin dispatch needed.
 import { runInOwnTransaction } from "@cosmicdrift/kumiko-framework/db";
 import { createEntityExecutor, } from "@cosmicdrift/kumiko-framework/engine";
+import { AccessDeniedError } from "@cosmicdrift/kumiko-framework/errors";
 import { eventsTable, VersionConflictError } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
@@ -48,11 +49,51 @@ export async function retryOnStreamVersionConflict(attempt) {
         }
     }
 }
-export function requireOutsideTransactionDb(ctx) {
-    if (!ctx.dbOutsideTransaction) {
-        throw new Error("cap-counter.bookCapUsage: outsideTransaction requested but ctx.dbOutsideTransaction is undefined");
+// A tenant-mode db pins every row it writes to its own tenant; counter and reservation row would
+// silently land on different tenants if that is not the user's.
+function assertDbServesUser(db, user) {
+    if (db.mode === "tenant" && db.tenantId !== user.tenantId) {
+        throw new AccessDeniedError({
+            message: "cap-counter: the context's database belongs to a different tenant than its user",
+        });
     }
-    return ctx.dbOutsideTransaction;
+    return db;
+}
+// Jobs write in place (their db is not transaction-bound); systemScope handlers reach both dbs via
+// systemDb, because their ctx.db / ctx.dbOutsideTransaction are fail-closed proxies.
+export function resolveCapCounterScope(ctx, outsideTransaction) {
+    // A job context spread into a handler-shaped one (user set) is a handler context: its user, not
+    // the job's systemUser, names the metered tenant.
+    if (!("user" in ctx) || !ctx.user) {
+        const jobUser = "systemUser" in ctx ? ctx.systemUser : undefined;
+        if (!jobUser) {
+            throw new Error("cap-counter: ctx.user.tenantId missing — required to resolve the counter");
+        }
+        const db = assertDbServesUser(ctx.db, jobUser);
+        return { user: jobUser, readDb: db, writeDb: db };
+    }
+    const { user } = ctx;
+    if (!user.tenantId) {
+        throw new Error("cap-counter: ctx.user.tenantId missing — required to resolve the counter");
+    }
+    if (ctx.systemDb) {
+        const readDb = ctx.systemDb.assertTenantMatch(user.tenantId);
+        const writeDb = outsideTransaction
+            ? ctx.systemDb.outsideTransaction.assertTenantMatch(user.tenantId)
+            : readDb;
+        return { user, readDb, writeDb };
+    }
+    const writeDb = outsideTransaction ? ctx.dbOutsideTransaction : ctx.db;
+    if (!writeDb) {
+        throw new Error(outsideTransaction
+            ? "cap-counter: outsideTransaction requested but ctx.dbOutsideTransaction is undefined"
+            : "cap-counter: ctx.db missing — run inside a handler context");
+    }
+    return {
+        user,
+        readDb: assertDbServesUser(ctx.db, user),
+        writeDb: assertDbServesUser(writeDb, user),
+    };
 }
 export async function bookCapUsage(ctx, options) {
     return applyCapDelta(ctx, options, "add");
@@ -96,19 +137,20 @@ export async function applyCapDeltaOn(db, user, options, direction) {
     }, user, db);
 }
 async function applyCapDelta(ctx, options, direction) {
+    const { user, writeDb } = resolveCapCounterScope(ctx, options.outsideTransaction === true);
     if (options.outsideTransaction) {
-        const outsideDb = requireOutsideTransactionDb(ctx);
-        return retryCounterWriteOnVersionConflict(() => runInOwnTransaction(outsideDb, (txDb) => applyCapDeltaOn(txDb, ctx.user, options, direction)));
+        return retryCounterWriteOnVersionConflict(() => runInOwnTransaction(writeDb, (txDb) => applyCapDeltaOn(txDb, user, options, direction)));
     }
-    return retryCounterWriteOnVersionConflict(() => applyCapDeltaOn(ctx.db, ctx.user, options, direction));
+    return retryCounterWriteOnVersionConflict(() => applyCapDeltaOn(writeDb, user, options, direction));
 }
 export async function markCapSoftWarned(ctx, options) {
     const parsed = capPeriodSchema.parse(options);
-    const aggregateId = capCounterAggregateId(ctx.user.tenantId, parsed.capName, parsed.periodStartIso);
+    const { user, writeDb } = resolveCapCounterScope(ctx, options.outsideTransaction === true);
+    const aggregateId = capCounterAggregateId(user.tenantId, parsed.capName, parsed.periodStartIso);
     async function attemptMark(db) {
         const existing = await db.selectMany(table, { id: aggregateId }, { limit: 1 });
         if (existing.length === 0) {
-            throw new Error(`cap-counter: cannot mark-soft-warned, no counter found for tenant=${ctx.user.tenantId} cap=${parsed.capName} period=${parsed.periodStartIso}`);
+            throw new Error(`cap-counter: cannot mark-soft-warned, no counter found for tenant=${user.tenantId} cap=${parsed.capName} period=${parsed.periodStartIso}`);
         }
         const row = existing[0];
         if (!row) {
@@ -124,13 +166,12 @@ export async function markCapSoftWarned(ctx, options) {
             id: aggregateId,
             version: currentVersion,
             changes: { lastSoftWarnedAt: Temporal.Now.instant() },
-        }, ctx.user, db);
+        }, user, db);
     }
     if (options.outsideTransaction) {
-        const outsideDb = requireOutsideTransactionDb(ctx);
-        return retryCounterWriteOnVersionConflict(() => runInOwnTransaction(outsideDb, attemptMark));
+        return retryCounterWriteOnVersionConflict(() => runInOwnTransaction(writeDb, attemptMark));
     }
-    return retryCounterWriteOnVersionConflict(() => attemptMark(ctx.db));
+    return retryCounterWriteOnVersionConflict(() => attemptMark(writeDb));
 }
 async function sumRollingEventAmounts(db, tenantId, options, type) {
     const aggregateId = rollingCapAggregateId(tenantId, options.capName);

package/dist/cap-counter/calendar-cap-usage-reservation.d.ts

@@ -0,0 +1,17 @@
+import type { CapCounterContext } from "./book-cap-usage.js";
+import { type CalendarCapReservation } from "./cap-reservation.js";
+import { type SoftHitNotifier } from "./enforce-cap.js";
+import type { CalendarCapDef } from "./with-cap-enforcement.js";
+export type CalendarCapUsageReservationSpec = Omit<CalendarCapDef, "amount" | "notify"> & {
+    readonly amount: number;
+    readonly notify?: SoftHitNotifier;
+    readonly outsideTransaction?: boolean;
+};
+export type CalendarCapUsageReservation = {
+    readonly amount: number;
+    readonly counterValue: number;
+    settle(actualAmount: number): Promise<void>;
+    release(): Promise<void>;
+};
+export declare function reserveEnforcedCalendarCap(ctx: CapCounterContext, cap: CalendarCapUsageReservationSpec): Promise<CalendarCapReservation>;
+export declare function reserveCalendarCapUsage(ctx: CapCounterContext, spec: CalendarCapUsageReservationSpec): Promise<CalendarCapUsageReservation>;

package/dist/cap-counter/calendar-cap-usage-reservation.js

@@ -0,0 +1,53 @@
+import { releaseExpiredCapReservations, reserveCalendarCap, settleCalendarCapReservation, } from "./cap-reservation.js";
+import { assertBelowHardCap, enforceCapAndMaybeNotify, } from "./enforce-cap.js";
+// Shared by withCapEnforcement and the public reservation API so both enforce identically.
+export async function reserveEnforcedCalendarCap(ctx, cap) {
+    const outsideTransaction = cap.outsideTransaction ?? true;
+    await releaseExpiredCapReservations(ctx, cap.capName, outsideTransaction);
+    if (cap.notify) {
+        await enforceCapAndMaybeNotify(ctx, {
+            capName: cap.capName,
+            periodStartIso: cap.periodStartIso,
+            limit: cap.limit,
+            profile: cap.profile,
+            notify: cap.notify,
+            amount: cap.amount,
+            markSoftWarnedOutsideTransaction: outsideTransaction,
+        });
+    }
+    return reserveCalendarCap(ctx, {
+        capName: cap.capName,
+        amount: cap.amount,
+        periodStartIso: cap.periodStartIso,
+        guardCurrentValue: (currentValue) => assertBelowHardCap(currentValue + cap.amount - 1, cap),
+    }, outsideTransaction);
+}
+export async function reserveCalendarCapUsage(ctx, spec) {
+    const outsideTransaction = spec.outsideTransaction ?? true;
+    const reservation = await reserveEnforcedCalendarCap(ctx, spec);
+    let state = "open";
+    return {
+        amount: spec.amount,
+        counterValue: reservation.counterValue,
+        async settle(actualAmount) {
+            if (state !== "open") {
+                throw new Error(`cap-counter: reservation for "${spec.capName}" is already ${state}`);
+            }
+            state = "settled";
+            try {
+                await settleCalendarCapReservation(ctx, reservation.reservationId, { capName: spec.capName, periodStartIso: spec.periodStartIso, actualAmount }, outsideTransaction);
+            }
+            catch (error) {
+                state = "open";
+                throw error;
+            }
+        },
+        async release() {
+            // skip: release after settle, or a second release, is a no-op by contract.
+            if (state !== "open")
+                return;
+            await reservation.release();
+            state = "released";
+        },
+    };
+}

package/dist/cap-counter/cap-reservation.d.ts

@@ -1,12 +1,21 @@
-import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import type { ReservationHandle } from "@cosmicdrift/kumiko-types/handlers";
-import { type BookCapUsageOptions, type ReadRollingCapUsageOptions } from "./book-cap-usage.js";
+import { type BookCapUsageOptions, type CapCounterContext, type ReadRollingCapUsageOptions } from "./book-cap-usage.js";
+export type CalendarCapReservation = ReservationHandle & {
+    readonly reservationId: string;
+    readonly counterValue: number;
+};
 export type ReserveCalendarCapOptions = Required<Pick<BookCapUsageOptions, "capName" | "periodStartIso" | "amount">> & Pick<BookCapUsageOptions, "guardCurrentValue">;
-export declare function reserveCalendarCap(ctx: HandlerContext, options: ReserveCalendarCapOptions): Promise<ReservationHandle>;
+export declare function reserveCalendarCap(ctx: CapCounterContext, options: ReserveCalendarCapOptions, outsideTransaction?: boolean): Promise<CalendarCapReservation>;
 export type ReserveRollingCapOptions = ReadRollingCapUsageOptions & {
     readonly amount: number;
     readonly guardCurrentValue?: (currentValue: number) => void;
 };
-export declare function reserveRollingCap(ctx: HandlerContext, options: ReserveRollingCapOptions): Promise<ReservationHandle>;
-export declare function releaseCapReservation(ctx: HandlerContext, id: string): Promise<void>;
-export declare function releaseExpiredCapReservations(ctx: HandlerContext, capName: string): Promise<void>;
+export declare function reserveRollingCap(ctx: CapCounterContext, options: ReserveRollingCapOptions, outsideTransaction?: boolean): Promise<ReservationHandle>;
+export declare function releaseCapReservation(ctx: CapCounterContext, id: string, outsideTransaction?: boolean): Promise<void>;
+export type SettleCalendarCapOptions = {
+    readonly capName: string;
+    readonly periodStartIso: string;
+    readonly actualAmount: number;
+};
+export declare function settleCalendarCapReservation(ctx: CapCounterContext, id: string, options: SettleCalendarCapOptions, outsideTransaction?: boolean): Promise<void>;
+export declare function releaseExpiredCapReservations(ctx: CapCounterContext, capName: string, outsideTransaction?: boolean): Promise<void>;

package/dist/cap-counter/cap-reservation.js

@@ -4,14 +4,15 @@ import { appendEventInTenantDb, getStreamVersionInTenantDb, } from "@cosmicdrift
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { rollingCapAggregateId } from "./aggregate-id.js";
-import { applyCapDeltaOn, readRollingCapUsage, requireOutsideTransactionDb, retryCounterWriteOnVersionConflict, retryOnStreamVersionConflict, } from "./book-cap-usage.js";
+import { applyCapDeltaOn, readRollingCapUsage, resolveCapCounterScope, retryCounterWriteOnVersionConflict, retryOnStreamVersionConflict, } from "./book-cap-usage.js";
 import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, CAP_RESERVATION_TTL_MINUTES, ROLLING_INCREMENTED_EVENT_QN, ROLLING_RELEASED_EVENT_QN, } from "./constants.js";
 import { capReservationsTable } from "./tables.js";
 const NOTHING_TO_RELEASE = { isSuccess: true, data: {} };
-async function insertReservationRow(txDb, id, draft) {
+async function insertReservationRow(txDb, user, id, draft) {
     const now = Temporal.Now.instant();
     await txDb.insertOne(capReservationsTable, {
         id,
+        tenantId: user.tenantId,
         capName: draft.capName,
         kind: draft.kind,
         periodStartIso: draft.periodStartIso ?? null,
@@ -20,22 +21,31 @@ async function insertReservationRow(txDb, id, draft) {
         createdAt: now,
     });
 }
-function toHandle(ctx, id) {
+function toHandle(ctx, id, outsideTransaction) {
     return {
-        release: () => releaseCapReservation(ctx, id),
+        release: () => releaseCapReservation(ctx, id, outsideTransaction),
         confirmInTransaction: (confirm) => confirmCapReservation(confirm, id),
     };
 }
 // The counter increment and the reservation row commit together, so a booked amount never exists
 // without a row that can give it back.
-export async function reserveCalendarCap(ctx, options) {
-    const outsideDb = requireOutsideTransactionDb(ctx);
+export async function reserveCalendarCap(ctx, options, outsideTransaction = true) {
+    const { user, writeDb } = resolveCapCounterScope(ctx, outsideTransaction);
     const id = generateId();
-    const reserved = await retryCounterWriteOnVersionConflict(() => runInOwnTransaction(outsideDb, async (txDb) => {
-        const booked = await applyCapDeltaOn(txDb, ctx.user, options, "add");
+    // The last attempt is the one that committed, so this holds the value its increment started from.
+    let valueBeforeBooking = 0;
+    const observedOptions = {
+        ...options,
+        guardCurrentValue: (currentValue) => {
+            options.guardCurrentValue?.(currentValue);
+            valueBeforeBooking = currentValue;
+        },
+    };
+    const reserved = await retryCounterWriteOnVersionConflict(() => runInOwnTransaction(writeDb, async (txDb) => {
+        const booked = await applyCapDeltaOn(txDb, user, observedOptions, "add");
         if (!booked.isSuccess)
             return booked;
-        await insertReservationRow(txDb, id, {
+        await insertReservationRow(txDb, user, id, {
             capName: options.capName,
             kind: "calendar",
             periodStartIso: options.periodStartIso,
@@ -45,7 +55,11 @@ export async function reserveCalendarCap(ctx, options) {
     }));
     if (!reserved.isSuccess)
         throw reraiseAsKumikoError(reserved.error);
-    return toHandle(ctx, id);
+    return {
+        ...toHandle(ctx, id, outsideTransaction),
+        reservationId: id,
+        counterValue: valueBeforeBooking + options.amount,
+    };
 }
 function rollingEvent(user, capName, amount, expectedVersion, type) {
     return {
@@ -59,23 +73,23 @@ function rollingEvent(user, capName, amount, expectedVersion, type) {
 }
 // The append is version-guarded: a booker that read the usage before another one appended loses the
 // race and repeats the whole attempt, so the hard-cap check always sees the stream it appends to.
-export async function reserveRollingCap(ctx, options) {
-    const outsideDb = requireOutsideTransactionDb(ctx);
+export async function reserveRollingCap(ctx, options, outsideTransaction = true) {
+    const { user, writeDb } = resolveCapCounterScope(ctx, outsideTransaction);
     const id = generateId();
-    const aggregateId = rollingCapAggregateId(ctx.user.tenantId, options.capName);
-    await retryOnStreamVersionConflict(() => runInOwnTransaction(outsideDb, async (txDb) => {
+    const aggregateId = rollingCapAggregateId(user.tenantId, options.capName);
+    await retryOnStreamVersionConflict(() => runInOwnTransaction(writeDb, async (txDb) => {
         const version = await getStreamVersionInTenantDb(txDb, aggregateId);
-        const usage = await readRollingCapUsage(txDb, ctx.user.tenantId, options);
+        const usage = await readRollingCapUsage(txDb, user.tenantId, options);
         options.guardCurrentValue?.(usage);
-        await appendEventInTenantDb(txDb, rollingEvent(ctx.user, options.capName, options.amount, version, ROLLING_INCREMENTED_EVENT_QN));
-        await insertReservationRow(txDb, id, {
+        await appendEventInTenantDb(txDb, rollingEvent(user, options.capName, options.amount, version, ROLLING_INCREMENTED_EVENT_QN));
+        await insertReservationRow(txDb, user, id, {
             capName: options.capName,
             kind: "rolling",
             amount: options.amount,
         });
         return NOTHING_TO_RELEASE;
     }));
-    return toHandle(ctx, id);
+    return toHandle(ctx, id, outsideTransaction);
 }
 // Deleting the row takes its row lock inside the handler transaction, so a release started after a
 // failed COMMIT waits for the real outcome and finds the row gone when the commit went through.
@@ -94,39 +108,74 @@ async function giveBackRolling(txDb, user, row) {
     return NOTHING_TO_RELEASE;
 }
 async function giveBackReservation(txDb, user, id) {
-    const row = await txDb.fetchOne(capReservationsTable, { id });
+    const ownRow = { id, tenantId: user.tenantId };
+    const row = await txDb.fetchOne(capReservationsTable, ownRow);
     if (!row)
         return NOTHING_TO_RELEASE;
-    // Waits for a confirm still holding the row; zero rows back means that confirm committed.
-    const claimed = await txDb.updateMany(capReservationsTable, { expiresAt: row.expiresAt }, { id });
-    if (claimed.length === 0)
+    const claimed = await claimReservationRow(txDb, user, row);
+    if (!claimed)
         return NOTHING_TO_RELEASE;
     const given = row.kind === "rolling"
         ? await giveBackRolling(txDb, user, row)
         : await giveBackCalendar(txDb, user, row);
     if (!given.isSuccess)
         return given;
-    await txDb.deleteMany(capReservationsTable, { id });
+    await txDb.deleteMany(capReservationsTable, ownRow);
     return given;
 }
-export async function releaseCapReservation(ctx, id) {
-    const outsideDb = requireOutsideTransactionDb(ctx);
-    const released = await retryOnStreamVersionConflict(() => retryCounterWriteOnVersionConflict(() => runInOwnTransaction(outsideDb, (txDb) => giveBackReservation(txDb, ctx.user, id))));
+// Waits for a confirm still holding the row; false means that confirm (or another release) won.
+async function claimReservationRow(txDb, user, row) {
+    const claimed = await txDb.updateMany(capReservationsTable, { expiresAt: row.expiresAt }, { id: row.id, tenantId: user.tenantId });
+    return claimed.length > 0;
+}
+export async function releaseCapReservation(ctx, id, outsideTransaction = true) {
+    const { user, writeDb } = resolveCapCounterScope(ctx, outsideTransaction);
+    const released = await retryOnStreamVersionConflict(() => retryCounterWriteOnVersionConflict(() => runInOwnTransaction(writeDb, (txDb) => giveBackReservation(txDb, user, id))));
     if (!released.isSuccess)
         throw reraiseAsKumikoError(released.error);
 }
+function bookCalendarDelta(txDb, user, period, delta) {
+    if (delta === 0)
+        return Promise.resolve({ isSuccess: true, data: {} });
+    return applyCapDeltaOn(txDb, user, { ...period, amount: Math.abs(delta) }, delta > 0 ? "add" : "subtract");
+}
+// Replaces the reserved amount by the actual one in a single transaction. When the row is already
+// gone (swept or released), the reserved amount was given back, so the full actual amount is booked.
+export async function settleCalendarCapReservation(ctx, id, options, outsideTransaction = true) {
+    if (!Number.isInteger(options.actualAmount) || options.actualAmount < 0) {
+        throw new Error(`cap-counter: settle amount must be a non-negative integer, got ${options.actualAmount}`);
+    }
+    const { user, writeDb } = resolveCapCounterScope(ctx, outsideTransaction);
+    const settled = await retryCounterWriteOnVersionConflict(() => runInOwnTransaction(writeDb, async (txDb) => {
+        const row = await txDb.fetchOne(capReservationsTable, {
+            id,
+            tenantId: user.tenantId,
+        });
+        const claimed = row ? await claimReservationRow(txDb, user, row) : false;
+        if (!row || !claimed) {
+            return bookCalendarDelta(txDb, user, options, options.actualAmount);
+        }
+        const booked = await bookCalendarDelta(txDb, user, options, options.actualAmount - row.amount);
+        if (!booked.isSuccess)
+            return booked;
+        await txDb.deleteMany(capReservationsTable, { id, tenantId: user.tenantId });
+        return booked;
+    }));
+    if (!settled.isSuccess)
+        throw reraiseAsKumikoError(settled.error);
+}
 // A failed release leaves its row behind; giving it back once the TTL passed bounds how long that
 // capacity stays counted.
-export async function releaseExpiredCapReservations(ctx, capName) {
-    const outsideDb = requireOutsideTransactionDb(ctx);
-    const expired = await outsideDb.selectMany(capReservationsTable, {
-        tenantId: ctx.user.tenantId,
+export async function releaseExpiredCapReservations(ctx, capName, outsideTransaction = true) {
+    const { user, writeDb } = resolveCapCounterScope(ctx, outsideTransaction);
+    const expired = await writeDb.selectMany(capReservationsTable, {
+        tenantId: user.tenantId,
         capName,
         expiresAt: { lt: Temporal.Now.instant() },
     });
     for (const { id } of expired) {
         try {
-            await releaseCapReservation(ctx, id);
+            await releaseCapReservation(ctx, id, outsideTransaction);
         }
         catch (error) {
             ctx.log?.error("releasing an expired cap reservation failed", { id, capName, error });