@cosmicdrift/kumiko-samples 0.352.0 → 0.354.0

package/packages/bundled-features/src/auth-mfa/web/mfa-recovery-codes-reveal.tsx

@@ -22,14 +22,7 @@ export function MfaRecoveryCodesReveal({
   const [acknowledged, setAcknowledged] = useState(false);
 
   return (
-    <Section
-      testId="mfa-regenerate-reveal"
-      actions={
-        <Button variant="primary" onClick={onDismiss} disabled={!acknowledged}>
-          {t("auth.mfa.regenerate.done")}
-        </Button>
-      }
-    >
+    <Section testId="mfa-regenerate-reveal">
       <div className="flex flex-col items-center gap-2 text-center">
         <span className="text-sm font-semibold">{t("auth.mfa.regenerate.newCodesTitle")}</span>
         <span className="text-xs text-muted-foreground">
@@ -48,6 +41,11 @@ export function MfaRecoveryCodesReveal({
           onChange={setAcknowledged}
         />
       </Field>
+      <div className="flex justify-end">
+        <Button variant="primary" onClick={onDismiss} disabled={!acknowledged}>
+          {t("auth.mfa.regenerate.done")}
+        </Button>
+      </div>
     </Section>
   );
 }

package/packages/bundled-features/src/auth-mfa/web/mfa-setup-preauth-screen.tsx

@@ -67,7 +67,7 @@ export type MfaSetupPreauthScreenProps = {
   readonly subtitle?: ReactNode;
   /** Fired once confirm succeeds — the caller owns session refresh, see the
    *  file-level comment above. */
-  readonly onSuccess?: () => void;
+  readonly onSuccess?: (landingPath?: string) => void;
   readonly onCancel?: () => void;
 };
 
@@ -146,7 +146,7 @@ export function MfaSetupPreauthScreen({
         }
         return;
       }
-      onSuccess?.();
+      onSuccess?.(res.data.landingPath);
     } catch {
       setError("setup_failed");
     } finally {
@@ -173,9 +173,9 @@ export function MfaSetupPreauthScreen({
       ) : null}
 
       {!setup && (
-        <Section
-          testId="mfa-setup-preauth-intro"
-          actions={
+        <Section testId="mfa-setup-preauth-intro">
+          <span className="text-sm text-muted-foreground">{t("auth.mfa.setup.intro")}</span>
+          <div className="flex justify-end">
             <Button
               variant="primary"
               onClick={() => void startSetup()}
@@ -184,27 +184,13 @@ export function MfaSetupPreauthScreen({
             >
               {t("auth.mfa.setup.start")}
             </Button>
-          }
-        >
-          <span className="text-sm text-muted-foreground">{t("auth.mfa.setup.intro")}</span>
+          </div>
         </Section>
       )}
 
       {setup && (
         <Form onSubmit={onSubmit}>
-          <Section
-            testId="mfa-setup-preauth-setup"
-            actions={
-              <Button
-                type="submit"
-                variant="primary"
-                loading={busy}
-                disabled={busy || !acknowledged || code.length !== 6}
-              >
-                {t("auth.mfa.setup.confirm")}
-              </Button>
-            }
-          >
+          <Section testId="mfa-setup-preauth-setup">
             <div className="flex flex-col items-center gap-2 text-center">
               <span className="text-sm font-semibold">{t("auth.mfa.enable.scanTitle")}</span>
               {/* qrcode's own SVG string output, not user input — safe to inline */}
@@ -251,6 +237,17 @@ export function MfaSetupPreauthScreen({
                 autoComplete="one-time-code"
               />
             </Field>
+
+            <div className="flex justify-end">
+              <Button
+                type="submit"
+                variant="primary"
+                loading={busy}
+                disabled={busy || !acknowledged || code.length !== 6}
+              >
+                {t("auth.mfa.setup.confirm")}
+              </Button>
+            </div>
           </Section>
         </Form>
       )}

package/packages/bundled-features/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -20,7 +20,7 @@ export type MfaVerifyScreenProps = {
   /** Called after the server confirms the code and the session state has
    *  refreshed. Optional — apps that swap this screen back out purely on
    *  session.status changing to "authenticated" don't need it. */
-  readonly onSuccess?: () => void;
+  readonly onSuccess?: (landingPath?: string) => void;
   // Some failures (challenge_expired, too_many_attempts) have no retry path —
   // the challengeToken is dead. Without this, the host has no way back to
   // login short of a full page reload. Optional: apps that always mount
@@ -68,7 +68,7 @@ export function MfaVerifyScreen({
     if (res.kind === "success") {
       await session.refresh();
       setSubmitting(false);
-      onSuccess?.();
+      onSuccess?.(res.data.landingPath);
       return;
     }
     setSubmitting(false);

package/packages/bundled-features/src/billing-foundation/billing-info-query.ts

@@ -39,19 +39,18 @@ export type BillingInfo<TTier extends string> = {
     readonly tier: string;
     readonly providerName: string;
   } | null;
-  readonly prices: Readonly<Partial<Record<string, string>>>;
+  readonly prices: TierPrices<TTier>;
 };
 
+export type TierPrices<TTier extends string> = { readonly [K in TTier]?: string };
+
 export type BillingInfoQueryDeps<TTier extends string> = {
   readonly roles: readonly string[];
   readonly resolveTier: (db: TenantDb, tenantId: TenantId) => Promise<TTier>;
-  // ctx is the same HandlerContext the returned handler receives — app
-  // implementations read app-specific extraContext fields off it (e.g.
-  // publicstatus/show-pony's getBillingPrices(ctx) reads `billingPrices`),
-  // so they type their own ctx param as `unknown` and cast internally.
-  readonly getBillingPrices: (
-    ctx: HandlerContext,
-  ) => Readonly<Partial<Record<string, string>>> | null;
+  // ctx is the same HandlerContext the returned handler receives — apps read
+  // their extraContext fields (e.g. `billingPrices`) off it and validate them
+  // at that boundary.
+  readonly getBillingPrices: (ctx: HandlerContext) => TierPrices<TTier> | null;
 };
 
 export function createBillingInfoQueryConfig<TTier extends string>(

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "BillingInfo.prices and getBillingPrices are keyed by the tier union",
+    "migration": "A getBillingPrices that returns keys outside your tier union no longer compiles; remove or rename those keys."
+  },
   {
     "version": "0.346.0",
     "type": "fix",

package/packages/bundled-features/src/billing-foundation/checkout-core.ts

@@ -274,6 +274,13 @@ export type OpenCheckoutOptions = {
   readonly baseUrl?: string;
   readonly catalog?: BillingPlanCatalog;
   readonly now: () => Temporal.Instant;
+  /** The caller already ran `assertBillingEnabled` under its own handler name
+   *  (before a costly provider lookup), so the gate is not repeated here. */
+  readonly billingEnabledChecked?: boolean;
+  /** The caller already ran `assertNoActiveSubscription` and passes its result
+   *  (null = tenant has none); mode:"subscription" skips the second read and
+   *  the providerCustomerId check reuses it. */
+  readonly checkedSubscription?: Awaited<ReturnType<typeof getSubscriptionForTenant>>;
 };
 
 export type OpenCheckoutInput = {
@@ -358,7 +365,9 @@ export async function assertCheckoutAllowed(
   // Checked before the redirect-origin hardening for every mode — a
   // disabled provider must reject a mode:"payment" checkout just as much
   // as a mode:"subscription" one.
-  await assertBillingEnabled(ctx, plugin, "create-checkout-session");
+  if (options.billingEnabledChecked !== true) {
+    await assertBillingEnabled(ctx, plugin, "create-checkout-session");
+  }
   assertRedirectOrigins([input.successUrl, input.cancelUrl], options.baseUrl);
 
   const mode = input.mode ?? "subscription";
@@ -368,7 +377,10 @@ export async function assertCheckoutAllowed(
 
   if (mode === "subscription") {
     assertSubscriptionPriceAllowed(plugin, options.catalog, input);
-    ownSubscription = await assertNoActiveSubscription(ctx, options.now());
+    ownSubscription =
+      options.checkedSubscription !== undefined
+        ? options.checkedSubscription
+        : await assertNoActiveSubscription(ctx, options.now());
   } else {
     assertOneOffPriceAllowed(plugin, input);
   }

package/packages/bundled-features/src/billing-foundation/handlers/start-plan-checkout.write.ts

@@ -74,7 +74,13 @@ export function createStartPlanCheckoutHandler(
       const baseUrl = options.baseUrl ?? "";
       const result = await openCheckout(
         ctx,
-        { baseUrl: options.baseUrl, catalog, now: options.now },
+        {
+          baseUrl: options.baseUrl,
+          catalog,
+          now: options.now,
+          billingEnabledChecked: true,
+          checkedSubscription: existing,
+        },
         {
           providerName,
           priceId: resolved.priceId,

package/packages/bundled-features/src/cap-overview/access.ts

@@ -1,4 +1,4 @@
-import { access } from "@cosmicdrift/kumiko-framework/engine";
+import { access, BUILT_IN_MEMBERSHIP_ROLES } from "@cosmicdrift/kumiko-framework/engine";
 
 // Usage numbers are an operator concern by default; wider visibility is an
 // explicit `usageVisibleTo` opt-in on createCapOverviewFeature. The my-caps
@@ -9,14 +9,7 @@ export const DEFAULT_CAP_USAGE_ROLES: readonly string[] = access.roles(...access
 // Roles the engine itself knows (role-assignment.ts ranks). App-declared roles
 // (assignableRole) only exist once the registry is composed, which is after
 // this feature is defined, so they cannot be validated here.
-const BUILT_IN_USAGE_VISIBLE_ROLES: ReadonlySet<string> = new Set([
-  "User",
-  "Member",
-  "Editor",
-  "Admin",
-  "TenantAdmin",
-  "SystemAdmin",
-]);
+const BUILT_IN_USAGE_VISIBLE_ROLES: ReadonlySet<string> = new Set(BUILT_IN_MEMBERSHIP_ROLES);
 
 export function resolveCapUsageRoles(
   usageVisibleTo: readonly string[] | undefined,

package/packages/bundled-features/src/cap-overview/handlers/tenant-caps-list.query.ts

@@ -10,7 +10,7 @@ import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/er
 import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation/index.js";
 import type { CapLimitContext } from "../../cap-counter/index.js";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 import { tierAssignmentEntity } from "../../tier-engine/index.js";
 import { capFieldName } from "../constants.js";
 import type { CapSpec, CapUsage } from "../types.js";
@@ -174,7 +174,10 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
         "cap-overview:tenant-caps:list — SystemAdmin platform-wide tenant overview",
       );
 
-      const tenants = await selectMany<TenantRow>(db, tenantTable, {});
+      const tenants = await decryptTenantNames(
+        await selectMany<TenantRow>(db, tenantTable, {}),
+        "cap-overview:tenant-caps:list",
+      );
       const assignments = await selectMany<TierAssignmentRow>(db, tierAssignmentTable, {});
       const subscriptions = await selectMany<SubscriptionRow>(db, subscriptionsProjectionTable, {});
 

package/packages/bundled-features/src/cap-overview/handlers/tenant-options.query.ts

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 
 type TenantRow = { readonly id: string; readonly name: string };
 
@@ -22,14 +22,11 @@ export const tenantOptionsQuery = defineQueryHandler({
     const db = ctx.systemDb.acknowledgeCrossTenant(
       "cap-overview:tenant-options — SystemAdmin dashboard tenant-filter options",
     );
-    const tenants = await selectMany<TenantRow>(
-      db,
-      tenantTable,
-      {},
-      {
-        orderBy: { col: "name", direction: "asc" },
-      },
+    const tenants = await decryptTenantNames(
+      await selectMany<TenantRow>(db, tenantTable, {}),
+      "cap-overview:tenant-options",
     );
-    return { rows: tenants.map((tenant) => ({ value: tenant.id, label: tenant.name })) };
+    const sorted = [...tenants].sort((a, b) => a.name.localeCompare(b.name));
+    return { rows: sorted.map((tenant) => ({ value: tenant.id, label: tenant.name })) };
   },
 });

package/packages/bundled-features/src/channel-in-app/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "in_app_messages gets a tenant, user, created_at index",
+    "migration": "Run `kumiko schema generate`; it emits an in-place CREATE INDEX with no DROP and no rebuild."
+  }
+]

package/packages/bundled-features/src/channel-in-app/in-app-channel.ts

@@ -24,7 +24,7 @@ export const inAppChannel: DeliveryChannel = {
     });
 
     if (ctx.sseBroker) {
-      ctx.sseBroker.pushToChannel(tenantChannel(ctx.tenantId), {
+      await ctx.sseBroker.pushToChannel(tenantChannel(ctx.tenantId), {
         type: "channel-in-app:event:delivered",
         data: {
           id: row?.id,

package/packages/bundled-features/src/channel-in-app/tables.ts

@@ -2,6 +2,7 @@ import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   boolean,
   type EntityTableMeta,
+  index,
   instant,
   table as pgTable,
   serial,
@@ -10,18 +11,23 @@ import {
   uuid,
 } from "@cosmicdrift/kumiko-framework/db";
 
-export const inAppMessagesTable = pgTable("in_app_messages", {
-  id: serial("id").primaryKey(),
-  tenantId: uuid("tenant_id").notNull(),
-  userId: text("user_id").notNull(),
-  notificationType: text("notification_type").notNull(),
-  title: text("title").notNull(),
-  body: text("body"),
-  data: text("data"), // JSON string for action, screen, etc.
-  isRead: boolean("is_read").default(false).notNull(),
-  readAt: instant("read_at"),
-  createdAt: instant("created_at").default(sql`now()`).notNull(),
-});
+export const inAppMessagesTable = pgTable(
+  "in_app_messages",
+  {
+    id: serial("id").primaryKey(),
+    tenantId: uuid("tenant_id").notNull(),
+    userId: text("user_id").notNull(),
+    notificationType: text("notification_type").notNull(),
+    title: text("title").notNull(),
+    body: text("body"),
+    data: text("data"), // JSON string for action, screen, etc.
+    isRead: boolean("is_read").default(false).notNull(),
+    readAt: instant("read_at"),
+    createdAt: instant("created_at").default(sql`now()`).notNull(),
+  },
+  // Every inbox, unread-count, mark-all-read and userData export/delete read filters by tenant + user.
+  (t) => [index("in_app_messages_tenant_user_created_idx").on(t.tenantId, t.userId, t.createdAt)],
+);
 
 // Derived from inAppMessagesTable (table() attaches the meta as a Symbol) so
 // the two can't drift, instead of hand-duplicating the column list.

package/packages/bundled-features/src/compliance-profiles-ops/handlers/tenants-missing-profile.query.ts

@@ -3,7 +3,7 @@ import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tenantComplianceProfileTable } from "../../compliance-profiles/index.js";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 
 // SystemAdmin platform-wide counterpart to needs-profile (#2089).
 //
@@ -34,9 +34,10 @@ export const tenantsMissingProfileQuery = defineQueryHandler({
       "platform operator scans every tenant for a missing compliance-profile selection",
     );
 
-    const tenants = await db.selectMany<{ id: TenantId; name: string }>(tenantTable, {
-      isEnabled: true,
-    });
+    const tenants = await decryptTenantNames(
+      await db.selectMany<{ id: TenantId; name: string }>(tenantTable, { isEnabled: true }),
+      "compliance-profiles-ops:tenants-missing-profile",
+    );
     const profileRows = await db.selectMany<{ tenantId: TenantId }>(
       tenantComplianceProfileTable,
       {},

package/packages/bundled-features/src/config/handlers/values.query.ts

@@ -13,8 +13,10 @@ import { hasConfigAccess } from "../write-helpers.js";
 export const valuesQuery = defineQueryHandler({
   name: "values",
   description:
-    "Returns the effective value, scope and winning source for every config key the caller may read, with encrypted and secret-backed values masked; use it to inspect the current settings.",
-  schema: z.object({}),
+    "Returns the effective value, scope and winning source for every config key the caller may read (optionally narrowed to `keys`), with encrypted and secret-backed values masked; use it to inspect the current settings.",
+  schema: z.object({
+    keys: z.array(z.string()).optional(),
+  }),
   // Per-key read access enforced via hasConfigAccess inside the handler.
   access: {
     openToAll: {
@@ -37,7 +39,10 @@ export const valuesQuery = defineQueryHandler({
     const allKeys = registry.getAllConfigKeys();
     const keyDefs = new Map<string, ConfigKeyDefinition>();
     const filteredKeys: string[] = [];
+    const requestedKeys =
+      query.payload.keys === undefined ? undefined : new Set(query.payload.keys);
     for (const [qualifiedKey, keyDef] of allKeys) {
+      if (requestedKeys !== undefined && !requestedKeys.has(qualifiedKey)) continue;
       if (!hasConfigAccess(keyDef.access.read, query.user.roles)) continue;
       keyDefs.set(qualifiedKey, keyDef);
       filteredKeys.push(qualifiedKey);

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "forget-subject: the SUBJECT_FORGOTTEN audit now commits before the handler tx does and records cleanupError when a derived-data sweep fails",
+    "detail": "The SUBJECT_FORGOTTEN audit event is appended through the outside-transaction db, so it commits before the handler transaction does and survives a later rollback. If the blind-index sweep or search purge fails, the event carries cleanupError (error code or name, never the message) and the handler then fails; retry to finish the cleanup. The user-lifecycle step runs in a savepoint and no longer aborts the handler transaction."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Writing a personal field of an erased data subject answers 409 subject_erased instead of 500",
+    "detail": "Writing PII to an erased data subject answers 409 `subject_erased`, rebinding a hook's unsafeRaw grant no longer inherits db.global() writes, jobs wait for boot gates before consuming\nA write that has to encrypt a personal field for a subject whose key was erased (crypto-shredding) now fails with a `ConflictError` (409, reason `subject_erased`, i18n in en and de) instead of a 500, on the executor write path and in `encryptForDirectWrite`. A hook's own `unsafeRaw` grant (`withUnsafeRawGrant`) no longer carries the handler's `globalWrites` grant. The job runner starts its BullMQ worker only after the boot gates passed, so a job queued by a previous run cannot execute against an unmet boot precondition. `buildServer` warns at boot when `r.systemScope()` features exist but no RateLimitResolver is configured. The auth, MFA, PAT, change-email and request-deletion handlers declare only the escape-hatch grants they use."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",