@cosmicdrift/kumiko-bundled-features 0.365.1 → 0.366.0

package/dist/tier-engine/feature.js

@@ -126,9 +126,9 @@ export function createTierEngineFeature(opts = {}) {
             category: "billing",
             recommended: false,
         });
-        r.requires("config");
-        r.requires("tenant");
-        r.entity("tier-assignment", tierAssignmentEntity);
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["tenant"] });
+        r.entity({ name: "tier-assignment", ...tierAssignmentEntity });
         // Standard-CRUD via Helper.
         r.writeHandler(defineEntityCreateHandler("tier-assignment", tierAssignmentEntity, {
             ...writeAccess,
@@ -265,27 +265,35 @@ export function createTierEngineFeature(opts = {}) {
         };
         onTierAssigned.fn = applyAssignment;
         // Invalidation: tier-assignment CRUD events (e.g. the billing webhook) update the cache.
-        r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
-            // result.data has tenantId + tier (after entity-update merge)
-            const data = result.data; // @cast-boundary engine-payload
-            // skip: defensive type-guard auf payload-shape. Bei korrekt gerenderten
-            // entity-events sind beide fields immer strings; ein malformed-payload
-            // (custom-handler-bug) würde hier silent zum cache-skip führen statt
-            // throwing — der lifecycle-pipeline darf nicht durch hook-fehler
-            // blocken (afterCommit-pattern, side-effect-best-effort).
-            if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
-                return;
-            applyAssignment(data.tenantId, data.tier);
+        r.hook({
+            type: "postSave",
+            target: { allOf: "tier-assignment" },
+            handler: async (result) => {
+                // result.data has tenantId + tier (after entity-update merge)
+                const data = result.data; // @cast-boundary engine-payload
+                // skip: defensive guard on the payload shape. Correct entity events
+                // always carry both fields as strings; a malformed payload (a custom
+                // handler bug) skips the cache update instead of throwing, because a
+                // hook error must not block the lifecycle pipeline (afterCommit,
+                // best-effort side effect).
+                if (typeof data.tenantId !== "string" || typeof data.tier !== "string")
+                    return;
+                applyAssignment(data.tenantId, data.tier);
+            },
         });
-        r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
-            const data = payload.data; // @cast-boundary engine-payload
-            // skip: gleiche type-guard semantik wie postSave-hook oben.
-            if (typeof data.tenantId !== "string")
-                return;
-            const tenantId = data.tenantId;
-            takeTicket(tenantId);
-            cache.delete(tenantId);
-            publishAssignmentChange(tenantId);
+        r.hook({
+            type: "postDelete",
+            target: { allOf: "tier-assignment" },
+            handler: async (payload) => {
+                const data = payload.data; // @cast-boundary engine-payload
+                // skip: gleiche type-guard semantik wie postSave-hook oben.
+                if (typeof data.tenantId !== "string")
+                    return;
+                const tenantId = data.tenantId;
+                takeTicket(tenantId);
+                cache.delete(tenantId);
+                publishAssignmentChange(tenantId);
+            },
         });
         // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
         // mit tenant-create rollback), schreibt tier-assignment via Direct-
@@ -302,55 +310,61 @@ export function createTierEngineFeature(opts = {}) {
         if (opts.defaultTier !== undefined) {
             const defaultTier = opts.defaultTier;
             const autoDefaultTierHookReason = "seeds the default tier-assignment stream of the tenant just created";
-            r.hook("postSave", { allOf: "tenant" }, async (result, ctx) => {
-                // result-shape: kumiko-framework's SaveContext mit isNew + data
-                const saveResult = result; // @cast-boundary engine-payload
-                // skip: nur bei tenant-create (initial) — tenant-updates feuern
-                // auch postSave aber wir wollen kein neues tier-assignment bei
-                // re-keying oder name-update.
-                if (saveResult.isNew !== true)
-                    return;
-                const data = saveResult.data; // @cast-boundary engine-payload
-                // skip: defensive type-guard. Tenant-entity hat id zwingend, aber
-                // CrudExecutor's payload-shape ist runtime-unknown.
-                if (typeof data.id !== "string")
-                    return;
-                const newTenantId = data.id; // @cast-boundary engine-payload
-                const aggregateId = tierAssignmentAggregateId(newTenantId);
-                // tenant is an r.systemScope() feature, so this cross-feature hook gets a
-                // fail-closed ctx.db — reach for ctx.systemDb instead (see entity-handlers.ts).
-                // Event-store paths need the raw DbConnection — TenantDb only exposes
-                // select/insert/update/delete, not execute (db.execute(sql`SELECT pg_notify(...)`) would TypeError).
-                const rawDb = ctx.systemDb
-                    ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
-                    : ctx.db && "unsafeRaw" in ctx.db
-                        ? ctx.db.unsafeRaw()
-                        : undefined;
-                // skip: defensive — inTransaction phase always sets db, but AppContext's
-                // type makes it optional. Throwing would be overreach (lifecycle
-                // blocking), silent-skip is defensive-soft.
-                if (!rawDb)
-                    return;
-                // Idempotency: stream-existence-check vor create. Pattern aus
-                // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
-                const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
-                // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
-                if (streamVersion > 0)
-                    return;
-                // SystemUser für den NEUEN tenant — der Hook wird vom signup-
-                // user (anderer tenant, oder SystemAdmin) ausgelöst, aber das
-                // tier-assignment muss im stream des neu-erzeugten tenants
-                // landen (= aggregate-id deterministic auf newTenantId). Memory
-                // `feedback_event_store_tenant_consistency`: by.tenantId muss =
-                // ziel-tenant.
-                const systemUser = {
-                    id: "00000000-0000-4000-8000-000000000001",
-                    tenantId: newTenantId,
-                    roles: ["SystemAdmin"],
-                };
-                const tdb = createTenantDb(rawDb, newTenantId, "system");
-                await tierAssignmentExecutor.create({ id: aggregateId, tier: defaultTier, source: TierAssignmentSources.default }, systemUser, tdb);
-            }, { phase: HookPhases.inTransaction, escapeHatch: { reason: autoDefaultTierHookReason } });
+            r.hook({
+                type: "postSave",
+                target: { allOf: "tenant" },
+                handler: async (result, ctx) => {
+                    // result-shape: kumiko-framework's SaveContext mit isNew + data
+                    const saveResult = result; // @cast-boundary engine-payload
+                    // skip: nur bei tenant-create (initial) — tenant-updates feuern
+                    // auch postSave aber wir wollen kein neues tier-assignment bei
+                    // re-keying oder name-update.
+                    if (saveResult.isNew !== true)
+                        return;
+                    const data = saveResult.data; // @cast-boundary engine-payload
+                    // skip: defensive type-guard. Tenant-entity hat id zwingend, aber
+                    // CrudExecutor's payload-shape ist runtime-unknown.
+                    if (typeof data.id !== "string")
+                        return;
+                    const newTenantId = data.id; // @cast-boundary engine-payload
+                    const aggregateId = tierAssignmentAggregateId(newTenantId);
+                    // tenant is an r.systemScope() feature, so this cross-feature hook gets a
+                    // fail-closed ctx.db — reach for ctx.systemDb instead (see entity-handlers.ts).
+                    // Event-store paths need the raw DbConnection — TenantDb only exposes
+                    // select/insert/update/delete, not execute (db.execute(sql`SELECT pg_notify(...)`) would TypeError).
+                    const rawDb = ctx.systemDb
+                        ? ctx.systemDb.unsafeRaw(autoDefaultTierHookReason)
+                        : ctx.db && "unsafeRaw" in ctx.db
+                            ? ctx.db.unsafeRaw()
+                            : undefined;
+                    // skip: defensive — inTransaction phase always sets db, but AppContext's
+                    // type makes it optional. Throwing would be overreach (lifecycle
+                    // blocking), silent-skip is defensive-soft.
+                    if (!rawDb)
+                        return;
+                    // Idempotency: stream-existence-check vor create. Pattern aus
+                    // seedTenant.ts. Bei re-replay (rebuild) nicht versionsbumpen.
+                    const streamVersion = await getUnscopedAggregateStreamMaxVersion(rawDb, aggregateId);
+                    // skip: idempotent — tier-assignment stream already seeded (rebuild/replay).
+                    if (streamVersion > 0)
+                        return;
+                    // SystemUser für den NEUEN tenant — der Hook wird vom signup-
+                    // user (anderer tenant, oder SystemAdmin) ausgelöst, aber das
+                    // tier-assignment muss im stream des neu-erzeugten tenants
+                    // landen (= aggregate-id deterministic auf newTenantId). Memory
+                    // `feedback_event_store_tenant_consistency`: by.tenantId muss =
+                    // ziel-tenant.
+                    const systemUser = {
+                        id: "00000000-0000-4000-8000-000000000001",
+                        tenantId: newTenantId,
+                        roles: ["SystemAdmin"],
+                    };
+                    const tdb = createTenantDb(rawDb, newTenantId, "system");
+                    await tierAssignmentExecutor.create({ id: aggregateId, tier: defaultTier, source: TierAssignmentSources.default }, systemUser, tdb);
+                },
+                phase: HookPhases.inTransaction,
+                escapeHatch: { reason: autoDefaultTierHookReason },
+            });
         }
         // Extension-point declaration + self-registration. Pattern analog
         // mail-foundation/file-foundation: das feature deklariert den

package/dist/user/feature.js

@@ -21,7 +21,7 @@ export function createUserFeature() {
             recommended: true,
         });
         r.systemScope();
-        r.entity("user", userEntity);
+        r.entity({ name: "user", ...userEntity });
         // Self-extension: `user` declares AND fulfils principalStatus (precedent:
         // tier-engine/feature.ts) — wires the blocked-principal check into every stack that mounts `user`.
         r.extendsRegistrar(EXT_PRINCIPAL_STATUS, {});

package/dist/user-data-rights/feature.js

@@ -56,7 +56,7 @@ export function createUserDataRightsFeature(opts = {}) {
             category: "compliance",
             recommended: false,
         });
-        r.requires("user", "data-retention", "compliance-profiles", "sessions");
+        r.requires({ features: ["user", "data-retention", "compliance-profiles", "sessions"] });
         r.usesApi("compliance.forTenant");
         r.usesApi("retention.policyFor");
         // S2.U6 — restrict-account ruft sessions.revokeAllForUser cross-feature.
@@ -92,13 +92,13 @@ export function createUserDataRightsFeature(opts = {}) {
             env: "TENANT_MODEL",
         }));
         // S2.U3 Atom 1b — ExportJob-Lifecycle-Entity.
-        r.entity("export-job", exportJobEntity);
+        r.entity({ name: "export-job", ...exportJobEntity });
         // S2.U3 Atom 4a — Download-Token-Entity. Worker generiert Token beim
         // Flip auf done (siehe run-export-jobs.ts). Hash in DB, plain im
         // RunExportJobsResult fuer Atom 5 (Notification per Email).
-        r.entity("export-download-token", exportDownloadTokenEntity);
+        r.entity({ name: "export-download-token", ...exportDownloadTokenEntity });
         // S2.U7 — Audit-Trail invalid Download-Attempts (DPO Brute-Force-Detection).
-        r.entity("download-attempt", downloadAttemptEntity);
+        r.entity({ name: "download-attempt", ...downloadAttemptEntity });
         // S2.U6 — DSGVO Art. 18 Account-Freeze (Verarbeitungs-Pause).
         // Endpoints fuer Restrict + Lift. Login-Block fuer Restricted Users
         // lebt in auth-email-password/login.write.ts.

package/dist/user-data-rights-defaults/feature.js

@@ -14,7 +14,7 @@ import { userSessionDeleteHook, userSessionExportHook, } from "./hooks/user-sess
 // `user` (S2.H1) und `fileRef` (S2.H2).
 //
 // Architektur-Entscheidung (S2.H1+H2): user-data-rights selbst kann
-// nicht r.requires("user", "files") + r.useExtension(EXT_USER_DATA, ...)
+// nicht r.requires({ features: ["user", "files"] }) + r.useExtension(EXT_USER_DATA, ...)
 // machen weil es selbst Provider von EXT_USER_DATA ist (Boot-Validator
 // lehnt self-extension ab). Lösung: drittes optional-mountbares Feature
 // das requires beide Sources + die useExtension-Calls macht.
@@ -40,7 +40,7 @@ export function createUserDataRightsDefaultsFeature() {
             category: "compliance",
             recommended: false,
         });
-        r.requires("user", "files", "user-data-rights");
+        r.requires({ features: ["user", "files", "user-data-rights"] });
         // Optional sources: hooks are registered unconditionally but each one
         // no-ops at runtime when its source feature isn't mounted (see
         // hooks/feature-mounted.ts) — the export runner has no per-hook

package/dist/user-profile/feature.js

@@ -22,10 +22,10 @@ export function createUserProfileFeature(options) {
             category: "identity",
             recommended: true,
         });
-        r.requires("user");
-        r.requires("auth-email-password");
-        r.requires("user-data-rights");
-        r.requires("user-data-rights-defaults");
+        r.requires({ features: ["user"] });
+        r.requires({ features: ["auth-email-password"] });
+        r.requires({ features: ["user-data-rights"] });
+        r.requires({ features: ["user-data-rights-defaults"] });
         const handlers = allowEmailChange ? { changeEmail: r.writeHandler(changeEmailWrite) } : {};
         // Boot-validator requires a "screen:<id>.title" key per r.screen(), plus
         // one entry per i18nKey()-marked dot-form label below — kept inline (not

package/dist/waitlist/feature.js

@@ -15,7 +15,7 @@ export function createWaitlistFeature(opts = {}) {
         r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
         r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
         r.systemScope();
-        r.requires("tenant", "auth-email-password", "user-data-rights");
+        r.requires({ features: ["tenant", "auth-email-password", "user-data-rights"] });
         r.translations({ keys: WAITLIST_I18N });
         r.notification("confirmation", {
             variables: WAITLIST_CONFIRMATION_VARIABLES,
@@ -26,7 +26,7 @@ export function createWaitlistFeature(opts = {}) {
             record: WAITLIST_ADMIN_NOTICE_RECORD,
             localizedTemplate: waitlistAdminNoticeTemplate,
         });
-        r.entity("waitlistEntry", waitlistEntryEntity);
+        r.entity({ name: "waitlistEntry", ...waitlistEntryEntity });
         r.writeHandler(createSubmitHandler(opts));
         r.writeHandler(createInviteHandler(opts.invite));
         r.writeHandler(rejectHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.365.1",
+  "version": "0.366.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -524,12 +524,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.365.1",
-    "@cosmicdrift/kumiko-framework": "0.365.1",
-    "@cosmicdrift/kumiko-headless": "0.365.1",
-    "@cosmicdrift/kumiko-renderer": "0.365.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.365.1",
-    "@cosmicdrift/kumiko-types": "0.365.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.366.0",
+    "@cosmicdrift/kumiko-framework": "0.366.0",
+    "@cosmicdrift/kumiko-headless": "0.366.0",
+    "@cosmicdrift/kumiko-renderer": "0.366.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.366.0",
+    "@cosmicdrift/kumiko-types": "0.366.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1078,9 +1078,9 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.365.1",
-    "@cosmicdrift/kumiko-locale-es": "0.365.1",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.365.1",
+    "@cosmicdrift/kumiko-locale-de": "0.366.0",
+    "@cosmicdrift/kumiko-locale-es": "0.366.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.366.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1"
   }

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Agent tool failures are classified instead of passing raw messages through",
+    "detail": "dispatchToolCall now adds a code to failed tool results. Client errors keep their message, rate limits also set retryable and retryAfterSeconds. Server errors and unknown throws are logged with their cause and returned to the model as \"Tool failed unexpectedly\", so internal details such as database messages no longer reach the model. ToolCallRequest accepts an optional log."
+  },
   {
     "version": "0.353.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "Removed unused AuthHandlers.inviteCancel constant",
+    "detail": "AuthHandlers.inviteCancel pointed at auth-email-password:write:invite-cancel, a handler that never existed. The constant is removed.",
+    "migration": "If you referenced AuthHandlers.inviteCancel, use tenant:write:cancel-invitation."
+  },
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "invite-create is no longer exposed to agents",
+    "detail": "The admin invite-create handler is now opted out of the agent tool catalog with agent: { expose: false }, like the other invite handlers, because it mails an accept link to an arbitrary address."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/cap-counter/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "cap-counter calendar settle is idempotent",
+    "detail": "Settling a calendar cap reservation now keeps the row as a tombstone (new column store_cap_reservations.settled_at, retained for 24 hours) instead of deleting it. A repeated settle with the same reservation id is a no-op, and confirm, give-back and expiry sweep ignore settled rows. The sweep deletes expired tombstones.",
+    "migration": "Apps with cap-counter generate a migration for the new column store_cap_reservations.settled_at (kumiko migrate generate)."
+  },
   {
     "version": "0.365.0",
     "type": "breaking",

package/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "fix",
+    "title": "forget-subject is covered for users stored before the KMS and users without an event stream",
+    "detail": "Tests now cover forget-subject for users stored as plaintext before the KMS was configured and for users without an event stream. Both succeed since the KMS tombstone fix, close the login door and write the audit event."
+  },
   {
     "version": "0.365.1",
     "type": "fix",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Renaming a notification type keeps user preferences and address opt-outs",
+    "detail": "r.notification accepts renamedFrom, a list of former qualified names. Preferences and address opt-outs stored under a former name keep applying to the renamed notification, and a stored choice under the current name wins over one under a former name. New writes via setPreference and the unsubscribe and resubscribe handlers are stored under the current name, resubscribeAddress also lifts opt-outs under former names. Boot fails if an alias is a current notification name, is the wildcard, or is claimed by two notifications."
+  },
   {
     "version": "0.365.0",
     "type": "fix",

package/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.366.0",
+    "type": "improvement",
+    "title": "Inbound mail fetch can skip already-seen message ids",
+    "detail": "InboundMailProviderPlugin.fetch receives an optional filterUnknownMessageIds(providerMessageIds) hook. The watch supervisor implements it with a tenant- and account-scoped lookup of already-seen provider message ids and returns the ids not seen yet, so a plugin can avoid downloading messages it has already processed."
+  },
+  {
+    "version": "0.366.0",
+    "type": "breaking",
+    "title": "InboundMailContext exposes metricsFor to provider plugins",
+    "detail": "InboundMailContext gains an optional metricsFor(featureName) returning a MetricsHandle. runProdApp, the worker app and the dev server wire it from the observability meter, so provider plugins can emit their own metrics through the same pipeline.",
+    "migration": "Code that builds SystemWireDeps itself adds metricsFor (createMetricsForFactory(meter))."
+  },
   {
     "version": "0.364.0",
     "type": "fix",