@cosmicdrift/kumiko-bundled-features 0.392.2 → 0.394.0

package/dist/subscription-paddle/webhook-events.js

@@ -0,0 +1,124 @@
+// Paddle webhook: signature check, then mapping of Paddle's event envelope onto
+// the foundation's normalized events. Events without a valid tenant binding are
+// dropped (200 ignored): see tenant-binding.ts.
+import { BillingEventKinds, SubscriptionEventTypes, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import * as z from "zod";
+import { PADDLE_PROVIDER_NAME } from "./constants.js";
+import { mapPaddleSubscriptionState, paddleCustomDataSchema, paddleSubscriptionSchema, } from "./subscription-state.js";
+import { boundTenantOf } from "./tenant-binding.js";
+import { verifyPaddleSignature } from "./verify-webhook.js";
+const PADDLE_SUBSCRIPTION_EVENT_TYPES = {
+    "subscription.created": SubscriptionEventTypes.created,
+    "subscription.activated": SubscriptionEventTypes.updated,
+    "subscription.updated": SubscriptionEventTypes.updated,
+    "subscription.trialing": SubscriptionEventTypes.updated,
+    "subscription.paused": SubscriptionEventTypes.updated,
+    "subscription.resumed": SubscriptionEventTypes.updated,
+    "subscription.past_due": SubscriptionEventTypes.invoicePaymentFailed,
+    "subscription.canceled": SubscriptionEventTypes.canceled,
+};
+const TRANSACTION_COMPLETED = "transaction.completed";
+const envelopeSchema = z.object({
+    event_id: z.string().min(1),
+    event_type: z.string(),
+    occurred_at: z.iso.datetime({ offset: true }),
+    data: z.unknown(),
+});
+const paddleTransactionSchema = z.object({
+    id: z.string().min(1),
+    subscription_id: z.string().nullish(),
+    customer_id: z.string().min(1).nullish(),
+    custom_data: paddleCustomDataSchema,
+    items: z.array(z.object({
+        price: z.object({ id: z.string().min(1) }),
+        quantity: z.number().int().positive().optional(),
+    })),
+});
+function currentUnixSeconds() {
+    return Math.floor(Temporal.Now.instant().epochMilliseconds / 1000);
+}
+function parsePaymentEvent(providerEventId, data, bindingKey) {
+    const parsed = paddleTransactionSchema.safeParse(data);
+    if (!parsed.success)
+        return null;
+    const transaction = parsed.data;
+    // A subscription's own payments are covered by its subscription.* events.
+    if (transaction.subscription_id)
+        return null;
+    const priceId = transaction.items[0]?.price.id;
+    const quantity = transaction.items[0]?.quantity ?? 1;
+    const bound = boundTenantOf(transaction.custom_data, bindingKey);
+    if (!bound || !priceId || !transaction.customer_id)
+        return null;
+    return {
+        kind: BillingEventKinds.payment,
+        providerEventId,
+        providerName: PADDLE_PROVIDER_NAME,
+        tenantId: bound.tenantId,
+        ...(bound.consentId !== undefined && { consentId: bound.consentId }),
+        providerCheckoutId: transaction.id,
+        providerCustomerId: transaction.customer_id,
+        priceId,
+        quantity,
+    };
+}
+// Subscription prices are meant to be quantity 1; the tier is still set, but a
+// different quantity is worth an operator's attention. Event id and quantity only.
+function warnOnUnexpectedQuantity(providerEventId, items) {
+    for (const item of items) {
+        if (item.quantity !== undefined && item.quantity !== 1) {
+            createFallbackLogger("subscription-paddle").warn("paddle subscription item quantity is not 1; the tier is still set", { providerEventId, quantity: item.quantity });
+        }
+    }
+}
+function parseSubscriptionEvent(providerEventId, type, providerEventAt, data, options) {
+    const parsed = paddleSubscriptionSchema.safeParse(data);
+    if (!parsed.success)
+        return null;
+    const sub = parsed.data;
+    const bound = boundTenantOf(sub.custom_data, options.bindingKey);
+    const state = mapPaddleSubscriptionState(sub, options.priceToTier);
+    if (!bound || !state)
+        return null;
+    warnOnUnexpectedQuantity(providerEventId, sub.items);
+    return {
+        providerEventId,
+        providerName: PADDLE_PROVIDER_NAME,
+        type,
+        tenantId: bound.tenantId,
+        ...(bound.consentId !== undefined && { consentId: bound.consentId }),
+        providerCustomerId: sub.customer_id,
+        providerSubscriptionId: sub.id,
+        providerEventAt,
+        ...state,
+    };
+}
+export function verifyAndParsePaddleWebhook(runtime, options) {
+    const nowSeconds = options.nowSeconds ?? currentUnixSeconds;
+    return async (rawBody, headers, systemSecrets) => {
+        const secret = await runtime.resolveWebhookSecret(systemSecrets);
+        verifyPaddleSignature(rawBody, headers, secret, nowSeconds());
+        // After verification only: an unauthenticated request must not trigger a second secret read.
+        const bindingKey = await runtime.resolveTenantBindingKey(systemSecrets);
+        // Past verification the body is trusted to be Paddle's; a malformed shape is
+        // schema drift, so it is dropped (200 ignored) instead of answered with a 401.
+        const envelope = envelopeSchema.safeParse(parseJsonOrThrow(rawBody, "subscription-paddle webhook body"));
+        if (!envelope.success)
+            return null;
+        const { event_id: providerEventId, event_type: type, occurred_at, data } = envelope.data;
+        if (type === TRANSACTION_COMPLETED)
+            return parsePaymentEvent(providerEventId, data, bindingKey);
+        if (!Object.hasOwn(PADDLE_SUBSCRIPTION_EVENT_TYPES, type))
+            return null;
+        const normalizedType = PADDLE_SUBSCRIPTION_EVENT_TYPES[type];
+        if (!normalizedType)
+            return null;
+        return parseSubscriptionEvent(providerEventId, normalizedType, occurred_at, data, {
+            priceToTier: options.priceToTier,
+            bindingKey,
+        });
+    };
+}

package/dist/template-resolver/handlers/collection-item.query.js

@@ -2,7 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.js";
-import { collectionStore, toCollectionEntry, } from "./collection-shared.js";
+import { collectionStore, readableCollectionEntry, } from "./collection-shared.js";
 // Single entry of one collection, for the editor behind a tree node. Same
 // per-collection construction as collection-list — see there for why.
 export function makeCollectionItemQuery(collection) {
@@ -31,7 +31,7 @@ export function makeCollectionItemQuery(collection) {
             });
             if (!row)
                 return null;
-            return toCollectionEntry(row);
+            return readableCollectionEntry(row, store, `${collection.id}-item`);
         },
     });
 }

package/dist/template-resolver/handlers/collection-list.query.js

@@ -2,7 +2,7 @@ import { castTenantRows, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { DEFAULT_COLLECTION_ACCESS } from "../web/constants.js";
-import { collectionStore, toCollectionEntry, } from "./collection-shared.js";
+import { collectionStore, readableCollectionEntry, } from "./collection-shared.js";
 // One list handler per declared collection: `kind`, `ownership` and `access`
 // come from the declaration, never from the payload.
 //
@@ -31,7 +31,9 @@ export function makeCollectionListQuery(collection) {
                 kind: collection.kind,
                 ...store.scopeOf(query.user),
             }));
-            return { blocks: rows.map(toCollectionEntry) };
+            return {
+                blocks: await Promise.all(rows.map((row) => readableCollectionEntry(row, store, `${collection.id}-list`))),
+            };
         },
     });
 }

package/dist/template-resolver/handlers/collection-set.write.d.ts

@@ -18,4 +18,4 @@ export declare function makeCollectionSetWrite(collection: ContentCollectionDefi
     slug: string;
     locale: string;
     isNew: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/collection-shared.d.ts

@@ -21,8 +21,19 @@ export type CollectionStore = {
     scopeOf(user: SessionUser): Readonly<Record<string, unknown>>;
     /** Columns a create needs beyond the editable ones the payload carries. */
     createDefaults(tenantId: TenantId): Readonly<Record<string, unknown>>;
+    /** True when `content` is stored as PII ciphertext and must be decrypted on read. */
+    readonly contentIsPii: boolean;
 };
 export declare function collectionStore(collection: ContentCollectionDefinition): CollectionStore;
+export declare function readableCollectionEntry(row: CollectionEntryRow, store: CollectionStore, fallbackRequestId: string): Promise<{
+    slug: string;
+    locale: string;
+    title: string | null;
+    content: string | null;
+    contentFormat: string;
+    folder: string | null;
+    modifiedAt: globalThis.Temporal.Instant | null;
+}>;
 export declare function toCollectionEntry(row: CollectionEntryRow): {
     slug: string;
     locale: string;

package/dist/template-resolver/handlers/collection-shared.js

@@ -1,3 +1,5 @@
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
+import { configuredPiiSubjectKms, decryptPiiFieldValues, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { templateResourceEntity, templateResourcesTable } from "../table.js";
@@ -18,6 +20,7 @@ export function collectionStore(collection) {
             executor: userContentExecutor,
             scopeOf: (user) => ({ ownerId: user.id }),
             createDefaults: () => ({}),
+            contentIsPii: true,
         };
     }
     return {
@@ -31,8 +34,21 @@ export function collectionStore(collection) {
             parentTemplateId: null,
             status: "active",
         }),
+        contentIsPii: false,
     };
 }
+// Raw reads return the stored column, which is ciphertext for a user-owned entry while a KMS
+// is configured; the API's leak guard rejects any response that still carries it.
+export async function readableCollectionEntry(row, store, fallbackRequestId) {
+    const kms = configuredPiiSubjectKms();
+    if (!store.contentIsPii || !kms || row.content === null)
+        return toCollectionEntry(row);
+    const decrypted = await decryptPiiFieldValues({ content: row.content }, ["content"], kms, {
+        requestId: requestContext.get()?.requestId ?? fallbackRequestId,
+    });
+    const content = decrypted["content"];
+    return toCollectionEntry({ ...row, content: typeof content === "string" ? content : null });
+}
 export function toCollectionEntry(row) {
     return {
         slug: row.slug,

package/dist/template-resolver/handlers/copy-locale.write.d.ts

@@ -21,4 +21,4 @@ export declare function makeCopyLocaleWrite(policy: TemplateEditPolicy): import(
     sourceId: string | number;
     sourceVersion: number;
     copies: readonly import("../store-template-resource.ts").PreparedLinkedResourceCopy[];
-}>;
+}, undefined>;

package/dist/template-resolver/handlers/discard-draft.write.d.ts

@@ -5,10 +5,10 @@ export declare function makeDiscardDraftWrite(policy: TemplateEditPolicy): impor
 }, z.core.$strip>, {
     id: string;
     discarded: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export declare function makeDiscardDraftSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     discarded: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/import-bundle-system.write.d.ts

@@ -37,4 +37,4 @@ export declare const importBundleSystemWrite: import("@cosmicdrift/kumiko-types/
     }, z.core.$strict>;
 }, z.core.$strip>, {
     ids: Record<string, string>;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, import("./bundle-import.ts").PreparedBundleResources>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, import("./bundle-import.ts").PreparedBundleResources, undefined>;

package/dist/template-resolver/handlers/import-bundle.write.d.ts

@@ -39,4 +39,4 @@ export declare function makeImportBundleWrite(policy: TemplateEditPolicy): impor
     overwrite: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>, {
     ids: Record<string, string>;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, import("./bundle-import.ts").PreparedBundleResources>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, import("./bundle-import.ts").PreparedBundleResources, undefined>;

package/dist/template-resolver/handlers/patch-draft.write.d.ts

@@ -64,4 +64,4 @@ export declare function makePatchDraftWrite(policy: TemplateEditPolicy): import(
         name: z.ZodString;
         definition: z.ZodNullable<z.ZodUnknown>;
     }, z.core.$strip>], "op">>;
-}, z.core.$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/reset-to-system.write.d.ts

@@ -6,4 +6,4 @@ export declare function makeResetToSystemWrite(policy: TemplateEditPolicy): impo
     id: string;
     status: "archived";
     systemTemplateId: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/resource-link-pdf.write.d.ts

@@ -6,4 +6,4 @@ export declare function makeResourceLinkPdfWrite(policy: TemplateEditPolicy): im
     templateSlug: z.ZodString;
     fileName: z.ZodString;
     tenantIdOverride: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, import("../store-template-resource.ts").LinkedTemplatePdfAttachment, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("../store-template-resource.ts").LinkedTemplatePdfAttachment, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/resource-remove.write.d.ts

@@ -7,4 +7,4 @@ export declare function makeResourceRemoveWrite(policy: TemplateEditPolicy): imp
 }, z.core.$strip>, {
     key: string;
     removed: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/resource-upload.write.d.ts

@@ -11,4 +11,4 @@ export declare function makeResourceUploadWrite(policy: TemplateEditPolicy): imp
         image: "image";
     }>>;
     fileName: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, StoredTemplateAttachment | StoredTemplateResource, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, PreparedTemplateFile>;
+}, z.core.$strip>, StoredTemplateAttachment | StoredTemplateResource, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, PreparedTemplateFile, undefined>;

package/dist/template-resolver/handlers/send-test.write.d.ts

@@ -12,4 +12,4 @@ export declare function makeSendTestWrite(policy: TemplateEditPolicy): import("@
 }, z.core.$strip>, {
     subject: string;
     checks: readonly import("../template-preview.ts").PreviewCheck[];
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/set.write.d.ts

@@ -28,4 +28,4 @@ export declare function makeSetWrite(policy: TemplateEditPolicy): import("@cosmi
     slug: string;
     locale: string;
     isNew: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/toggle-status.write.d.ts

@@ -17,23 +17,23 @@ export declare function makeArchiveWrite(policy: TemplateEditPolicy): import("@c
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export declare function makePublishWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export declare function makeArchiveSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export declare function makePublishSystemWrite(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<string, z.ZodObject<{
     id: z.ZodString;
 }, z.core.$strip>, {
     id: string;
     status: TemplateStatus;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;
 export {};

package/dist/template-resolver/handlers/upsert-system.write.d.ts

@@ -21,4 +21,4 @@ export declare const upsertSystemWrite: import("@cosmicdrift/kumiko-types/define
     parentTemplateId: import("zod").ZodOptional<import("zod").ZodString>;
     title: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
     folder: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
-}, import("zod/v4/core").$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, import("zod/v4/core").$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/handlers/upsert-tenant.write.d.ts

@@ -28,4 +28,4 @@ export declare function makeUpsertTenantWrite(policy: TemplateEditPolicy): impor
         active: "active";
         draft: "draft";
     }>>;
-}, z.core.$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
+}, z.core.$strip>, import("./template-write.ts").WrittenTemplateRow, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined, undefined>;

package/dist/template-resolver/web/client-plugin.d.ts

@@ -1,4 +1,5 @@
 import type { TreeNode } from "@cosmicdrift/kumiko-framework/engine";
+import { type FeatureSchema } from "@cosmicdrift/kumiko-renderer";
 import { type ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 export type BlockSummary = {
     readonly slug: string;
@@ -9,8 +10,11 @@ export type BlockSummary = {
     readonly modifiedAt: string | null;
 };
 export declare function groupBlocksByFolder(blocks: readonly BlockSummary[], tenantIdOverride?: string, collectionId?: string): readonly TreeNode[];
+type ContentCollectionSchema = NonNullable<FeatureSchema["contentCollections"]>[number];
+export declare function canWriteContent(collection: Pick<ContentCollectionSchema, "access"> | undefined, roles: readonly string[] | undefined): boolean;
 export declare function resolveWriteContentFormat(collectionContentFormat: string | undefined, loadedContentFormat: string | undefined): string | undefined;
 export declare function textBlocksClient(opts?: {
     readonly navId?: string;
     readonly tenantId?: string;
 }): ClientFeatureDefinition;
+export {};