@cosmicdrift/kumiko-bundled-features 0.388.0 → 0.389.0

package/dist/auth-email-password/web/login-screen.js

@@ -1,12 +1,12 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Login handler reason codes map 1:1 to i18n keys (reasonToI18nKey): a new
 // reason code needs a bundle entry plus a line in that mapping.
-import { useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
+import { prependBasePath, useBasePath, useOptionalDispatcher, usePrimitives, useQuery, useTranslation, } from "@cosmicdrift/kumiko-renderer";
 import { useState } from "react";
 import { requestEmailVerification, } from "./auth-client.js";
 import { AuthCard } from "./auth-form-primitives.js";
 import { DEFAULT_AUTH_PATHS, DEFAULT_FORGOT_PASSWORD_PATH } from "./auth-paths.js";
-import { followNextOrLandingAfterLogin } from "./auth-redirect.js";
+import { appendReturnTo, followNextOrLandingAfterLogin, readNextFromWindow, } from "./auth-redirect.js";
 import { AuthQueries } from "./constants.js";
 import { useSession } from "./session.js";
 // Maps login-handler reason codes to i18n keys and optional interpolation parameters.
@@ -51,14 +51,19 @@ function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unl
     // Hides the resend button once the email input changes; otherwise resend
     // would silently go to the edited, possibly mistyped address.
     const [failedLoginEmail, setFailedLoginEmail] = useState(null);
+    const basePath = useBasePath();
+    // The page the user was sent away from rides along so the reset or signup mail leads back to it.
+    const returnTo = readNextFromWindow();
     const effectiveForgotHref = forgotPasswordHref === undefined
         ? loginOptions?.passwordReset === true
-            ? DEFAULT_FORGOT_PASSWORD_PATH
+            ? appendReturnTo(prependBasePath(DEFAULT_FORGOT_PASSWORD_PATH, basePath), returnTo)
             : null
-        : forgotPasswordHref;
+        : forgotPasswordHref === null
+            ? null
+            : appendReturnTo(forgotPasswordHref, returnTo);
     const effectiveUnlockHref = unlockAccountHref === undefined
         ? loginOptions?.accountUnlock === true
-            ? DEFAULT_AUTH_PATHS.unlockAccount
+            ? prependBasePath(DEFAULT_AUTH_PATHS.unlockAccount, basePath)
             : null
         : unlockAccountHref;
     const doSubmit = async () => {
@@ -123,7 +128,7 @@ function LoginScreenBody({ title, subtitle, submitLabel, forgotPasswordHref, unl
                                     email.trim().length > 0 &&
                                     email === failedLoginEmail && (_jsx("span", { className: "self-start", children: _jsx(Button, { variant: "link", onClick: () => void onResend(), disabled: resendStatus.kind === "sending", children: resendStatus.kind === "sending"
                                             ? t("auth.login.submitting")
-                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: signupHref, variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
+                                            : t("auth.login.resendVerification") }) })), error.reason === "account_locked" && effectiveUnlockHref !== null && (_jsx("span", { className: "self-start", children: _jsx(Link, { href: effectiveUnlockHref, variant: "default", children: t("auth.login.unlockAccount") }) })), resendStatus.kind === "rateLimited" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendRateLimited") })), resendStatus.kind === "error" && (_jsx("span", { className: "text-xs", children: t("auth.login.resendError") }))] }) })) : null, _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.login.submitting") : effectiveSubmit })] }), effectiveForgotHref !== null && (_jsx(Link, { href: effectiveForgotHref, variant: "muted", className: "self-center", children: t("auth.login.forgotPassword") })), signupHref !== undefined && (_jsx(Link, { href: appendReturnTo(signupHref, returnTo), variant: "muted", className: "self-center", children: t("auth.signup.title") })), legalLinks !== undefined && legalLinks.length > 0 && (_jsx("nav", { "data-testid": "login-legal-links", className: "flex items-center justify-center gap-3 pt-2 border-t border-border/50", children: legalLinks.map((link) => (_jsx(Link, { href: link.href, variant: "muted", className: "text-xs", children: link.label }, link.href))) }))] }));
 }
 function LoginScreenWithQueriedOptions(props) {
     const { data } = useQuery(AuthQueries.loginOptions, {}, { enabled: props.forgotPasswordHref === undefined || props.unlockAccountHref === undefined });

package/dist/auth-email-password/web/reset-password-screen.js

@@ -13,6 +13,7 @@ import { useState } from "react";
 import { resetPassword } from "./auth-client.js";
 import { passwordPairIssue } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
+import { buildLoginRedirectUrl, readReturnToFromWindow } from "./auth-redirect.js";
 export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/login", }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
@@ -22,6 +23,7 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     const [submitting, setSubmitting] = useState(false);
     const [done, setDone] = useState(false);
     const [error, setError] = useState(null);
+    const [afterResetHref, setAfterResetHref] = useState(loginHref);
     const doSubmit = async () => {
         setError(null);
         const issue = passwordPairIssue(newPassword, confirmPassword);
@@ -37,6 +39,10 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
         const res = await resetPassword(token, newPassword);
         setSubmitting(false);
         if (res.ok) {
+            const returnTo = readReturnToFromWindow();
+            if (returnTo !== null) {
+                setAfterResetHref(buildLoginRedirectUrl(loginHref, returnTo, window.location.origin));
+            }
             setDone(true);
             return;
         }
@@ -62,5 +68,5 @@ export function ResetPasswordScreen({ title, token: tokenProp, loginHref = "/log
     if (token === "") {
         return (_jsxs(AuthCard, { title: effectiveTitle, children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.missingToken") }), _jsx(Link, { href: loginHref, variant: "muted", children: t("auth.resetPassword.goToLogin") })] }));
     }
-    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: loginHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
+    return (_jsx(AuthCard, { title: effectiveTitle, children: done ? (_jsxs(_Fragment, { children: [_jsxs(Banner, { variant: "info", children: [_jsx("p", { className: "font-medium text-foreground", children: t("auth.resetPassword.successTitle") }), _jsx("p", { className: "mt-1", children: t("auth.resetPassword.successBody") })] }), _jsx(Link, { href: afterResetHref, variant: "button", children: t("auth.resetPassword.goToLogin") })] })) : (_jsxs(_Fragment, { children: [_jsx("p", { className: "text-sm text-muted-foreground", children: t("auth.resetPassword.intro") }), _jsxs(Form, { onSubmit: onSubmit, children: [_jsx(Field, { id: "reset-new-password", label: t("auth.resetPassword.newPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-new-password", name: "reset-new-password", value: newPassword, onChange: setNewPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), _jsx(Field, { id: "reset-confirm-password", label: t("auth.resetPassword.confirmPassword"), required: true, children: _jsx(Input, { kind: "password", id: "reset-confirm-password", name: "reset-confirm-password", value: confirmPassword, onChange: setConfirmPassword, disabled: submitting, required: true, autoComplete: "new-password" }) }), error !== null && _jsx(Banner, { variant: "error", children: error }), _jsx(Button, { type: "submit", loading: submitting, disabled: submitting, children: submitting ? t("auth.resetPassword.submitting") : t("auth.resetPassword.submit") })] })] })) }));
 }

package/dist/auth-email-password/web/return-path.d.ts

@@ -0,0 +1,4 @@
+export declare const RETURN_TO_QUERY_PARAM = "returnTo";
+export declare const MAX_RETURN_PATH_LENGTH = 2048;
+export declare function isSafeReturnPath(candidate: unknown): candidate is string;
+export declare function readReturnToFromSearch(search: string): string | null;

package/dist/auth-email-password/web/return-path.js

@@ -0,0 +1,34 @@
+// Shared by the server (mail link) and the web pages (landing page), so it is plain string logic:
+// no DOM, no window, no `new URL` (React Native's URL getters throw).
+export const RETURN_TO_QUERY_PARAM = "returnTo";
+export const MAX_RETURN_PATH_LENGTH = 2048;
+const DOT_SEGMENTS = new Set([".", "..", ".%2e", "%2e.", "%2e%2e", "%2e"]);
+function hasForbiddenCharacter(candidate) {
+    for (let i = 0; i < candidate.length; i++) {
+        const code = candidate.charCodeAt(i);
+        if (code <= 0x20 || code === 0x7f || (code >= 0x80 && code <= 0x9f))
+            return true;
+        if (code === 0x5c)
+            return true;
+    }
+    return false;
+}
+// A dot segment is resolved by URL normalization, so "/.//evil" would become "//evil".
+function hasDotSegment(candidate) {
+    const pathEnd = candidate.search(/[?#]/);
+    const path = pathEnd === -1 ? candidate : candidate.slice(0, pathEnd);
+    return path.split("/").some((segment) => DOT_SEGMENTS.has(segment.toLowerCase()));
+}
+export function isSafeReturnPath(candidate) {
+    if (typeof candidate !== "string")
+        return false;
+    if (candidate.length < 1 || candidate.length > MAX_RETURN_PATH_LENGTH)
+        return false;
+    if (!candidate.startsWith("/") || candidate[1] === "/")
+        return false;
+    return !hasForbiddenCharacter(candidate) && !hasDotSegment(candidate);
+}
+export function readReturnToFromSearch(search) {
+    const candidate = new URLSearchParams(search).get(RETURN_TO_QUERY_PARAM);
+    return isSafeReturnPath(candidate) ? candidate : null;
+}

package/dist/auth-email-password/web/session.js

@@ -10,6 +10,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
 // and transitions.
 import { CurrentUserProvider, useSessionEndedSignal, } from "@cosmicdrift/kumiko-renderer";
 import { readCsrfToken } from "@cosmicdrift/kumiko-renderer/live";
+import { clearRememberedListState } from "@cosmicdrift/kumiko-renderer/web";
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, } from "react";
 import { AuthRequestError, fetchCurrentUser, fetchTenants, login as loginApi, logout as logoutApi, switchTenant as switchTenantApi, } from "./auth-client.js";
 // Exported so screens that render on BOTH authenticated and anonymous public
@@ -127,6 +128,8 @@ export function SessionProvider({ children, postLogoutUrl, }) {
     }, [doRefresh]);
     const logout = useCallback(async () => {
         await logoutApi();
+        // The reload below would hide the identity change from the list-state boot.
+        clearRememberedListState();
         if (postLogoutUrl !== undefined && typeof window !== "undefined") {
             // State stays untouched: flipping to unauthenticated would let an AuthGate
             // with loginUrl race this navigation to its own redirect.
@@ -160,6 +163,7 @@ export function SessionProvider({ children, postLogoutUrl, }) {
     const userEmail = profile?.email;
     const userDisplayName = profile?.displayName;
     const userTimeZone = profile?.effectiveTimeZone;
+    const activeTenantId = state.activeTenantId ?? undefined;
     const currentUser = useMemo(() => userId === undefined || userEmail === undefined || userDisplayName === undefined
         ? undefined
         : {
@@ -167,7 +171,8 @@ export function SessionProvider({ children, postLogoutUrl, }) {
             email: userEmail,
             displayName: userDisplayName,
             ...(userTimeZone !== undefined && { timeZone: userTimeZone }),
-        }, [userId, userEmail, userDisplayName, userTimeZone]);
+            ...(activeTenantId !== undefined && { tenantId: activeTenantId }),
+        }, [userId, userEmail, userDisplayName, userTimeZone, activeTenantId]);
     return (_jsx(SessionContext.Provider, { value: api, children: _jsx(CurrentUserProvider, { user: currentUser, children: children }) }));
 }
 export function useSession() {

package/dist/auth-email-password/web/signup-complete-screen.js

@@ -21,7 +21,7 @@ import { useState } from "react";
 import { confirmSignup } from "./auth-client.js";
 import { passwordPairIssue, resolvePostAuthHref } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
-import { buildLoginRedirectUrl } from "./auth-redirect.js";
+import { buildLoginRedirectUrl, readReturnToFromWindow } from "./auth-redirect.js";
 export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "/", loginHref = "/login", }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
@@ -47,11 +47,19 @@ export function SignupCompleteScreen({ title, token: tokenProp, loggedInHref = "
         const res = await confirmSignup(token, password);
         setSubmitting(false);
         if (res.ok) {
+            // The page the signup started from beats the server's landing path.
+            const returnTo = readReturnToFromWindow();
             if (res.data.kind === "mfa-pending") {
                 setMfaPending(true);
-                setContinueHref(res.data.landingPath === undefined
+                const next = returnTo ?? res.data.landingPath;
+                setContinueHref(next === undefined
                     ? loginHref
-                    : buildLoginRedirectUrl(loginHref, res.data.landingPath, window.location.origin));
+                    : buildLoginRedirectUrl(loginHref, next, window.location.origin));
+                return;
+            }
+            // A claimed handover keeps its app-defined target.
+            if (returnTo !== null && res.data.handover === undefined) {
+                setContinueHref(returnTo);
                 return;
             }
             // Cookies are already set (auto-login). Show a confirmation with an

package/dist/auth-email-password/web/signup-screen.d.ts

@@ -5,5 +5,8 @@ export type SignupScreenProps = {
     /** href for the "Already have an account?" link. App-specific; defaults to
      *  "/login". */
     readonly loginHref?: string;
+    /** Page the activation mail should lead to after signup; defaults to the `returnTo` query
+     *  parameter of this page. Unsafe values are dropped. */
+    readonly returnTo?: string;
 };
-export declare function SignupScreen({ title, subtitle, loginHref, }: SignupScreenProps): ReactNode;
+export declare function SignupScreen({ title, subtitle, loginHref, returnTo, }: SignupScreenProps): ReactNode;

package/dist/auth-email-password/web/signup-screen.js

@@ -16,7 +16,12 @@ import { useState } from "react";
 import { requestSignup } from "./auth-client.js";
 import { retryAfterMinutes } from "./auth-form-logic.js";
 import { AuthCard } from "./auth-form-primitives.js";
-export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
+import { readReturnToFromWindow } from "./auth-redirect.js";
+import { isSafeReturnPath } from "./return-path.js";
+function resolveReturnTo(prop) {
+    return (isSafeReturnPath(prop) ? prop : readReturnToFromWindow()) ?? undefined;
+}
+export function SignupScreen({ title, subtitle, loginHref = "/login", returnTo, }) {
     const t = useTranslation();
     const { Form, Field, Input, Button, Banner, Link } = usePrimitives();
     const [email, setEmail] = useState("");
@@ -27,7 +32,7 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         setSubmitting(true);
         setError(null);
         try {
-            const res = await requestSignup(email);
+            const res = await requestSignup(email, undefined, resolveReturnTo(returnTo));
             if (res.ok) {
                 setDone(true);
             }
@@ -59,7 +64,7 @@ export function SignupScreen({ title, subtitle, loginHref = "/login", }) {
         setSubmitting(true);
         setError(null);
         try {
-            await requestSignup(email);
+            await requestSignup(email, undefined, resolveReturnTo(returnTo));
         }
         finally {
             setSubmitting(false);

package/dist/auth-mfa/config.d.ts

@@ -1,5 +1,5 @@
 import { type ConfigKeyHandle } from "@cosmicdrift/kumiko-framework/engine";
-export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "admins", "all"];
+export declare const MFA_REQUIRED_POLICIES: readonly ["optional", "systemAdmins", "admins", "all"];
 export type MfaRequiredPolicy = (typeof MFA_REQUIRED_POLICIES)[number];
 export declare const mfaRequiredConfigHandle: ConfigKeyHandle<"select">;
 export declare function mfaRequiredConfigKey(defaultPolicy?: MfaRequiredPolicy): import("@cosmicdrift/kumiko-types/config").ConfigKeyDefinition<"select">;

package/dist/auth-mfa/config.js

@@ -2,14 +2,10 @@
 // they haven't opted in themselves? Default "optional" means the feature
 // is fully opt-in (existing tenants/users unaffected — no migration step).
 //
-// ponytail: "admins"/"all" HARD-BLOCK login for an unenrolled user (see
-// mfa-status-checker.ts's setupRequired branch) — there is no in-band way
-// for a blocked user to complete enrollment yet (that flow ships in PR3's
-// UI). Flipping this away from "optional" before PR3 locks out every
-// unenrolled matching user with no recovery path. Fine for a tenant that
-// enrolls its admins out-of-band first; a footgun otherwise.
+// Every non-optional policy blocks login for an unenrolled matching user until
+// they finish the pre-auth enrollment step (mfa-status-checker.ts setupRequired).
 import { access, createTenantConfig, } from "@cosmicdrift/kumiko-framework/engine";
-export const MFA_REQUIRED_POLICIES = ["optional", "admins", "all"];
+export const MFA_REQUIRED_POLICIES = ["optional", "systemAdmins", "admins", "all"];
 export const mfaRequiredConfigHandle = {
     name: "auth-mfa:config:required",
     type: "select",

package/dist/auth-mfa/mfa-status-checker.js

@@ -1,3 +1,4 @@
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { access, declareEscapeHatch, } from "@cosmicdrift/kumiko-framework/engine";
 import { mfaRequiredConfigHandle, mfaRequiredConfigKey } from "./config.js";
@@ -32,9 +33,10 @@ export function createMfaStatusChecker(opts) {
         const buildSetupToken = () => signMfaPreauthSetupToken({ userId, tenantId }, MFA_PREAUTH_SETUP_TOKEN_TTL_MINUTES, opts.challengeTokenSecret).token;
         if (policy === "all")
             return { setupRequired: true, preauthSetupToken: buildSetupToken() };
-        // policy === "admins"
-        const isAdmin = roles.some((role) => access.admin.includes(role));
-        return isAdmin
+        const isEnforced = policy === "systemAdmins"
+            ? roles.includes(ROLES.SystemAdmin)
+            : roles.some((role) => access.admin.includes(role));
+        return isEnforced
             ? { setupRequired: true, preauthSetupToken: buildSetupToken() }
             : { required: false };
     };

package/dist/cap-counter/cap-reservation.js

@@ -186,6 +186,16 @@ function bookCalendarDelta(txDb, user, period, delta) {
         return Promise.resolve({ isSuccess: true, data: {} });
     return applyCapDeltaOn(txDb, user, { ...period, amount: Math.abs(delta) }, delta > 0 ? "add" : "subtract");
 }
+// Asked after a missed or lost claim. A released tombstone committed since the first read does not
+// count: the caller's own tombstone insert then conflicts with it, and the retry claims that row.
+async function hasSettledTombstone(txDb, user, id) {
+    const settled = await txDb.fetchOne(capReservationsTable, {
+        id,
+        tenantId: user.tenantId,
+        settledAt: { ne: null },
+    });
+    return settled !== undefined;
+}
 async function settleInTransaction(txDb, user, id, options) {
     const ownRow = { id, tenantId: user.tenantId };
     const open = await txDb.fetchOne(capReservationsTable, {
@@ -205,12 +215,11 @@ async function settleInTransaction(txDb, user, id, options) {
         await txDb.updateMany(capReservationsTable, { settledAt: now, expiresAt: now.add({ minutes: CAP_SETTLED_TOMBSTONE_TTL_MINUTES }) }, ownRow);
         return booked;
     }
-    // The claim lost to a concurrent settle or release: a tombstone means the amount is booked.
-    if (await txDb.fetchOne(capReservationsTable, ownRow)) {
+    if (await hasSettledTombstone(txDb, user, id))
         return NOTHING_TO_RELEASE;
-    }
     // Row swept or released: its amount was given back, so the full actual amount is booked and a
-    // tombstone makes a repeated settle a no-op. A parallel settle inserting first fails this insert.
+    // tombstone makes a repeated settle a no-op. A parallel settle or consume inserting first fails
+    // this insert.
     // Booking first: a lost counter race returns a result instead of throwing, so the transaction
     // commits and a tombstone written before it would turn the retry into a no-op.
     const booked = await bookCalendarDelta(txDb, user, options, options.actualAmount);
@@ -286,7 +295,7 @@ async function consumeClaimedRow(txDb, user, claimed, options) {
     return NOTHING_TO_RELEASE;
 }
 // Row already expired away: the units are booked directly and a released tombstone remembers them
-// so a later settle subtracts them. A parallel consume inserting first fails this insert.
+// so a later settle subtracts them. A parallel consume or settle inserting first fails this insert.
 async function consumeWithoutRow(txDb, user, id, options) {
     // Booking first, for the same reason as settle's missing-row path.
     const booked = await bookCalendarDelta(txDb, user, options, options.units);
@@ -320,7 +329,7 @@ async function consumeInTransaction(txDb, user, id, options) {
     const claimed = open && (await claimReservationRow(txDb, user, open));
     if (claimed)
         return consumeClaimedRow(txDb, user, claimed, options);
-    if (await txDb.fetchOne(capReservationsTable, ownRow)) {
+    if (await hasSettledTombstone(txDb, user, id)) {
         throw new CapReservationSettledError(options.capName);
     }
     return consumeWithoutRow(txDb, user, id, options);

package/dist/cap-counter/feature.js

@@ -54,6 +54,7 @@ import { CAP_COUNTER_I18N } from "./i18n.js";
 import { capReservationsTableMeta } from "./tables.js";
 export function createCapCounterFeature() {
     return defineFeature(CAP_COUNTER_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Tracks per-tenant usage against configurable limits using two complementary storage models: calendar-period counters (one projection row per tenant/capName/period, reset implicitly by period rollover) and rolling-window counters (append-only event stream, no projection). Use `enforceCap` / `enforceRollingCap` (or the `withCapEnforcement` / `withRollingCapEnforcement` handler wrappers) in your write-handlers to check limits with soft-warn and hard-block tolerances; call `enforceCapAndMaybeNotify` when you also want to trigger a delivery notification on soft-threshold hits.");
         r.uiHints({
             displayLabel: "Cap Counter · Usage Limits",

package/dist/cap-overview/feature.js

@@ -36,6 +36,7 @@ export function createCapOverviewFeature(opts) {
         }
     }
     return defineFeature(CAP_OVERVIEW_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Read-only visibility into per-tenant tier assignment and cap usage. SystemAdmin gets a platform-wide tenant list with usage bars; tenant admins (or the roles in `usageVisibleTo`) get their own tenant's usage as dashboard cards. Reads tier-engine, billing-foundation, and tenant data plus app-owned usage tables via caller-supplied CapSpec callbacks — never writes.");
         r.uiHints({
             displayLabel: "Cap Overview · Tier & Usage Visibility",

package/dist/config/handlers/set.write.js

@@ -4,7 +4,7 @@ import { createEventStoreExecutor, scopeTenantDbToTenant } from "@cosmicdrift/ku
 import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, isKumikoError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { requireConfigEncryption, requireSystemDb } from "../feature.js";
+import { requireConfigEncryption, requireConfigResolver, requireSystemDb } from "../feature.js";
 import { MASKED } from "../read-redaction.js";
 import { configValueEntity, configValuesTable } from "../table.js";
 import { findConfigRow, prepareConfigWrite, resolvePiiSubject, validateBounds, validateExtensionPlugin, validatePattern, validateScope, validateType, } from "../write-helpers.js";
@@ -69,13 +69,23 @@ export const setWrite = defineWriteHandler({
         if (patternError)
             return writeFailure(patternError);
         if (keyDef.validate) {
+            const validateDb = scopeTenantDbToTenant(db, tenantId);
             try {
                 await keyDef.validate(event.payload.value, {
                     key: event.payload.key,
                     scope,
                     tenantId,
                     userId,
-                    db: scopeTenantDbToTenant(db, tenantId),
+                    db: validateDb,
+                    readCascade: (qualifiedKey) => {
+                        const cascadeKeyDef = ctx.registry.getConfigKey(qualifiedKey);
+                        if (!cascadeKeyDef) {
+                            throw new InternalError({
+                                message: `[config:write:set] readCascade: unknown config key "${qualifiedKey}"`,
+                            });
+                        }
+                        return requireConfigResolver(ctx, "config:write:set").getCascade(qualifiedKey, cascadeKeyDef, tenantId, event.user.id, validateDb, ctx.secrets);
+                    },
                 });
             }
             catch (error) {

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -399,7 +399,7 @@ export const forgetSubjectWrite = defineWriteHandler({
         //   - user.updated as lifecycle event (updateUserLifecycle), so a
         //     read_users rebuild doesn't wipe the flip
         //   - sessions don't need active revocation — session-callbacks
-        //     re-validate user.status on every request (isPrincipalBlocked
+        //     re-validate the user row on every request (isPrincipalRowBlocked
         //     blocks Deleted).
         // Both idempotent (status set / revokedAt IS NULL filter), retry after
         // crash recovery is safe. User-feature guard: without the user feature

package/dist/custom-fields/lib/parse-serialized-field.js

@@ -1,7 +1,7 @@
 // Centralised parser for `fieldDefinition.serializedField`.
 //
 // The column is stored as `text` in B1 (entity.ts) — what the db row hands
-// back depends on the driver: postgres-js returns text as a `string`, but
+// back depends on the driver: text normally arrives as a `string`, but
 // jsonb-tolerant drivers and middleware can deliver an already-parsed
 // object. This helper normalises both, validates the shape, and centralises
 // the single boundary cast so callers don't sprinkle `as { … }`-narrowings

package/dist/delivery/feature.js

@@ -21,6 +21,7 @@ export function createDeliveryFeature(options) {
     const resolvedAccess = options?.access ?? access.admin;
     const attemptLogRetentionDays = resolveAttemptLogRetentionDays(options?.attemptLogRetentionDays);
     return defineFeature("delivery", (r) => {
+        r.adoptsBundledLists();
         r.describe("The notification dispatch core: call `ctx.notify(notificationType, { to, route, data, priority, idempotencyKey })` from any handler to fan out a notification across all registered channels (email, in-app, push). Inside a write handler the delivery runs after the write has committed (the call returns `{ kind: \"deferred\" }`, a rolled-back write sends nothing); `immediate: true` delivers synchronously and returns `{ kind: \"dispatched\", deliveries }`. It stores per-user channel preferences in the `notification-preference` entity, opt-outs for no-account recipient addresses in `notification-address-opt-out` (keyed by a blind-index hash, never the plaintext address), logs every attempt to `store_delivery_attempts`, and enforces idempotency and rate-limiting \u2014 add `channel-email`, `channel-in-app`, or `channel-push` on top to actually send anything. Unsubscribe/resubscribe links are served by `createUnsubscribeRoutes({ secret })` mounted via the app's `extraRoutes` at `/api/delivery/unsubscribe` and `/api/delivery/resubscribe`: `GET /unsubscribe?token=` renders a confirmation page (no write), `POST /unsubscribe` performs the opt-out (RFC 8058 one-click, token from the form body or query), `POST /resubscribe` undoes it (JSON `{token}` or form body only, never the query — reachable by a mail-client link prefetcher) — sign links with `signUnsubscribeToken` / `signAddressUnsubscribeToken` using the same secret. `channel-email` sets `List-Unsubscribe` / `List-Unsubscribe-Post` automatically when a message's `data.unsubscribeUrl` points at the unsubscribe route. A notification declared with `unsubscribe: true` gets that link from delivery itself when the service has `unsubscribeLinks` (the `runProdApp` and `runDevApp` option `unsubscribe: { secret }` mounts the routes and wires it; base URL from `auth.publicOrigin`, `auth.mail.baseUrl` or `APP_BASE_URL`): user recipients get a user token, `route` recipients an address token (needs a blind-index key, otherwise no link); a `data.unsubscribeUrl` from the caller wins. `unsubscribe.tenantOrigin: (ctx) => origin | null` points the link at the tenant's own host (subdomain or custom domain, must serve this app's `/api`); null, a throw or a non-https value fall back to the app origin. The token carries the mail's locale, so the confirmation and result pages render in the mail's language. An app serving its own (e.g. legacy) unsubscribe links renders the same result page with `renderUnsubscribeResultPage({ kind, locale })`. To react to a no-account opt-out (e.g. remove the app's own subscriber row), declare `r.job(name, { trigger: { on: DeliveryHandlers.unsubscribeAddress } }, handler)` on a lane the app consumes: it runs after each committed opt-out, also an idempotent repeat, with `unsubscribeAddressPayloadSchema` (`addressHash`, `notificationType`, `channel`) as payload and the tenant in `ctx.triggeredBy.tenantId`; match the subscriber via `hashUnsubscribeAddress(email)`. Declare `unsubscribeUrl` as an optional template variable if the mail body shows it.");
         r.uiHints({
             displayLabel: "Notifications \u00b7 Dispatch Core",

package/dist/delivery/index.d.ts

@@ -12,6 +12,7 @@ export { createDeliveryFeature, type DeliveryFeatureOptions } from "./feature.ts
 export { type UnsubscribeAddressPayload, unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.ts";
 export { currentNotificationType } from "./notification-type-aliases.ts";
 export { createDeliveryNotifyFactory } from "./notify-factory.ts";
+export { buildSystemChannelContext, type SystemChannelContextDeps, type SystemChannelContextOptions, } from "./system-channel-context.ts";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.ts";
 export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing.ts";
 export { type AttachmentOrigin, type ChannelContext, type ChannelMessage, type ChannelResult, type DeliveryChannel, type DeliveryChannelMode, type DeliveryChannelPlugin, type DeliveryLogEntry, type DeliveryService, isDeliveryChannelPlugin, type RenderedMessage, } from "./types.ts";

package/dist/delivery/index.js

@@ -11,6 +11,7 @@ export { createDeliveryFeature } from "./feature.js";
 export { unsubscribeAddressPayloadSchema, } from "./handlers/unsubscribe-address.write.js";
 export { currentNotificationType } from "./notification-type-aliases.js";
 export { createDeliveryNotifyFactory } from "./notify-factory.js";
+export { buildSystemChannelContext, } from "./system-channel-context.js";
 export { deliveryAttemptsTable, notificationAddressOptOutEntity, notificationAddressOptOutsTable, notificationPreferenceEntity, notificationPreferencesTable, } from "./tables.js";
 export { createDeliveryTestContext } from "./testing.js";
 export { isDeliveryChannelPlugin, } from "./types.js";

package/dist/delivery/system-channel-context.d.ts

@@ -0,0 +1,15 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { ConfigAccessor, Registry } from "@cosmicdrift/kumiko-framework/engine";
+import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
+import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
+import type { ChannelContext } from "./types.ts";
+export type SystemChannelContextDeps = {
+    readonly db: DbConnection;
+    readonly registry: Registry;
+    readonly filesForTenant: (tenantId: string) => FileContext | undefined;
+};
+export type SystemChannelContextOptions = {
+    readonly config?: ConfigAccessor;
+    readonly secrets?: SecretsContext;
+};
+export declare function buildSystemChannelContext(deps: SystemChannelContextDeps, options?: SystemChannelContextOptions): ChannelContext;

package/dist/delivery/system-channel-context.js

@@ -0,0 +1,5 @@
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { buildChannelContext } from "./channel-context.js";
+export function buildSystemChannelContext(deps, options = {}) {
+    return buildChannelContext(deps.db, deps.registry, undefined, SYSTEM_TENANT_ID, options.secrets, options.config, deps.filesForTenant);
+}

package/dist/document-ingest-foundation/append-missing-extract-event.d.ts

@@ -0,0 +1,21 @@
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { Registry, SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+export type ExistingDocumentExtract = {
+    readonly id: string;
+    readonly meta: {
+        readonly error?: unknown;
+    } | null;
+};
+export type AppendMissingExtractEventDeps = {
+    readonly tenantDb: TenantDb;
+    readonly registry: Registry;
+    readonly actor: SessionUser;
+    readonly tenantId: string;
+};
+export type AppendMissingExtractEventOptions = {
+    readonly readyEventQn: string;
+    readonly failedEventQn: string;
+    readonly mapError?: (error: string) => string;
+};
+export type AppendMissingExtractEventResult = "appended-ready" | "appended-failed" | "already-terminal";
+export declare function appendMissingDocumentExtractEvent(deps: AppendMissingExtractEventDeps, existing: ExistingDocumentExtract, fileRefId: string, options: AppendMissingExtractEventOptions): Promise<AppendMissingExtractEventResult>;

package/dist/document-ingest-foundation/append-missing-extract-event.js

@@ -0,0 +1,42 @@
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { appendEventInTenantDb, getStreamVersionInTenantDb, } from "@cosmicdrift/kumiko-framework/event-store";
+import { DOCUMENT_EXTRACT_AGGREGATE_TYPE, documentExtractFailedPayloadSchema, documentExtractReadyPayloadSchema, } from "./events.js";
+// Version 1 of the stream is the extract's created event; anything beyond it is the terminal event.
+const CREATED_ONLY_STREAM_VERSION = 1;
+const UNKNOWN_EXTRACT_ERROR = "unknown extract error";
+// A previous delivery created the extract but died before appending its ready/failed event.
+// Without the event, consumers waiting on it hang forever.
+export async function appendMissingDocumentExtractEvent(deps, existing, fileRefId, options) {
+    if (deps.tenantDb.tenantId !== deps.tenantId) {
+        throw new InternalError({
+            message: `document-ingest-foundation: tenantDb is bound to tenant ${deps.tenantDb.tenantId}, not ${deps.tenantId}`,
+        });
+    }
+    const version = await getStreamVersionInTenantDb(deps.tenantDb, existing.id);
+    // A missing stream means a wrong id; appending would make the terminal event the first event of a new stream.
+    if (version === 0) {
+        throw new InternalError({
+            message: `document-ingest-foundation: no document extract stream for id ${existing.id}`,
+        });
+    }
+    // skip: the terminal event was already written, nothing to catch up
+    if (version > CREATED_ONLY_STREAM_VERSION)
+        return "already-terminal";
+    const metaError = existing.meta?.error;
+    const failed = typeof metaError === "string";
+    await appendEventInTenantDb(deps.tenantDb, {
+        aggregateId: existing.id,
+        aggregateType: DOCUMENT_EXTRACT_AGGREGATE_TYPE,
+        expectedVersion: version,
+        type: failed ? options.failedEventQn : options.readyEventQn,
+        payload: failed
+            ? documentExtractFailedPayloadSchema.parse({
+                documentExtractId: existing.id,
+                fileRefId,
+                error: options.mapError?.(metaError) || metaError || UNKNOWN_EXTRACT_ERROR,
+            })
+            : documentExtractReadyPayloadSchema.parse({ documentExtractId: existing.id, fileRefId }),
+        metadata: { userId: deps.actor.id },
+    }, { registry: deps.registry });
+    return failed ? "appended-failed" : "appended-ready";
+}

package/dist/document-ingest-foundation/events.d.ts

@@ -26,3 +26,14 @@ export declare const documentIngestSkippedPayloadSchema: z.ZodObject<{
     }>;
 }, z.core.$strip>;
 export type DocumentIngestSkippedPayload = z.infer<typeof documentIngestSkippedPayloadSchema>;
+export declare const documentExtractReadyPayloadSchema: z.ZodObject<{
+    documentExtractId: z.ZodString;
+    fileRefId: z.ZodString;
+}, z.core.$strip>;
+export type DocumentExtractReadyPayload = z.infer<typeof documentExtractReadyPayloadSchema>;
+export declare const documentExtractFailedPayloadSchema: z.ZodObject<{
+    documentExtractId: z.ZodString;
+    fileRefId: z.ZodString;
+    error: z.ZodString;
+}, z.core.$strip>;
+export type DocumentExtractFailedPayload = z.infer<typeof documentExtractFailedPayloadSchema>;

package/dist/document-ingest-foundation/events.js

@@ -35,3 +35,14 @@ export const documentIngestSkippedPayloadSchema = z.object({
     size: z.number().int().min(0),
     reason: z.enum(["file-too-large", "unsupported-mime-type"]),
 });
+// Terminal events of a document-extract stream. The QNs belong to the provider that registers
+// them; the foundation only owns the shared payload shape.
+export const documentExtractReadyPayloadSchema = z.object({
+    documentExtractId: z.string().min(1),
+    fileRefId: z.string().min(1),
+});
+export const documentExtractFailedPayloadSchema = z.object({
+    documentExtractId: z.string().min(1),
+    fileRefId: z.string().min(1),
+    error: z.string().min(1),
+});

package/dist/document-ingest-foundation/index.d.ts

@@ -1,6 +1,7 @@
 export { documentIngestAggregateId } from "./aggregate-id.ts";
+export { type AppendMissingExtractEventDeps, type AppendMissingExtractEventOptions, type AppendMissingExtractEventResult, appendMissingDocumentExtractEvent, type ExistingDocumentExtract, } from "./append-missing-extract-event.ts";
 export { type DocumentExtractMeta, documentExtractEntity, documentExtractsTable, type IngestPage, } from "./entity.ts";
-export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
+export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, type DocumentExtractFailedPayload, type DocumentExtractReadyPayload, type DocumentIngestRequestedPayload, type DocumentIngestSkippedPayload, documentExtractFailedPayloadSchema, documentExtractReadyPayloadSchema, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.ts";
 export { createDocumentIngestFoundationFeature } from "./feature.ts";
 export { readIngestPages, writeIngestPages } from "./pages.ts";
 export { type DocumentIngestProviderOptions, documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, type ResolvedDocumentIngestProvider, resolveDocumentIngestProviders, } from "./providers.ts";

package/dist/document-ingest-foundation/index.js

@@ -1,7 +1,8 @@
 // Public API of the document-ingest-foundation bundled-feature.
 export { documentIngestAggregateId } from "./aggregate-id.js";
+export { appendMissingDocumentExtractEvent, } from "./append-missing-extract-event.js";
 export { documentExtractEntity, documentExtractsTable, } from "./entity.js";
-export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
+export { DOCUMENT_EXTRACT_AGGREGATE_TYPE, DOCUMENT_INGEST_AGGREGATE_TYPE, DOCUMENT_INGEST_REQUESTED_EVENT_QN, DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, DOCUMENT_INGEST_SKIPPED_EVENT_QN, DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentExtractFailedPayloadSchema, documentExtractReadyPayloadSchema, documentIngestRequestedPayloadSchema, documentIngestSkippedPayloadSchema, } from "./events.js";
 export { createDocumentIngestFoundationFeature } from "./feature.js";
 export { readIngestPages, writeIngestPages } from "./pages.js";
 export { documentIngestProviderOptionsSchema, documentIngestProviderTrigger, EXT_DOCUMENT_INGEST_PROVIDER, listIngestibleMimeTypes, resolveDocumentIngestProviders, } from "./providers.js";

package/dist/feature-toggles/feature.js

@@ -8,6 +8,7 @@ import { FEATURE_TOGGLES_I18N } from "./i18n.js";
 import { FEATURE_TOGGLE_SET_EVENT_NAME, FeatureToggleHandlers, FeatureToggleQueries, TOGGLE_ADMIN_SCREEN_ID, } from "./web/constants.js";
 export function createFeatureTogglesFeature(options = {}) {
     return defineFeature("feature-toggles", (r) => {
+        r.adoptsBundledLists();
         r.describe('Persists per-feature enabled/disabled state in the `store_global_feature_state` table and exposes a `set` write-handler plus `list`/`registered` query-handlers so operators can flip features at runtime without redeploying. Each API instance keeps an in-memory `GlobalFeatureToggleRuntime` snapshot (initialize it via `createFeatureToggleRuntime`, pass a `() => runtime` accessor to `createFeatureTogglesFeature`) that the dispatcher gate reads on every request; a `toggle-cache-sync` multi-stream projection with `delivery: "shared"` syncs the snapshot across instances whenever a `toggle-set` event is appended.');
         r.uiHints({
             displayLabel: "Feature Toggles · Operator Switches",