@cosmicdrift/kumiko-bundled-features 0.369.0 → 0.370.0

package/dist/waitlist/handlers/export-purge.write.js

@@ -0,0 +1,61 @@
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import * as z from "zod";
+import { WAITLIST_AUDIT_AGGREGATE_TYPE, WAITLIST_EXPORTED_EVENT_QN, WAITLIST_PURGED_EVENT_QN, WaitlistErrors, } from "../constants.js";
+import { listAllWaitlistRows, purgeWaitlistRows } from "../entries-admin.js";
+import { adminAccess, waitlistDb } from "../lib.js";
+const PurgeSchema = z.object({ confirmCount: z.number().int().min(0) }).strict();
+const ExportSchema = z.object({}).strict();
+async function appendAudit(ctx, type, count) {
+    await ctx.unsafeAppendEvent({
+        aggregateId: generateId(),
+        aggregateType: WAITLIST_AUDIT_AGGREGATE_TYPE,
+        type,
+        payload: { count },
+    });
+}
+function exportedRow(row) {
+    return {
+        id: row["id"],
+        name: row["name"],
+        email: row["email"],
+        company: row["company"],
+        portfolio: row["portfolio"],
+        message: row["message"],
+        locale: row["locale"],
+        status: row["status"],
+        submittedAt: String(row["submittedAt"] ?? ""),
+    };
+}
+export const exportHandler = defineWriteHandler({
+    name: "export",
+    schema: ExportSchema,
+    access: adminAccess,
+    agent: { expose: false, risk: "high" },
+    description: "Returns every waitlist entry with its personal data for a hand-over and records the export as an audit event that carries only the count.",
+    handler: async (_event, ctx) => {
+        const rows = await listAllWaitlistRows(waitlistDb(ctx));
+        await appendAudit(ctx, WAITLIST_EXPORTED_EVENT_QN, rows.length);
+        return { isSuccess: true, data: { count: rows.length, entries: rows.map(exportedRow) } };
+    },
+});
+export const purgeHandler = defineWriteHandler({
+    name: "purge",
+    schema: PurgeSchema,
+    access: adminAccess,
+    agent: { expose: false, risk: "high" },
+    description: "Erases every waitlist entry and shreds its personal data. confirmCount must equal the current entry count, so a stale export cannot purge newer entries.",
+    handler: async (event, ctx) => {
+        const db = waitlistDb(ctx);
+        const rows = await listAllWaitlistRows(db);
+        if (rows.length !== event.payload.confirmCount) {
+            return writeFailure(new UnprocessableError(WaitlistErrors.confirmCountMismatch, {
+                details: { confirmCount: event.payload.confirmCount, actualCount: rows.length },
+            }));
+        }
+        await purgeWaitlistRows(db, rows, event.user.id);
+        await appendAudit(ctx, WAITLIST_PURGED_EVENT_QN, rows.length);
+        return { isSuccess: true, data: { purged: rows.length } };
+    },
+});

package/dist/waitlist/handlers/invite.write.d.ts

@@ -1,4 +1,4 @@
-import type { WaitlistInviteOptions } from "../options.js";
+import type { WaitlistInviteOptions } from "../options.ts";
 export type WaitlistInviteData = {
     readonly kind: "invited";
     readonly id: string;

package/dist/waitlist/handlers/submit.write.d.ts

@@ -1,4 +1,4 @@
-import { type WaitlistOptions } from "../options.js";
+import { type WaitlistOptions } from "../options.ts";
 export type WaitlistSubmitData = {
     readonly kind: "submitted";
 };

package/dist/waitlist/i18n.js

@@ -26,6 +26,10 @@ export const WAITLIST_I18N = {
         en: "Invited",
         de: "Eingeladen",
     },
+    "waitlist:entity:waitlistEntry:field:status:option:provisioned": {
+        en: "Provisioned",
+        de: "Eingerichtet",
+    },
     "waitlist:entity:waitlistEntry:field:status:option:rejected": {
         en: "Rejected",
         de: "Abgelehnt",

package/dist/waitlist/import.d.ts

@@ -0,0 +1,24 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import type { WaitlistStatus } from "./constants.ts";
+export type WaitlistImportEntry = {
+    /** Stable identity of the source row (e.g. `offlot:<uuid>`); the new entry id derives from it. */
+    readonly sourceKey: string;
+    readonly name: string;
+    readonly email: string;
+    readonly locale: string;
+    readonly status: WaitlistStatus;
+    readonly submittedAt: Temporal.Instant;
+    readonly company?: string;
+    readonly portfolio?: string;
+    readonly message?: string;
+    readonly invitedAt?: Temporal.Instant;
+    readonly invitedBy?: string;
+    readonly provisionedAt?: Temporal.Instant;
+    readonly linkedTenantId?: string;
+};
+export type WaitlistImportOutcome = "created" | "skipped";
+export declare function waitlistImportId(sourceKey: string): string;
+export declare function importWaitlistEntry(db: TenantDb, entry: WaitlistImportEntry, options?: {
+    readonly dryRun?: boolean;
+}): Promise<WaitlistImportOutcome>;

package/dist/waitlist/import.js

@@ -0,0 +1,51 @@
+import { createHash } from "node:crypto";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.js";
+// RFC 4122 name-based UUID (v5 layout, fixed namespace) so a re-run finds the entry
+// it created before without matching on encrypted personal data.
+const IMPORT_NAMESPACE = "kumiko-waitlist-import";
+export function waitlistImportId(sourceKey) {
+    const bytes = createHash("sha1").update(`${IMPORT_NAMESPACE}:${sourceKey}`).digest();
+    const byte6 = bytes[6] ?? 0;
+    const byte8 = bytes[8] ?? 0;
+    bytes[6] = (byte6 & 0x0f) | 0x50;
+    bytes[8] = (byte8 & 0x3f) | 0x80;
+    const hex = bytes.subarray(0, 16).toString("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function presentOnly(fields) {
+    return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
+}
+// Writes through the entity executor, so events, projection and subject encryption
+// behave exactly as for a live submit. No mail, no rate limit, no duplicate-by-email
+// check: the source row is the truth and the id makes the call idempotent.
+export async function importWaitlistEntry(db, entry, options = {}) {
+    const id = waitlistImportId(entry.sourceKey);
+    const existing = await waitlistExecutor.detail({ id }, platformActor(), db);
+    if (existing)
+        return "skipped";
+    if (options.dryRun === true)
+        return "created";
+    const created = await waitlistExecutor.create({
+        id,
+        name: entry.name,
+        email: normalizeEmail(entry.email),
+        locale: entry.locale,
+        status: entry.status,
+        submittedAt: entry.submittedAt,
+        ...presentOnly({
+            company: entry.company,
+            portfolio: entry.portfolio,
+            message: entry.message,
+            invitedAt: entry.invitedAt,
+            invitedBy: entry.invitedBy,
+            provisionedAt: entry.provisionedAt,
+            linkedTenantId: entry.linkedTenantId,
+        }),
+    }, platformActor(), db);
+    if (!created.isSuccess)
+        throw new InternalError({
+            message: `waitlist import failed for ${entry.sourceKey}: ${created.error.code}`,
+        });
+    return "created";
+}

package/dist/waitlist/index.d.ts

@@ -1,5 +1,7 @@
-export { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_FEATURE, WAITLIST_FIELD_LIMITS, WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS, WaitlistErrors, WaitlistHandlers, WaitlistQueries, type WaitlistStatus, } from "./constants.js";
-export { isOpenWaitlistStatus, waitlistEntryEntity, waitlistEntryTable } from "./entity.js";
-export { createWaitlistFeature } from "./feature.js";
-export type { WaitlistInviteOptions, WaitlistOptions } from "./options.js";
-export { type WaitlistSubmitInput, WaitlistSubmitSchema } from "./payloads.js";
+export { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_FEATURE, WAITLIST_FIELD_LIMITS, WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS, WaitlistErrors, WaitlistHandlers, WaitlistQueries, type WaitlistStatus, } from "./constants.ts";
+export { isOpenWaitlistStatus, waitlistEntryEntity, waitlistEntryTable } from "./entity.ts";
+export { createWaitlistFeature } from "./feature.ts";
+export { importWaitlistEntry, type WaitlistImportEntry, type WaitlistImportOutcome, waitlistImportId, } from "./import.ts";
+export { DEFAULT_IMPORT_LOCALE, DEFAULT_LEGACY_SOURCE_TABLE, isLegacyWaitlistSource, LEGACY_WAITLIST_SOURCES, type LegacyWaitlistMigrateOptions, type LegacyWaitlistMigrateReport, type LegacyWaitlistSource, migrateLegacyWaitlist, offlotLegacyTable, publicstatusLegacyTable, } from "./legacy-migrate.ts";
+export type { WaitlistInviteOptions, WaitlistOptions } from "./options.ts";
+export { type WaitlistSubmitInput, WaitlistSubmitSchema } from "./payloads.ts";

package/dist/waitlist/index.js

@@ -1,4 +1,6 @@
 export { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_FEATURE, WAITLIST_FIELD_LIMITS, WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS, WaitlistErrors, WaitlistHandlers, WaitlistQueries, } from "./constants.js";
 export { isOpenWaitlistStatus, waitlistEntryEntity, waitlistEntryTable } from "./entity.js";
 export { createWaitlistFeature } from "./feature.js";
+export { importWaitlistEntry, waitlistImportId, } from "./import.js";
+export { DEFAULT_IMPORT_LOCALE, DEFAULT_LEGACY_SOURCE_TABLE, isLegacyWaitlistSource, LEGACY_WAITLIST_SOURCES, migrateLegacyWaitlist, offlotLegacyTable, publicstatusLegacyTable, } from "./legacy-migrate.js";
 export { WaitlistSubmitSchema } from "./payloads.js";

package/dist/waitlist/legacy-migrate.d.ts

@@ -0,0 +1,27 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-types/db-connection";
+import { type WaitlistImportEntry } from "./import.ts";
+export declare const LEGACY_WAITLIST_SOURCES: readonly ["offlot", "publicstatus"];
+export type LegacyWaitlistSource = (typeof LEGACY_WAITLIST_SOURCES)[number];
+export declare function isLegacyWaitlistSource(value: string | undefined): value is LegacyWaitlistSource;
+export declare const DEFAULT_LEGACY_SOURCE_TABLE: Readonly<Record<LegacyWaitlistSource, string>>;
+export declare const DEFAULT_IMPORT_LOCALE = "en";
+export type LegacyWaitlistMigrateOptions = {
+    readonly from: LegacyWaitlistSource;
+    readonly dryRun: boolean;
+    readonly sourceTable: string;
+    /** publicstatus rows carry no language; every imported entry gets this one. */
+    readonly defaultLocale: string;
+};
+export type LegacyWaitlistMigrateReport = {
+    readonly read: number;
+    readonly created: number;
+    readonly skipped: number;
+    readonly unreadable: number;
+};
+type LegacyRow = Readonly<Record<string, unknown>>;
+export declare function mapOfflotRow(row: LegacyRow): Promise<WaitlistImportEntry | undefined>;
+export declare function mapPublicstatusRow(row: LegacyRow, defaultLocale: string): WaitlistImportEntry | undefined;
+export declare function publicstatusLegacyTable(sourceTable: string): import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare function offlotLegacyTable(sourceTable: string): import("@cosmicdrift/kumiko-types/schema-table-types").SchemaTable;
+export declare function migrateLegacyWaitlist(db: DbConnection, options: LegacyWaitlistMigrateOptions): Promise<LegacyWaitlistMigrateReport>;
+export {};

package/dist/waitlist/legacy-migrate.js

@@ -0,0 +1,173 @@
+import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
+import { createTenantDb, selectMany, table, text as textColumn, timestamp, transaction, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { WAITLIST_STATUS } from "./constants.js";
+import { importWaitlistEntry } from "./import.js";
+export const LEGACY_WAITLIST_SOURCES = ["offlot", "publicstatus"];
+export function isLegacyWaitlistSource(value) {
+    return LEGACY_WAITLIST_SOURCES.some((known) => known === value);
+}
+export const DEFAULT_LEGACY_SOURCE_TABLE = {
+    offlot: "read_waitlist_entries",
+    publicstatus: "marketing_waitlist",
+};
+export const DEFAULT_IMPORT_LOCALE = "en";
+function toInstant(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (value instanceof Temporal.Instant)
+        return value;
+    if (value instanceof Date)
+        return Temporal.Instant.fromEpochMilliseconds(Number(value));
+    if (typeof value !== "string")
+        return undefined;
+    try {
+        return Temporal.Instant.from(value);
+    }
+    catch {
+        // Temporal.Instant.from throws RangeError for a non-ISO string.
+        return undefined;
+    }
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+function isWaitlistStatus(value) {
+    return Object.values(WAITLIST_STATUS).some((known) => known === value);
+}
+// Legacy offlot rows may hold subject ciphertext; decryption is self-describing and
+// needs the same KMS the app ran with. Without it the value cannot be read, so the
+// caller counts the row as unreadable instead of importing ciphertext as the name.
+async function readPii(value, field) {
+    const raw = nonEmpty(value);
+    if (raw === undefined || !isPiiCiphertext(raw))
+        return raw;
+    const kms = configuredPiiSubjectKms();
+    if (!kms)
+        return undefined;
+    const decrypted = await decryptPiiFieldValues({ [field]: raw }, [field], kms, {
+        requestId: "waitlist-migrate",
+    });
+    const plain = decrypted[field];
+    return typeof plain === "string" && plain !== PII_ERASED_SENTINEL ? plain : undefined;
+}
+// Source columns without a FW counterpart (city, stock, country, notes) are kept
+// as labelled lines in `message`, so no information is lost.
+function offlotMessage(row) {
+    const lines = [
+        ["City", nonEmpty(row["city"])],
+        ["Stock", nonEmpty(row["stock"])],
+        ["Country", nonEmpty(row["country"])],
+        ["Notes", nonEmpty(row["notes"])],
+    ].flatMap(([label, value]) => (value === undefined ? [] : [`${label}: ${value}`]));
+    return lines.length === 0 ? undefined : lines.join("\n");
+}
+export async function mapOfflotRow(row) {
+    const id = nonEmpty(row["id"]);
+    const name = await readPii(row["name"], "name");
+    const email = await readPii(row["email"], "email");
+    const submittedAt = toInstant(row["submittedAt"]);
+    const status = nonEmpty(row["status"]);
+    if (!id || !name || !email || !submittedAt || !isWaitlistStatus(status))
+        return undefined;
+    const company = nonEmpty(row["dealership"]);
+    const message = offlotMessage(row);
+    const invitedAt = toInstant(row["invitedAt"]);
+    const provisionedAt = toInstant(row["provisionedAt"]);
+    const invitedBy = nonEmpty(row["invitedBy"]);
+    const linkedTenantId = nonEmpty(row["linkedTenantId"]);
+    return {
+        sourceKey: `offlot:${id}`,
+        name,
+        email,
+        locale: nonEmpty(row["locale"]) ?? DEFAULT_IMPORT_LOCALE,
+        status,
+        submittedAt,
+        ...(company !== undefined && { company }),
+        ...(message !== undefined && { message }),
+        ...(invitedAt !== undefined && { invitedAt }),
+        ...(invitedBy !== undefined && { invitedBy }),
+        ...(provisionedAt !== undefined && { provisionedAt }),
+        ...(linkedTenantId !== undefined && { linkedTenantId }),
+    };
+}
+export function mapPublicstatusRow(row, defaultLocale) {
+    const id = nonEmpty(row["id"]);
+    const email = nonEmpty(row["email"]);
+    const submittedAt = toInstant(row["createdAt"]);
+    if (!id || !email || !submittedAt)
+        return undefined;
+    return {
+        sourceKey: `publicstatus:${id}`,
+        // The apex form only asked for an address; the FW entry requires a name.
+        name: email.split("@")[0] ?? email,
+        email,
+        locale: defaultLocale,
+        status: WAITLIST_STATUS.Pending,
+        submittedAt,
+    };
+}
+export function publicstatusLegacyTable(sourceTable) {
+    return table(sourceTable, {
+        id: uuid("id").primaryKey(),
+        email: textColumn("email").notNull(),
+        createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+    });
+}
+export function offlotLegacyTable(sourceTable) {
+    return table(sourceTable, {
+        id: uuid("id").primaryKey(),
+        name: textColumn("name").notNull(),
+        email: textColumn("email").notNull(),
+        dealership: textColumn("dealership"),
+        city: textColumn("city"),
+        stock: textColumn("stock"),
+        country: textColumn("country"),
+        locale: textColumn("locale").notNull(),
+        status: textColumn("status").notNull(),
+        submittedAt: timestamp("submitted_at", { withTimezone: true }).notNull(),
+        invitedAt: timestamp("invited_at", { withTimezone: true }),
+        invitedBy: textColumn("invited_by"),
+        provisionedAt: timestamp("provisioned_at", { withTimezone: true }),
+        linkedTenantId: textColumn("linked_tenant_id"),
+        notes: textColumn("notes"),
+    });
+}
+async function readLegacyRows(db, from, sourceTable) {
+    if (from === "publicstatus") {
+        return await selectMany(db, publicstatusLegacyTable(sourceTable), undefined, {
+            orderBy: { col: "createdAt", direction: "asc" },
+        });
+    }
+    return await selectMany(db, offlotLegacyTable(sourceTable), undefined, {
+        orderBy: { col: "submittedAt", direction: "asc" },
+    });
+}
+// Idempotent: the new entry id derives from the source row id, so a re-run finds
+// what an earlier run wrote and skips it. Writes go through the waitlist entity
+// executor (events, projection, subject encryption), never into tables directly.
+export async function migrateLegacyWaitlist(db, options) {
+    const rows = await readLegacyRows(db, options.from, options.sourceTable);
+    let created = 0;
+    let skipped = 0;
+    let unreadable = 0;
+    for (const row of rows) {
+        const entry = options.from === "offlot"
+            ? await mapOfflotRow(row)
+            : mapPublicstatusRow(row, options.defaultLocale);
+        if (!entry) {
+            unreadable += 1;
+            continue;
+        }
+        await transaction(db, async (tx) => {
+            const tenantDb = createTenantDb({ db: tx, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+            const outcome = await importWaitlistEntry(tenantDb, entry, { dryRun: options.dryRun });
+            if (outcome === "created")
+                created += 1;
+            else
+                skipped += 1;
+        });
+    }
+    return { read: rows.length, created, skipped, unreadable };
+}

package/dist/waitlist/lib.d.ts

@@ -1,11 +1,11 @@
 import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { type HandlerContext, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { type AppContext, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 export declare const WAITLIST_CROSS_TENANT_REASON = "waitlist is platform-wide (systemScope)";
 export declare const adminAccess: {
     readonly roles: readonly string[];
 };
 export declare const waitlistExecutor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor;
 export declare function normalizeEmail(email: string): string;
-export declare function waitlistDb(ctx: HandlerContext): TenantDb;
+export declare function waitlistDb(ctx: Pick<AppContext, "systemDb">): TenantDb;
 export declare function platformActor(): SessionUser;
 export declare function isTenantMember(db: TenantDb, email: string, tenantId: TenantId): Promise<boolean>;

package/dist/waitlist/link-on-signup.d.ts

@@ -0,0 +1,3 @@
+import { type MultiStreamApplyFn } from "@cosmicdrift/kumiko-framework/engine";
+export declare const WAITLIST_MEMBERSHIP_CREATED_EVENT: string;
+export declare const linkWaitlistOnSignup: MultiStreamApplyFn;

package/dist/waitlist/link-on-signup.js

@@ -0,0 +1,83 @@
+import { createTenantDb, entityEventName, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { decryptStoredPii } from "../shared/index.js";
+import { tenantMembershipsTable } from "../tenant/index.js";
+import { userTable } from "../user/index.js";
+import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS } from "./constants.js";
+import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.js";
+const PII_DECRYPT_REASON = "waitlist:link-on-signup";
+export const WAITLIST_MEMBERSHIP_CREATED_EVENT = entityEventName("tenant-membership", "created");
+// Only a TenantAdmin membership can be the signup owner; invite-accept memberships of
+// other roles are not owners.
+function readSignupOwnerMembership(event) {
+    const { userId, roles } = event.payload;
+    if (typeof userId !== "string")
+        return undefined;
+    if (!parseRoles(roles).includes(DEFAULT_OWN_TENANT_INVITE_ROLE))
+        return undefined;
+    return { userId, tenantId: event.tenantId };
+}
+// An unreadable submittedAt sorts last instead of throwing: one bad row must not
+// stall the at-least-once consumer.
+function newestSubmittedFirst(a, b) {
+    return submittedAtMillis(b) - submittedAtMillis(a);
+}
+function submittedAtMillis(row) {
+    return instantMillis(row["submittedAt"]);
+}
+function instantMillis(value) {
+    if (value instanceof Temporal.Instant)
+        return value.epochMilliseconds;
+    if (typeof value !== "string")
+        return 0;
+    try {
+        return Temporal.Instant.from(value).epochMilliseconds;
+    }
+    catch {
+        // Temporal.Instant.from throws RangeError for a non-ISO string.
+        return 0;
+    }
+}
+// Runs as a multi-stream consumer (at least once): the hook phase of the signup and
+// invite-accept paths has no system db handle, and a waitlist problem must not roll
+// back the signup. Idempotent because only `invited` entries are updated.
+export const linkWaitlistOnSignup = async (event, tx) => {
+    const membership = readSignupOwnerMembership(event);
+    // skip: not a TenantAdmin membership, nothing to link.
+    if (!membership)
+        return;
+    // Only the tenant's first membership is the owner; later TenantAdmin invites must not link.
+    const [first] = await selectMany(tx, tenantMembershipsTable, { tenantId: membership.tenantId }, { limit: 1, fields: ["id"], orderBy: [{ col: "insertedAt" }, { col: "id" }] });
+    // skip: another membership came first.
+    if (first && first.id !== event.aggregateId)
+        return;
+    const db = createTenantDb({ db: tx, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+    const user = await fetchOne(tx, userTable, { id: membership.userId });
+    // skip: user row unreadable (erased or not projected yet).
+    if (typeof user?.email !== "string")
+        return;
+    const email = normalizeEmail(await decryptStoredPii(user.email, "email", PII_DECRYPT_REASON));
+    const found = await waitlistExecutor.list({
+        filter: { field: "email", op: "eq", value: email },
+        filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
+    }, platformActor(), db);
+    const invited = [...found.rows].sort(newestSubmittedFirst)[0];
+    // skip: the signup email has no invited waitlist entry (open signup or stale invite).
+    if (!invited)
+        return;
+    const { id, version } = invited;
+    // skip: defensive guard on the row shape.
+    if (typeof id !== "string" || typeof version !== "number")
+        return;
+    await waitlistExecutor.update({
+        id,
+        version,
+        changes: {
+            status: WAITLIST_STATUS.Provisioned,
+            linkedTenantId: membership.tenantId,
+            provisionedAt: Temporal.Now.instant(),
+        },
+    }, platformActor(), db);
+};

package/dist/waitlist/options.d.ts

@@ -1,5 +1,5 @@
 import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { PayloadRateLimitOption, RateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
+import type { PayloadRateLimitOption, RateLimitDeclaration, RateLimitOption } from "@cosmicdrift/kumiko-types/handlers";
 export type WaitlistInviteOptions = {
     /** Each invited entry gets its own tenant, named after company or name. */
     readonly mode: "own-tenant";
@@ -18,11 +18,19 @@ export type WaitlistOptions = {
     readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
     /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
     readonly invite?: WaitlistInviteOptions;
-    /** Default: 5 submits per IP per 10 minutes. */
-    readonly rateLimit?: RateLimitOption;
+    /** Default: 5 submits per IP per 10 minutes. Pass `{ disabled: true, reason }`
+     *  to turn the per-IP limit off (e.g. when a CDN already throttles the route). */
+    readonly rateLimit?: RateLimitDeclaration;
     /** Default: 3 submits per email address per day, across all IPs. Stops a botnet
      *  from flooding one address with confirmation mails. Pass `[]` to disable. */
     readonly emailRateLimits?: readonly PayloadRateLimitOption[];
+    /** Marks an invited entry `provisioned` and records the tenant when its email
+     *  becomes the first TenantAdmin member of a tenant (open signup after an
+     *  invite, or accepting an own-tenant invite). Default false. */
+    readonly linkOnSignup?: boolean;
+    /** Mounts the SystemAdmin-only `export` and `purge` handlers for handing over
+     *  and erasing the whole list. Default true; pass false to leave them out. */
+    readonly exportPurge?: boolean;
     /** Shown in the confirmation mail; omitted when unset. */
     readonly appName?: string;
 };

package/dist/waitlist/payloads.d.ts

@@ -12,3 +12,6 @@ export type WaitlistSubmitInput = z.infer<typeof WaitlistSubmitSchema>;
 export declare const WaitlistIdSchema: z.ZodObject<{
     id: z.ZodUUID;
 }, z.core.$strict>;
+export declare const WaitlistAuditEventSchema: z.ZodObject<{
+    count: z.ZodNumber;
+}, z.core.$strip>;

package/dist/waitlist/payloads.js

@@ -45,3 +45,4 @@ export const WaitlistSubmitSchema = z
 })
     .strict();
 export const WaitlistIdSchema = z.object({ id: z.uuid() }).strict();
+export const WaitlistAuditEventSchema = z.object({ count: z.number().int().nonnegative() });

package/dist/workflow-runner/feature.d.ts

@@ -1,7 +1,3 @@
 export declare function createWorkflowRunnerFeature(): import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
     readonly exports: void;
 };
-/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export declare const workflowRunnerFeature: import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {
-    readonly exports: void;
-};

package/dist/workflow-runner/feature.js

@@ -76,5 +76,3 @@ export function createWorkflowRunnerFeature() {
         });
     }, { dedupeOptions: {} });
 }
-/** @deprecated Use createWorkflowRunnerFeature(). Run `bun kumiko-upgrade --apply`. Removed in the first release after 2026-10-29. */
-export const workflowRunnerFeature = createWorkflowRunnerFeature();

package/dist/workflow-runner/index.d.ts

@@ -1,4 +1,4 @@
-export { workflowRunAggregateId } from "./aggregate-id.js";
-export { registerEventTrigger } from "./event-trigger.js";
-export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
-export { startAndRunWorkflow, type WorkflowRunCompletedPayload, type WorkflowRunFailedPayload, type WorkflowRunStartedPayload, WorkflowSuspensionUnsupportedError, } from "./runner.js";
+export { workflowRunAggregateId } from "./aggregate-id.ts";
+export { registerEventTrigger } from "./event-trigger.ts";
+export { createWorkflowRunnerFeature } from "./feature.ts";
+export { startAndRunWorkflow, type WorkflowRunCompletedPayload, type WorkflowRunFailedPayload, type WorkflowRunStartedPayload, WorkflowSuspensionUnsupportedError, } from "./runner.ts";

package/dist/workflow-runner/index.js

@@ -1,5 +1,5 @@
 // Public API of the workflow-runner bundled-feature.
 export { workflowRunAggregateId } from "./aggregate-id.js";
 export { registerEventTrigger } from "./event-trigger.js";
-export { createWorkflowRunnerFeature, workflowRunnerFeature } from "./feature.js";
+export { createWorkflowRunnerFeature } from "./feature.js";
 export { startAndRunWorkflow, WorkflowSuspensionUnsupportedError, } from "./runner.js";