@cosmicdrift/kumiko-bundled-features 0.47.0 → 0.48.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.47.0",
+  "version": "0.48.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/subscription-stripe/__tests__/plugin-methods.test.ts

@@ -24,7 +24,7 @@ import type { StripeCtxRuntime } from "../runtime";
 const TEST_API_KEY = "sk_test_dummy";
 
 function buildStripe(): Stripe {
-  return new Stripe(TEST_API_KEY, { apiVersion: "2026-04-22.dahlia" });
+  return new Stripe(TEST_API_KEY);
 }
 
 /** Test-runtime: gibt den gespyten Client zurück + ein billing-live-Gate

package/src/subscription-stripe/__tests__/stripe-foundation.integration.test.ts

@@ -66,7 +66,7 @@ let webhookApp: Hono;
 let webhookAppWithSecrets: Hono;
 let secretsCtx: SecretsContext;
 
-const stripeForFixtures = new Stripe(TEST_API_KEY, { apiVersion: "2026-04-22.dahlia" });
+const stripeForFixtures = new Stripe(TEST_API_KEY);
 
 beforeAll(async () => {
   // subscription-stripe requires jetzt config + secrets. Scenarios 1–4

package/src/subscription-stripe/__tests__/verify-webhook.test.ts

@@ -27,7 +27,7 @@ const TEST_API_KEY = "sk_test_dummy_apikey";
 // Test-helpers
 // =============================================================================
 
-const stripeForFixtures = new Stripe(TEST_API_KEY, { apiVersion: "2026-04-22.dahlia" });
+const stripeForFixtures = new Stripe(TEST_API_KEY);
 
 /** Test-runtime: liefert den fixture-Client + TEST_SECRET (statt sie aus
  *  system-secrets aufzulösen — die Resolution testet runtime.test.ts). */

package/src/subscription-stripe/constants.ts

@@ -6,10 +6,6 @@ export const SUBSCRIPTION_STRIPE_FEATURE = "subscription-stripe" as const;
 // `/api/subscription/webhook/stripe`.
 export const STRIPE_PROVIDER_NAME = "stripe" as const;
 
-// Stripe-API-version-pin. Zentral, damit jeder Client (egal ob mount-time-
-// fallback oder runtime-rotiert) dieselbe API-Version spricht.
-export const STRIPE_API_VERSION = "2026-04-22.dahlia" as const;
-
 // Secret- + config-key short-names. Qualified zu `subscription-stripe:<name>`
 // (secrets) bzw. `subscription-stripe:config:<name>` (config) beim
 // registry-build.

package/src/subscription-stripe/runtime.ts

@@ -35,7 +35,7 @@ import {
 import { FeatureDisabledError, UnconfiguredError } from "@cosmicdrift/kumiko-framework/errors";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import Stripe from "stripe";
-import { STRIPE_API_VERSION, SUBSCRIPTION_STRIPE_FEATURE } from "./constants";
+import { SUBSCRIPTION_STRIPE_FEATURE } from "./constants";
 
 const API_KEY_HINT =
   "Set the system-scoped Stripe API key via secrets:write:set (or seed it from STRIPE_API_KEY during the env bridge).";
@@ -48,7 +48,9 @@ export function createStripeClientCache(): (apiKey: string) => Stripe {
   return (apiKey) => {
     const cached = cache.get(apiKey);
     if (cached) return cached;
-    const client = new Stripe(apiKey, { apiVersion: STRIPE_API_VERSION });
+    // No apiVersion pin — a string literal breaks consumers' typecheck on newer
+    // stripe SDKs (#256); the SDK's own default keeps wire-version and types aligned.
+    const client = new Stripe(apiKey);
     cache.set(apiKey, client);
     return client;
   };

package/src/user-data-rights/feature.ts

@@ -104,7 +104,7 @@ export type UserDataRightsOptions = {
 export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): FeatureDefinition {
   return defineFeature("user-data-rights", (r) => {
     r.describe(
-      'Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion` + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.',
+      'Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.',
     );
     r.requires("user", "data-retention", "compliance-profiles", "sessions");
     r.usesApi("compliance.forTenant");