@cosmicdrift/kumiko-samples 0.344.0 → 0.346.0

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -7,6 +7,7 @@ import {
 import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { tierAssignmentAggregateId } from "../aggregate-id.js";
+import { TierAssignmentSources } from "../constants.js";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 
 // SystemAdmin setzt das Tier eines BELIEBIGEN Tenants — manueller Grant ohne
@@ -21,8 +22,8 @@ import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 // funktioniert nur für SYSTEM_TENANT_ID (immer im IN-Filter). Dies ist das
 // auto-default-Hook-Muster (feature.ts), generalisiert auf einen Request-Handler.
 //
-// `source: "manual"` markiert den Grant, damit ein späterer Stripe→Tier-Sync ihn
-// nicht plättet. Upsert: ein Aggregat pro Tenant (deterministische aggregate-id).
+// `source: TierAssignmentSources.manual` marks the grant so the billing sync skips it.
+// Upsert: one aggregate per tenant (deterministic aggregate id).
 //
 // Effective-set invalidation: the executor write does not fire the
 // `tier-assignment:postSave` entity hook, and a per-handler postSave would not
@@ -90,7 +91,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
           {
             id: existing.id,
             version: existing.version,
-            changes: { tier, source: "manual" },
+            changes: { tier, source: TierAssignmentSources.manual },
           },
           systemUser,
           tdb,
@@ -101,7 +102,12 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
       }
 
       const result = await executor.create(
-        { id: tierAssignmentAggregateId(tenantId), tier, source: "manual", tenantId },
+        {
+          id: tierAssignmentAggregateId(tenantId),
+          tier,
+          source: TierAssignmentSources.manual,
+          tenantId,
+        },
         systemUser,
         tdb,
       );

package/packages/bundled-features/src/tier-engine/index.ts

@@ -17,7 +17,12 @@ export {
   type TierDefinition,
   type TierMap,
 } from "./compose-app.js";
-export { TIER_ENGINE_FEATURE, TierEngineHandlers, TierEngineQueries } from "./constants.js";
+export {
+  TIER_ENGINE_FEATURE,
+  TierAssignmentSources,
+  TierEngineHandlers,
+  TierEngineQueries,
+} from "./constants.js";
 export { tierAssignmentEntity } from "./entity.js";
 export {
   type CreateTierEngineOptions,

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -51,7 +51,7 @@
     },
     {
       "name": "audit",
-      "description": "Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection — the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).",
+      "description": "Exposes the framework's event store as a paginated, filterable audit log via the `audit:query:list` handler (accessible to `Admin` and `SystemAdmin` roles). No separate table or projection — the event store is the audit trail by construction: every entity write already records who, when, what entity, and the event payload with PII stripped. A SystemAdmin can pass `scope: \"system\"` to read the app-instance system events such as `app.started`. Filter by `aggregateType`, `aggregateId`, `eventType`, `userId`, or time range. Also records `audit:event:escape-hatch-used` whenever a handler uses one of the framework's escape hatches (unsafeRaw, acknowledgeCrossTenant, db.global() writes, or a granted identity switch).",
       "toggleableDefault": null,
       "requires": [
         "tenant",
@@ -127,6 +127,7 @@
         "auth-email-password:write:reset-password",
         "auth-email-password:write:signup-confirm",
         "auth-email-password:write:signup-request",
+        "auth-email-password:write:switch-tenant-mfa-gate",
         "auth-email-password:write:system-invite-create",
         "auth-email-password:write:verify-email"
       ],
@@ -2301,7 +2302,7 @@
     },
     {
       "name": "step-dispatcher",
-      "description": "Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`.",
+      "description": "Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.",
       "toggleableDefault": null,
       "requires": [
         "secrets"

package/samples/recipes/i18n/README.md

@@ -13,7 +13,7 @@ A translation value can be a CLDR plural-forms object instead of a plain
 string. `other` is required; the rest (`zero`/`one`/`two`/`few`/`many`) only
 exist where the locale's grammar needs them:
 
-```ts
+```ts illustration
 "greeting.unread_count": {
   de: { one: "{count} ungelesene Nachricht", other: "{count} ungelesene Nachrichten" },
   en: { one: "{count} unread message", other: "{count} unread messages" },

package/samples/recipes/rate-limiting/README.md

@@ -12,7 +12,7 @@ End-to-end rate limiting: L1 global-IP + L2 auth + L3 handler opt-in.
 A public write handler that mails an address typed by the caller is also limited per
 address, so rotating IPs does not help against mail flooding. Declare it next to `rateLimit`:
 
-```ts
+```ts illustration
 r.writeHandler({
   // ...
   access: { roles: ["anonymous"] },

package/samples/recipes/webhook-step/README.md

@@ -5,7 +5,7 @@ Workflow / pipeline step that calls an HTTP webhook.
 ## What it shows
 
 - Webhook step registration in a workflow
-- Retry / failure surface for outbound HTTP
+- Failure surface for outbound HTTP (one delivery attempt per request)
 - Authenticated webhooks via a tenant-owned secret (`incident:open-authenticated`)
 
 ## Auth secret
@@ -16,7 +16,7 @@ never a process-wide env var. The `secrets` feature must be mounted
 (`createSecretsFeature()` + a `MasterKeyProvider`) alongside
 `step-dispatcher`. Set the secret per tenant before dispatching:
 
-```ts
+```ts illustration
 await stack.http.writeOk(
   "secrets:write:set",
   { key: "step-dispatcher:webhook-auth.incident-hook", value: "<token>" },
@@ -33,6 +33,13 @@ Never combine `auth.secret` with a caller-controlled `url`: the caller would
 receive the secret as the `Authorization` header. `incident:open-authenticated`
 therefore posts to a fixed URL.
 
+## Idempotency-Key
+
+Every webhook request carries `Idempotency-Key: <dispatch stream id>`. The
+value is the same when the same dispatch request is delivered again, so a
+receiver can deduplicate redelivered calls. An `Idempotency-Key` set explicitly in
+`headers` (any casing) wins.
+
 ## Source
 
 Feature entry point: `src/feature.ts`.

package/samples/recipes/webhook-step/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-sample-webhook-step",
-  "description": "Tier-2 r.step.webhook.send showcase: deferred webhook dispatch via step-dispatcher subscription, no outbox table, retry from event-stream.",
+  "description": "Tier-2 r.step.webhook.send showcase: deferred webhook dispatch via step-dispatcher subscription, no outbox table.",
   "private": true,
   "dependencies": {
     "@cosmicdrift/kumiko-bundled-features": "workspace:*",