@cosmicdrift/kumiko-samples 0.341.0 → 0.343.0

package/packages/bundled-features/src/step-dispatcher/mail-runner.ts

@@ -31,9 +31,3 @@ export function setMailRunner(fn: (spec: MailSpec) => Promise<MailDispatchResult
 export async function performMailDispatch(spec: MailSpec): Promise<MailDispatchResult> {
   return mailRunner(spec);
 }
-
-// Adapter errors usually quote the rejected recipient ("550 <ops@example.com> rejected"); the
-// address must not outlive the crypto-shredded dispatch payload in logs.
-export function redactEmailAddresses(text: string): string {
-  return text.replace(/[^\s<>,;"']+@[^\s<>,;"']+/g, "[redacted-address]");
-}

package/packages/bundled-features/src/tenant/web/member-roles-cell.tsx

@@ -5,7 +5,7 @@
 
 import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import type { ReactNode } from "react";
-import { translateOrRaw } from "./translate-or-raw.js";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 
 export function MemberRolesCell({ row }: ColumnRendererProps): ReactNode {
   const t = useTranslation();

package/packages/bundled-features/src/tenant/web/member-status-cell.tsx

@@ -7,7 +7,7 @@
 import { type ColumnRendererProps, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer-web";
 import type { ReactNode } from "react";
-import { translateOrRaw } from "./translate-or-raw.js";
+import { translateOrRaw } from "../../shared/web/translate-or-raw.js";
 
 const STATUS_TONE: Readonly<Record<string, StatusTone>> = {
   active: "ok",

package/packages/bundled-features/src/tenant-lifecycle/feature.ts

@@ -34,7 +34,11 @@ import {
 } from "./events.js";
 import { cancelDestructionWrite } from "./handlers/cancel-destruction.write.js";
 import { requestDestructionWrite } from "./handlers/request-destruction.write.js";
-import { resolveTenantLifecycleGate, runTenantDestructionSweep } from "./run-tenant-destroy.js";
+import {
+  hasTenantDestructionWork,
+  resolveTenantLifecycleGate,
+  runTenantDestructionSweep,
+} from "./run-tenant-destroy.js";
 
 const tenantLifecycleStatusPlugin: TenantLifecycleStatusPlugin = {
   async resolveStatus(tenantId, { db }) {
@@ -125,10 +129,16 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
           throw new Error("run-tenant-destruction: ctx.registry required (JobContext incomplete)");
         }
         const T = (await import("@cosmicdrift/kumiko-framework/time")).getTemporal();
+        const now = T.Now.instant();
+        // Without crossTenantReads (undeclared hatch) fall through to the sweep.
+        if (ctx.crossTenantReads && !(await hasTenantDestructionWork(ctx.crossTenantReads, now))) {
+          // skip: no tenant is due, so the sweep would not touch anything
+          return;
+        }
         await runTenantDestructionSweep({
           db: ctx.db.unsafeRaw() as import("@cosmicdrift/kumiko-framework/db").DbConnection, // @cast-boundary db-operator — jobs never run inside a DbTx
           registry: ctx.registry,
-          now: T.Now.instant(),
+          now,
           log: (message) => ctx.log?.warn(message),
           fileProviderResolver: ctx._fileProviderResolver,
           escapeHatchAuditSink: ctx._escapeHatchAuditSink,

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -1,6 +1,6 @@
 /// <reference types="temporal-polyfill/global" preserve="true" />
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { DbRunner, TenantDb, WhereObject } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
@@ -307,6 +307,26 @@ export async function runNextDestructionStage(args: {
   }
 }
 
+function destroyRequestedDueWhere(now: Temporal.Instant): WhereObject {
+  return {
+    status: "destroyRequested",
+    gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
+  };
+}
+
+const destroyingWhere: WhereObject = { status: "destroying" };
+
+export async function hasTenantDestructionWork(
+  reads: Pick<TenantDb, "count">,
+  now: Temporal.Instant,
+): Promise<boolean> {
+  const [due, destroying] = await Promise.all([
+    reads.count(tenantTable, destroyRequestedDueWhere(now)),
+    reads.count(tenantTable, destroyingWhere),
+  ]);
+  return due > 0 || destroying > 0;
+}
+
 /** Cron entry: start destruction for tenants past grace, then advance stages. */
 export async function runTenantDestructionSweep(args: {
   readonly db: DbRunner;
@@ -319,10 +339,7 @@ export async function runTenantDestructionSweep(args: {
 }): Promise<{ readonly triggered: number; readonly advanced: number }> {
   const T = getTemporal();
   const now = args.now ?? T.Now.instant();
-  const due = await selectMany<{ id: string }>(args.db, tenantTable, {
-    status: "destroyRequested",
-    gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
-  });
+  const due = await selectMany<{ id: string }>(args.db, tenantTable, destroyRequestedDueWhere(now));
 
   let triggered = 0;
   for (const row of due) {
@@ -354,9 +371,7 @@ export async function runTenantDestructionSweep(args: {
   }
 
   let advanced = 0;
-  const destroying = await selectMany<{ id: string }>(args.db, tenantTable, {
-    status: "destroying",
-  });
+  const destroying = await selectMany<{ id: string }>(args.db, tenantTable, destroyingWhere);
   for (const row of destroying) {
     try {
       const result = await runNextDestructionStage({

package/packages/bundled-features/src/user/index.ts

@@ -6,6 +6,7 @@ export {
 } from "./db/queries/stream-tenant-backfill.js";
 export { createUserFeature } from "./feature.js";
 export { isPrincipalBlocked, principalStatusPlugin } from "./principal-status.js";
+export { resolveUserDisplayNames } from "./resolve-display-names.js";
 export type { UserStatus } from "./schema/user.js";
 export {
   USER_ANONYMIZED_DISPLAY_NAME,

package/packages/bundled-features/src/user/resolve-display-names.ts

@@ -0,0 +1,35 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { decryptStoredPii, mapWithConcurrency } from "../shared/index.js";
+import { userTable } from "./schema/user.js";
+
+// Shares the KMS adapter's small dedicated pool, same as member-directory.
+const KMS_POOL_CONCURRENCY = 4;
+
+// One batched lookup for a page of user ids. Users that are missing, have no
+// display name, or whose name cannot be decrypted (e.g. crypto-shredded) are
+// left out, so callers fall back to the raw id instead of failing the page.
+export async function resolveUserDisplayNames(
+  db: TenantDb,
+  userIds: readonly string[],
+): Promise<ReadonlyMap<string, string>> {
+  const names = new Map<string, string>();
+  if (userIds.length === 0) return names;
+  const users = await selectMany(db, userTable, { id: [...userIds] });
+  const named = users.filter((user) => typeof user.displayName === "string");
+  await mapWithConcurrency(named, KMS_POOL_CONCURRENCY, async (user) => {
+    try {
+      names.set(
+        String(user.id),
+        await decryptStoredPii(
+          String(user.displayName),
+          "displayName",
+          "user:resolve-display-names",
+        ),
+      );
+    } catch {
+      // Unreadable name: the caller's fallback applies.
+    }
+  });
+  return names;
+}

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.342.0",
+    "type": "improvement",
+    "title": "Waitlist notifyRecipient may return a promise",
+    "detail": "Waitlist `notifyRecipient` may return a promise, so apps can read the admin address from config"
+  },
   {
     "version": "0.341.0",
     "type": "improvement",

package/packages/bundled-features/src/waitlist/handlers/submit.write.ts

@@ -140,7 +140,7 @@ export function createSubmitHandler(opts: WaitlistOptions) {
       );
 
       await sendBestEffort(ctx, "admin notice", async (notify) => {
-        const adminRecipient = opts.notifyRecipient?.(ctx);
+        const adminRecipient = await opts.notifyRecipient?.(ctx);
         // skip: no admin recipient configured
         if (!adminRecipient) return;
         await notify(WAITLIST_NOTIFICATION_TYPES.adminNotice, {

package/packages/bundled-features/src/waitlist/options.ts

@@ -17,8 +17,9 @@ export type WaitlistInviteOptions =
 
 export type WaitlistOptions = {
   /** Address for an admin notification mail on each new entry. Null, an empty
-   *  string or an absent option sends none. Best effort, never fails the submit. */
-  readonly notifyRecipient?: (ctx: HandlerContext) => string | null;
+   *  string or an absent option sends none. Best effort, never fails the submit,
+   *  also when the resolver throws or rejects. */
+  readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
   /** Default `{ mode: "own-tenant", role: "TenantAdmin" }`. */
   readonly invite?: WaitlistInviteOptions;
   /** Default: 5 submits per IP per 10 minutes. */

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -55,14 +55,39 @@
       "toggleableDefault": null,
       "requires": [
         "tenant",
-        "user"
+        "user",
+        "config"
       ],
       "optionalRequires": [],
       "configReads": [],
       "exposesApis": [],
       "usesApis": [],
       "extensionsUsed": [],
-      "configKeys": [],
+      "configKeys": [
+        {
+          "key": "escape-hatch-retention-days",
+          "qualifiedName": "audit:config:escape-hatch-retention-days",
+          "type": "number",
+          "scope": "system",
+          "default": 90,
+          "encrypted": false,
+          "computed": false,
+          "validated": false,
+          "options": null,
+          "bounds": {
+            "min": 1
+          },
+          "pattern": null,
+          "writeRoles": [
+            "system"
+          ],
+          "readRoles": [
+            "TenantAdmin",
+            "Admin",
+            "SystemAdmin"
+          ]
+        }
+      ],
       "secrets": [],
       "writeHandlers": [],
       "uiHints": {