@cosmicdrift/kumiko-bundled-features 0.363.0 → 0.364.0

package/dist/audit/handlers/list.query.js

@@ -88,11 +88,15 @@ export const listQuery = defineQueryHandler({
             aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
         }, direction);
         const rows = await selectMany(ctx.db, eventsTable, where, {
-            // `id` as tie-breaker keeps the order total, so pages never overlap.
-            orderBy: [
-                { col: p.sort === "type" ? "type" : "createdAt", direction },
-                { col: "id", direction },
-            ],
+            // The id cursor only resumes an id-ordered listing. created_at comes from the
+            // transaction start and can run against insert order, so ordering by it would let
+            // a page boundary skip rows; only the type sort leaves id order (and is one page).
+            orderBy: p.sort === "type"
+                ? [
+                    { col: "type", direction },
+                    { col: "id", direction },
+                ]
+                : [{ col: "id", direction }],
             limit: p.limit,
         });
         const serialised = rows.map((r) => ({

package/dist/auth-email-password/bootstrap.d.ts

@@ -1,7 +1,8 @@
-import { makeDispatchSystemWrite, type SystemDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, type RoleDispatchArgs } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type Registry, type TenantId, type WriteResult } from "@cosmicdrift/kumiko-framework/engine";
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
 import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
@@ -18,9 +19,7 @@ export type BootstrapSeedDeps = {
     /** Writes as the system user with the given tenant roles in the seeded
      *  tenant; use it when the app gates tenant data on its own roles rather
      *  than SystemAdmin. */
-    readonly dispatchWriteAs: (args: Pick<SystemDispatchArgs, "handlerQn" | "payload"> & {
-        readonly roles: readonly string[];
-    }) => Promise<WriteResult>;
+    readonly dispatchWriteAs: (args: Omit<RoleDispatchArgs, "tenantId">) => Promise<WriteResult>;
 };
 export type BootstrapConfigValue = string | number | boolean;
 export type BootstrapTenant = {
@@ -54,6 +53,10 @@ export type BootstrapDeps = {
     readonly db: DbConnection;
     readonly redis: Redis;
     readonly dispatcher: Dispatcher;
+    /** With these, a rerun can compare `encrypted`/`piiEncrypted` config keys by
+     *  their decrypted value; without them such keys are rewritten on every run. */
+    readonly registry?: Registry;
+    readonly configCipher?: EnvelopeCipher;
 };
 export type BootstrapTenantOutcome = "created" | "exists";
 export type BootstrapInviteOutcome = "invited" | "resent" | "pending" | "active" | "cancelled" | "role-mismatch";

package/dist/auth-email-password/bootstrap.js

@@ -4,14 +4,14 @@
 // exactly as for any other writer. Nobody gets a role before accepting: the
 // invitation row holds membership role + global roles until the invitee
 // accepts through the regular invite-accept routes.
-import { makeDispatchSystemWrite, } from "@cosmicdrift/kumiko-framework/api";
+import { makeDispatchSystemWrite, makeDispatchWriteAs, } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { ConfigScopes, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 // kumiko-lint-ignore cross-feature-import bootstrap sets per-tenant config through the config feature's write handler
 import { ConfigHandlers } from "../config/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap compares against the stored config row to stay idempotent
-import { findConfigRow } from "../config/write-helpers.js";
+import { configRowHoldsValue, findConfigRow } from "../config/write-helpers.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
 import { TenantHandlers } from "../tenant/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap provisions tenant + invitation rows owned by the tenant feature
@@ -78,8 +78,10 @@ async function applyTenantConfig(deps, tenant) {
     const applied = [];
     for (const [key, value] of Object.entries(tenant.config ?? {})) {
         const existing = await findConfigRow(deps.db, key, tenant.id, null);
-        if (existing?.value === JSON.stringify(value))
+        const serialized = JSON.stringify(value);
+        if (await configRowHoldsValue(existing, deps.registry?.getConfigKey(key), deps.configCipher, key, serialized)) {
             continue;
+        }
         const result = await deps.dispatcher.write(ConfigHandlers.set, { key, value, scope: ConfigScopes.tenant }, 
         // SystemAdmin on top of the system role: keys with the default tenant
         // write access (admin roles) reject a bare system user, system-only keys
@@ -125,6 +127,11 @@ async function decideInvite(deps, invite) {
     }
     if (invitation.status === INVITATION_STATUS.accepted)
         return "active";
+    // The plan dropped a global role (e.g. an admin moved to tenants[].invites):
+    // the stored invitation would still grant it on accept, so it is re-issued.
+    if (storedGlobalRoles.some((role) => !invite.globalRoles.some((planned) => planned === role))) {
+        return "resent";
+    }
     if (await hasLiveInviteToken(deps.redis, invitation.id))
         return "pending";
     return "resent";
@@ -135,6 +142,7 @@ function isMailingOutcome(outcome) {
 export async function bootstrapTenants(deps, plan) {
     const plannedInvites = planInvites(plan);
     const dispatchSystemWrite = makeDispatchSystemWrite(deps.dispatcher);
+    const dispatchWriteAsRoles = makeDispatchWriteAs(deps.dispatcher);
     const tenants = [];
     for (const tenant of plan.tenants) {
         const outcome = await ensureTenant(deps, tenant);
@@ -144,7 +152,7 @@ export async function bootstrapTenants(deps, plan) {
                 tenantId: tenant.id,
                 db: deps.db,
                 dispatchSystemWrite,
-                dispatchWriteAs: ({ handlerQn, payload, roles }) => deps.dispatcher.write(handlerQn, payload, createSystemUser(tenant.id, roles)),
+                dispatchWriteAs: (args) => dispatchWriteAsRoles({ ...args, tenantId: tenant.id }),
             });
         }
         const configApplied = await applyTenantConfig(deps, tenant);

package/dist/auth-email-password/email-rate-limits.d.ts

@@ -0,0 +1,4 @@
+import type { PayloadRateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+export declare const AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS: number;
+export declare const AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS = 3;
+export declare const AUTH_EMAIL_PAYLOAD_RATE_LIMITS: readonly PayloadRateLimitOption[];

package/dist/auth-email-password/email-rate-limits.js

@@ -0,0 +1,13 @@
+// The bucket counts across all IPs, so a long window would let an attacker who
+// knows an address lock its owner out of recovery/signup for the whole window.
+// A short one still throttles mail bombing but clears within minutes.
+export const AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS = 15 * 60;
+export const AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS = 3;
+export const AUTH_EMAIL_PAYLOAD_RATE_LIMITS = [
+    {
+        per: { payloadField: "email" },
+        limit: AUTH_EMAIL_RATE_LIMIT_MAX_REQUESTS,
+        windowSeconds: AUTH_EMAIL_RATE_LIMIT_WINDOW_SECONDS,
+        normalize: "email",
+    },
+];

package/dist/auth-email-password/handlers/change-password.write.d.ts

@@ -4,4 +4,4 @@ export declare const changePasswordWrite: import("@cosmicdrift/kumiko-types/defi
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/change-password.write.js

@@ -1,4 +1,4 @@
-import { access, createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { hashPassword, verifyPassword } from "../../shared/index.js";
 import { UserHandlers, UserQueries } from "../../user/index.js";
@@ -14,7 +14,11 @@ export const changePasswordWrite = defineWriteHandler({
         oldPassword: z.string().min(1),
         newPassword: passwordSchema,
     }),
-    access: { roles: access.authenticated },
+    access: {
+        openToAll: {
+            reason: "Self-service: acts only on event.user.id and re-checks the caller's current password; invited members hold only an app role, so a fixed role list would lock them out.",
+        },
+    },
     escapeHatch: {
         grants: ["systemIdentity"],
         reason: "Reads the caller's own passwordHash (privileged-only field) via ctx.queryAs(SYSTEM, ...) " +

package/dist/auth-email-password/handlers/confirm-account-unlock.write.d.ts

@@ -6,4 +6,4 @@ export declare function createConfirmAccountUnlockHandler(opts: ConfirmAccountUn
     token: z.ZodString;
 }, z.core.$strip>, {
     kind: "account-unlocked";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-accept-with-login.write.d.ts

@@ -18,4 +18,4 @@ export declare function createInviteAcceptWithLoginHandler(opts?: InviteAcceptWi
     token: z.ZodString;
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteAcceptWithLoginData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-accept.write.d.ts

@@ -8,4 +8,4 @@ export type InviteAcceptData = {
 };
 export declare function createInviteAcceptHandler(): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-accept", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteAcceptData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -33,12 +33,12 @@ export type InviteCreateOptions = {
 export declare function createInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export declare function createSystemInviteCreateHandler(opts: InviteCreateOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"system-invite-create", z.ZodObject<{
     email: z.ZodEmail;
     role: z.ZodString;
     globalRoles: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         SystemAdmin: "SystemAdmin";
     }>>>;
-}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/invite-signup-complete.write.d.ts

@@ -13,4 +13,4 @@ export type InviteSignupCompleteOptions = Pick<LoginHandlerOptions, "mfaStatusCh
 export declare function createInviteSignupCompleteHandler(opts?: InviteSignupCompleteOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"invite-signup-complete", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, InviteSignupCompleteData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/login.write.d.ts

@@ -74,5 +74,5 @@ export declare function gateBuildSession(ctx: HandlerContext, userId: string, te
 export declare function createLoginHandler(opts?: LoginHandlerOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"login", z.ZodObject<{
     email: z.ZodEmail;
     password: z.ZodString;
-}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, LoginResult, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/logout.write.d.ts

@@ -1,2 +1,2 @@
 import * as z from "zod";
-export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare const logoutWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"logout", z.ZodObject<{}, z.core.$strip>, unknown, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/logout.write.js

@@ -1,4 +1,4 @@
-import { access, defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler, stepsPipeline } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 // Logout — JWT is stateless, so server-side we only return OK. A future
 // revocation list / session table can land here without changing the
@@ -6,7 +6,11 @@ import * as z from "zod";
 export const logoutWrite = defineWriteHandler({
     name: "logout",
     schema: z.object({}),
-    access: { roles: access.authenticated },
+    access: {
+        openToAll: {
+            reason: "Self-service: touches no data, any signed-in member must be able to sign out regardless of which role they hold.",
+        },
+    },
     description: "Acknowledges a sign-out for the authenticated caller so the client can discard its token; the JWT is stateless, so no server-side session state changes here.",
     perform: stepsPipeline(({ r }) => [
         r.step.return({ isSuccess: true, data: { kind: "logged-out" } }),

package/dist/auth-email-password/handlers/request-account-unlock.write.d.ts

@@ -3,4 +3,4 @@ export type RequestAccountUnlockOptions = TokenRequestOptions;
 export type RequestUnlockData = TokenRequestData<"unlock-requested">;
 export declare function createRequestAccountUnlockHandler(opts: RequestAccountUnlockOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-account-unlock", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"unlock-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/request-email-verification.write.d.ts

@@ -3,4 +3,4 @@ export type RequestEmailVerificationOptions = TokenRequestOptions;
 export type RequestVerificationData = TokenRequestData<"verification-requested">;
 export declare function createRequestEmailVerificationHandler(opts: RequestEmailVerificationOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-email-verification", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"verification-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/request-password-reset.write.d.ts

@@ -3,4 +3,4 @@ export type RequestPasswordResetOptions = TokenRequestOptions;
 export type RequestResetData = TokenRequestData<"reset-requested">;
 export declare function createRequestPasswordResetHandler(opts: RequestPasswordResetOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"request-password-reset", import("zod").ZodObject<{
     email: import("zod").ZodEmail;
-}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("zod/v4/core").$strip>, TokenRequestData<"reset-requested">, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/reset-password.write.d.ts

@@ -7,4 +7,4 @@ export declare function createResetPasswordHandler(opts: ResetPasswordOptions):
     newPassword: z.ZodString;
 }, z.core.$strip>, {
     kind: "password-reset";
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/signup-confirm.write.d.ts

@@ -27,5 +27,5 @@ type ClaimedHandover = {
 export declare function createSignupConfirmHandler(opts?: SignupConfirmOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"signup-confirm", z.ZodObject<{
     token: z.ZodString;
     password: z.ZodString;
-}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SignupConfirmData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
 export {};

package/dist/auth-email-password/handlers/signup-request.write.d.ts

@@ -29,4 +29,4 @@ export declare function createSignupRequestHandler(opts: SignupRequestOptions):
         entityType: z.ZodString;
         token: z.ZodString;
     }, z.core.$strip>>;
-}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SignupRequestData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/signup-request.write.js

@@ -24,6 +24,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { findSignupHandoverProvider } from "../../shared/index.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
 import { resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle.js";
 import { issueSignupActivation } from "../signup-activation.js";
@@ -48,7 +49,7 @@ export function createSignupRequestHandler(opts) {
         schema: SignupRequestSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 3, windowSeconds: 86400 }],
+        additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
         description: "Starts magic-link self-registration by mailing a fresh activation link to an address and invalidating any link still outstanding for it; the answer looks the same whether or not the address is already registered.",
         escapeHatch: { reason: HANDOVER_GRANT_VERIFY_REASON, grants: ["unsafeRaw"] },
         handler: async (event, ctx) => {

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -6,4 +6,4 @@ export type SwitchTenantMfaGateData = {
 export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
     userId: z.ZodString;
     tenantId: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, SwitchTenantMfaGateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/token-request-handler.d.ts

@@ -41,4 +41,4 @@ export type TokenRequestOptions = {
 };
 export declare function createTokenRequestHandler<TName extends string, TSuccessKind extends string>(spec: TokenRequestSpec<TName, TSuccessKind>, opts: TokenRequestOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<TName, z.ZodObject<{
     email: z.ZodEmail;
-}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, TokenRequestData<TSuccessKind>, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/handlers/token-request-handler.js

@@ -17,6 +17,7 @@ import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { UserQueries } from "../../user/index.js";
 import { parseAuthUserRow } from "../auth-user-row.js";
+import { AUTH_EMAIL_PAYLOAD_RATE_LIMITS } from "../email-rate-limits.js";
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 const RequestTokenSchema = z.object({
     email: z.email(),
@@ -33,7 +34,7 @@ export function createTokenRequestHandler(spec, opts) {
         schema: RequestTokenSchema,
         access: { roles: ["anonymous"] },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
-        additionalRateLimits: [{ per: { payloadField: "email" }, limit: 5, windowSeconds: 86400 }],
+        additionalRateLimits: AUTH_EMAIL_PAYLOAD_RATE_LIMITS,
         escapeHatch: {
             grants: ["systemIdentity"],
             reason: "Anonymous requester has no session — looks up the target user by email via " +

package/dist/auth-email-password/handlers/verify-email.write.d.ts

@@ -9,4 +9,4 @@ export type VerifyEmailData = {
 };
 export declare function createVerifyEmailHandler(opts: VerifyEmailOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"verify-email", z.ZodObject<{
     token: z.ZodString;
-}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, z.core.$strip>, VerifyEmailData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-email-password/web/auth-gate.js

@@ -10,7 +10,7 @@ import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 // (nur `{ children }`-Prop). Der Sample kann so einen eigenen Login-
 // Screen rein konfigurieren, ohne den Gate selbst ersetzen zu müssen.
 import { useLocale } from "@cosmicdrift/kumiko-renderer";
-import { useEffect, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import { assertNavigableUrl, buildLoginRedirectUrl, followNextOrLandingAfterLogin, } from "./auth-redirect.js";
 import { LoginScreen } from "./login-screen.js";
 import { SessionProvider, useSession } from "./session.js";
@@ -102,6 +102,17 @@ export function resolveLoginRedirect(loginUrl, locale, { origin, pathname, searc
         url: typeof loginUrl === "function" ? target : buildLoginRedirectUrl(target, returnPath, origin),
     };
 }
+// A throwing loginUrl builder must not take the whole app tree down in render;
+// null falls through to the built-in login screen.
+function resolveLoginRedirectOrNull(loginUrl, locale, location) {
+    try {
+        return resolveLoginRedirect(loginUrl, locale, location);
+    }
+    catch (error) {
+        console.error("Auth gate: loginUrl could not be resolved, showing the built-in login", error);
+        return null;
+    }
+}
 export function makeAuthGate(opts = {}) {
     const { loginUrl } = opts;
     if (typeof loginUrl === "string")
@@ -110,9 +121,10 @@ export function makeAuthGate(opts = {}) {
     function AuthGate({ children }) {
         const { status } = useSession();
         const locale = useLocale().locale();
-        const loginRedirect = loginUrl !== undefined && status === "unauthenticated"
-            ? resolveLoginRedirect(loginUrl, locale, window.location)
-            : null;
+        const { origin, pathname, search, hash } = window.location;
+        const loginRedirect = useMemo(() => loginUrl !== undefined && status === "unauthenticated"
+            ? resolveLoginRedirectOrNull(loginUrl, locale, { origin, pathname, search, hash })
+            : null, [status, locale, origin, pathname, search, hash]);
         const redirectUrl = loginRedirect?.kind === "redirect" ? loginRedirect.url : null;
         // kumiko-lint-ignore no-raw-hooks Phase-3 conversion tracked in #2312
         useEffect(() => {

package/dist/auth-mfa/handlers/disable.write.d.ts

@@ -7,4 +7,4 @@ export declare function createDisableHandler(opts: DisableOptions): import("@cos
     code: z.ZodString;
 }, z.core.$strip>, {
     disabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-confirm-preauth.write.d.ts

@@ -13,4 +13,4 @@ export declare function createEnableConfirmPreauthHandler(opts: EnableConfirmPre
 }, z.core.$strip>, {
     kind: string;
     session: SessionUser;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-confirm.write.d.ts

@@ -9,4 +9,4 @@ export declare function createEnableConfirmHandler(opts: EnableConfirmOptions):
     code: z.ZodString;
 }, z.core.$strip>, {
     enabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-start-preauth.write.d.ts

@@ -11,4 +11,4 @@ export declare function createEnableStartPreauthHandler(opts: EnableStartPreauth
     setupToken: string;
     otpauthUri: string;
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/enable-start.write.d.ts

@@ -10,4 +10,4 @@ export declare function createEnableStartHandler(opts: EnableStartOptions): impo
     otpauthUri: string;
     totpSecret: string;
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/regenerate-recovery.write.d.ts

@@ -6,4 +6,4 @@ export declare function createRegenerateRecoveryHandler(opts: RegenerateRecovery
     code: z.ZodString;
 }, z.core.$strip>, {
     recoveryCodes: string[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/auth-mfa/handlers/verify.write.d.ts

@@ -11,4 +11,4 @@ export declare function createMfaVerifyHandler(opts: MfaVerifyOptions): import("
 }, z.core.$strip>, {
     kind: string;
     session: SessionUser;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/billing-foundation/consumer-protection/confirmation-mail.js

@@ -1,4 +1,7 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { Marked } from "marked";
+import { isAllowedDocumentLinkHref, isDocumentPlaceholderHref, } from "../../template-resolver/index.js";
 import { resolveConsentLocale } from "./consent-text.js";
 export const CONFIRMATION_LABELS = {
     de: {
@@ -89,13 +92,57 @@ function formatDate(iso, locale, timeZone) {
         timeZoneName: "short",
     }).format(epochMilliseconds);
 }
-// The mail template only knows plain text variables, so the Markdown terms
-// become one row per paragraph; heading markers are dropped.
+// One richText row of inline HTML per Markdown block. The sanitizer shows a rejected
+// row as escaped text, so author HTML, images and refused links stay plain text.
+const ROW_END = "\n\n";
+function isMailLinkHref(href) {
+    return isAllowedDocumentLinkHref(href) && !isDocumentPlaceholderHref(href);
+}
+const inlineHtmlMarkdown = new Marked({ gfm: false, breaks: false });
+inlineHtmlMarkdown.use({
+    renderer: {
+        heading({ tokens }) {
+            const headingHtml = this.parser.parseInline(tokens);
+            return `<strong>${headingHtml}</strong>${ROW_END}`;
+        },
+        paragraph({ tokens }) {
+            return `${this.parser.parseInline(tokens)}${ROW_END}`;
+        },
+        code: ({ text }) => `${escapeHtml(text)}${ROW_END}`,
+        blockquote({ tokens }) {
+            return this.parser.parse(tokens);
+        },
+        list({ items }) {
+            return items.map((item) => this.parser.parse(item.tokens)).join("");
+        },
+        hr: () => "",
+        space: () => "",
+        del({ tokens }) {
+            return this.parser.parseInline(tokens);
+        },
+        br: () => " ",
+        html: ({ text }) => escapeHtml(text),
+        image: ({ text }) => escapeHtml(text),
+        text(token) {
+            // Only block-level text (a list item's own text) carries inline child tokens.
+            return "tokens" in token && token.tokens
+                ? `${this.parser.parseInline(token.tokens)}${ROW_END}`
+                : escapeHtml(token.text);
+        },
+        link({ href, tokens }) {
+            const labelHtml = this.parser.parseInline(tokens);
+            if (isMailLinkHref(href))
+                return `<a href="${escapeHtmlAttr(href)}">${labelHtml}</a>`;
+            return labelHtml === escapeHtml(href) ? labelHtml : `${labelHtml} (${escapeHtml(href)})`;
+        },
+    },
+});
 function termsParagraphsOf(markdown) {
-    return markdown
+    return inlineHtmlMarkdown
+        .parse(markdown, { async: false })
         .split(/\n\s*\n/)
-        .map((paragraph) => paragraph.replace(/^#{1,6}\s+/gm, "").trim())
-        .filter((paragraph) => paragraph.length > 0)
+        .map((row) => row.replace(/\s+/g, " ").trim())
+        .filter((row) => row.length > 0)
         .map((text) => ({ text }));
 }
 export function contractConfirmationVariables(args) {

package/dist/billing-foundation/consumer-protection/consent-gate.d.ts

@@ -22,6 +22,9 @@ export type OrderItem = {
     readonly labelKey: string;
     readonly params?: Readonly<Record<string, string | number>>;
 };
+/** Throws an InternalError (an app configuration fault, not a buyer error) for a
+ *  label the consent event could not store. */
+export declare function assertValidOrderItem(item: OrderItem | undefined, priceId: string): void;
 export type ConsentPriceDetails = {
     readonly tier: string | null;
     readonly priceId: string;

package/dist/billing-foundation/consumer-protection/consent-gate.js

@@ -2,12 +2,12 @@
 // validate + prepare before the provider call, record only after it succeeded.
 import { createHash } from "node:crypto";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { requireTemplateResolver, TEXT_BLOCK_KIND, TemplateNotFoundError, } from "../../template-resolver/index.js";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id.js";
-import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, PAYMENT_AGGREGATE_TYPE, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
+import { CHECKOUT_CONSENT_RECORDED_EVENT_QN, checkoutConsentRecordedPayloadSchema, PAYMENT_AGGREGATE_TYPE, SUBSCRIPTION_AGGREGATE_TYPE, } from "../events.js";
 import { consentTextVersion, resolveConsentLocale, submitMessageFor } from "./consent-text.js";
 // Optional at the schema level so a missing/unchecked consent reaches
 // prepareConsent and fails as 422 consent_required, not as a zod 400.
@@ -19,6 +19,25 @@ export const consentPayloadSchema = z
     locale: z.string().min(2).max(35),
 })
     .strict();
+// Bounds come from the event schema the label ends up in, so an app label that
+// passes here cannot fail the append after the provider session exists.
+const orderItemSchema = z.object({
+    labelKey: checkoutConsentRecordedPayloadSchema.shape.itemLabelKey.unwrap(),
+    params: checkoutConsentRecordedPayloadSchema.shape.itemLabelParams,
+});
+/** Throws an InternalError (an app configuration fault, not a buyer error) for a
+ *  label the consent event could not store. */
+export function assertValidOrderItem(item, priceId) {
+    // skip: subscription checkouts have no one-off order item
+    if (item === undefined)
+        return;
+    const parsed = orderItemSchema.safeParse(item);
+    if (!parsed.success) {
+        throw new InternalError({
+            message: `billing-foundation: consumerProtection.oneOffItemLabel returned an invalid label for priceId "${priceId}": ${parsed.error.message}`,
+        });
+    }
+}
 export async function prepareConsent(ctx, options, consent, mode) {
     if (!consent?.earlyPerformanceRequested || !consent.withdrawalLossAcknowledged) {
         throw new UnprocessableError("consent_required", {

package/dist/billing-foundation/consumer-protection/mail-notifications.js

@@ -21,7 +21,7 @@ export const OPERATOR_NOTICE_VARIABLES = {
 export const CONTRACT_CONFIRMATION_VARIABLES = {
     contractLines: textRows(),
     consentGivenAt: templateVariable.text({ required: true }),
-    termsParagraphs: textRows(),
+    termsParagraphs: templateVariable.list({ text: templateVariable.richText({ required: true }) }, { required: true }),
     operatorEmail: templateVariable.text({ required: true }),
 };
 function perLocale(build) {

package/dist/billing-foundation/consumer-protection/register-termination.js

@@ -16,7 +16,17 @@ export function registerContractTermination(r, options, consumerProtection) {
     // request: matched and unmatched requests then do the same work and the
     // response time does not tell whether the email belongs to a customer.
     // The tenant comes from the stored trigger event (the job's system user).
-    r.job("cancel-on-public-termination-declared", { trigger: { on: CONTRACT_TERMINATION_DECLARED_EVENT_QN }, runIn: "worker" }, async (payload, ctx) => {
+    // Every declaration appends to the same subscription stream, so parallel runs
+    // and a declaration arriving mid-run hit version conflicts. Sequential runs
+    // rule out the first; a retry re-reads the stream and the requestId check in
+    // record-contract-termination keeps it from recording twice.
+    r.job("cancel-on-public-termination-declared", {
+        trigger: { on: CONTRACT_TERMINATION_DECLARED_EVENT_QN },
+        runIn: "worker",
+        concurrency: "sequential",
+        retries: 3,
+        backoff: "exponential",
+    }, async (payload, ctx) => {
         const declared = contractTerminationDeclaredPayloadSchema.safeParse(payload);
         // skip: trigger event carries no usable declaration
         if (!declared.success)