@cosmicdrift/kumiko-bundled-features 0.386.0 → 0.388.0

package/dist/sessions/screens.js

@@ -12,7 +12,7 @@ export const createSessionListScreen = (adminRoles = access.admin) => ({
     pageSize: MAX_LIST_LIMIT,
     // Mirrors list.query's own fallback (unrecognised/absent sort → createdAt
     // desc) — kept in sync by hand, boot-validator only requires the field
-    // be present once the query accepts `sort` (fw#2230).
+    // be present once the query accepts `sort`.
     defaultSort: { field: "createdAt", dir: "desc" },
     columns: [
         { field: "id", label: i18nKey("sessions.list.col.id") },
@@ -71,7 +71,7 @@ export const createSessionDetailScreen = (adminRoles = access.admin) => ({
                     // The shim (projection-detail-shim.ts) stamps every field as
                     // type:"text" — field.renderer is the only way this screen
                     // type reaches real per-type formatting instead of a raw ISO
-                    // string (fw#2245).
+                    // string.
                     { field: "createdAt", renderer: { format: "timestamp" } },
                     { field: "expiresAt", renderer: { format: "timestamp" } },
                     { field: "revokedAt", renderer: { format: "timestamp" } },

package/dist/sessions/session-callbacks.js

@@ -155,11 +155,11 @@ export function createSessionCallbacks(opts) {
             return transaction(db, async (tx) => {
                 const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
                 // Lightweight append alongside the direct-write above, same pattern
-                // as revoke.write.ts (#1559) — this callback is the password-change
+                // as revoke.write.ts — this callback is the password-change
                 // auto-revoke path (sessions/feature.ts postSave hook) and has no
                 // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
                 // append() like revoke-all-for-user.write.ts does. Without this, the
-                // access-invalidation consumer (#1560) never hears about a password
+                // access-invalidation consumer never hears about a password
                 // change and an already-open SSE stream survives it — the exact
                 // "stale JWT mid-stream" gap this feature exists to close.
                 if (result.length > 0) {

package/dist/sessions/session-revoked-event.js

@@ -1,11 +1,11 @@
 import * as z from "zod";
 // Lightweight custom event appended alongside the direct-write
 // updateMany() in revoke.write.ts / revoke-all-others.write.ts /
-// revoke-all-for-user.write.ts (#1559). store_user_sessions itself stays
+// revoke-all-for-user.write.ts. store_user_sessions itself stays
 // an unmanaged direct-write store (see feature.ts) — the row columns are
 // the audit trail, this event is NOT a CRUD/lifecycle event for that
 // table and carries no projection. Its only job is to give cross-instance
-// consumers (access-invalidation, #1560) something to LISTEN for via the
+// consumers (access-invalidation) something to LISTEN for via the
 // existing event-store NOTIFY, keyed by the affected userId.
 //
 // _SHORT/_QN pair mirrors cap-counter's rolling-incremented event:

package/dist/shared/assert-no-where-rule-in-ownership-write.js

@@ -1,4 +1,4 @@
-// Boot validation rejects `{ kind: "where" }` in access.write too (fw#2626);
+// Boot validation rejects `{ kind: "where" }` in access.write too;
 // failing at factory time names the option instead of an entity scope.
 export function assertNoWhereRuleInOwnershipWrite(factoryName, writeOwnership) {
     // skip: no write ownership declared, nothing to validate

package/dist/shared/decrypt-stored-pii.d.ts

@@ -1 +1,2 @@
 export declare function decryptStoredPii(value: string, field: string, fallbackRequestId: string): Promise<string>;
+export declare function decryptStoredUserEmail(stored: string, fallbackRequestId: string): Promise<string | null>;

package/dist/shared/decrypt-stored-pii.js

@@ -1,10 +1,10 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
-import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
 // Raw reads (fetchOne/selectMany) return the stored column value — with an
 // active KMS that is ciphertext (self-describing: it names its own subject,
 // so no entity/field context is needed for key selection). `field` must
 // still match the field name used at encrypt time — it is part of the
-// AAD (#1263), so a mismatch fails decrypt loud rather than silently
+// AAD, so a mismatch fails decrypt loud rather than silently
 // letting ciphertext cut-and-pasted from another field decrypt. An erased
 // subject yields the sentinel, which matches no real value.
 export async function decryptStoredPii(value, field, fallbackRequestId) {
@@ -17,3 +17,8 @@ export async function decryptStoredPii(value, field, fallbackRequestId) {
     const decrypted = out[field];
     return typeof decrypted === "string" ? decrypted : value;
 }
+// Null for an erased subject: the sentinel must never be mailed or shown as an address.
+export async function decryptStoredUserEmail(stored, fallbackRequestId) {
+    const email = await decryptStoredPii(stored, "email", fallbackRequestId);
+    return email === PII_ERASED_SENTINEL ? null : email;
+}

package/dist/shared/encrypt-for-direct-write.js

@@ -4,7 +4,7 @@ import { subjectErasedConflict } from "@cosmicdrift/kumiko-framework/errors";
 // Unmanaged direct-write stores (r.unmanagedTable) skip the executor, so its
 // PII encryption never runs — every insert of subject-annotated fields must
 // go through this instead, and the feature declares { piiEncryptedOnWrite:
-// true } at the registration site (enforced by the registry, #820).
+// true } at the registration site (enforced by the registry).
 export async function encryptForDirectWrite(entity, entityName, row, fallbackRequestId) {
     const kms = configuredPiiSubjectKms();
     if (!kms)

package/dist/shared/index.d.ts

@@ -3,7 +3,7 @@ export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-own
 export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.ts";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.ts";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.ts";
-export { decryptStoredPii } from "./decrypt-stored-pii.ts";
+export { decryptStoredPii, decryptStoredUserEmail } from "./decrypt-stored-pii.ts";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
 export { entitiesOf } from "./entities-of.ts";
 export { isWithinGracePeriod } from "./grace-period.ts";

package/dist/shared/index.js

@@ -3,7 +3,7 @@ export { assertNoWhereRuleInOwnershipWrite } from "./assert-no-where-rule-in-own
 export { attachmentFileNameSchema, sanitizePdfAttachmentFileName, } from "./attachment-file-name.js";
 export { runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, } from "./classify-stored-envelope.js";
-export { decryptStoredPii } from "./decrypt-stored-pii.js";
+export { decryptStoredPii, decryptStoredUserEmail } from "./decrypt-stored-pii.js";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.js";
 export { entitiesOf } from "./entities-of.js";
 export { isWithinGracePeriod } from "./grace-period.js";

package/dist/shared/mail-template-body.d.ts

@@ -1,7 +1,11 @@
 export declare function mailTextWithSlotsHtml(text: string): string;
-export declare function mailParagraph(text: string): string;
+type MailParagraphOptions = {
+    readonly showIf?: string;
+};
+export declare function mailParagraph(text: string, options?: MailParagraphOptions): string;
 export declare function mailHeading(text: string): string;
 export declare function mailButton(label: string, linkVariable: string): string;
-export declare function mailParagraphWithLink(text: string, linkLabel: string, linkVariable: string): string;
+export declare function mailParagraphWithLink(text: string, linkLabel: string, linkVariable: string, options?: MailParagraphOptions): string;
 export declare function mailRepeatedRows(listName: string, field: string): string;
 export declare function mailSubject(text: string): string;
+export {};

package/dist/shared/mail-template-body.js

@@ -5,8 +5,11 @@ const SLOT_PATTERN = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 export function mailTextWithSlotsHtml(text) {
     return escapeHtml(text).replace(SLOT_PATTERN, (_, name) => `<span data-variable="${escapeHtmlAttr(name)}"></span>`);
 }
-export function mailParagraph(text) {
-    return `<p>${mailTextWithSlotsHtml(text)}</p>`;
+function paragraphOpenTag(options) {
+    return options?.showIf === undefined ? "<p>" : `<p data-if="${escapeHtmlAttr(options.showIf)}">`;
+}
+export function mailParagraph(text, options) {
+    return `${paragraphOpenTag(options)}${mailTextWithSlotsHtml(text)}</p>`;
 }
 export function mailHeading(text) {
     return `<h2>${mailTextWithSlotsHtml(text)}</h2>`;
@@ -14,8 +17,8 @@ export function mailHeading(text) {
 export function mailButton(label, linkVariable) {
     return `<p><a data-button href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(label)}</a></p>`;
 }
-export function mailParagraphWithLink(text, linkLabel, linkVariable) {
-    return `<p>${mailTextWithSlotsHtml(text)} <a href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(linkLabel)}</a></p>`;
+export function mailParagraphWithLink(text, linkLabel, linkVariable, options) {
+    return `${paragraphOpenTag(options)}${mailTextWithSlotsHtml(text)} <a href="{{${escapeHtmlAttr(linkVariable)}}}">${escapeHtml(linkLabel)}</a></p>`;
 }
 // One table row per list entry; the cell shows the entry's `field`.
 export function mailRepeatedRows(listName, field) {

package/dist/shared/map-with-concurrency.js

@@ -12,19 +12,20 @@
 // an unhandled rejection — verified in `mapWithConcurrency.test.ts`).
 export async function mapWithConcurrency(items, limit, fn) {
     const results = new Array(items.length);
-    let nextIndex = 0;
+    const unclaimed = items.entries();
     let failed = false;
     async function worker() {
         for (;;) {
             // skip: another worker already failed — stop claiming new items.
             if (failed)
                 return;
-            const index = nextIndex++;
+            const claimed = unclaimed.next();
             // skip: cursor exhausted, normal worker-loop exit
-            if (index >= items.length)
+            if (claimed.done)
                 return;
+            const [index, item] = claimed.value;
             try {
-                results[index] = await fn(items[index], index);
+                results[index] = await fn(item, index);
             }
             catch (err) {
                 failed = true;

package/dist/shared/parent-visibility.js

@@ -60,14 +60,14 @@ export async function hostRowIsGone(registry, entityType, entityId, db) {
     const row = await db.fetchOne(table, { id: entityId });
     return row === undefined || row["isDeleted"] === true;
 }
-// Write-path half of the parentRef gate (fw#2766). Resolves the join entity's
+// Write-path half of the parentRef gate. Resolves the join entity's
 // own `parentRef` declaration from the registry — the same object the read
 // path's SQL gate reads — so the field names and the allowedTypes allowlist
 // exist in exactly one place instead of once per path.
 export async function joinRowParentIsVisible(registry, joinEntityName, payload, user, db) {
     const parentRef = registry.getEntity(joinEntityName)?.parentRef;
     // A mount whose join entity lost its declaration can't derive a gate —
-    // deny rather than silently fall back to the pre-#2766 open behaviour.
+    // deny rather than silently fall back to the open behaviour.
     if (parentRef === undefined)
         return false;
     const entityType = payload[parentRef.entityTypeField];

package/dist/shared/password-hashing.js

@@ -40,7 +40,7 @@ export async function verifyPassword(hashString, password) {
         return false;
     }
 }
-// Anti-enumeration timing equaliser (#774). The login handler runs this on
+// Anti-enumeration timing equaliser. The login handler runs this on
 // the no-user / no-hash path so a missing account costs the same argon2
 // latency as a real verify — otherwise response timing leaks whether an
 // email is registered. Derived from hashPassword once and cached, so it

package/dist/shared/signup-handover.js

@@ -1,5 +1,4 @@
-// Cross-device try-first handover (kumiko-framework#3035 follow-up,
-// offlot-app#454): signup-request runs in whichever browser the activation
+// Cross-device try-first handover: signup-request runs in whichever browser the activation
 // link ends up opened in, which may not be the one holding the anonymous
 // visitor's tenant-handover grant. This extension point lets
 // auth-email-password bind a verified grant to the signup token server-side

package/dist/shared/single-use-token-store.js

@@ -25,7 +25,7 @@
 //
 // Every key is derived from sha256(token), never the raw token — Redis key
 // names, MONITOR output, replica traffic, and memory/backup dumps never
-// carry the bearer secret in the clear (#2174). The by-subject entry stores
+// carry the bearer secret in the clear. The by-subject entry stores
 // the *hash* of the live token, not the token itself, so it can only be
 // used to invalidate (delete the matching forward entry) — never to
 // recover or resend the original token. A resend therefore always mints a

package/dist/step-dispatcher/feature.js

@@ -42,6 +42,7 @@ export function createStepDispatcherFeature() {
             retries: DELIVER_RETRIES,
             backoff: "exponential",
             maxPerTenant: { limit: DELIVER_MAX_PER_TENANT, onLimit: "defer" },
+            schema: deliverJobPayloadSchema,
             escapeHatch: { reason: DELIVER_ESCAPE_HATCH_REASON },
         }, async (payload, ctx) => {
             const { aggregateId } = deliverJobPayloadSchema.parse(payload);

package/dist/subscription-dodo/client.d.ts

@@ -0,0 +1,17 @@
+export type DodoSend = (url: string, init?: RequestInit) => Promise<Response>;
+export type DodoRequest = {
+    readonly method: "GET" | "POST" | "PATCH";
+    /** Path segments interpolated into it must already be encodeURIComponent'ed. */
+    readonly path: string;
+    readonly query?: Readonly<Record<string, string>>;
+    readonly body?: unknown;
+};
+export type DodoTarget = {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+};
+export declare class DodoHttpError extends Error {
+    readonly status: number;
+    constructor(request: DodoRequest, status: number);
+}
+export declare function createDodoHttp(send: DodoSend): (target: DodoTarget, request: DodoRequest) => Promise<unknown>;

package/dist/subscription-dodo/client.js

@@ -0,0 +1,31 @@
+// Thin JSON-over-fetch client for the Dodo Payments REST API. All traffic goes
+// through the injected `send`, which defaults to the SSRF-safe egress in
+// feature.ts and is replaced by a mock in tests.
+import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+// Never carries the response body or the key: both can hold customer data or secrets.
+export class DodoHttpError extends Error {
+    status;
+    constructor(request, status) {
+        super(`subscription-dodo: ${request.method} ${request.path} failed with status ${status}`);
+        this.name = "DodoHttpError";
+        this.status = status;
+    }
+}
+export function createDodoHttp(send) {
+    return async (target, request) => {
+        const query = request.query ? `?${new URLSearchParams(request.query).toString()}` : "";
+        const response = await send(`${target.baseUrl}${request.path}${query}`, {
+            method: request.method,
+            headers: {
+                Authorization: `Bearer ${target.apiKey}`,
+                Accept: "application/json",
+                ...(request.body !== undefined && { "Content-Type": "application/json" }),
+            },
+            ...(request.body !== undefined && { body: JSON.stringify(request.body) }),
+        });
+        if (!response.ok)
+            throw new DodoHttpError(request, response.status);
+        const text = await response.text();
+        return text.length === 0 ? null : parseJsonOrThrow(text, "subscription-dodo response");
+    };
+}

package/dist/subscription-dodo/constants.d.ts

@@ -0,0 +1,12 @@
+export declare const SUBSCRIPTION_DODO_FEATURE: "subscription-dodo";
+export declare const DODO_PROVIDER_NAME: "dodo";
+export declare const DODO_API_KEY_CONFIG: "api-key";
+export declare const DODO_WEBHOOK_SECRET_CONFIG: "webhook-secret";
+export declare const DODO_BILLING_LIVE_CONFIG: "billingLive";
+export declare const DODO_ENVIRONMENT_CONFIG: "environment";
+export declare const DodoEnvironments: {
+    readonly test: "test";
+    readonly live: "live";
+};
+export type DodoEnvironment = (typeof DodoEnvironments)[keyof typeof DodoEnvironments];
+export declare const DODO_BASE_URLS: Readonly<Record<DodoEnvironment, string>>;

package/dist/subscription-dodo/constants.js

@@ -0,0 +1,19 @@
+export const SUBSCRIPTION_DODO_FEATURE = "subscription-dodo";
+// Must match the path segment in the webhook URL `/api/subscription/webhook/dodo`.
+export const DODO_PROVIDER_NAME = "dodo";
+// Config-key short-names, qualified to `subscription-dodo:config:<name>` at
+// registry-build. api-key + webhook-secret are backing:"secrets".
+export const DODO_API_KEY_CONFIG = "api-key";
+export const DODO_WEBHOOK_SECRET_CONFIG = "webhook-secret";
+export const DODO_BILLING_LIVE_CONFIG = "billingLive";
+export const DODO_ENVIRONMENT_CONFIG = "environment";
+// Separate from billingLive on purpose: staging runs Dodo's test API with
+// billingLive on, production flips both.
+export const DodoEnvironments = {
+    test: "test",
+    live: "live",
+};
+export const DODO_BASE_URLS = {
+    test: "https://test.dodopayments.com",
+    live: "https://live.dodopayments.com",
+};

package/dist/subscription-dodo/feature.d.ts

@@ -0,0 +1,37 @@
+import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import * as z from "zod";
+import type { DodoSend } from "./client.ts";
+/** Bridge contract: both fields are optional fallbacks for the secrets store. */
+export declare const subscriptionDodoEnvSchema: z.ZodObject<{
+    DODO_PAYMENTS_API_KEY: z.ZodOptional<z.ZodString>;
+    DODO_PAYMENTS_WEBHOOK_KEY: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type DodoProductEnvShape<TPrice extends string> = {
+    [Key in `DODO_PRODUCT_${TPrice}`]: z.ZodOptional<z.ZodString>;
+};
+/** Dodo env block plus one `DODO_PRODUCT_<NAME>` slot per plan product the app
+ *  maps to a tier, e.g. `dodoEnvSchema({ prices: ["PRO", "TEAM"] })`.
+ *  Shares its bridge fields with `subscriptionDodoEnvSchema`, so spreading
+ *  it into `composeEnvSchema({ extend })` next to the mounted feature is no
+ *  key clash. */
+export declare function dodoEnvSchema<const TPrice extends string>(options: {
+    readonly prices: readonly TPrice[];
+}): z.ZodObject<{
+    DODO_PAYMENTS_API_KEY: z.ZodOptional<z.ZodString>;
+    DODO_PAYMENTS_WEBHOOK_KEY: z.ZodOptional<z.ZodString>;
+} & DodoProductEnvShape<TPrice> extends infer T ? { -readonly [P in keyof T]: T[P]; } : never, z.core.$strip>;
+export type SubscriptionDodoOptions = {
+    /** Bridge-fallback API key; the `api-key` config key wins when set. */
+    readonly apiKey?: string;
+    /** Bridge-fallback webhook secret; the `webhook-secret` config key wins when set. */
+    readonly webhookSecret?: string;
+    /** Dodo product id → app tier name. Products absent here drop the event. */
+    readonly priceToTier?: Readonly<Record<string, string>>;
+    /** Product ids a mode:"payment" checkout may target; empty = one-off checkouts closed. */
+    readonly oneOffPriceIds?: readonly string[];
+    /** HTTP transport; defaults to the SSRF-safe external egress. Test seam. */
+    readonly send?: DodoSend;
+};
+export declare function createSubscriptionDodoFeature(options?: SubscriptionDodoOptions): FeatureWithEnvSchema<FeatureDefinition, typeof subscriptionDodoEnvSchema.shape>;
+export {};

package/dist/subscription-dodo/feature.js

@@ -0,0 +1,144 @@
+// kumiko-feature-version: 1
+//
+// subscription-dodo — Dodo Payments (merchant of record) plugin for the
+// billing-foundation plugin API. Credentials, the billing-live master switch and
+// the API environment (test | live) are config keys resolved at call time, like
+// subscription-stripe. `apiKey` / `webhookSecret` options are env→secrets bridge
+// fallbacks.
+import { access, createSystemConfig, defineFeature, } from "@cosmicdrift/kumiko-framework/engine";
+import { featureWithEnvSchema } from "@cosmicdrift/kumiko-framework/env";
+import { egress } from "@cosmicdrift/kumiko-framework/http";
+import * as z from "zod";
+import { DODO_API_KEY_CONFIG, DODO_BILLING_LIVE_CONFIG, DODO_ENVIRONMENT_CONFIG, DODO_PROVIDER_NAME, DODO_WEBHOOK_SECRET_CONFIG, DodoEnvironments, SUBSCRIPTION_DODO_FEATURE, } from "./constants.js";
+import { createDodoApplyPlanSwitch, createDodoCancelSubscription, createDodoCheckoutSession, createDodoPortalSession, createDodoPreviewPlanSwitch, createDodoPriceCache, createDodoResumeSubscription, createDodoRetrievePrices, createDodoRetrieveSubscription, } from "./plugin-methods.js";
+import { createDodoRuntimes } from "./runtime.js";
+import { verifyAndParseDodoWebhook } from "./verify-webhook.js";
+/** Bridge contract: both fields are optional fallbacks for the secrets store. */
+export const subscriptionDodoEnvSchema = z.object({
+    DODO_PAYMENTS_API_KEY: z
+        .string()
+        .min(1)
+        .describe("Dodo Payments API key. Bridge-fallback — prefer the secret.")
+        .meta({ kumiko: { pulumi: { secret: true } } })
+        .optional(),
+    DODO_PAYMENTS_WEBHOOK_KEY: z
+        .string()
+        .min(1)
+        .describe("Dodo Payments webhook signing key (`whsec_...`). Bridge-fallback — prefer the secret.")
+        .meta({ kumiko: { pulumi: { secret: true } } })
+        .optional(),
+});
+/** Dodo env block plus one `DODO_PRODUCT_<NAME>` slot per plan product the app
+ *  maps to a tier, e.g. `dodoEnvSchema({ prices: ["PRO", "TEAM"] })`.
+ *  Shares its bridge fields with `subscriptionDodoEnvSchema`, so spreading
+ *  it into `composeEnvSchema({ extend })` next to the mounted feature is no
+ *  key clash. */
+export function dodoEnvSchema(options) {
+    const productShape = Object.fromEntries(options.prices.map((price) => [
+        `DODO_PRODUCT_${price}`,
+        z
+            .string()
+            .regex(/^pdt_/, `DODO_PRODUCT_${price} must start with 'pdt_'`)
+            .optional()
+            .describe(`Dodo Payments product id (\`pdt_...\`) of the ${price} plan.`),
+    ]));
+    return z.object({ ...subscriptionDodoEnvSchema.shape, ...productShape });
+}
+// Validated once at feature-build time so a typo fails app startup instead of
+// silently widening or narrowing the one-off allowlist at request time.
+function validateOneOffPriceIds(priceIds) {
+    const seen = new Set();
+    for (const priceId of priceIds) {
+        if (priceId.length === 0) {
+            throw new Error("subscription-dodo: oneOffPriceIds must not contain an empty string");
+        }
+        if (seen.has(priceId)) {
+            throw new Error(`subscription-dodo: duplicate oneOffPriceIds entry "${priceId}"`);
+        }
+        seen.add(priceId);
+    }
+}
+export function createSubscriptionDodoFeature(options = {}) {
+    validateOneOffPriceIds(options.oneOffPriceIds ?? []);
+    const feature = defineFeature(SUBSCRIPTION_DODO_FEATURE, (r) => {
+        r.describe('Dodo Payments provider plugin for `billing-foundation`. Dodo acts as merchant of record: it sells to the customer and issues invoice and VAT, so the consumer-protection texts for this provider come from `consumerProtection.providerTexts`. Reads its API key and webhook secret from system config keys with `backing:"secrets"` (envelope-encrypted in the secrets store under the system tenant), plus a `billingLive` master switch and an `environment` key (test | live). `environment` is its own key because Dodo serves test and live mode from different API hosts and a live key must never hit the test host or the other way round; `billingLive` only decides whether checkouts are offered at all. All four are runtime config, so keys rotate and prod goes live without a redeploy, and the `mask` on each derives the sysadmin settings screen and nav. Mount via `createSubscriptionDodoFeature({ priceToTier })`; the optional `apiKey`/`webhookSecret` options are env to secrets bridge fallbacks (`DODO_PAYMENTS_API_KEY`, `DODO_PAYMENTS_WEBHOOK_KEY`). The plugin always mounts; `createCheckoutSession` throws `feature_disabled` unless `billingLive` is true. Webhooks arrive at `/api/subscription/webhook/dodo` and are verified per the Standard Webhooks spec (HMAC-SHA256 over id, timestamp and the raw body, 5 minute tolerance); events for products outside `priceToTier` or without tenant metadata are dropped. Implements hosted checkout, customer portal, cancel and resume, `retrievePrices` (10-minute TTL cache), `retrieveSubscription` for the sync job, and an in-app plan switch: `previewPlanSwitch` shows the proration before the customer confirms, `applyPlanSwitch` changes the plan without a hosted page and waits for the `plan_changed` webhook to move the tier. A plan switch in Dodo requires all plan products to belong to one Product Collection.');
+        r.uiHints({
+            displayLabel: "Billing · Dodo Payments",
+            category: "billing",
+            recommended: false,
+        });
+        r.requires({ features: ["billing-foundation"] });
+        r.requires({ features: ["config"] });
+        r.requires({ features: ["secrets"] });
+        r.envSchema(subscriptionDodoEnvSchema);
+        const configKeys = r.config({
+            keys: {
+                [DODO_API_KEY_CONFIG]: createSystemConfig("text", {
+                    backing: "secrets",
+                    write: access.systemAdmin,
+                    read: access.admin,
+                    mask: { title: "subscription-dodo.api-key", icon: "key", order: 1 },
+                }),
+                [DODO_WEBHOOK_SECRET_CONFIG]: createSystemConfig("text", {
+                    backing: "secrets",
+                    write: access.systemAdmin,
+                    read: access.admin,
+                    mask: { title: "subscription-dodo.webhook-secret", icon: "shield", order: 2 },
+                }),
+                [DODO_ENVIRONMENT_CONFIG]: createSystemConfig("select", {
+                    default: DodoEnvironments.test,
+                    options: [DodoEnvironments.test, DodoEnvironments.live],
+                    write: access.systemAdmin,
+                    read: access.admin,
+                    mask: { title: "subscription-dodo.environment", icon: "server", order: 3 },
+                }),
+                [DODO_BILLING_LIVE_CONFIG]: createSystemConfig("boolean", {
+                    default: false,
+                    write: access.privileged,
+                    read: access.admin,
+                    mask: { title: "subscription-dodo.billing-live", icon: "rocket", order: 4 },
+                }),
+            },
+        });
+        r.translations({
+            keys: {
+                "subscription-dodo.api-key": { en: "Dodo Payments API key" },
+                "subscription-dodo.webhook-secret": { en: "Dodo Payments webhook secret" },
+                "subscription-dodo.environment": { en: "Dodo Payments environment" },
+                "subscription-dodo.billing-live": { en: "Live billing" },
+                "subscription-dodo.settings": { en: "Dodo Payments" },
+                "screen:subscription-dodo-system.title": { en: "Dodo Payments" },
+            },
+        });
+        const priceToTier = options.priceToTier ?? {};
+        const runtimes = createDodoRuntimes({
+            apiKeyHandle: configKeys[DODO_API_KEY_CONFIG],
+            webhookSecretHandle: configKeys[DODO_WEBHOOK_SECRET_CONFIG],
+            billingLiveHandle: configKeys[DODO_BILLING_LIVE_CONFIG],
+            environmentHandle: configKeys[DODO_ENVIRONMENT_CONFIG],
+            send: options.send ?? egress({ kind: "external" }),
+            fallback: {
+                ...(options.apiKey !== undefined && { apiKey: options.apiKey }),
+                ...(options.webhookSecret !== undefined && { webhookSecret: options.webhookSecret }),
+            },
+        });
+        const plugin = {
+            displayName: "Dodo Payments",
+            verifyAndParseWebhook: verifyAndParseDodoWebhook(runtimes.webhook, { priceToTier }),
+            createCheckoutSession: createDodoCheckoutSession(runtimes.ctx),
+            createPortalSession: createDodoPortalSession(runtimes.ctx),
+            cancelSubscription: createDodoCancelSubscription(runtimes.ctx),
+            resumeSubscription: createDodoResumeSubscription(runtimes.ctx),
+            priceToTier,
+            oneOffPriceIds: options.oneOffPriceIds ?? [],
+            isBillingEnabled: runtimes.ctx.isBillingEnabled,
+            retrievePrices: createDodoRetrievePrices(runtimes.ctx, createDodoPriceCache()),
+            retrieveSubscription: createDodoRetrieveSubscription(runtimes.ctx, { priceToTier }),
+            previewPlanSwitch: createDodoPreviewPlanSwitch(runtimes.ctx),
+            applyPlanSwitch: createDodoApplyPlanSwitch(runtimes.ctx),
+        };
+        r.useExtension("subscriptionProvider", DODO_PROVIDER_NAME, plugin);
+        return { configKeys };
+    });
+    return featureWithEnvSchema(feature, subscriptionDodoEnvSchema);
+}

package/dist/subscription-dodo/index.d.ts

@@ -0,0 +1,2 @@
+export { DODO_BASE_URLS, DODO_PROVIDER_NAME, type DodoEnvironment, DodoEnvironments, SUBSCRIPTION_DODO_FEATURE, } from "./constants.ts";
+export { createSubscriptionDodoFeature, dodoEnvSchema, type SubscriptionDodoOptions, subscriptionDodoEnvSchema, } from "./feature.ts";

package/dist/subscription-dodo/index.js

@@ -0,0 +1,4 @@
+// Public API of the subscription-dodo bundled feature. The webhook verifier,
+// client and plugin methods are internal to feature.ts.
+export { DODO_BASE_URLS, DODO_PROVIDER_NAME, DodoEnvironments, SUBSCRIPTION_DODO_FEATURE, } from "./constants.js";
+export { createSubscriptionDodoFeature, dodoEnvSchema, subscriptionDodoEnvSchema, } from "./feature.js";

package/dist/subscription-dodo/plugin-methods.d.ts

@@ -0,0 +1,23 @@
+import { type ProviderPrice, type SubscriptionProviderPlugin } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import type { DodoCtxRuntime } from "./runtime.ts";
+type PluginMethod<TName extends keyof SubscriptionProviderPlugin> = NonNullable<SubscriptionProviderPlugin[TName]>;
+export declare function createDodoCheckoutSession(runtime: DodoCtxRuntime): PluginMethod<"createCheckoutSession">;
+export declare function createDodoPortalSession(runtime: DodoCtxRuntime): PluginMethod<"createPortalSession">;
+export declare function createDodoCancelSubscription(runtime: DodoCtxRuntime): PluginMethod<"cancelSubscription">;
+export declare function createDodoResumeSubscription(runtime: DodoCtxRuntime): PluginMethod<"resumeSubscription">;
+export type DodoPriceCache = {
+    readonly get: (priceId: string) => ProviderPrice | null | undefined;
+    readonly set: (priceId: string, price: ProviderPrice | null) => void;
+};
+export type DodoPriceCacheOptions = {
+    readonly ttlMs?: number;
+    readonly now?: () => number;
+};
+export declare function createDodoPriceCache({ ttlMs, now, }?: DodoPriceCacheOptions): DodoPriceCache;
+export declare function createDodoRetrievePrices(runtime: DodoCtxRuntime, cache: DodoPriceCache): PluginMethod<"retrievePrices">;
+export declare function createDodoPreviewPlanSwitch(runtime: DodoCtxRuntime): PluginMethod<"previewPlanSwitch">;
+export declare function createDodoApplyPlanSwitch(runtime: DodoCtxRuntime): PluginMethod<"applyPlanSwitch">;
+export declare function createDodoRetrieveSubscription(runtime: DodoCtxRuntime, options: {
+    readonly priceToTier: Readonly<Record<string, string>>;
+}): PluginMethod<"retrieveSubscription">;
+export {};