@cosmicdrift/kumiko-bundled-features 0.364.0 → 0.365.0

package/dist/tier-engine/entity.d.ts

@@ -1,3 +1,4 @@
+import { type TierAssignmentSource } from "./constants.js";
 export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
     tier: {
         readonly type: "text";
@@ -23,25 +24,25 @@ export declare const tierAssignmentEntity: import("@cosmicdrift/kumiko-types/fie
         required: true;
     };
     source: {
-        readonly type: "text";
+        readonly type: "select";
         readonly description?: string;
-        readonly maxLength?: number;
-        readonly minLength?: number;
-        readonly autoComplete?: string;
+        readonly options: ("billing" | "default" | "manual")[];
         readonly required?: boolean;
-        readonly searchable?: boolean;
         readonly sortable?: boolean;
         readonly filterable?: boolean;
-        readonly encrypted?: boolean;
         readonly sensitive?: boolean;
-        readonly writeOnly?: boolean;
-        readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password";
-        readonly default?: string;
+        readonly default?: "billing" | "default" | "manual" | undefined;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-        readonly multiline?: boolean | {
-            readonly rows?: number;
-        };
+        readonly display?: "radio" | "dropdown";
+        readonly optionTones?: {
+            readonly billing?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly default?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly manual?: "bad" | "neutral" | "ok" | "warn" | undefined;
+        } | undefined;
+        readonly optionsQuery?: string;
+        readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+        readonly optionsAvailabilityQuery?: string;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"billing" | "default" | "manual">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
@@ -50,6 +51,6 @@ export type TierAssignmentRow = {
     readonly id: string;
     readonly version: number;
     readonly tier: string;
-    readonly source: string | null;
+    readonly source: TierAssignmentSource | null;
     readonly tenantId: string;
 };

package/dist/tier-engine/entity.js

@@ -1,4 +1,5 @@
-import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
+import { createEntity, createSelectField, createTextField, } from "@cosmicdrift/kumiko-framework/engine";
+import { TierAssignmentSources } from "./constants.js";
 // tier-assignment — pro Plattform-Tenant genau ein Aggregat. Aggregate-ID
 // wird deterministisch aus tenantId abgeleitet (uuidv5, siehe aggregate-id.ts).
 //
@@ -33,9 +34,9 @@ export const tierAssignmentEntity = createEntity({
         }),
         // Origin of the assignment, see TierAssignmentSources. Optional for back-compat with
         // rows without source. Protects manual grants from being overwritten by the billing sync.
-        source: createTextField({
+        source: createSelectField({
+            options: Object.values(TierAssignmentSources),
             required: false,
-            maxLength: 20,
             personal: false,
             reason: "technical_reference",
         }),

package/dist/tier-engine/handlers/set-tenant-tier.write.d.ts

@@ -15,6 +15,11 @@ export type SetTenantTierOptions = {
 export declare function createSetTenantTierWrite(opts?: SetTenantTierOptions): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"set-tenant-tier", z.ZodObject<{
     tenantId: z.ZodString;
     tier: z.ZodString;
+    source: z.ZodDefault<z.ZodEnum<{
+        readonly manual: "manual";
+        readonly billing: "billing";
+        readonly default: "default";
+    }>>;
 }, z.core.$strip>, {
     tenantId: string;
     tier: string;

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -13,7 +13,8 @@ import { tierAssignmentEntity } from "../entity.js";
 // Cross-tenant mechanics: ctx.forTenant(tenantId) yields a tenant-mode db bound to the target plus
 // the streamTenantId, so the event lands in the target's stream with the operator as actor.
 //
-// `source: TierAssignmentSources.manual` marks the grant so the billing sync skips it.
+// `source` defaults to manual and marks the grant so the billing sync skips it; passing
+// `billing` hands the row back to the sync, which overwrites it on the next webhook.
 // Upsert: one aggregate per tenant (deterministic aggregate id).
 //
 // Effective-set invalidation: the executor write does not fire the
@@ -30,7 +31,7 @@ const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEnt
 export function createSetTenantTierWrite(opts = {}) {
     return defineWriteHandler({
         name: "set-tenant-tier",
-        description: "Assigns a tier to any tenant as a manual grant without a billing purchase, marking it so a later billing sync will not overwrite it, and applies the new feature set immediately.",
+        description: "Assigns a tier to any tenant as a manual grant without a billing purchase, marking it so a later billing sync will not overwrite it (or, with source billing, handing the row back to the sync), and applies the new feature set immediately.",
         schema: z.object({
             tenantId: z.string().min(1),
             tier: z
@@ -38,6 +39,7 @@ export function createSetTenantTierWrite(opts = {}) {
                 .min(1)
                 .max(50)
                 .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
+            source: z.enum(TierAssignmentSources).default(TierAssignmentSources.manual),
         }),
         access: { roles: ["SystemAdmin"] },
         agent: { risk: "high" },
@@ -53,12 +55,13 @@ export function createSetTenantTierWrite(opts = {}) {
             const tenantId = event.payload.tenantId; // @cast-boundary engine-bridge
             const { db: tdb, streamTenantId } = requireForTenant(ctx, tenantId);
             const tier = event.payload.tier;
+            const source = event.payload.source;
             const existing = await fetchOne(tdb, tierAssignmentTable, { tenantId });
             if (existing) {
                 const result = await executor.update({
                     id: existing.id,
                     version: existing.version,
-                    changes: { tier, source: TierAssignmentSources.manual },
+                    changes: { tier, source },
                 }, event.user, tdb, { streamTenantId });
                 if (!result.isSuccess)
                     return result;
@@ -68,7 +71,7 @@ export function createSetTenantTierWrite(opts = {}) {
             const result = await executor.create({
                 id: tierAssignmentAggregateId(tenantId),
                 tier,
-                source: TierAssignmentSources.manual,
+                source,
                 tenantId,
             }, event.user, tdb, { streamTenantId });
             if (!result.isSuccess)

package/dist/tier-engine/index.d.ts

@@ -1,6 +1,6 @@
 export { tierAssignmentAggregateId } from "./aggregate-id.js";
 export { type AddOnDefinition, type AddOnMap, type ComposeAppInput, type ComposedApp, composeApp, type TierDefinition, type TierMap, } from "./compose-app.js";
-export { TIER_ENGINE_FEATURE, TierAssignmentSources, TierEngineHandlers, TierEngineQueries, } from "./constants.js";
+export { isTierAssignmentSource, TIER_ENGINE_FEATURE, type TierAssignmentSource, TierAssignmentSources, TierEngineHandlers, TierEngineQueries, } from "./constants.js";
 export { tierAssignmentEntity } from "./entity.js";
 export { type CreateTierEngineOptions, createTierEngineFeature, tierEngineFeature, } from "./feature.js";
 export { createTierOptionGate, type TierOptionAvailability, type TierOptionGate, type TierOptionGateDeps, type TierOptionSpec, } from "./tier-option-gate.js";

package/dist/tier-engine/index.js

@@ -8,7 +8,7 @@
 //   - `TierEngineHandlers` / `TierEngineQueries` — qualified handler names
 export { tierAssignmentAggregateId } from "./aggregate-id.js";
 export { composeApp, } from "./compose-app.js";
-export { TIER_ENGINE_FEATURE, TierAssignmentSources, TierEngineHandlers, TierEngineQueries, } from "./constants.js";
+export { isTierAssignmentSource, TIER_ENGINE_FEATURE, TierAssignmentSources, TierEngineHandlers, TierEngineQueries, } from "./constants.js";
 export { tierAssignmentEntity } from "./entity.js";
 export { createTierEngineFeature, tierEngineFeature, } from "./feature.js";
 export { createTierOptionGate, } from "./tier-option-gate.js";

package/dist/tier-engine/tier-resolver.d.ts

@@ -31,25 +31,25 @@ export declare function createTierResolver<TTier extends string, TCaps>(deps: Ti
             required: true;
         };
         source: {
-            readonly type: "text";
+            readonly type: "select";
             readonly description?: string;
-            readonly maxLength?: number;
-            readonly minLength?: number;
-            readonly autoComplete?: string;
+            readonly options: ("billing" | "default" | "manual")[];
             readonly required?: boolean;
-            readonly searchable?: boolean;
             readonly sortable?: boolean;
             readonly filterable?: boolean;
-            readonly encrypted?: boolean;
             readonly sensitive?: boolean;
-            readonly writeOnly?: boolean;
-            readonly readAsInstruction?: boolean;
-            readonly format?: "email" | "url" | "phone" | "password";
-            readonly default?: string;
+            readonly default?: "billing" | "default" | "manual" | undefined;
             readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
-            readonly multiline?: boolean | {
-                readonly rows?: number;
-            };
+            readonly display?: "radio" | "dropdown";
+            readonly optionTones?: {
+                readonly billing?: "bad" | "neutral" | "ok" | "warn" | undefined;
+                readonly default?: "bad" | "neutral" | "ok" | "warn" | undefined;
+                readonly manual?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            } | undefined;
+            readonly optionsQuery?: string;
+            readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
+            readonly optionsAvailabilityQuery?: string;
+            readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"billing" | "default" | "manual">[] | undefined;
         } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
             required: false;
         };

package/dist/user/constants.d.ts

@@ -3,6 +3,7 @@ export declare const USER_FEATURE: "user";
  *  platform operator. Membership roles (TenantAdmin/Admin/User/…) live on
  *  tenant-membership, not here. */
 export declare const GLOBAL_ROLE_OPTIONS: readonly ["SystemAdmin"];
+export type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 export declare const UserHandlers: {
     readonly create: "user:write:user:create";
     readonly update: "user:write:user:update";

package/dist/user/invited-global-roles.d.ts

@@ -1,14 +1,12 @@
 import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+import { type GlobalRole } from "./constants.js";
 export declare function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[];
 export declare function grantInvitedGlobalRoles(db: DbRunner, options: {
     readonly userId: string;
-    readonly globalRoles: readonly string[];
+    readonly globalRoles: readonly GlobalRole[];
 }): Promise<import("@cosmicdrift/kumiko-types/write-error-info-types").WriteFailure | {
     readonly isSuccess: true;
     readonly data: {
         readonly roles: readonly string[];
     };
 }>;
-export {};

package/dist/user-data-rights/email-templates.js

@@ -25,7 +25,6 @@ export const GDPR_MAIL_EN = {
     "gdpr.mail.deletionRequested.cancel": "If you didn't request this, sign in and cancel the deletion in your account settings before the deadline.",
     "gdpr.mail.deletionExecuted.subject": "{app} — Your account has been deleted",
     "gdpr.mail.deletionExecuted.intro": "your {app} account and the associated personal data were deleted on {when}. This action is permanent.",
-    "gdpr.mail.fallbackUrl": "If the button doesn't work, copy this link into your browser:",
 };
 registerMailTranslations("en", GDPR_MAIL_EN);
 export function formatGdprMailTimestamp(iso) {

package/dist/user-data-rights/i18n.js

@@ -1,4 +1,9 @@
 export const USER_DATA_RIGHTS_I18N = {
+    "user-data-rights:feature.label": { en: "Privacy" },
+    "user-data-rights:notify.export-ready.label": { en: "Data export ready" },
+    "user-data-rights:notify.export-failed.label": { en: "Data export failed" },
+    "user-data-rights:notify.deletion-requested.label": { en: "Deletion requested" },
+    "user-data-rights:notify.deletion-executed.label": { en: "Deletion completed" },
     "user-data-rights:nav.exportJobs": { en: "GDPR exports" },
     "screen:export-job-list.title": { en: "GDPR exports" },
     "screen:export-job-detail.title": { en: "Export job" },

package/dist/user-data-rights/lib/update-user-lifecycle.d.ts

@@ -1,6 +1,8 @@
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type WritePurpose } from "@cosmicdrift/kumiko-framework/db";
 export type UpdateUserLifecycleOptions = {
     readonly expect?: Readonly<Record<string, string | number | boolean | null>>;
+    readonly writePurpose?: WritePurpose;
 };
 export declare function updateUserLifecycle(conn: DbRunner, userId: string, changes: Record<string, unknown>, options?: UpdateUserLifecycleOptions): Promise<{
     readonly applied: boolean;

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -1,5 +1,5 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
@@ -39,7 +39,11 @@ export async function updateUserLifecycle(conn, userId, changes, options) {
     // version to pass as `payload.version`, which update() requires otherwise.
     // Callers needing a guard use `options.expect` instead.
     const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
-    const result = await userExecutor.update({ id: userId, changes }, createSystemUser(SYSTEM_TENANT_ID), tenantDb, { skipOptimisticLock: true, ...(options?.expect && { expect: options.expect }) });
+    const result = await userExecutor.update({ id: userId, changes }, createSystemUser(SYSTEM_TENANT_ID), tenantDb, {
+        skipOptimisticLock: true,
+        ...(options?.expect && { expect: options.expect }),
+        ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+    });
     if (result.isSuccess)
         return { applied: true };
     if (options?.expect &&

package/dist/user-data-rights/run-forget-cleanup.js

@@ -36,7 +36,7 @@ import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 // retried automatisch).
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createTenantDb, entityEventName, executeRawQuery, nullBlindIndexesForSubject, } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, entityEventName, executeRawQuery, nullBlindIndexesForSubject, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { EXT_USER_DATA, EXT_USER_DATA_ORDER, extensionUsageEscapeHatchReason, } from "@cosmicdrift/kumiko-framework/engine";
 import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject, } from "@cosmicdrift/kumiko-framework/search";
@@ -287,7 +287,7 @@ async function processUser(args) {
             // geworfen hat, kommen wir hier nicht an — die Tx rollback'd
             // alles, der User bleibt im DeletionRequested-Status, naechster
             // Run retried.
-            await updateUserLifecycle(tx, userId, { status: USER_STATUS.Deleted });
+            await updateUserLifecycle(tx, userId, { status: USER_STATUS.Deleted }, { writePurpose: WritePurposes.erasure });
             txSucceeded = true;
         });
     }

package/dist/waitlist/feature.js

@@ -12,7 +12,7 @@ import { waitlistListScreen } from "./screens.js";
 import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
 export function createWaitlistFeature(opts = {}) {
     return defineFeature(WAITLIST_FEATURE, (r) => {
-        r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response never reveals whether an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
+        r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
         r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
         r.systemScope();
         r.requires("tenant", "auth-email-password", "user-data-rights");

package/dist/waitlist/handlers/invite.write.js

@@ -1,4 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -6,8 +7,11 @@ import { AuthErrors, AuthHandlers } from "../../auth-email-password/index.js";
 import { TenantHandlers, tenantTable } from "../../tenant/index.js";
 import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
-import { adminAccess, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
+import { adminAccess, isTenantMember, platformActor, waitlistDb, waitlistExecutor, } from "../lib.js";
 import { WaitlistIdSchema } from "../payloads.js";
+// pg_advisory_xact_lock namespace (int4): 'wlin' as ASCII, disjoint from the submit lock.
+const INVITE_LOCK_NAMESPACE = 0x776c696e;
+const INVITE_LOCK_REASON = "takes the per-entry advisory lock so parallel invites cannot both create a tenant and invitation; TenantDb has no lock API";
 const DEFAULT_INVITE = {
     mode: "own-tenant",
     role: DEFAULT_OWN_TENANT_INVITE_ROLE,
@@ -17,7 +21,7 @@ function tenantKeyForEntry(entryId) {
     return `waitlist-${entryId}`;
 }
 function readEntryRow(row) {
-    const { id, version, email, name, company, linkedTenantId } = row;
+    const { id, version, email, name, company, linkedTenantId, locale } = row;
     if (typeof id !== "string" ||
         typeof version !== "number" ||
         typeof email !== "string" ||
@@ -32,6 +36,7 @@ function readEntryRow(row) {
         name,
         company: typeof company === "string" && company !== "" ? company : null,
         linkedTenantId: typeof linkedTenantId === "string" ? linkedTenantId : null,
+        locale: typeof locale === "string" && locale !== "" ? locale : undefined,
     };
 }
 function isInviteAlreadyAccepted(details) {
@@ -75,8 +80,13 @@ export function createInviteHandler(invite = DEFAULT_INVITE) {
         description: "Invites a pending or already-invited waitlist entry: creates its tenant (or uses the configured shared tenant), mails the entrant a fresh accept link with the configured role and marks the entry invited; rejected entries cannot be invited. The invitee never receives a global role.",
         // Sends an invite link by email, which cannot be recalled.
         agent: { risk: "high" },
+        escapeHatch: { grants: ["unsafeRaw"], reason: INVITE_LOCK_REASON },
         handler: async (event, ctx) => {
             const db = waitlistDb(ctx);
+            if (!ctx.systemDb) {
+                throw new InternalError({ message: "waitlist:invite requires ctx.systemDb" });
+            }
+            await acquireNamespacedAdvisoryLock(ctx.systemDb.unsafeRaw(INVITE_LOCK_REASON), INVITE_LOCK_NAMESPACE, event.payload.id);
             const row = await waitlistExecutor.detail({ id: event.payload.id }, platformActor(), db);
             if (!row)
                 return writeFailure(new NotFoundError("waitlistEntry", event.payload.id));
@@ -87,10 +97,18 @@ export function createInviteHandler(invite = DEFAULT_INVITE) {
             const target = await resolveInviteTarget(invite, entry, ctx);
             if ("isSuccess" in target)
                 return target;
+            if (await isTenantMember(db, entry.email, target.tenantId)) {
+                return writeFailure(new UnprocessableError(WaitlistErrors.notInvitable));
+            }
             // inviteCreate is admin-only (no system role); the system variant with an
             // empty globalRoles list is the only in-process path, and a waitlist
             // invite must never grant a global role.
-            const invited = await ctx.writeAs(createSystemUser(target.tenantId), AuthHandlers.systemInviteCreate, { email: entry.email.toLowerCase(), role: target.role, globalRoles: [] });
+            const invited = await ctx.writeAs(createSystemUser(target.tenantId), AuthHandlers.systemInviteCreate, {
+                email: entry.email.toLowerCase(),
+                role: target.role,
+                globalRoles: [],
+                ...(entry.locale !== undefined && { locale: entry.locale }),
+            });
             if (!invited.isSuccess) {
                 // Re-inviting a person who already accepted would reset their live invitation.
                 if (isInviteAlreadyAccepted(invited.error.details)) {

package/dist/waitlist/handlers/reject.write.js

@@ -1,24 +1,11 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createSystemUser, defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { cancelPendingInvitation, INVITATION_STATUS, tenantInvitationsTable, tenantMembershipsTable, } from "../../tenant/index.js";
-import { userTable } from "../../user/index.js";
+import { cancelPendingInvitation, INVITATION_STATUS, tenantInvitationsTable, } from "../../tenant/index.js";
 import { WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
-import { adminAccess, normalizeEmail, platformActor, waitlistDb, waitlistExecutor, } from "../lib.js";
+import { adminAccess, isTenantMember, normalizeEmail, platformActor, waitlistDb, waitlistExecutor, } from "../lib.js";
 import { WaitlistIdSchema } from "../payloads.js";
-// An admin re-invite can flip an accepted invitation back to pending, so the
-// invitation status alone cannot prove the person holds no access.
-async function isTenantMember(db, email, tenantId) {
-    const user = await fetchOne(db, userTable, {
-        email: normalizeEmail(email),
-        isDeleted: false,
-    });
-    if (!user)
-        return false;
-    const membership = await fetchOne(db, tenantMembershipsTable, { userId: user.id, tenantId });
-    return membership !== undefined && membership !== null;
-}
 // An invited entry already has a live invitation link; rejecting must kill it,
 // otherwise the rejected person can still sign up. Once accepted they hold
 // access, which only tenant member removal may revoke.

package/dist/waitlist/handlers/submit.write.js

@@ -13,8 +13,10 @@ const SUBMIT_LOCK_NAMESPACE = 0x776c7374;
 const SUBMIT_LOCK_REASON = "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check; TenantDb has no lock API";
 // Logged-in callers carry no anonymous role, so every signed-in role must be listed.
 const SUBMIT_ROLES = access.roles(...access.anonymous, ...access.authenticated, "Member", "TenantAdmin");
-// Identical for new, duplicate and honeypot submits: the response must not
-// reveal whether the email is already on the list.
+const OPEN_STATUSES = [WAITLIST_STATUS.Pending, WAITLIST_STATUS.Invited];
+// Identical body for new, duplicate and honeypot submits so the response does not
+// state whether the email is already on the list. Timing still differs: only the
+// new-entry path writes and sends mail.
 const SUBMITTED = {
     isSuccess: true,
     data: { kind: "submitted" },
@@ -31,8 +33,26 @@ function isHoneypotFilled(payload) {
     return payload.website !== undefined && payload.website.trim() !== "";
 }
 async function hasOpenEntryForEmail(email, ctx) {
-    const found = await waitlistExecutor.list({ filter: { field: "email", op: "eq", value: email }, limit: 50 }, platformActor(), waitlistDb(ctx));
-    return found.rows.some((row) => row["status"] === WAITLIST_STATUS.Pending || row["status"] === WAITLIST_STATUS.Invited);
+    const found = await waitlistExecutor.list({
+        filter: { field: "email", op: "eq", value: email },
+        filters: [{ field: "status", op: "in", value: OPEN_STATUSES }],
+        limit: 1,
+    }, platformActor(), waitlistDb(ctx));
+    return found.rows.length > 0;
+}
+// The resolver usually reads config; run it outside the handler transaction's
+// critical section so a failing statement cannot abort the transaction that holds
+// the entry, and a slow resolver does not extend the per-email advisory lock.
+async function resolveAdminRecipient(opts, ctx) {
+    try {
+        return (await opts.notifyRecipient?.(ctx)) || null;
+    }
+    catch (err) {
+        ctx.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
+            error: err instanceof Error ? err.message : String(err),
+        });
+        return null;
+    }
 }
 async function sendBestEffort(ctx, label, send) {
     try {
@@ -48,13 +68,15 @@ async function sendBestEffort(ctx, label, send) {
     }
 }
 export function createSubmitHandler(opts) {
+    const emailRateLimits = opts.emailRateLimits ?? DEFAULT_SUBMIT_EMAIL_RATE_LIMITS;
     return defineWriteHandler({
         name: "submit",
         schema: WaitlistSubmitSchema,
         access: { roles: SUBMIT_ROLES, personalData: "public-intake" },
         rateLimit: opts.rateLimit ?? DEFAULT_SUBMIT_RATE_LIMIT,
-        additionalRateLimits: opts.emailRateLimits ?? DEFAULT_SUBMIT_EMAIL_RATE_LIMITS,
-        description: "Public waitlist sign-up: registers an interest entry and sends the submitter a confirmation mail. Always reports success, whether the address is new or already on the list.",
+        // An empty array means "disabled"; boot validation rejects an empty additionalRateLimits.
+        ...(emailRateLimits.length > 0 && { additionalRateLimits: emailRateLimits }),
+        description: "Public waitlist sign-up: registers an interest entry and sends the submitter a confirmation mail. Reports success whether the address is new or already on the list; the response body is identical, response timing can still differ.",
         escapeHatch: { grants: ["unsafeRaw"], reason: SUBMIT_LOCK_REASON },
         handler: async (event, ctx) => {
             const payload = event.payload;
@@ -66,6 +88,7 @@ export function createSubmitHandler(opts) {
                     message: "waitlist:submit requires ctx.systemDb — is r.systemScope() set?",
                 });
             }
+            const adminRecipient = await resolveAdminRecipient(opts, ctx);
             await acquireNamespacedAdvisoryLock(ctx.systemDb.unsafeRaw(SUBMIT_LOCK_REASON), SUBMIT_LOCK_NAMESPACE, email);
             if (await hasOpenEntryForEmail(email, ctx))
                 return SUBMITTED;
@@ -89,7 +112,6 @@ export function createSubmitHandler(opts) {
                 locale: resolveWaitlistMailLocale(payload.locale),
             }));
             await sendBestEffort(ctx, "admin notice", async (notify) => {
-                const adminRecipient = await opts.notifyRecipient?.(ctx);
                 // skip: no admin recipient configured
                 if (!adminRecipient)
                     return;

package/dist/waitlist/i18n.js

@@ -1,4 +1,13 @@
 export const WAITLIST_I18N = {
+    "waitlist:feature.label": { en: "Waitlist", de: "Warteliste" },
+    "waitlist:notify.confirmation.label": {
+        en: "Waitlist confirmation",
+        de: "Bestätigung der Warteliste",
+    },
+    "waitlist:notify.admin-notice.label": {
+        en: "New waitlist entry",
+        de: "Neuer Eintrag auf der Warteliste",
+    },
     "screen:waitlist-list.title": { en: "Waitlist", de: "Warteliste" },
     "waitlist.nav.waitlist": { en: "Waitlist", de: "Warteliste" },
     "waitlist:entity:waitlistEntry:field:name": { en: "Name", de: "Name" },

package/dist/waitlist/lib.d.ts

@@ -1,5 +1,5 @@
 import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { type HandlerContext, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import { type HandlerContext, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 export declare const WAITLIST_CROSS_TENANT_REASON = "waitlist is platform-wide (systemScope)";
 export declare const adminAccess: {
     readonly roles: readonly string[];
@@ -8,3 +8,4 @@ export declare const waitlistExecutor: import("@cosmicdrift/kumiko-types/event-s
 export declare function normalizeEmail(email: string): string;
 export declare function waitlistDb(ctx: HandlerContext): TenantDb;
 export declare function platformActor(): SessionUser;
+export declare function isTenantMember(db: TenantDb, email: string, tenantId: TenantId): Promise<boolean>;

package/dist/waitlist/lib.js

@@ -1,6 +1,9 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, createSystemUser, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { tenantMembershipsTable } from "../tenant/index.js";
+import { userTable } from "../user/index.js";
 import { waitlistEntryEntity, waitlistEntryTable } from "./entity.js";
 export const WAITLIST_CROSS_TENANT_REASON = "waitlist is platform-wide (systemScope)";
 export const adminAccess = { roles: access.systemAdmin };
@@ -22,3 +25,15 @@ export function waitlistDb(ctx) {
 export function platformActor() {
     return createSystemUser(SYSTEM_TENANT_ID);
 }
+// An admin re-invite can flip an accepted invitation back to pending, so the
+// invitation status alone cannot prove the person holds no access.
+export async function isTenantMember(db, email, tenantId) {
+    const user = await fetchOne(db, userTable, {
+        email: normalizeEmail(email),
+        isDeleted: false,
+    });
+    if (!user)
+        return false;
+    const membership = await fetchOne(db, tenantMembershipsTable, { userId: user.id, tenantId });
+    return membership !== undefined && membership !== null;
+}

package/dist/workflow-runner/feature.js

@@ -30,7 +30,7 @@ import { registerWorkflowRunPendingProjection } from "./pending-projection.js";
 import { workflowRunPendingTableMeta } from "./tables.js";
 // Kebab-case matching the "./workflow-runner" export subpath — every other
 // bundled feature's runtime name follows this convention, and
-// FEATURE_IMPORT_REGISTRY (use-all-bundled) keys off it.
+// use-all-bundled's check-coverage matches exports to mounted features by it.
 const FEATURE_NAME = "workflow-runner";
 export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {
     r.describe("Writes the run-envelope (`workflow.run-started` / `workflow.run-completed` / `workflow.run-failed`) for a workflow run onto its `workflow-run` aggregate stream. Provides `startAndRunWorkflow` and `registerEventTrigger` for consumer features to wire up `defineWorkflow`-based workflows against domain events. Registers no workflows itself. Runs the resume loop for suspended `wait`/`retry`/`waitForEvent` steps (`resume-due-runs` job + `resume-run` handler); `registerEventTrigger` wires an event-wakeup subscriber per workflow that declares `awaits` so a `waitForEvent` step resumes as soon as its awaited event arrives, not just on timeout.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.364.0",
+  "version": "0.365.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -524,12 +524,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.364.0",
-    "@cosmicdrift/kumiko-framework": "0.364.0",
-    "@cosmicdrift/kumiko-headless": "0.364.0",
-    "@cosmicdrift/kumiko-renderer": "0.364.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.364.0",
-    "@cosmicdrift/kumiko-types": "0.364.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.365.0",
+    "@cosmicdrift/kumiko-framework": "0.365.0",
+    "@cosmicdrift/kumiko-headless": "0.365.0",
+    "@cosmicdrift/kumiko-renderer": "0.365.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.365.0",
+    "@cosmicdrift/kumiko-types": "0.365.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1078,9 +1078,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.364.0",
-    "@cosmicdrift/kumiko-locale-es": "0.364.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.364.0",
+    "@cosmicdrift/kumiko-locale-de": "0.365.0",
+    "@cosmicdrift/kumiko-locale-es": "0.365.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.365.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/audit/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Escape-hatch retention keeps the operator floor and deletes in bounded batches",
+    "detail": "An explicitly configured retention key now acts as a lower bound for tenant compliance-profile cutoffs, so a tenant profile can no longer delete events younger than the operator allows. A key left at its default does not count. Pruning runs in batches of 5000 events, each in its own transaction, until a batch comes back short."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Audit retention events always use the system user",
+    "detail": "Events written by the audit feature no longer fall back to the calling user id and always record the system user."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Magic-link mail expiry and app name use the template locale",
+    "detail": "The expiry text, the app-name fallback and the notify locale follow the locale the auth mail template actually renders in, while the link keeps the request locale."
+  },
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "systemInviteCreate takes an optional locale tag",
+    "detail": "The payload accepts a locale (BCP 47 tag) that wins over the request locale when rendering the invitation mail, so system callers such as the waitlist can invite in the recipient's language."
+  },
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "Auth mails carry designer labels",
+    "detail": "The feature registers <feature>:feature.label and notify labels for password-reset, account-unlock, email-verification, signup-activation and invite, so the document designer lists them by name. German and Spanish ship in the locale packages."
+  },
   {
     "version": "0.364.0",
     "type": "fix",