@cosmicdrift/kumiko-bundled-features 0.368.0 → 0.370.0

package/dist/tier-engine/web/client-plugin.js

@@ -2,9 +2,10 @@
 // Client-feature factory for tier-engine. Supplies the default translations
 // for the declarative tier-admin actionForm (registered server-side via
 // r.screen in the feature); the app places the screen only via r.nav.
-import { mergeTranslations } from "@cosmicdrift/kumiko-renderer";
+import { mergeTranslations, translationsByLocaleFromKeys, } from "@cosmicdrift/kumiko-renderer";
 import { TIER_ENGINE_FEATURE } from "../constants.js";
-import { defaultTranslations } from "../i18n.js";
+import { TIER_ENGINE_I18N } from "../i18n.js";
+const defaultTranslations = translationsByLocaleFromKeys(TIER_ENGINE_I18N);
 export function tierEngineClient(options) {
     return {
         name: TIER_ENGINE_FEATURE,

package/dist/tier-engine/web/index.d.ts

@@ -1 +1 @@
-export { type TierEngineClientOptions, tierEngineClient } from "./client-plugin.js";
+export { type TierEngineClientOptions, tierEngineClient } from "./client-plugin.tsx";

package/dist/user/index.d.ts

@@ -1,8 +1,8 @@
-export { UserCommandSchemas } from "./command-schemas.js";
-export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants.js";
-export { backfillUserStreamTenants, type UserStreamBackfillResult, } from "./db/queries/stream-tenant-backfill.js";
-export { createUserFeature } from "./feature.js";
-export { isPrincipalBlocked, isPrincipalRowBlocked, principalStatusPlugin, } from "./principal-status.js";
-export { resolveUserDisplayNames } from "./resolve-display-names.js";
-export type { UserStatus } from "./schema/user.js";
-export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.js";
+export { UserCommandSchemas } from "./command-schemas.ts";
+export { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "./constants.ts";
+export { backfillUserStreamTenants, type UserStreamBackfillResult, } from "./db/queries/stream-tenant-backfill.ts";
+export { createUserFeature } from "./feature.ts";
+export { isPrincipalBlocked, isPrincipalRowBlocked, principalStatusPlugin, } from "./principal-status.ts";
+export { resolveUserDisplayNames } from "./resolve-display-names.ts";
+export type { UserStatus } from "./schema/user.ts";
+export { USER_ANONYMIZED_DISPLAY_NAME, USER_ANONYMIZED_EMAIL_DOMAIN, USER_ANONYMIZED_EMAIL_PREFIX, USER_DELETED_DISPLAY_NAME, USER_DELETED_EMAIL_PREFIX, USER_STATUS, userEntity, userTable, } from "./schema/user.ts";

package/dist/user/invited-global-roles.d.ts

@@ -1,5 +1,5 @@
 import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { type GlobalRole } from "./constants.js";
+import { type GlobalRole } from "./constants.ts";
 export declare function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[];
 export declare function grantInvitedGlobalRoles(db: DbRunner, options: {
     readonly userId: string;

package/dist/user/principal-status.d.ts

@@ -1,5 +1,5 @@
 import type { PrincipalStatusPlugin } from "@cosmicdrift/kumiko-framework/engine";
-import { type UserStatus } from "./schema/user.js";
+import { type UserStatus } from "./schema/user.ts";
 export declare function isPrincipalBlocked(status: UserStatus): boolean;
 export declare function isPrincipalRowBlocked(row: {
     readonly status: UserStatus;

package/dist/user/seeding.d.ts

@@ -1,6 +1,6 @@
 import { type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
-import { type SeedTenantHooks } from "../tenant/seeding.js";
+import { type SeedTenantHooks } from "../tenant/seeding.ts";
 export type SeedUserOptions = {
     readonly email: string;
     readonly displayName: string;

package/dist/user/testing.d.ts

@@ -1 +1 @@
-export * from "./seeding.js";
+export * from "./seeding.ts";

package/dist/user-data-rights/deletion-token.d.ts

@@ -1,5 +1,5 @@
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { type RowBoundGrantResult } from "../shared/index.js";
+import { type RowBoundGrantResult } from "../shared/index.ts";
 export declare function signDeletionToken(userId: string, requestId: string, ttlMinutes: number, secret: string, now?: Temporal.Instant): {
     readonly token: string;
     readonly expiresAt: Temporal.Instant;

package/dist/user-data-rights/feature.d.ts

@@ -1,9 +1,9 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import { type SendDeletionRequestedEmailFn } from "./handlers/request-deletion.write.js";
-import { type SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write.js";
-import { type GdprMailDefaults } from "./lib/default-mailers.js";
-import { type SendExportFailedEmailFn, type SendExportReadyEmailFn } from "./run-export-jobs.js";
-import { type SendDeletionExecutedEmailFn } from "./run-forget-cleanup.js";
+import { type SendDeletionRequestedEmailFn } from "./handlers/request-deletion.write.ts";
+import { type SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write.ts";
+import { type GdprMailDefaults } from "./lib/default-mailers.ts";
+import { type SendExportFailedEmailFn, type SendExportReadyEmailFn } from "./run-export-jobs.ts";
+import { type SendDeletionExecutedEmailFn } from "./run-forget-cleanup.ts";
 /**
  * Options fuer createUserDataRightsFeature. Notification-Callbacks
  * (Atom 5) folgen dem password-reset-Pattern aus auth-routes.ts.

package/dist/user-data-rights/feature.js

@@ -521,15 +521,18 @@ export function createUserDataRightsFeature(opts = {}) {
                     db: forgetDb,
                     userId: forgetUserId,
                 });
-                // Without an app callback the default mail goes out when a mail transport and a
-                // mail renderer are mounted. The user is already erased here, so it bypasses the
-                // delivery log: an attempt row would be new personal data.
+                // Without an app callback the default mail goes out when an email channel or a
+                // mail transport, plus a mail renderer, are mounted. The user is already erased
+                // here, so it bypasses the delivery log: an attempt row would be new personal data.
                 const forgetConfigResolver = ctx.configResolver;
                 const sendDeletionExecutedEmail = opts.sendDeletionExecutedEmail ??
-                    (isMailTransportAvailable(forgetRegistry) && isMailRendererAvailable(forgetRegistry)
+                    ((isGdprMailDeliveryAvailable(forgetRegistry) ||
+                        isMailTransportAvailable(forgetRegistry)) &&
+                        isMailRendererAvailable(forgetRegistry)
                         ? makeDefaultDeletionExecutedEmail({
                             registry: forgetRegistry,
                             db: forgetDb,
+                            ...(ctx.secrets !== undefined && { secrets: ctx.secrets }),
                             resolveTransport: makeTenantMailTransportResolver({
                                 registry: forgetRegistry,
                                 configResolver: forgetConfigResolver,

package/dist/user-data-rights/handlers/request-deletion.write.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { type GdprMailDefaults } from "../lib/default-mailers.js";
+import { type GdprMailDefaults } from "../lib/default-mailers.ts";
 export type SendDeletionRequestedEmailFn = (args: {
     readonly userId: string;
     readonly userEmail: string;

package/dist/user-data-rights/handlers/run-forget-cleanup.write.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-import { type SendDeletionExecutedEmailFn } from "../run-forget-cleanup.js";
+import { type SendDeletionExecutedEmailFn } from "../run-forget-cleanup.ts";
 export type RunForgetCleanupOptions = {
     readonly sendDeletionExecutedEmail?: SendDeletionExecutedEmailFn;
 };
@@ -7,7 +7,7 @@ export declare function createRunForgetCleanupHandler(opts?: RunForgetCleanupOpt
     processedUserIds: readonly string[];
     hookCallsAttempted: number;
     errorCount: number;
-    errors: readonly import("../run-forget-cleanup.js").ForgetCleanupError[];
+    errors: readonly import("../run-forget-cleanup.ts").ForgetCleanupError[];
     incompleteCount: number;
-    incomplete: readonly import("../run-forget-cleanup.js").ForgetCleanupIncomplete[];
+    incomplete: readonly import("../run-forget-cleanup.ts").ForgetCleanupIncomplete[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/user-data-rights/index.d.ts

@@ -1,13 +1,13 @@
-export { TENANT_MODEL_CONFIG_KEY } from "./constants.js";
-export { createUserDataRightsFeature, type UserDataRightsOptions } from "./feature.js";
-export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write.js";
-export { denyIfTargetOutsideAdminTenant, TARGET_USER_NOT_IN_ADMIN_TENANT, } from "./lib/deny-if-target-outside-admin-tenant.js";
-export { isSystemAdminActor } from "./lib/is-admin-actor.js";
-export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle.js";
-export type { SendExportFailedEmailFn, SendExportReadyEmailFn, } from "./run-export-jobs.js";
-export type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup.js";
-export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
-export type { UserExportBundle } from "./run-user-export.js";
-export { runUserExport } from "./run-user-export.js";
-export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";
-export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, type ExportJobStatus, exportJobEntity, exportJobsTable, } from "./schema/export-job.js";
+export { TENANT_MODEL_CONFIG_KEY } from "./constants.ts";
+export { createUserDataRightsFeature, type UserDataRightsOptions } from "./feature.ts";
+export type { SendDeletionVerificationEmailFn } from "./handlers/request-deletion-by-email.write.ts";
+export { denyIfTargetOutsideAdminTenant, TARGET_USER_NOT_IN_ADMIN_TENANT, } from "./lib/deny-if-target-outside-admin-tenant.ts";
+export { isSystemAdminActor } from "./lib/is-admin-actor.ts";
+export { backfillUserLifecycleEvents, updateUserLifecycle } from "./lib/update-user-lifecycle.ts";
+export type { SendExportFailedEmailFn, SendExportReadyEmailFn, } from "./run-export-jobs.ts";
+export type { SendDeletionExecutedEmailFn } from "./run-forget-cleanup.ts";
+export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.ts";
+export type { UserExportBundle } from "./run-user-export.ts";
+export { runUserExport } from "./run-user-export.ts";
+export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.ts";
+export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, type ExportJobStatus, exportJobEntity, exportJobsTable, } from "./schema/export-job.ts";

package/dist/user-data-rights/lib/default-mailers.d.ts

@@ -1,10 +1,11 @@
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { ConfigAccessor, NotifyFn, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import { type GdprMailLocale } from "../email-templates.js";
-import type { SendDeletionRequestedEmailFn } from "../handlers/request-deletion.write.js";
-import type { SendExportFailedEmailFn, SendExportReadyEmailFn } from "../run-export-jobs.js";
-import type { SendDeletionExecutedEmailFn } from "../run-forget-cleanup.js";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import { type GdprMailLocale } from "../email-templates.ts";
+import type { SendDeletionRequestedEmailFn } from "../handlers/request-deletion.write.ts";
+import type { SendExportFailedEmailFn, SendExportReadyEmailFn } from "../run-export-jobs.ts";
+import type { SendDeletionExecutedEmailFn } from "../run-forget-cleanup.ts";
 export type GdprMailDefaults = {
     readonly locale?: GdprMailLocale;
     readonly appName?: string;
@@ -19,7 +20,9 @@ export declare function makeDefaultDeletionRequestedEmail(notify: NotifyFn, defa
 export type DeletionExecutedMailDeps = {
     readonly registry: Registry;
     readonly db: DbConnection;
+    /** Used only when no email delivery channel is mounted. */
     readonly resolveTransport: (tenantId: string) => Promise<EmailTransport>;
     readonly configFor: (tenantId: TenantId) => ConfigAccessor | undefined;
+    readonly secrets?: SecretsContext;
 };
 export declare function makeDefaultDeletionExecutedEmail(deps: DeletionExecutedMailDeps, defaults?: GdprMailDefaults): SendDeletionExecutedEmailFn;

package/dist/user-data-rights/lib/default-mailers.js

@@ -7,11 +7,11 @@
 // to the user, so delivery resolves the address and the attempt row carries
 // the recipientId the forget path erases. Deletion-executed cannot: the user
 // is gone by then, and an attempt row written after the erasure would be new
-// personal data. It renders the seeded template and sends over the tenant's
-// mail transport, with no delivery log.
+// personal data. It renders the seeded template and sends it straight through the
+// email channel (or, without one, the tenant's mail transport), with no delivery log.
 import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { hasMailTranslations, mailT } from "@cosmicdrift/kumiko-framework/i18n";
-import { DELIVERY_CHANNEL_EXTENSION } from "../../delivery/index.js";
+import { buildChannelContext, collectChannels, DELIVERY_CHANNEL_EXTENSION, EMAIL_CHANNEL_NAME, } from "../../delivery/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, } from "../../renderer-foundation/index.js";
 import { formatGdprMailTimestamp, normalizeGdprMailLocale, } from "../email-templates.js";
 import { GdprMailNotificationTypes, gdprMailTemplateLocale } from "../mail-notifications.js";
@@ -88,6 +88,9 @@ export function makeDefaultDeletionRequestedEmail(notify, defaults = {}) {
         });
     };
 }
+function emailChannelOf(registry) {
+    return collectChannels(registry).find((channel) => channel.name === EMAIL_CHANNEL_NAME);
+}
 export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
     return async (args) => {
         // Der User ist global, der Mail-Transport per-Tenant — wir senden ueber den
@@ -121,6 +124,25 @@ export function makeDefaultDeletionExecutedEmail(deps, defaults = {}) {
         if (rendered.kind !== "mail") {
             throw new Error(`deletion-executed mail: renderer answered with kind "${rendered.kind}"`);
         }
+        // The channel picks the same transport as every other mail of this notification
+        // (the app transport unless it is declared tenantTransport), so a tenant without
+        // its own mail provider still gets the confirmation. channel.send writes no attempt row.
+        const channel = emailChannelOf(deps.registry);
+        if (channel !== undefined) {
+            const result = await channel.send(args.userEmail, {
+                notificationType: type,
+                title: rendered.subject,
+                body: undefined,
+                data: undefined,
+                locale,
+            }, buildChannelContext(deps.db, deps.registry, undefined, tenantId, deps.secrets, config), { subject: rendered.subject, html: rendered.html, text: rendered.text });
+            if (result.status !== "sent") {
+                // No address in the message: the user is already erased.
+                throw new Error(`deletion-executed mail not sent: ${result.error ?? result.status}`);
+            }
+            // skip: the channel delivered it, the transport fallback below is for apps without one
+            return;
+        }
         const transport = await deps.resolveTransport(tenantId);
         await transport.send({
             to: args.userEmail,

package/dist/user-data-rights/web/client-plugin.d.ts

@@ -1,6 +1,6 @@
 import { type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { type PublicDeletionRoutes } from "./public-deletion-gate.js";
+import { type PublicDeletionRoutes } from "./public-deletion-gate.tsx";
 export type UserDataRightsClientOptions = {
     /** Key-weise Overrides über die Default-Bundles (de/en). */
     readonly translations?: TranslationsByLocale;

package/dist/user-data-rights/web/index.d.ts

@@ -1,8 +1,8 @@
-export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.js";
-export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.js";
-export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
-export { defaultTranslations } from "./i18n.js";
-export { formatDate } from "./privacy-center-screen.js";
-export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.js";
-export type { RequestAccountDeletionScreenProps } from "./request-deletion-screen.js";
-export { RequestAccountDeletionScreen } from "./request-deletion-screen.js";
+export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.tsx";
+export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.tsx";
+export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+export { defaultTranslations } from "./i18n.ts";
+export { formatDate } from "./privacy-center-screen.tsx";
+export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";
+export type { RequestAccountDeletionScreenProps } from "./request-deletion-screen.tsx";
+export { RequestAccountDeletionScreen } from "./request-deletion-screen.tsx";

package/dist/user-data-rights-defaults/index.d.ts

@@ -1,11 +1,11 @@
-export { createUserDataRightsDefaultsFeature } from "./feature.js";
-export { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.js";
-export { configValueDeleteHook, configValueExportHook, } from "./hooks/config-value.userdata-hook.js";
-export { deliveryAttemptDeleteHook, deliveryAttemptExportHook, } from "./hooks/delivery-attempt.userdata-hook.js";
-export { fileRefDeleteHook, fileRefExportHook, } from "./hooks/file-ref.userdata-hook.js";
-export { inAppMessageDeleteHook, inAppMessageExportHook, } from "./hooks/in-app-message.userdata-hook.js";
-export { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.js";
-export { notificationPreferenceDeleteHook, notificationPreferenceExportHook, } from "./hooks/notification-preference.userdata-hook.js";
-export { tenantInvitationDeleteHook, tenantInvitationExportHook, } from "./hooks/tenant-invitation.userdata-hook.js";
-export { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook.js";
-export { userSessionDeleteHook, userSessionExportHook, } from "./hooks/user-session.userdata-hook.js";
+export { createUserDataRightsDefaultsFeature } from "./feature.ts";
+export { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.ts";
+export { configValueDeleteHook, configValueExportHook, } from "./hooks/config-value.userdata-hook.ts";
+export { deliveryAttemptDeleteHook, deliveryAttemptExportHook, } from "./hooks/delivery-attempt.userdata-hook.ts";
+export { fileRefDeleteHook, fileRefExportHook, } from "./hooks/file-ref.userdata-hook.ts";
+export { inAppMessageDeleteHook, inAppMessageExportHook, } from "./hooks/in-app-message.userdata-hook.ts";
+export { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.ts";
+export { notificationPreferenceDeleteHook, notificationPreferenceExportHook, } from "./hooks/notification-preference.userdata-hook.ts";
+export { tenantInvitationDeleteHook, tenantInvitationExportHook, } from "./hooks/tenant-invitation.userdata-hook.ts";
+export { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook.ts";
+export { userSessionDeleteHook, userSessionExportHook, } from "./hooks/user-session.userdata-hook.ts";

package/dist/user-profile/index.d.ts

@@ -1,2 +1,2 @@
-export { USER_PROFILE_FEATURE, UserDataRightsHandlers, UserProfileErrors, UserProfileHandlers, UserProfileQueries, } from "./constants.js";
-export { createUserProfileFeature, type UserProfileFeatureOptions } from "./feature.js";
+export { USER_PROFILE_FEATURE, UserDataRightsHandlers, UserProfileErrors, UserProfileHandlers, UserProfileQueries, } from "./constants.ts";
+export { createUserProfileFeature, type UserProfileFeatureOptions } from "./feature.ts";

package/dist/user-profile/web/index.d.ts

@@ -1,2 +1,2 @@
-export { type UserProfileClientFeature, type UserProfileClientOptions, userProfileClient, } from "./client-plugin.js";
-export { ChangeEmailSection, ChangePasswordSection } from "./profile-screen.js";
+export { type UserProfileClientFeature, type UserProfileClientOptions, userProfileClient, } from "./client-plugin.ts";
+export { ChangeEmailSection, ChangePasswordSection } from "./profile-screen.tsx";

package/dist/waitlist/constants.d.ts

@@ -2,6 +2,7 @@ export declare const WAITLIST_FEATURE: "waitlist";
 export declare const WAITLIST_STATUS: {
     readonly Pending: "pending";
     readonly Invited: "invited";
+    readonly Provisioned: "provisioned";
     readonly Rejected: "rejected";
 };
 export type WaitlistStatus = (typeof WAITLIST_STATUS)[keyof typeof WAITLIST_STATUS];
@@ -9,6 +10,8 @@ export declare const WaitlistHandlers: {
     readonly submit: "waitlist:write:submit";
     readonly invite: "waitlist:write:invite";
     readonly reject: "waitlist:write:reject";
+    readonly export: "waitlist:write:export";
+    readonly purge: "waitlist:write:purge";
 };
 export declare const WaitlistQueries: {
     readonly list: "waitlist:query:waitlist-entry:list";
@@ -16,6 +19,7 @@ export declare const WaitlistQueries: {
 export declare const WaitlistErrors: {
     readonly notInvitable: "waitlist_not_invitable";
     readonly notRejectable: "waitlist_not_rejectable";
+    readonly confirmCountMismatch: "waitlist_confirm_count_mismatch";
 };
 export declare const WAITLIST_NOTIFICATION_TYPES: {
     readonly confirmation: "waitlist:notify:confirmation";
@@ -31,3 +35,8 @@ export declare const WAITLIST_FIELD_LIMITS: {
     readonly locale: 35;
     readonly honeypot: 500;
 };
+export declare const WAITLIST_EXPORTED_EVENT_SHORT: "exported";
+export declare const WAITLIST_PURGED_EVENT_SHORT: "purged";
+export declare const WAITLIST_EXPORTED_EVENT_QN: "waitlist:event:exported";
+export declare const WAITLIST_PURGED_EVENT_QN: "waitlist:event:purged";
+export declare const WAITLIST_AUDIT_AGGREGATE_TYPE: "waitlist-audit";

package/dist/waitlist/constants.js

@@ -4,12 +4,15 @@ export const WAITLIST_FEATURE = "waitlist";
 export const WAITLIST_STATUS = {
     Pending: "pending",
     Invited: "invited",
+    Provisioned: "provisioned",
     Rejected: "rejected",
 };
 export const WaitlistHandlers = {
     submit: "waitlist:write:submit",
     invite: "waitlist:write:invite",
     reject: "waitlist:write:reject",
+    export: "waitlist:write:export",
+    purge: "waitlist:write:purge",
 };
 // Entity-convention list QN: entityList screens resolve their query by this shape.
 export const WaitlistQueries = {
@@ -18,6 +21,7 @@ export const WaitlistQueries = {
 export const WaitlistErrors = {
     notInvitable: "waitlist_not_invitable",
     notRejectable: "waitlist_not_rejectable",
+    confirmCountMismatch: "waitlist_confirm_count_mismatch",
 };
 export const WAITLIST_NOTIFICATION_TYPES = {
     confirmation: "waitlist:notify:confirmation",
@@ -33,3 +37,10 @@ export const WAITLIST_FIELD_LIMITS = {
     locale: 35,
     honeypot: 500,
 };
+// Audit trail for the export/purge handlers: own aggregate per occurrence, payload
+// carries counts only (never addresses).
+export const WAITLIST_EXPORTED_EVENT_SHORT = "exported";
+export const WAITLIST_PURGED_EVENT_SHORT = "purged";
+export const WAITLIST_EXPORTED_EVENT_QN = "waitlist:event:exported";
+export const WAITLIST_PURGED_EVENT_QN = "waitlist:event:purged";
+export const WAITLIST_AUDIT_AGGREGATE_TYPE = "waitlist-audit";

package/dist/waitlist/entity.d.ts

@@ -134,23 +134,24 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     status: {
         readonly type: "select";
         readonly description?: string;
-        readonly options: readonly ["pending", "invited", "rejected"];
+        readonly options: readonly ["pending", "invited", "provisioned", "rejected"];
         readonly required?: boolean;
         readonly sortable?: boolean;
         readonly filterable?: boolean;
         readonly sensitive?: boolean;
-        readonly default?: "invited" | "pending" | "rejected" | undefined;
+        readonly default?: "invited" | "pending" | "provisioned" | "rejected" | undefined;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
             readonly invited?: "bad" | "neutral" | "ok" | "warn" | undefined;
             readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly provisioned?: "bad" | "neutral" | "ok" | "warn" | undefined;
             readonly rejected?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
-        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"invited" | "pending" | "rejected">[] | undefined;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"invited" | "pending" | "provisioned" | "rejected">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -207,6 +208,21 @@ export declare const waitlistEntryEntity: import("@cosmicdrift/kumiko-types/fiel
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
+    provisionedAt: {
+        readonly type: "timestamp";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly locatedBy?: string;
+        readonly min?: string;
+        readonly max?: string;
+        readonly locale?: string;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
     linkedTenantId: {
         readonly type: "text";
         readonly description?: string;
@@ -366,23 +382,24 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     status: {
         readonly type: "select";
         readonly description?: string;
-        readonly options: readonly ["pending", "invited", "rejected"];
+        readonly options: readonly ["pending", "invited", "provisioned", "rejected"];
         readonly required?: boolean;
         readonly sortable?: boolean;
         readonly filterable?: boolean;
         readonly sensitive?: boolean;
-        readonly default?: "invited" | "pending" | "rejected" | undefined;
+        readonly default?: "invited" | "pending" | "provisioned" | "rejected" | undefined;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly display?: "radio" | "dropdown";
         readonly optionTones?: {
             readonly invited?: "bad" | "neutral" | "ok" | "warn" | undefined;
             readonly pending?: "bad" | "neutral" | "ok" | "warn" | undefined;
+            readonly provisioned?: "bad" | "neutral" | "ok" | "warn" | undefined;
             readonly rejected?: "bad" | "neutral" | "ok" | "warn" | undefined;
         } | undefined;
         readonly optionsQuery?: string;
         readonly optionsQueryPayload?: import("@cosmicdrift/kumiko-types/fields").OptionsQueryPayload;
         readonly optionsAvailabilityQuery?: string;
-        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"invited" | "pending" | "rejected">[] | undefined;
+        readonly conditionalOptions?: readonly import("@cosmicdrift/kumiko-types/fields").SelectConditionalOptions<"invited" | "pending" | "provisioned" | "rejected">[] | undefined;
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
@@ -439,6 +456,21 @@ export declare const waitlistEntryTable: import("@cosmicdrift/kumiko-framework/d
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
+    provisionedAt: {
+        readonly type: "timestamp";
+        readonly description?: string;
+        readonly required?: boolean;
+        readonly sortable?: boolean;
+        readonly filterable?: boolean;
+        readonly sensitive?: boolean;
+        readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
+        readonly locatedBy?: string;
+        readonly min?: string;
+        readonly max?: string;
+        readonly locale?: string;
+    } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
+        required: false;
+    };
     linkedTenantId: {
         readonly type: "text";
         readonly description?: string;

package/dist/waitlist/entity.js

@@ -4,13 +4,14 @@ import { WAITLIST_STATUS } from "./constants.js";
 const WAITLIST_STATUS_OPTIONS = [
     WAITLIST_STATUS.Pending,
     WAITLIST_STATUS.Invited,
+    WAITLIST_STATUS.Provisioned,
     WAITLIST_STATUS.Rejected,
 ];
 const OPEN_WAITLIST_STATUSES = [
     WAITLIST_STATUS.Pending,
     WAITLIST_STATUS.Invited,
 ];
-// Entries still awaiting a decision; rejected is terminal.
+// Entries still awaiting a decision; provisioned and rejected are terminal.
 export function isOpenWaitlistStatus(status) {
     return OPEN_WAITLIST_STATUSES.some((open) => open === status);
 }
@@ -22,7 +23,7 @@ export function isOpenWaitlistStatus(status) {
 // SYSTEM_TENANT_ID, which also lets the per-tenant GDPR hooks read them.
 export const waitlistEntryEntity = createEntity({
     table: "read_waitlist_entries",
-    description: "A prospect's signup on the platform waitlist, tracked through pending, invited and rejected status as admins process it; name, email and message are the entry's own personal data.",
+    description: "A prospect's signup on the platform waitlist, tracked through pending, invited, provisioned and rejected status as admins process it; name, email and message are the entry's own personal data.",
     systemStream: true,
     tenancy: "global",
     fields: {
@@ -57,6 +58,7 @@ export const waitlistEntryEntity = createEntity({
         }),
         invitedAt: createTimestampField(),
         invitedBy: createTextField({ personal: false, reason: "is_admin_audit_id" }),
+        provisionedAt: createTimestampField(),
         // Not named tenantId: that is the framework's physical tenant column.
         linkedTenantId: createTextField({ personal: false, reason: "is_tenant_reference" }),
     },

package/dist/waitlist/entries-admin.d.ts

@@ -0,0 +1,4 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+export type WaitlistRow = Record<string, unknown>;
+export declare function listAllWaitlistRows(db: TenantDb): Promise<readonly WaitlistRow[]>;
+export declare function purgeWaitlistRows(db: TenantDb, rows: readonly WaitlistRow[], requestedBy: string): Promise<void>;

package/dist/waitlist/entries-admin.js

@@ -0,0 +1,42 @@
+import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
+import { collectErasureFailure, throwIfErasureFailed } from "../shared/index.js";
+import { platformActor, waitlistExecutor } from "./lib.js";
+const PAGE_SIZE = 200;
+const PURGE_REASON = "waitlist:purge";
+// Pages by offset on a stable sort; the list is small (a marketing waitlist) and
+// the callers hold the whole result anyway.
+export async function listAllWaitlistRows(db) {
+    const rows = [];
+    for (let offset = 0;; offset += PAGE_SIZE) {
+        const page = await waitlistExecutor.list({ sort: "submittedAt", sortDirection: "asc", limit: PAGE_SIZE, offset }, platformActor(), db);
+        rows.push(...page.rows);
+        if (page.rows.length < PAGE_SIZE)
+            return rows;
+    }
+}
+// Same two-step erasure as the user-data delete hook: the executor forgets the
+// row (replays on rebuild), then the record subject key is shredded so the event
+// log's ciphertext becomes unreadable. Keys are shredded only after every forget
+// succeeded: a thrown failure rolls the handler transaction back, and a shredded
+// key cannot be restored.
+export async function purgeWaitlistRows(db, rows, requestedBy) {
+    const failures = [];
+    const forgottenIds = [];
+    for (const row of rows) {
+        const id = row["id"];
+        if (typeof id !== "string")
+            continue;
+        const forgotten = await waitlistExecutor.forget({ id }, platformActor(), db);
+        collectErasureFailure(forgotten, "waitlistEntry", id, failures);
+        if (forgotten.isSuccess)
+            forgottenIds.push(id);
+    }
+    throwIfErasureFailed(failures);
+    const kms = configuredPiiSubjectKms();
+    // skip: no PII key service configured, so there are no record keys to shred.
+    if (!kms)
+        return;
+    for (const id of forgottenIds) {
+        await kms.eraseKey({ kind: "record", entity: "waitlistEntry", id }, { requestId: PURGE_REASON, userId: requestedBy, eraseReason: PURGE_REASON });
+    }
+}

package/dist/waitlist/feature.d.ts

@@ -1,3 +1,3 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
-import type { WaitlistOptions } from "./options.js";
+import type { WaitlistOptions } from "./options.ts";
 export declare function createWaitlistFeature(opts?: WaitlistOptions): FeatureDefinition;

package/dist/waitlist/feature.js

@@ -1,13 +1,16 @@
 import { defineFeature, EXT_USER_DATA, i18nKey, } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_FEATURE } from "./constants.js";
+import { WAITLIST_EXPORTED_EVENT_SHORT, WAITLIST_FEATURE, WAITLIST_PURGED_EVENT_SHORT, } from "./constants.js";
 import { waitlistEntryEntity } from "./entity.js";
+import { exportHandler, purgeHandler } from "./handlers/export-purge.write.js";
 import { createInviteHandler } from "./handlers/invite.write.js";
 import { listQuery } from "./handlers/list.query.js";
 import { rejectHandler } from "./handlers/reject.write.js";
 import { createSubmitHandler } from "./handlers/submit.write.js";
 import { WAITLIST_I18N } from "./i18n.js";
 import { adminAccess } from "./lib.js";
+import { linkWaitlistOnSignup, WAITLIST_MEMBERSHIP_CREATED_EVENT } from "./link-on-signup.js";
 import { WAITLIST_ADMIN_NOTICE_RECORD, WAITLIST_ADMIN_NOTICE_VARIABLES, WAITLIST_CONFIRMATION_VARIABLES, waitlistAdminNoticeTemplate, waitlistConfirmationTemplate, } from "./mail.js";
+import { WaitlistAuditEventSchema } from "./payloads.js";
 import { waitlistListScreen } from "./screens.js";
 import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
 export function createWaitlistFeature(opts = {}) {
@@ -31,6 +34,18 @@ export function createWaitlistFeature(opts = {}) {
         r.writeHandler(createInviteHandler(opts.invite));
         r.writeHandler(rejectHandler);
         r.queryHandler(listQuery);
+        if (opts.exportPurge !== false) {
+            r.defineEvent(WAITLIST_EXPORTED_EVENT_SHORT, WaitlistAuditEventSchema, { piiFields: "none" });
+            r.defineEvent(WAITLIST_PURGED_EVENT_SHORT, WaitlistAuditEventSchema, { piiFields: "none" });
+            r.writeHandler(exportHandler);
+            r.writeHandler(purgeHandler);
+        }
+        if (opts.linkOnSignup === true) {
+            r.multiStreamProjection({
+                name: "link-on-signup",
+                apply: { [WAITLIST_MEMBERSHIP_CREATED_EVENT]: linkWaitlistOnSignup },
+            });
+        }
         r.screen(waitlistListScreen);
         r.nav({
             id: "waitlist",