@cosmicdrift/kumiko-samples 0.346.0 → 0.347.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.346.0",
+  "version": "0.347.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.346.0",
+  "version": "0.347.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.347.0",
+    "type": "fix",
+    "title": "Signup-confirm under an MFA policy returns the signup landing path and the activation screen forwards it to login as next",
+    "detail": "Signup with an MFA requirement keeps its landing path\nWhen the MFA policy asks for a factor at self-registration, `/auth/signup-confirm` now also returns the `landingPath` that `auth.postAuthLanding` resolves for the signup flow (including a claimed handover). `SignupCompleteScreen` passes it to the login link as `?next=`, so the login that follows can land where a signup without MFA would have."
+  },
   {
     "version": "0.345.0",
     "type": "fix",

package/packages/bundled-features/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -76,7 +76,16 @@ export type SignupConfirmData =
       // actually succeeded (see the handler body below).
       readonly handover?: { readonly entityType: string; readonly id: string };
     }
-  | Exclude<LoginResult, { readonly kind: "auth-session" }>;
+  | (Exclude<LoginResult, { readonly kind: "auth-session" }> & {
+      // What the response needs to resolve the signup landing although no
+      // session is issued yet.
+      readonly signup: {
+        readonly roles: readonly string[];
+        readonly tenantId: TenantId;
+        readonly tenantKey: string;
+        readonly handover?: ClaimedHandover;
+      };
+    });
 
 export type SignupConfirmOptions = Pick<LoginHandlerOptions, "mfaStatusChecker">;
 
@@ -240,7 +249,18 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
 
         if (mfaGate !== undefined) {
           committed = true;
-          return { isSuccess: true, data: mfaGate };
+          return {
+            isSuccess: true,
+            data: {
+              ...mfaGate,
+              signup: {
+                roles: session.roles,
+                tenantId: provisioned.tenantId,
+                tenantKey,
+                ...(handover !== undefined && { handover }),
+              },
+            },
+          };
         }
 
         committed = true;

package/packages/bundled-features/src/auth-email-password/web/auth-client.ts

@@ -362,9 +362,11 @@ export type SignupConfirmSuccess = {
 
 // mfa-pending: account exists but the server issued no session because the
 // new roles require a second factor — the user must sign in to enroll.
+// landingPath is where the signup would have landed; the login that follows
+// should end there.
 export type SignupConfirmResult =
   | ({ readonly kind: "signed-in" } & SignupConfirmSuccess)
-  | { readonly kind: "mfa-pending" };
+  | { readonly kind: "mfa-pending"; readonly landingPath?: string };
 
 export async function confirmSignup(
   token: string,
@@ -383,7 +385,13 @@ export async function confirmSignup(
       readonly mfaSetupRequired?: boolean;
     };
     if (body.mfaRequired === true || body.mfaSetupRequired === true) {
-      return { ok: true, data: { kind: "mfa-pending" } };
+      return {
+        ok: true,
+        data: {
+          kind: "mfa-pending",
+          ...(typeof body.landingPath === "string" && { landingPath: body.landingPath }),
+        },
+      };
     }
     return { ok: true, data: { kind: "signed-in", ...body } };
   }

package/packages/bundled-features/src/auth-email-password/web/signup-complete-screen.tsx

@@ -22,6 +22,7 @@ import { type FormEvent, type ReactNode, useState } from "react";
 import { confirmSignup, type SignupConfirmSuccess } from "./auth-client.js";
 import { passwordPairIssue, resolvePostAuthHref } from "./auth-form-logic.js";
 import { AuthCard, useUrlToken } from "./auth-form-primitives.js";
+import { buildLoginRedirectUrl } from "./auth-redirect.js";
 
 export type SignupCompleteScreenProps = {
   readonly title?: string;
@@ -76,7 +77,11 @@ export function SignupCompleteScreen({
     if (res.ok) {
       if (res.data.kind === "mfa-pending") {
         setMfaPending(true);
-        setContinueHref(loginHref);
+        setContinueHref(
+          res.data.landingPath === undefined
+            ? loginHref
+            : buildLoginRedirectUrl(loginHref, res.data.landingPath, window.location.origin),
+        );
         return;
       }
       // Cookies are already set (auto-login). Show a confirmation with an

package/packages/bundled-features/src/personal-access-tokens/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.347.0",
+    "type": "improvement",
+    "title": "API-token screens hide behind the tier gate and can fall back to an upgrade screen via lockedFallbackScreen",
+    "detail": "Token screens follow the tier gate of personal-access-tokens\nThe list and mint screens carry a `visibleWhen` on the new `personal-access-tokens:query:availability` probe. For a tenant whose tier excludes the feature (`toggleable`), the dispatcher already rejected every token handler with `feature_disabled`; now the screens also show the unavailable notice instead of an empty list with a broken Create button. A new option `lockedFallbackScreen` names a screen (for example an upgrade notice) to show in its place. Without `toggleable` nothing changes: the feature stays always on."
+  },
   {
     "version": "0.336.0",
     "type": "fix",

package/packages/bundled-features/src/personal-access-tokens/constants.ts

@@ -32,6 +32,7 @@ export const PatHandlers = {
 export const PatQueries = {
   mine: "personal-access-tokens:query:mine",
   availableScopes: "personal-access-tokens:query:available-scopes",
+  availability: "personal-access-tokens:query:availability",
 } as const;
 
 // Only the first chars of a minted token are stored (alongside the hash) so the

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -11,6 +11,7 @@ import {
   PAT_FEATURE,
   type PatRateLimit,
 } from "./constants.js";
+import { availabilityQuery } from "./handlers/availability.query.js";
 import { buildAvailableScopesQuery } from "./handlers/available-scopes.query.js";
 import { type CreatePatOptions, createPatCreateHandler } from "./handlers/create.write.js";
 import { listPatQuery } from "./handlers/list.query.js";
@@ -65,6 +66,10 @@ export type PersonalAccessTokensOptions = {
    *  { default: false } for fail-closed gating (feature off until a tier grants
    *  it). Omit to keep PAT always-on (default). */
   readonly toggleable?: { readonly default: boolean };
+  /** Screen (same-feature id or `<feature>:screen:<id>`, must not be gated itself)
+   *  shown in place of the token screens when the tenant's tier excludes the
+   *  feature, e.g. an upgrade notice. Default: the standard "unavailable" notice. */
+  readonly lockedFallbackScreen?: string;
   // Opt-in MFA re-auth gate for minting a token — wired via
   // mfaVerifierFromFeature (auth-mfa/feature.ts) at app-composition time. No
   // hard dependency on the optional auth-mfa feature.
@@ -161,13 +166,16 @@ export function createPersonalAccessTokensFeature(
     };
     const queries = {
       mine: r.queryHandler(listPatQuery),
+      availability: r.queryHandler(availabilityQuery),
       availableScopes: r.queryHandler(buildAvailableScopesQuery(scopes)),
     };
 
     // Declarative screens — list-with-revoke + mint-with-reveal. The app
     // places `patListScreen` via r.nav in its logged-in settings area.
-    r.screen(patListScreen);
-    r.screen(createPatMintScreen(scopes));
+    const lockedFallback =
+      options.lockedFallbackScreen === undefined ? {} : { fallback: options.lockedFallbackScreen };
+    r.screen({ ...patListScreen, ...lockedFallback });
+    r.screen({ ...createPatMintScreen(scopes), ...lockedFallback });
     r.translations({ keys: { ...PAT_FEATURE_I18N, ...patScopeOptionTranslations(scopes) } });
 
     // rateLimit flows into feature.exports so run-prod-app builds the

package/packages/bundled-features/src/personal-access-tokens/handlers/availability.query.ts

@@ -0,0 +1,20 @@
+import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+
+// Screen gate probe: the dispatcher's feature gate rejects every handler of a
+// toggleable feature the tenant's tier does not include, so this query only
+// answers for tenants that may use tokens — a rejection makes the screens'
+// visibleWhen fall back instead of rendering an unusable token list.
+export const availabilityQuery = defineQueryHandler({
+  name: "availability",
+  schema: z.object({}),
+  access: {
+    openToAll: {
+      reason:
+        "constant answer that only exists to be gated by the feature toggle; it carries no user or tenant data",
+    },
+  },
+  description:
+    "Reports that personal access tokens are available to the caller's tenant; fails with feature_disabled when the tenant's tier excludes them. The token screens use it to decide whether to render.",
+  handler: async () => ({ enabled: true }),
+});

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -9,9 +9,18 @@ import type { PatScopeConfig } from "./scopes.js";
 
 const PAT_STATUS_OPTION_KEY_PREFIX = "pat.list.status.";
 
+// Both screens render only for tenants whose tier includes the feature; the
+// availability query is rejected by the feature gate otherwise.
+const PAT_SCREEN_VISIBLE_WHEN = {
+  query: PatQueries.availability,
+  field: "enabled",
+  eq: true,
+} as const;
+
 export const patListScreen: ProjectionListScreenDefinition = {
   id: PAT_SCREEN_ID,
   type: "projectionList",
+  visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
   query: PatQueries.mine,
   // The `mine` handler honours `limit` only (no offset/total), so a pager would
   // show page 1 forever: send one max-size request and render no pager.
@@ -86,6 +95,7 @@ export function createPatMintScreen(scopes: PatScopeConfig): SecretMintScreenDef
   return {
     id: PAT_MINT_SCREEN_ID,
     type: "secretMint",
+    visibleWhen: PAT_SCREEN_VISIBLE_WHEN,
     handler: PatHandlers.create,
     fields: {
       name: { type: "text", required: true, maxLength: 120 },

package/packages/bundled-features/src/step-dispatcher/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.347.0",
+    "type": "fix",
+    "title": "Webhook dispatch cancels the unread response body so a stalling receiver cannot hold the connection",
+    "detail": "Webhook dispatch releases the connection right after the status\nThe step-dispatcher only needs the response status, so it now cancels the unread response body instead of leaving the socket open until the 10 s request timeout fires."
+  },
   {
     "version": "0.346.0",
     "type": "fix",

package/packages/bundled-features/src/step-dispatcher/webhook-runner.ts

@@ -234,6 +234,8 @@ export async function performWebhookDispatch(
       signal: AbortSignal.timeout(deps.requestTimeoutMs ?? WEBHOOK_REQUEST_TIMEOUT_MS),
       body: spec.body !== undefined ? JSON.stringify(spec.body) : undefined,
     });
+    // Only the status is used; an unread body would pin the socket until the timeout fires.
+    await res.body?.cancel().catch(() => {});
     if (!res.ok) {
       return { ok: false, error: `HTTP ${res.status}: ${res.statusText}` };
     }

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -297,6 +297,7 @@ export function createTierEngineFeature<
         ],
       },
       submitLabel: "tier-admin.submit",
+      successMessage: "tier-admin.success",
       cancelTarget: false,
       description: "tier-admin.screen.subtitle",
       access: { roles: ["SystemAdmin"] },

package/packages/bundled-features/src/tier-engine/i18n.ts

@@ -25,6 +25,7 @@ export const TIER_ENGINE_I18N: Readonly<Record<string, LocalizedString>> = {
   "tier-engine:entity:__action-form__:field:tenantId": { en: "Tenant" },
   "tier-engine:entity:__action-form__:field:tier": { en: "New tier" },
   "tier-admin.submit": { en: "Assign tier" },
+  "tier-admin.success": { en: "Tier assigned: {tenantId} → {tier}" },
 };
 
 export const defaultTranslations: TranslationsByLocale =

package/samples/recipes/workflow-engine/README.md

@@ -1,11 +1,12 @@
 # Workflow Engine
 
-Tier-3 `defineWorkflow` vocabulary: wait, branch, mail, webhook, retry.
+Tier-3 `defineWorkflow` vocabulary: wait, branch, mail, webhook.
 
 ## What it shows
 
 - Real runnable pipelines (no empty `build: () => []` stubs)
-- Workflow-run lifecycle across wait / waitForEvent / retry
+- Workflow-run lifecycle across wait / waitForEvent
+- `webhook.send` is delivered once by the step-dispatcher; a failed delivery ends as `step.dispatch-failed`. Wrapping it in `r.step.retry` would not repeat it, because the step only enqueues the request and never throws on a delivery error
 
 ## Source
 

package/samples/recipes/workflow-engine/src/feature.ts

@@ -1,7 +1,7 @@
 // workflow-engine Sample — M.4 Tier-3 step-vocabulary showcase.
 //
-// Demonstrates defineWorkflow with wait, branch, mail.send, webhook.send,
-// retry, and the workflow-run lifecycle. Each workflow below is a real,
+// Demonstrates defineWorkflow with wait, branch, mail.send, webhook.send
+// and the workflow-run lifecycle. Each workflow below is a real,
 // runnable pipeline — no empty `build: () => []` stubs. The
 // integration-tests in __tests__/ exercise the suspension/resume cycle
 // against the in-memory fetcher and (separately) the postgres event-store.
@@ -17,7 +17,7 @@
 //     full HandlerContext surface. `r.step.read.findOne` works (db is
 //     present), `r.step.callFeature` does NOT yet (no `write`/`writeAs`
 //     on apply-ctx). Pipelines should stick to compute / branch / wait /
-//     retry / mail.send / webhook.send for now.
+//     mail.send / webhook.send for now.
 //   - The fetcher reads every suspension row whose wakeAt has expired
 //     (no `workflow_run_pending` read-side projection yet). Concurrency
 //     is safe via the event-store version-conflict path; performance is
@@ -98,28 +98,24 @@ export const userOnboardingWorkflow: WorkflowDefinition<{ email: string; userId:
   });
 
 /**
- * Retry-with-backoff workflow: wraps a deferred webhook in retry(3,
- * exponential). The retry step suspends the run between attempts and
- * the resume-loop re-enters it after the backoff window.
+ * Webhook-delivery workflow: one deferred webhook per `data.processed` event.
+ * `webhook.send` only enqueues a dispatch request; the step-dispatcher
+ * delivers it once and a failed delivery ends as `step.dispatch-failed`. A
+ * `retry` around it would never fire, because the step itself cannot throw
+ * on a delivery error.
  */
-export const resilientWebhookWorkflow: WorkflowDefinition<
+export const webhookDeliveryWorkflow: WorkflowDefinition<
   { data: unknown; webhookUrl: string },
   void
 > = defineWorkflow({
-  name: "resilient-webhook",
+  name: "webhook-delivery",
   trigger: { kind: "event", eventType: "data.processed" },
 
   steps: stepsPipeline<{ data: unknown; webhookUrl: string }, void>(({ r }) => [
-    r.step.retry({
-      times: 3,
-      backoff: "exponential",
-      do: [
-        r.step.webhook.send({
-          url: (ctx: PipelineCtx) => (ctx.event.payload as { webhookUrl: string }).webhookUrl,
-          body: (ctx: PipelineCtx) => (ctx.event.payload as { data: unknown }).data,
-          mode: "deferred",
-        }),
-      ],
+    r.step.webhook.send({
+      url: (ctx: PipelineCtx) => (ctx.event.payload as { webhookUrl: string }).webhookUrl,
+      body: (ctx: PipelineCtx) => (ctx.event.payload as { data: unknown }).data,
+      mode: "deferred",
     }),
     r.step.return({ isSuccess: true, data: undefined }),
   ]),
@@ -155,7 +151,7 @@ export const workflowEngineFeature = defineFeature("workflowEngine", (r) => {
   // The runtime only touches trigger/name/idempotencyKey + executes
   // the closure with the real event payload — payload-agnostic.
   registerEventTrigger(r, userOnboardingWorkflow as unknown as WorkflowDefinition);
-  registerEventTrigger(r, resilientWebhookWorkflow as unknown as WorkflowDefinition);
+  registerEventTrigger(r, webhookDeliveryWorkflow as unknown as WorkflowDefinition);
   // dailyReportWorkflow is cron-triggered — skip MSP registration
 });