@cosmicdrift/kumiko-bundled-features 0.370.0 → 0.371.0

package/dist/auth-foundation/resolve-anonymous-access.d.ts

@@ -8,4 +8,5 @@ import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 import type { AuthProviderBuildDeps } from "./types.ts";
 export declare function resolveAnonymousAccessFromRegistry(base: AnonymousAccessResolved | AnonymousAccessConfig | undefined, deps: AuthProviderBuildDeps & {
     readonly registry: Registry;
+    readonly warn?: (message: string) => void;
 }): Promise<AnonymousAccessResolved | undefined>;

package/dist/auth-foundation/resolve-anonymous-access.js

@@ -1,4 +1,6 @@
 import { resolveTenantExistence, resolveTenantResolver } from "./feature.js";
+// Features whose routes are anonymous and need an `anonymousAccess` entry to resolve a tenant.
+const ANONYMOUS_ROUTE_FEATURES = ["host-routing", "managed-pages", "legal-pages"];
 export async function resolveAnonymousAccessFromRegistry(base, deps) {
     const [tenantResolver, tenantExists] = await Promise.all([
         resolveTenantResolver(deps),
@@ -9,8 +11,14 @@ export async function resolveAnonymousAccessFromRegistry(base, deps) {
     // anonymousAccess become defined for an app that never set it — that
     // would upgrade every roles:["anonymous"] handler to reachable without
     // a JWT the moment such a routing feature is mounted (#1452).
-    if (!base)
+    if (!base) {
+        const needing = ANONYMOUS_ROUTE_FEATURES.filter((name) => deps.registry.getFeature(name));
+        if (needing.length > 0) {
+            deps.warn?.(`[auth-foundation] ${needing.join(", ")} mount${needing.length === 1 ? "s" : ""} anonymous routes but anonymousAccess is not set, ` +
+                "so anonymous requests get no tenant. Add `anonymousAccess: {}` to opt in.");
+        }
         return undefined;
+    }
     // Fail-closed (#1374 security): inline tenantResolver without trust is the
     // old ambiguous config — providers always carry trust; test stacks must too.
     if (!tenantResolver &&

package/dist/billing-foundation/index.d.ts

@@ -11,6 +11,6 @@ export { createBillingFoundationFeature } from "./feature.ts";
 export { getSubscriptionForTenant, type SubscriptionView } from "./get-subscription-for-tenant.ts";
 export { paymentsProjectionTable, subscriptionsProjectionTable } from "./projection.ts";
 export { billingPlansPanel, createBillingPlansScreen } from "./screens.ts";
-export { createSubscriptionTierSync, effectiveTierFromSubscription, SUBSCRIPTION_WEBHOOK_PATH, type SubscriptionTierSyncDeps, } from "./subscription-tier-sync.ts";
+export { createSubscriptionTierSync, effectiveTierFromSubscription, SUBSCRIPTION_WEBHOOK_PATH, type SubscriptionTierSyncDeps, type TierSyncResult, } from "./subscription-tier-sync.ts";
 export { type BillingFoundationOptions, type BillingPlanBenefit, type BillingPlanCatalog, type BillingPlanPrice, type BillingPlansResult, type BillingPlanView, type ConsumerProtectionOptions, KNOWN_RECURRING_INTERVALS, type LegalLinkSet, type PaymentEvent, type ProviderPrice, type ProviderSubscriptionSnapshot, type RecurringInterval, type SubscriptionEvent, type SubscriptionProviderPlugin, } from "./types.ts";
 export { createSubscriptionWebhookRoute, type SubscriptionWebhookRouteOptions, } from "./webhook-handler.ts";

package/dist/billing-foundation/subscription-tier-sync.d.ts

@@ -1,10 +1,28 @@
 import type { ExtraRouteDefinition, SignatureExtraRouteDeps } from "@cosmicdrift/kumiko-framework/api";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { PaymentEvent, SubscriptionEvent } from "./types.ts";
 export declare const SUBSCRIPTION_WEBHOOK_PATH = "/webhooks/subscription/:providerName";
 export type SubscriptionTierSyncDeps<TTier extends string> = {
     readonly isTierName: (value: string) => value is TTier;
     readonly defaultTier: TTier;
     readonly onSyncError?: "log" | "fail-webhook";
+    /** Runs after every webhook whose sync succeeded, also when the tier stayed the same
+     *  (`changed: false`). Not called when the tenant has no subscription yet, when a
+     *  manual grant was kept, or when the sync failed. A throw counts as a sync failure
+     *  and follows `onSyncError`. */
+    readonly afterSync?: (result: TierSyncResult<TTier>) => Promise<void>;
+};
+export type TierSyncResult<TTier extends string> = {
+    readonly tenantId: TenantId;
+    /** The tier the subscription yields. */
+    readonly tier: TTier;
+    /** True when this sync created or updated the tenant's tier assignment. */
+    readonly changed: boolean;
+    readonly event: SubscriptionEvent | PaymentEvent;
+};
+type SyncError = {
+    code: string;
+    message: string;
 };
 export declare const TIER_SYNC_MANUAL_GRANT_SKIPPED = "tier_sync_manual_grant_skipped";
 export declare function effectiveTierFromSubscription<TTier extends string>(status: string | undefined, tier: string | undefined, isTierName: (value: string) => value is TTier, defaultTier: TTier): TTier;
@@ -12,8 +30,7 @@ export declare function createSubscriptionTierSync<TTier extends string>(deps: S
     createWebhookRoute: (options?: {
         readonly path?: string;
     }) => ExtraRouteDefinition;
-    syncTierFromSubscription: (tenantId: TenantId, routeDeps: Pick<SignatureExtraRouteDeps, "dispatchSystemQuery" | "dispatchSystemWrite">) => Promise<{
-        code: string;
-        message: string;
-    } | null>;
+    syncTierFromSubscription: (tenantId: TenantId, routeDeps: Pick<SignatureExtraRouteDeps, "dispatchSystemQuery" | "dispatchSystemWrite">) => Promise<SyncError | null>;
+    syncAndNotify: (tenantId: TenantId, event: SubscriptionEvent | PaymentEvent, routeDeps: Pick<SignatureExtraRouteDeps, "dispatchSystemQuery" | "dispatchSystemWrite">) => Promise<SyncError | null>;
 };
+export {};

package/dist/billing-foundation/subscription-tier-sync.js

@@ -41,7 +41,7 @@ function findTierAssignment(rows, tenantId) {
     };
 }
 export function createSubscriptionTierSync(deps) {
-    async function syncTierFromSubscription(tenantId, routeDeps) {
+    async function runTierSync(tenantId, routeDeps) {
         try {
             const subscriptionId = subscriptionAggregateId(tenantId);
             const subscriptionRows = asRows(await routeDeps.dispatchSystemQuery({
@@ -51,7 +51,7 @@ export function createSubscriptionTierSync(deps) {
             }));
             const sub = subscriptionRows.find((row) => row["id"] === subscriptionId);
             if (!sub)
-                return null;
+                return { error: null };
             const effective = effectiveTierFromSubscription(typeof sub["status"] === "string" ? sub["status"] : undefined, typeof sub["tier"] === "string" ? sub["tier"] : undefined, deps.isTierName, deps.defaultTier);
             const tierAssignmentRows = asRows(await routeDeps.dispatchSystemQuery({
                 handlerQn: TierEngineQueries.list,
@@ -71,18 +71,23 @@ export function createSubscriptionTierSync(deps) {
                 });
                 if (!created.isSuccess) {
                     return {
-                        code: "tier_sync_failed",
-                        message: `tier-engine create with "${effective}" failed: ${created.error?.code ?? "unknown"}`,
+                        error: {
+                            code: "tier_sync_failed",
+                            message: `tier-engine create with "${effective}" failed: ${created.error?.code ?? "unknown"}`,
+                        },
                     };
                 }
-                return null;
+                return { error: null, applied: { tier: effective, changed: true } };
+            }
+            if (assignment.tier === effective) {
+                return { error: null, applied: { tier: effective, changed: false } };
             }
-            if (assignment.tier === effective)
-                return null;
             if (assignment.source === TierAssignmentSources.manual) {
                 return {
-                    code: TIER_SYNC_MANUAL_GRANT_SKIPPED,
-                    message: `manual tier grant "${String(assignment.tier)}" kept although the subscription yields "${effective}"`,
+                    error: {
+                        code: TIER_SYNC_MANUAL_GRANT_SKIPPED,
+                        message: `manual tier grant "${String(assignment.tier)}" kept although the subscription yields "${effective}"`,
+                    },
                 };
             }
             const result = await routeDeps.dispatchSystemWrite({
@@ -96,11 +101,13 @@ export function createSubscriptionTierSync(deps) {
             });
             if (!result.isSuccess) {
                 return {
-                    code: "tier_sync_failed",
-                    message: `tier-engine update to "${effective}" failed: ${result.error?.code ?? "unknown"}`,
+                    error: {
+                        code: "tier_sync_failed",
+                        message: `tier-engine update to "${effective}" failed: ${result.error?.code ?? "unknown"}`,
+                    },
                 };
             }
-            return null;
+            return { error: null, applied: { tier: effective, changed: true } };
         }
         catch (error) {
             // dispatchSystemQuery throws (AccessDenied/NotFound/Validation) rather
@@ -109,8 +116,29 @@ export function createSubscriptionTierSync(deps) {
             // a failed dispatchSystemWrite instead of letting it bubble into the
             // webhook response as an unhandled 500.
             return {
-                code: "tier_sync_failed",
-                message: error instanceof Error ? error.message : "tier sync threw a non-Error value",
+                error: {
+                    code: "tier_sync_failed",
+                    message: error instanceof Error ? error.message : "tier sync threw a non-Error value",
+                },
+            };
+        }
+    }
+    async function syncTierFromSubscription(tenantId, routeDeps) {
+        return (await runTierSync(tenantId, routeDeps)).error;
+    }
+    async function syncAndNotify(tenantId, event, routeDeps) {
+        const outcome = await runTierSync(tenantId, routeDeps);
+        if (outcome.error !== null || outcome.applied === undefined || !deps.afterSync) {
+            return outcome.error;
+        }
+        try {
+            await deps.afterSync({ tenantId, event, ...outcome.applied });
+            return null;
+        }
+        catch (error) {
+            return {
+                code: "tier_sync_after_hook_failed",
+                message: error instanceof Error ? error.message : "afterSync threw a non-Error value",
             };
         }
     }
@@ -118,8 +146,8 @@ export function createSubscriptionTierSync(deps) {
     function createWebhookRoute(options = {}) {
         return createSubscriptionWebhookRoute({
             path: options.path ?? SUBSCRIPTION_WEBHOOK_PATH,
-            afterDispatch: async (dispatched, tenantId, routeDeps) => {
-                const syncError = await syncTierFromSubscription(tenantId, routeDeps);
+            afterDispatch: async (dispatched, tenantId, routeDeps, event) => {
+                const syncError = await syncAndNotify(tenantId, event, routeDeps);
                 if (syncError) {
                     // biome-ignore lint/suspicious/noConsole: operator visibility for a post-commit sync failure
                     console.warn(`[subscription-tier-sync] tier sync for tenant ${tenantId} after successful webhook write: ${syncError.code} ${syncError.message}`);
@@ -140,5 +168,5 @@ export function createSubscriptionTierSync(deps) {
             },
         });
     }
-    return { createWebhookRoute, syncTierFromSubscription };
+    return { createWebhookRoute, syncTierFromSubscription, syncAndNotify };
 }

package/dist/billing-foundation/webhook-handler.d.ts

@@ -1,3 +1,4 @@
+import type { PaymentEvent, SubscriptionEvent } from "./types.ts";
 export type SubscriptionWebhookRouteOptions = {
     /** Route path — MUST carry the `:providerName` path-param. Default
      *  "/api/subscription/webhook/:providerName". */
@@ -7,7 +8,7 @@ export type SubscriptionWebhookRouteOptions = {
      *  duplicating the provider-resolve/payload-mapping logic above. Returning
      *  a failed WriteResult turns the response into the same 500 a dispatch
      *  failure would produce. */
-    readonly afterDispatch?: (dispatched: import("@cosmicdrift/kumiko-framework/engine").WriteResult, tenantId: import("@cosmicdrift/kumiko-framework/engine").TenantId, deps: import("@cosmicdrift/kumiko-framework/api").SignatureExtraRouteDeps) => Promise<import("@cosmicdrift/kumiko-framework/engine").WriteResult>;
+    readonly afterDispatch?: (dispatched: import("@cosmicdrift/kumiko-framework/engine").WriteResult, tenantId: import("@cosmicdrift/kumiko-framework/engine").TenantId, deps: import("@cosmicdrift/kumiko-framework/api").SignatureExtraRouteDeps, event: SubscriptionEvent | PaymentEvent) => Promise<import("@cosmicdrift/kumiko-framework/engine").WriteResult>;
 };
 /**
  * Builds the `entry:"signature"` extraRoute definition. Mount via

package/dist/billing-foundation/webhook-handler.js

@@ -68,7 +68,7 @@ export function createSubscriptionWebhookRoute(options = {}) {
                     },
                 });
                 return respondFromDispatch(c, dispatched.isSuccess && options.afterDispatch
-                    ? await options.afterDispatch(dispatched, tenantId, deps)
+                    ? await options.afterDispatch(dispatched, tenantId, deps, parsed)
                     : dispatched, "subscription_payment_webhook_processing_failed", "Internal error processing payment event");
             }
             const dispatched = await deps.dispatchSystemWrite({
@@ -88,7 +88,7 @@ export function createSubscriptionWebhookRoute(options = {}) {
                 },
             });
             return respondFromDispatch(c, dispatched.isSuccess && options.afterDispatch
-                ? await options.afterDispatch(dispatched, tenantId, deps)
+                ? await options.afterDispatch(dispatched, tenantId, deps, parsed)
                 : dispatched, "subscription_webhook_processing_failed", "Internal error processing subscription event");
         },
     });

package/dist/file-provider-s3/env-schema.d.ts

@@ -1,5 +1,5 @@
 import * as z from "zod";
-/** S3-compatible endpoint URL: https, or http on a loopback host. */
+/** S3-compatible endpoint URL: https, or http on a loopback host; any http host outside `NODE_ENV=production`. */
 export declare const s3EndpointSchema: z.ZodURL;
 /** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
  *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.

package/dist/file-provider-s3/env-schema.js

@@ -1,17 +1,20 @@
 import * as z from "zod";
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
-// The bucket holds tenant files, so a remote endpoint must be https; plain
-// http stays allowed for a loopback MinIO in dev and CI.
-function isHttpsOrLoopbackHttp(value) {
+// The bucket holds tenant files, so in production a remote endpoint must be
+// https. Outside production plain http stays allowed, also for compose-network
+// hostnames (minio, rustfs) that are not loopback.
+function isAcceptableEndpoint(value) {
     if (!URL.canParse(value))
         return false;
     const url = new URL(value);
-    return url.protocol === "https:" || LOOPBACK_HOSTNAMES.has(url.hostname);
+    if (url.protocol === "https:")
+        return true;
+    return process.env["NODE_ENV"] !== "production" || LOOPBACK_HOSTNAMES.has(url.hostname);
 }
-/** S3-compatible endpoint URL: https, or http on a loopback host. */
+/** S3-compatible endpoint URL: https, or http on a loopback host; any http host outside `NODE_ENV=production`. */
 export const s3EndpointSchema = z
     .url({ protocol: /^https?$/ })
-    .refine(isHttpsOrLoopbackHttp, "must use https unless the host is loopback");
+    .refine(isAcceptableEndpoint, "must use https unless the host is loopback");
 /** Builds the env block `createS3ProviderFromEnv(prefix)` reads, e.g.
  *  `createS3EnvSchema({ prefix: "RELEASES_S3_" })` for a second bucket.
  *  Every field is optional: an app that mounts the env provider next to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.370.0",
+  "version": "0.371.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -536,12 +536,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.370.0",
-    "@cosmicdrift/kumiko-framework": "0.370.0",
-    "@cosmicdrift/kumiko-headless": "0.370.0",
-    "@cosmicdrift/kumiko-renderer": "0.370.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.370.0",
-    "@cosmicdrift/kumiko-types": "0.370.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.371.0",
+    "@cosmicdrift/kumiko-framework": "0.371.0",
+    "@cosmicdrift/kumiko-headless": "0.371.0",
+    "@cosmicdrift/kumiko-renderer": "0.371.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.371.0",
+    "@cosmicdrift/kumiko-types": "0.371.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1102,12 +1102,12 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.370.0",
-    "@cosmicdrift/kumiko-locale-es": "0.370.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.370.0",
+    "@cosmicdrift/kumiko-locale-de": "0.371.0",
+    "@cosmicdrift/kumiko-locale-es": "0.371.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.371.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.370.0"
+    "@cosmicdrift/kumiko-testing": "0.371.0"
   },
   "peerDependencies": {
     "@cosmicdrift/kumiko-testing": ">=0.366.0 <1.0.0"

package/src/auth-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "Boot warning when anonymous routes run without anonymousAccess",
+    "detail": "A boot warning names anonymousAccess when host-routing, managed-pages or legal-pages is mounted without it; anonymous requests get no tenant until the option is set."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "Billing webhook sync exposes afterSync",
+    "detail": "The billing webhook sync calls afterSync({ tenantId, tier, changed, event }) after every webhook, with changed false when the tier stayed the same."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/src/delivery/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "Unsubscribe endpoint answers form posts with an HTML page",
+    "detail": "POST on the delivery unsubscribe route returns an HTML confirmation page for a form post and JSON for a bare POST. The behavior is unchanged; this only documents it.",
+    "migration": "Clients that post the unsubscribe form expect HTML, API clients that post without a form content type expect JSON. No code change is needed."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/src/file-provider-s3/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.371.0",
+    "type": "improvement",
+    "title": "S3 endpoint over http outside production",
+    "detail": "s3EndpointSchema rejects http on non-loopback hosts only when NODE_ENV=production, so compose hostnames such as minio work in smoke setups."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",