@cosmicdrift/kumiko-bundled-features 0.365.0 → 0.366.0

package/dist/admin-shell/feature.js

@@ -21,18 +21,18 @@ export function createAdminShellFeature(options = {}) {
             category: "operations",
             recommended: false,
         });
-        r.requires("user");
-        r.requires("tenant");
-        r.requires("audit");
-        r.requires("jobs");
-        r.requires("metrics");
-        r.requires("metrics-system");
+        r.requires({ features: ["user"] });
+        r.requires({ features: ["tenant"] });
+        r.requires({ features: ["audit"] });
+        r.requires({ features: ["jobs"] });
+        r.requires({ features: ["metrics"] });
+        r.requires({ features: ["metrics-system"] });
         if (includeTierAdmin)
-            r.requires("tier-engine");
+            r.requires({ features: ["tier-engine"] });
         if (includeCapOverview)
-            r.requires("cap-overview");
+            r.requires({ features: ["cap-overview"] });
         if (includeDocumentDesigner)
-            r.requires("document-designer");
+            r.requires({ features: ["document-designer"] });
         r.translations({ keys: ADMIN_SHELL_I18N });
         const tenantNav = [
             "admin-shell:nav:tenant-overview",

package/dist/agent-tools/tool-dispatch.d.ts

@@ -1,4 +1,5 @@
 import type { SessionUser, WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+import { type Logger } from "@cosmicdrift/kumiko-framework/logging";
 import type { ToolDispatchDescriptor } from "./types.js";
 /** Narrow view of `Dispatcher` (packages/framework/src/pipeline/dispatcher.ts) — kept out of
  *  `ToolDispatchDescriptor`'s reach and small enough for tests to build a plain object instead
@@ -17,6 +18,9 @@ export type ToolCallResult = {
 } | {
     readonly ok: false;
     readonly error: string;
+    readonly code?: string;
+    readonly retryable?: boolean;
+    readonly retryAfterSeconds?: number;
 };
 export type ToolCallRequest = {
     readonly dispatcher: ToolDispatcher;
@@ -30,10 +34,14 @@ export type ToolCallRequest = {
     /** Idempotency scope: `${runId}:${toolCallId}` becomes the write requestId. */
     readonly runId: string;
     readonly toolCallId: string;
+    /** Receives the cause of unexpected (5xx) failures, which the tool result never carries. */
+    readonly log?: Pick<Logger, "error">;
 };
 /** Executes one LLM-issued tool call. Never throws — a missing tool, a missing argument, a
  *  disallowed filter field, or a rejected handler call (cap check, validation, ...) all come
  *  back as `{ ok: false }` so the agent loop can feed the error back to the model instead of
- *  crashing. `request.user` must be the caller's real identity — every server-kind tool runs
+ *  crashing. Client errors (< 500) keep their message and carry a `code`; 429 adds
+ *  `retryable`. Server-side failures (>= 500, unknown throws) are logged and returned as a
+ *  generic message so internals never reach the model. `request.user` must be the caller's real identity — every server-kind tool runs
  *  through the same permission-checked dispatcher pipeline as a normal HTTP request. */
 export declare function dispatchToolCall(request: ToolCallRequest): Promise<ToolCallResult>;

package/dist/agent-tools/tool-dispatch.js

@@ -1,6 +1,48 @@
+import { isKumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { runAsDirectCallEntry } from "@cosmicdrift/kumiko-framework/internal/request-context";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
+const HTTP_TOO_MANY_REQUESTS = 429;
+const HTTP_SERVER_ERROR = 500;
+const UNEXPECTED_FAILURE_MESSAGE = "Tool failed unexpectedly";
+const fallbackLog = createFallbackLogger("agent-tools");
+function toolFailureOf(err) {
+    if (isKumikoError(err)) {
+        return {
+            code: err.code,
+            httpStatus: err.httpStatus,
+            message: err.message,
+            retryAfterSeconds: err.retryAfterSeconds,
+        };
+    }
+    return {
+        code: "internal_error",
+        httpStatus: HTTP_SERVER_ERROR,
+        message: err instanceof Error ? err.message : String(err),
+        retryAfterSeconds: undefined,
+    };
+}
+function createFailureClassifier(toolName, log) {
+    return (failure, cause) => {
+        if (failure.httpStatus === HTTP_TOO_MANY_REQUESTS) {
+            return {
+                ok: false,
+                error: failure.message,
+                code: failure.code,
+                retryable: true,
+                ...(failure.retryAfterSeconds !== undefined && {
+                    retryAfterSeconds: failure.retryAfterSeconds,
+                }),
+            };
+        }
+        if (failure.httpStatus < HTTP_SERVER_ERROR) {
+            return { ok: false, error: failure.message, code: failure.code };
+        }
+        log.error("agent tool call failed unexpectedly", { toolName, code: failure.code, cause });
+        return { ok: false, error: UNEXPECTED_FAILURE_MESSAGE, code: failure.code };
+    };
+}
 const SEARCH_RESULT_LIMIT = 10;
 const DEFAULT_LIST_LIMIT = 10;
 const MAX_LIST_LIMIT = 200;
@@ -124,7 +166,7 @@ async function dispatchServerQuery(descriptor, dispatcher, user, input) {
  *  paired detail handler right before the optimistic-lock write), dispatches with a
  *  run-scoped idempotency key, and — on success — re-reads through the detail handler so the
  *  returned data goes through the field-level read filter (the raw write result does not). */
-async function dispatchServerWrite(descriptor, dispatcher, user, input, runId, toolCallId) {
+async function dispatchServerWrite(descriptor, dispatcher, user, input, runId, toolCallId, classifyFailure) {
     let payload = input;
     if (descriptor.injectsVersion) {
         const id = input["id"];
@@ -144,7 +186,12 @@ async function dispatchServerWrite(descriptor, dispatcher, user, input, runId, t
     const requestId = `${runId}:${toolCallId}`;
     const result = await dispatcher.write(descriptor.qn, payload, user, requestId);
     if (!result.isSuccess) {
-        return { ok: false, error: result.error.message };
+        return classifyFailure({
+            code: result.error.code,
+            httpStatus: result.error.httpStatus,
+            message: result.error.message,
+            retryAfterSeconds: result.error.retryAfterSeconds,
+        }, result.error);
     }
     const { id, version } = extractIdAndVersion(result.data);
     const scalars = { ...(id !== undefined && { id }), ...(version !== undefined && { version }) };
@@ -230,10 +277,13 @@ function dispatchClient(descriptor, input) {
 /** Executes one LLM-issued tool call. Never throws — a missing tool, a missing argument, a
  *  disallowed filter field, or a rejected handler call (cap check, validation, ...) all come
  *  back as `{ ok: false }` so the agent loop can feed the error back to the model instead of
- *  crashing. `request.user` must be the caller's real identity — every server-kind tool runs
+ *  crashing. Client errors (< 500) keep their message and carry a `code`; 429 adds
+ *  `retryable`. Server-side failures (>= 500, unknown throws) are logged and returned as a
+ *  generic message so internals never reach the model. `request.user` must be the caller's real identity — every server-kind tool runs
  *  through the same permission-checked dispatcher pipeline as a normal HTTP request. */
 export async function dispatchToolCall(request) {
     const { dispatcher, user, toolName, input, dispatchTable, runId, toolCallId } = request;
+    const classifyFailure = createFailureClassifier(toolName, request.log ?? fallbackLog);
     const descriptor = dispatchTable.get(toolName);
     if (!descriptor) {
         return { ok: false, error: `Unknown tool "${toolName}"` };
@@ -252,11 +302,11 @@ export async function dispatchToolCall(request) {
                 case "server":
                     return descriptor.op === "query"
                         ? await dispatchServerQuery(descriptor, dispatcher, user, input)
-                        : await dispatchServerWrite(descriptor, dispatcher, user, input, runId, toolCallId);
+                        : await dispatchServerWrite(descriptor, dispatcher, user, input, runId, toolCallId, classifyFailure);
             }
         });
     }
     catch (err) {
-        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+        return classifyFailure(toolFailureOf(err), err);
     }
 }

package/dist/audit/feature.js

@@ -27,7 +27,7 @@ export function createAuditFeature() {
             recommended: false,
         });
         r.translations({ keys: AUDIT_I18N });
-        r.requires("tenant", "user", "config");
+        r.requires({ features: ["tenant", "user", "config"] });
         // Registered so ops tools/MSPs can discover the type — escape-hatch-audit-sink.ts appends it via the low-level event-store API.
         r.defineEvent("escape-hatch-used", escapeHatchUsedSchema, { piiFields: "none" });
         r.config("escapeHatchRetentionDays", createSystemConfig("number", {

package/dist/auth-email-password/constants.d.ts

@@ -18,7 +18,6 @@ export declare const AuthHandlers: {
     readonly inviteAcceptWithLogin: "auth-email-password:write:invite-accept-with-login";
     readonly inviteSignupComplete: "auth-email-password:write:invite-signup-complete";
     readonly switchTenantMfaGate: "auth-email-password:write:switch-tenant-mfa-gate";
-    readonly inviteCancel: "auth-email-password:write:invite-cancel";
 };
 export declare const AuthQueries: {
     readonly signupRegistrationStatus: "auth-email-password:query:signup-registration-status";

package/dist/auth-email-password/constants.js

@@ -36,7 +36,6 @@ export const AuthHandlers = {
     //   inviteAccept: logged-in user → POST token (membership-add)
     //   inviteAcceptWithLogin: anon user with existing email → POST token + email + password
     //   inviteSignupComplete: anon user with new email → POST token + password
-    //   inviteCancel: admin cancels a pending invite
     inviteCreate: "auth-email-password:write:invite-create",
     // System-only variant (access.system) that may carry global roles — see
     // invite-create.write.ts. Dispatched in-process by runBootstrap.
@@ -45,7 +44,6 @@ export const AuthHandlers = {
     inviteAcceptWithLogin: "auth-email-password:write:invite-accept-with-login",
     inviteSignupComplete: "auth-email-password:write:invite-signup-complete",
     switchTenantMfaGate: "auth-email-password:write:switch-tenant-mfa-gate",
-    inviteCancel: "auth-email-password:write:invite-cancel",
 };
 // Qualified query names. Anonymous-readable status so the (unauthenticated)
 // signup page can decide whether to show its own link/form.

package/dist/auth-email-password/feature.js

@@ -82,13 +82,13 @@ export function createAuthEmailPasswordFeature(opts = {}) {
                 { key: "accountUnlock", label: "Account-Unlock-Flow", type: "boolean", default: false },
             ],
         });
-        r.requires("user");
-        r.requires("tenant");
+        r.requires({ features: ["user"] });
+        r.requires({ features: ["tenant"] });
         // All five magic-link flows (reset/verify/signup/invite/unlock) dispatch
         // via ctx.notify → delivery must be mounted. Fail closed at boot instead
         // of silently dropping the mail.
         if (sendsMagicLinkMail(opts))
-            r.requires("delivery");
+            r.requires({ features: ["delivery"] });
         r.envSchema(authEmailPasswordEnvSchema);
         r.translations({ keys: AUTH_EMAIL_PASSWORD_MAIL_I18N });
         // Declared unconditionally: apps also issue the activation link from their

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -176,6 +176,7 @@ export function createInviteCreateHandler(opts) {
         name: "invite-create",
         schema: InviteCreateSchema,
         access: { roles: access.admin },
+        agent: { expose: false },
         description: "Invites an email address into the caller's tenant with a chosen membership role, creating or reusing the invitation and mailing the invitee a fresh accept link; re-inviting the same address invalidates the previous link.",
         handler: async (event, ctx) => {
             const roleRejection = checkAssignableInviteRole(opts, event.user.roles, event.payload.role, ctx);

package/dist/auth-mfa/feature.js

@@ -86,12 +86,12 @@ export function createAuthMfaFeature(opts) {
         // shared variable; an app mounting auth-mfa without `secrets` still gets the
         // KEK slot (and its _CIPHERTEXT twin) declared.
         r.envSchema(secretsEnvSchema);
-        r.requires("user");
-        r.requires("config");
+        r.requires({ features: ["user"] });
+        r.requires({ features: ["config"] });
         // verify.write.ts dispatches "tenant:query:memberships" — without this
         // the app boots clean and the first MFA login dies at runtime on an
         // unknown handler instead of failing at mount time.
-        r.requires("tenant");
+        r.requires({ features: ["tenant"] });
         r.config("required", mfaRequiredConfigKey(opts.requiredPolicy));
         // Declarative secretMint screen — mint (no input) -> reveal QR/secret/
         // recovery-codes -> confirm with a code. App places it via r.nav in its
@@ -112,7 +112,7 @@ export function createAuthMfaFeature(opts) {
             },
             handler: (payload, ctx) => mfaReencryptJob(payload, ctx, ctx.db.unsafeRaw()),
         });
-        r.entity("user-mfa", userMfaEntity);
+        r.entity({ name: "user-mfa", ...userMfaEntity });
         // Late-bound by run-prod-app once the sessions feature (if mounted) has
         // produced a concrete `sessionRevokeAllOthers` callback — mirrors
         // sessions' own bindAutoRevokeOnPasswordChange. Shared by every handler

package/dist/auth-mfa-user-data/index.js

@@ -8,7 +8,7 @@ import { defineFeature, EXT_USER_DATA } from "@cosmicdrift/kumiko-framework/engi
 import { userMfaDeleteHook, userMfaExportHook } from "./hooks.js";
 export const authMfaUserDataFeature = defineFeature("auth-mfa-user-data", (r) => {
     r.describe("GDPR (Art. 20 export / Art. 17 erasure) coverage for the `auth-mfa` feature's `user-mfa` entity. Mounts the EXT_USER_DATA export + delete hooks so 2FA enrollment status is included in the user-data export bundle and a user's TOTP secret + recovery codes are hard-deleted (via executor.forget, rebuild-safe) on a data-subject erasure request. Kept separate from `auth-mfa` so consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `auth-mfa`.");
-    r.requires("user-data-rights");
+    r.requires({ features: ["user-data-rights"] });
     r.optionalRequires("auth-mfa");
     r.useExtension(EXT_USER_DATA, "user-mfa", {
         export: userMfaExportHook,

package/dist/billing-foundation/consumer-protection/register-consent.js

@@ -22,7 +22,7 @@ function isConfirmableSubscriptionStatus(status) {
     return status === SubscriptionStatuses.active || status === SubscriptionStatuses.trialing;
 }
 export function registerConsumerProtection(r, options, consumerProtection) {
-    r.requires("template-resolver", "delivery", "user", "tenant");
+    r.requires({ features: ["template-resolver", "delivery", "user", "tenant"] });
     registerConsumerProtectionMails(r);
     registerContractTermination(r, options, consumerProtection);
     r.defineEvent(CHECKOUT_CONSENT_RECORDED_EVENT_SHORT, checkoutConsentRecordedPayloadSchema, {

package/dist/billing-foundation/feature.js

@@ -96,7 +96,7 @@ export function createBillingFoundationFeature(options = {}) {
             category: "billing",
             recommended: false,
         });
-        r.requires("tenant-lifecycle", "compliance-profiles");
+        r.requires({ features: ["tenant-lifecycle", "compliance-profiles"] });
         // 5 fine-grained domain-events. All 5 share the same payload shape (a
         // subscription-state snapshot); the event type tags what happened.
         // Future consumers (billing-history, accounting) listen directly on

package/dist/cap-counter/cap-reservation.js

@@ -1,11 +1,11 @@
-import { deleteMany, runInOwnTransaction } from "@cosmicdrift/kumiko-framework/db";
+import { deleteMany, isUniqueViolation, runInOwnTransaction, } from "@cosmicdrift/kumiko-framework/db";
 import { reraiseAsKumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { appendEventInTenantDb, getStreamVersionInTenantDb, } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { rollingCapAggregateId } from "./aggregate-id.js";
 import { applyCapDeltaOn, readRollingCapUsage, resolveCapCounterScope, retryCounterWriteOnVersionConflict, retryOnStreamVersionConflict, } from "./book-cap-usage.js";
-import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, CAP_RESERVATION_TTL_MINUTES, ROLLING_INCREMENTED_EVENT_QN, ROLLING_RELEASED_EVENT_QN, } from "./constants.js";
+import { CAP_COUNTER_ROLLING_AGGREGATE_TYPE, CAP_RESERVATION_TTL_MINUTES, CAP_SETTLED_TOMBSTONE_TTL_MINUTES, ROLLING_INCREMENTED_EVENT_QN, ROLLING_RELEASED_EVENT_QN, } from "./constants.js";
 import { capReservationsTable } from "./tables.js";
 const NOTHING_TO_RELEASE = { isSuccess: true, data: {} };
 async function insertReservationRow(txDb, user, id, draft) {
@@ -19,6 +19,7 @@ async function insertReservationRow(txDb, user, id, draft) {
         amount: draft.amount,
         expiresAt: now.add({ minutes: CAP_RESERVATION_TTL_MINUTES }),
         createdAt: now,
+        settledAt: null,
     });
 }
 function toHandle(ctx, id, outsideTransaction) {
@@ -94,7 +95,11 @@ export async function reserveRollingCap(ctx, options, outsideTransaction = true)
 // Deleting the row takes its row lock inside the handler transaction, so a release started after a
 // failed COMMIT waits for the real outcome and finds the row gone when the commit went through.
 async function confirmCapReservation(confirm, id) {
-    await deleteMany(confirm.tx, capReservationsTable, { id, tenantId: confirm.tenantId });
+    await deleteMany(confirm.tx, capReservationsTable, {
+        id,
+        tenantId: confirm.tenantId,
+        settledAt: null,
+    });
 }
 async function giveBackCalendar(txDb, user, row) {
     if (row.periodStartIso === null) {
@@ -113,7 +118,10 @@ async function giveBackRolling(txDb, user, row) {
 }
 async function giveBackReservation(txDb, user, id) {
     const ownRow = { id, tenantId: user.tenantId };
-    const row = await txDb.fetchOne(capReservationsTable, ownRow);
+    const row = await txDb.fetchOne(capReservationsTable, {
+        ...ownRow,
+        settledAt: null,
+    });
     if (!row)
         return NOTHING_TO_RELEASE;
     const claimed = await claimReservationRow(txDb, user, row);
@@ -127,9 +135,10 @@ async function giveBackReservation(txDb, user, id) {
     await txDb.deleteMany(capReservationsTable, ownRow);
     return given;
 }
-// Waits for a confirm still holding the row; false means that confirm (or another release) won.
+// Waits for a confirm still holding the row; false means that confirm, a settle or another release
+// won (Postgres re-checks settled_at after the lock wait).
 async function claimReservationRow(txDb, user, row) {
-    const claimed = await txDb.updateMany(capReservationsTable, { expiresAt: row.expiresAt }, { id: row.id, tenantId: user.tenantId });
+    const claimed = await txDb.updateMany(capReservationsTable, { expiresAt: row.expiresAt }, { id: row.id, tenantId: user.tenantId, settledAt: null });
     return claimed.length > 0;
 }
 export async function releaseCapReservation(ctx, id, outsideTransaction = true) {
@@ -143,39 +152,78 @@ function bookCalendarDelta(txDb, user, period, delta) {
         return Promise.resolve({ isSuccess: true, data: {} });
     return applyCapDeltaOn(txDb, user, { ...period, amount: Math.abs(delta) }, delta > 0 ? "add" : "subtract");
 }
-// Replaces the reserved amount by the actual one in a single transaction. When the row is already
-// gone (swept or released), the reserved amount was given back, so the full actual amount is booked.
+async function settleInTransaction(txDb, user, id, options) {
+    const ownRow = { id, tenantId: user.tenantId };
+    const open = await txDb.fetchOne(capReservationsTable, {
+        ...ownRow,
+        settledAt: null,
+    });
+    if (open && (await claimReservationRow(txDb, user, open))) {
+        const booked = await bookCalendarDelta(txDb, user, options, options.actualAmount - open.amount);
+        if (!booked.isSuccess)
+            return booked;
+        const now = Temporal.Now.instant();
+        await txDb.updateMany(capReservationsTable, { settledAt: now, expiresAt: now.add({ minutes: CAP_SETTLED_TOMBSTONE_TTL_MINUTES }) }, ownRow);
+        return booked;
+    }
+    // The claim lost to a concurrent settle or release: a tombstone means the amount is booked.
+    if (await txDb.fetchOne(capReservationsTable, ownRow)) {
+        return NOTHING_TO_RELEASE;
+    }
+    // Row swept or released: its amount was given back, so the full actual amount is booked and a
+    // tombstone makes a repeated settle a no-op. A parallel settle inserting first fails this insert.
+    const now = Temporal.Now.instant();
+    await txDb.insertOne(capReservationsTable, {
+        ...ownRow,
+        capName: options.capName,
+        kind: "calendar",
+        periodStartIso: options.periodStartIso,
+        amount: options.actualAmount,
+        expiresAt: now.add({ minutes: CAP_SETTLED_TOMBSTONE_TTL_MINUTES }),
+        createdAt: now,
+        settledAt: now,
+    });
+    return bookCalendarDelta(txDb, user, options, options.actualAmount);
+}
+// The failed tombstone insert aborts the whole attempt, so nothing was booked; the repeat sees the
+// winner's tombstone.
+async function retryOnceOnTombstoneRace(attempt) {
+    try {
+        return await attempt();
+    }
+    catch (error) {
+        if (!isUniqueViolation(error))
+            throw error;
+        return attempt();
+    }
+}
+// Replaces the reserved amount by the actual one in a single transaction and keeps the row as a
+// settled tombstone, so a repeated settle (retry, lost ack) books nothing twice.
 export async function settleCalendarCapReservation(ctx, id, options, outsideTransaction = true) {
     if (!Number.isInteger(options.actualAmount) || options.actualAmount < 0) {
         throw new Error(`cap-counter: settle amount must be a non-negative integer, got ${options.actualAmount}`);
     }
     const { user, writeDb } = resolveCapCounterScope(ctx, outsideTransaction);
-    const settled = await retryCounterWriteOnVersionConflict(() => runInOwnTransaction(writeDb, async (txDb) => {
-        const row = await txDb.fetchOne(capReservationsTable, {
-            id,
-            tenantId: user.tenantId,
-        });
-        const claimed = row ? await claimReservationRow(txDb, user, row) : false;
-        if (!row || !claimed) {
-            return bookCalendarDelta(txDb, user, options, options.actualAmount);
-        }
-        const booked = await bookCalendarDelta(txDb, user, options, options.actualAmount - row.amount);
-        if (!booked.isSuccess)
-            return booked;
-        await txDb.deleteMany(capReservationsTable, { id, tenantId: user.tenantId });
-        return booked;
-    }));
+    const settled = await retryCounterWriteOnVersionConflict(() => retryOnceOnTombstoneRace(() => runInOwnTransaction(writeDb, (txDb) => settleInTransaction(txDb, user, id, options))));
     if (!settled.isSuccess)
         throw reraiseAsKumikoError(settled.error);
 }
 // A failed release leaves its row behind; giving it back once the TTL passed bounds how long that
-// capacity stays counted.
+// capacity stays counted. Expired settled tombstones are only deleted: their amount stays booked.
 export async function releaseExpiredCapReservations(ctx, capName, outsideTransaction = true) {
     const { user, writeDb } = resolveCapCounterScope(ctx, outsideTransaction);
-    const expired = await writeDb.selectMany(capReservationsTable, {
+    const expiredWhere = {
         tenantId: user.tenantId,
         capName,
         expiresAt: { lt: Temporal.Now.instant() },
+    };
+    await writeDb.deleteMany(capReservationsTable, {
+        ...expiredWhere,
+        settledAt: { ne: null },
+    });
+    const expired = await writeDb.selectMany(capReservationsTable, {
+        ...expiredWhere,
+        settledAt: null,
     });
     for (const { id } of expired) {
         try {

package/dist/cap-counter/constants.d.ts

@@ -6,6 +6,7 @@ export declare const ROLLING_INCREMENTED_EVENT_QN: "cap-counter:event:rolling-in
 export declare const ROLLING_RELEASED_EVENT_SHORT: "rolling-released";
 export declare const ROLLING_RELEASED_EVENT_QN: "cap-counter:event:rolling-released";
 export declare const CAP_RESERVATION_TTL_MINUTES = 60;
+export declare const CAP_SETTLED_TOMBSTONE_TTL_MINUTES: number;
 export declare const CapCounterHandlers: {
     readonly increment: "cap-counter:write:increment";
     readonly incrementRolling: "cap-counter:write:increment-rolling";

package/dist/cap-counter/constants.js

@@ -22,6 +22,8 @@ export const ROLLING_RELEASED_EVENT_QN = "cap-counter:event:rolling-released";
 // A reservation row older than this is treated as a lost release and given back before the next
 // reservation for the same cap, which bounds the over-count a failed release can leave behind.
 export const CAP_RESERVATION_TTL_MINUTES = 60;
+// A settled reservation stays as a tombstone this long so a retried or lost-ack settle stays a no-op.
+export const CAP_SETTLED_TOMBSTONE_TTL_MINUTES = 24 * 60;
 // Qualified write handler names (QN format: scope:type:name).
 export const CapCounterHandlers = {
     increment: "cap-counter:write:increment",

package/dist/cap-counter/feature.js

@@ -1,7 +1,7 @@
 // cap-counter — Counter-Storage + Increment-API + Soft-Warn-State.
 //
 // **Was diese Feature liefert:**
-//   1. r.entity("cap-counter") — Counter-Rows pro (tenant, capName,
+//   1. r.entity({ name: "cap-counter" }) — Counter-Rows pro (tenant, capName,
 //      period) für Calendar-Period-Caps (Mails/Monat, Egress/Monat).
 //   2. increment-Handler — atomic counter increment via deterministic
 //      aggregate-id (try-create / executor-update). Race-frei via
@@ -60,7 +60,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
         category: "operations",
         recommended: false,
     });
-    r.entity("cap-counter", capCounterEntity);
+    r.entity({ name: "cap-counter", ...capCounterEntity });
     r.storeTable(capReservationsTableMeta, {
         reason: "coordination.cap_reservation_ledger",
     });

package/dist/cap-counter/tables.js

@@ -2,8 +2,9 @@ import { defineUnmanagedTable, index, instant, integer, table as pgTable, text,
 const CAP_RESERVATIONS_TENANT_CAP_EXPIRES_INDEX = "store_cap_reservations_tenant_id_cap_name_expires_at_idx";
 // One row per capacity that was booked before a handler transaction and is not settled yet. The
 // handler transaction deletes it on its own commit (confirm); a release or the TTL sweep deletes it
-// together with the counter decrement. Unmanaged: the rows are a coordination aid, not state with
-// an event history.
+// together with the counter decrement. A settle keeps the row as a tombstone (settled_at set) until
+// its shortened TTL passes, so a repeated settle or a late release finds it and does nothing.
+// Unmanaged: the rows are a coordination aid, not state with an event history.
 export const capReservationsTable = pgTable("store_cap_reservations", {
     id: uuid("id").primaryKey(),
     tenantId: uuid("tenant_id").notNull(),
@@ -14,6 +15,7 @@ export const capReservationsTable = pgTable("store_cap_reservations", {
     amount: integer("amount").notNull(),
     expiresAt: instant("expires_at").notNull(),
     createdAt: instant("created_at").notNull(),
+    settledAt: instant("settled_at"),
 }, (t) => [index(CAP_RESERVATIONS_TENANT_CAP_EXPIRES_INDEX).on(t.tenantId, t.capName, t.expiresAt)]);
 export const capReservationsTableMeta = defineUnmanagedTable({
     tableName: "store_cap_reservations",
@@ -32,5 +34,6 @@ export const capReservationsTableMeta = defineUnmanagedTable({
         { name: "amount", pgType: "integer", notNull: true },
         { name: "expires_at", pgType: "timestamptz", notNull: true },
         { name: "created_at", pgType: "timestamptz", notNull: true },
+        { name: "settled_at", pgType: "timestamptz", notNull: false },
     ],
 });

package/dist/cap-overview/feature.js

@@ -43,9 +43,9 @@ export function createCapOverviewFeature(opts) {
             recommended: false,
         });
         r.systemScope();
-        r.requires("tenant");
-        r.requires("tier-engine");
-        r.requires("billing-foundation");
+        r.requires({ features: ["tenant"] });
+        r.requires({ features: ["tier-engine"] });
+        r.requires({ features: ["billing-foundation"] });
         r.queryHandler(createTenantCapsListQuery(opts.caps, listCaps));
         r.queryHandler(createCapsUsageQuery(opts.caps, usageRoles));
         r.queryHandler(tenantOptionsQuery);

package/dist/channel-discord/feature.js

@@ -9,8 +9,8 @@ export function createChannelDiscordFeature(options = {}) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
-        r.requires("secrets");
+        r.requires({ features: ["delivery"] });
+        r.requires({ features: ["secrets"] });
         const webhookTarget = resolveChatWebhookTarget({
             defaultAllowedHosts: DISCORD_DEFAULT_ALLOWED_HOSTS,
             requiredPathPrefix: DISCORD_WEBHOOK_PATH_PREFIX,

package/dist/channel-email/feature.js

@@ -10,7 +10,7 @@ export function createChannelEmailFeature(options) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
+        r.requires({ features: ["delivery"] });
         r.translations({ keys: { "delivery.channel.email": { en: "Email" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, {
             mode: channel.mode,

package/dist/channel-in-app/feature.js

@@ -14,7 +14,7 @@ export function createChannelInAppFeature() {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
+        r.requires({ features: ["delivery"] });
         r.storeTable(inAppMessagesTableMeta, {
             reason: "read_side.in_app_messages",
         });

package/dist/channel-push/feature.js

@@ -10,7 +10,7 @@ export function createChannelPushFeature(options) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
+        r.requires({ features: ["delivery"] });
         r.translations({ keys: { "delivery.channel.push": { en: "Push" } } });
         r.useExtension(DELIVERY_CHANNEL_EXTENSION, "push", {
             mode: channel.mode,

package/dist/channel-slack/feature.js

@@ -9,8 +9,8 @@ export function createChannelSlackFeature(options = {}) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
-        r.requires("secrets");
+        r.requires({ features: ["delivery"] });
+        r.requires({ features: ["secrets"] });
         const webhookTarget = resolveChatWebhookTarget({ defaultAllowedHosts: SLACK_DEFAULT_ALLOWED_HOSTS }, options);
         const webhooks = r.secretNamespace("webhooks", {
             label: { en: "Slack webhooks", de: "Slack-Webhooks", es: "Webhooks de Slack" },

package/dist/channel-teams/feature.js

@@ -9,8 +9,8 @@ export function createChannelTeamsFeature(options = {}) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
-        r.requires("secrets");
+        r.requires({ features: ["delivery"] });
+        r.requires({ features: ["secrets"] });
         const webhookTarget = resolveChatWebhookTarget({ defaultAllowedHosts: TEAMS_DEFAULT_ALLOWED_HOSTS }, options);
         const webhooks = r.secretNamespace("webhooks", {
             label: {

package/dist/channel-telegram/feature.js

@@ -10,8 +10,8 @@ export function createChannelTelegramFeature(options = {}) {
             category: "notifications",
             recommended: false,
         });
-        r.requires("delivery");
-        r.requires("secrets");
+        r.requires({ features: ["delivery"] });
+        r.requires({ features: ["secrets"] });
         const botToken = r.secret("botToken", {
             label: { en: "Telegram bot token" },
             hint: {

package/dist/compliance-profiles/feature.js

@@ -22,7 +22,7 @@ export function createComplianceProfilesFeature(options) {
         // Context, Profile-Selection ist eigene Entity, sub-processor-Liste
         // sind Constants. Wenn S1.4+ Cross-Feature-Reads dazukommen, kommt
         // r.requires hier rein.
-        r.entity("tenant-compliance-profile", tenantComplianceProfileEntity);
+        r.entity({ name: "tenant-compliance-profile", ...tenantComplianceProfileEntity });
         r.exposesApi("compliance.forTenant");
         const handlers = {
             setProfile: r.writeHandler({ ...setProfileWrite, access: { roles: resolvedAccess } }),

package/dist/compliance-profiles-ops/index.js

@@ -7,7 +7,7 @@
 // a separate feature (mirrors folders-user-data/notes-history-user-data)
 // rather than folded into compliance-profiles: this is the one genuinely
 // cross-tenant capability in the picker's orbit, and it alone needs
-// r.systemScope() + a hard r.requires("tenant") — apps that only want the
+// r.systemScope() + a hard r.requires({ features: ["tenant"] }) — apps that only want the
 // per-tenant picker (the vast majority) stay unaffected.
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { tenantsMissingProfileQuery } from "./handlers/tenants-missing-profile.query.js";
@@ -19,8 +19,8 @@ export const complianceProfilesOpsFeature = defineFeature("compliance-profiles-o
         recommended: false,
     });
     r.systemScope();
-    r.requires("compliance-profiles");
-    r.requires("tenant");
+    r.requires({ features: ["compliance-profiles"] });
+    r.requires({ features: ["tenant"] });
     const queries = {
         tenantsMissingProfile: r.queryHandler(tenantsMissingProfileQuery),
     };