@cosmicdrift/kumiko-samples 0.364.0 → 0.365.1

package/packages/bundled-features/src/waitlist/handlers/reject.write.ts

@@ -1,11 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createSystemUser,
   defineWriteHandler,
   type HandlerContext,
   parseTenantId,
-  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   InternalError,
@@ -18,13 +16,12 @@ import {
   cancelPendingInvitation,
   INVITATION_STATUS,
   tenantInvitationsTable,
-  tenantMembershipsTable,
 } from "../../tenant/index.js";
-import { userTable } from "../../user/index.js";
 import { WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
 import {
   adminAccess,
+  isTenantMember,
   normalizeEmail,
   platformActor,
   waitlistDb,
@@ -34,18 +31,6 @@ import { WaitlistIdSchema } from "../payloads.js";
 
 export type WaitlistRejectData = { readonly kind: "rejected"; readonly id: string };
 
-// An admin re-invite can flip an accepted invitation back to pending, so the
-// invitation status alone cannot prove the person holds no access.
-async function isTenantMember(db: TenantDb, email: string, tenantId: TenantId): Promise<boolean> {
-  const user = await fetchOne<{ id: string }>(db, userTable, {
-    email: normalizeEmail(email),
-    isDeleted: false,
-  });
-  if (!user) return false;
-  const membership = await fetchOne(db, tenantMembershipsTable, { userId: user.id, tenantId });
-  return membership !== undefined && membership !== null;
-}
-
 // An invited entry already has a live invitation link; rejecting must kill it,
 // otherwise the rejected person can still sign up. Once accepted they hold
 // access, which only tenant member removal may revoke.

package/packages/bundled-features/src/waitlist/handlers/submit.write.ts

@@ -36,10 +36,13 @@ const SUBMIT_ROLES = access.roles(
   "TenantAdmin",
 );
 
+const OPEN_STATUSES = [WAITLIST_STATUS.Pending, WAITLIST_STATUS.Invited];
+
 export type WaitlistSubmitData = { readonly kind: "submitted" };
 
-// Identical for new, duplicate and honeypot submits: the response must not
-// reveal whether the email is already on the list.
+// Identical body for new, duplicate and honeypot submits so the response does not
+// state whether the email is already on the list. Timing still differs: only the
+// new-entry path writes and sends mail.
 const SUBMITTED: WriteResult<WaitlistSubmitData> = {
   isSuccess: true,
   data: { kind: "submitted" },
@@ -60,13 +63,32 @@ function isHoneypotFilled(payload: WaitlistSubmitInput): boolean {
 
 async function hasOpenEntryForEmail(email: string, ctx: HandlerContext): Promise<boolean> {
   const found = await waitlistExecutor.list(
-    { filter: { field: "email", op: "eq", value: email }, limit: 50 },
+    {
+      filter: { field: "email", op: "eq", value: email },
+      filters: [{ field: "status", op: "in", value: OPEN_STATUSES }],
+      limit: 1,
+    },
     platformActor(),
     waitlistDb(ctx),
   );
-  return found.rows.some(
-    (row) => row["status"] === WAITLIST_STATUS.Pending || row["status"] === WAITLIST_STATUS.Invited,
-  );
+  return found.rows.length > 0;
+}
+
+// The resolver usually reads config; run it outside the handler transaction's
+// critical section so a failing statement cannot abort the transaction that holds
+// the entry, and a slow resolver does not extend the per-email advisory lock.
+async function resolveAdminRecipient(
+  opts: WaitlistOptions,
+  ctx: HandlerContext,
+): Promise<string | null> {
+  try {
+    return (await opts.notifyRecipient?.(ctx)) || null;
+  } catch (err) {
+    ctx.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
+      error: err instanceof Error ? err.message : String(err),
+    });
+    return null;
+  }
 }
 
 async function sendBestEffort(
@@ -87,14 +109,16 @@ async function sendBestEffort(
 }
 
 export function createSubmitHandler(opts: WaitlistOptions) {
+  const emailRateLimits = opts.emailRateLimits ?? DEFAULT_SUBMIT_EMAIL_RATE_LIMITS;
   return defineWriteHandler<"submit", typeof WaitlistSubmitSchema, WaitlistSubmitData>({
     name: "submit",
     schema: WaitlistSubmitSchema,
     access: { roles: SUBMIT_ROLES, personalData: "public-intake" },
     rateLimit: opts.rateLimit ?? DEFAULT_SUBMIT_RATE_LIMIT,
-    additionalRateLimits: opts.emailRateLimits ?? DEFAULT_SUBMIT_EMAIL_RATE_LIMITS,
+    // An empty array means "disabled"; boot validation rejects an empty additionalRateLimits.
+    ...(emailRateLimits.length > 0 && { additionalRateLimits: emailRateLimits }),
     description:
-      "Public waitlist sign-up: registers an interest entry and sends the submitter a confirmation mail. Always reports success, whether the address is new or already on the list.",
+      "Public waitlist sign-up: registers an interest entry and sends the submitter a confirmation mail. Reports success whether the address is new or already on the list; the response body is identical, response timing can still differ.",
     escapeHatch: { grants: ["unsafeRaw"], reason: SUBMIT_LOCK_REASON },
     handler: async (event, ctx) => {
       const payload = event.payload;
@@ -106,6 +130,7 @@ export function createSubmitHandler(opts: WaitlistOptions) {
           message: "waitlist:submit requires ctx.systemDb — is r.systemScope() set?",
         });
       }
+      const adminRecipient = await resolveAdminRecipient(opts, ctx);
       await acquireNamespacedAdvisoryLock(
         ctx.systemDb.unsafeRaw(SUBMIT_LOCK_REASON),
         SUBMIT_LOCK_NAMESPACE,
@@ -140,7 +165,6 @@ export function createSubmitHandler(opts: WaitlistOptions) {
       );
 
       await sendBestEffort(ctx, "admin notice", async (notify) => {
-        const adminRecipient = await opts.notifyRecipient?.(ctx);
         // skip: no admin recipient configured
         if (!adminRecipient) return;
         await notify(WAITLIST_NOTIFICATION_TYPES.adminNotice, {

package/packages/bundled-features/src/waitlist/i18n.ts

@@ -1,6 +1,15 @@
 type LocalizedString = { readonly en: string; readonly de: string };
 
 export const WAITLIST_I18N: Readonly<Record<string, LocalizedString>> = {
+  "waitlist:feature.label": { en: "Waitlist", de: "Warteliste" },
+  "waitlist:notify.confirmation.label": {
+    en: "Waitlist confirmation",
+    de: "Bestätigung der Warteliste",
+  },
+  "waitlist:notify.admin-notice.label": {
+    en: "New waitlist entry",
+    de: "Neuer Eintrag auf der Warteliste",
+  },
   "screen:waitlist-list.title": { en: "Waitlist", de: "Warteliste" },
   "waitlist.nav.waitlist": { en: "Waitlist", de: "Warteliste" },
   "waitlist:entity:waitlistEntry:field:name": { en: "Name", de: "Name" },

package/packages/bundled-features/src/waitlist/lib.ts

@@ -1,3 +1,4 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
@@ -5,8 +6,11 @@ import {
   type HandlerContext,
   type SessionUser,
   SYSTEM_TENANT_ID,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { tenantMembershipsTable } from "../tenant/index.js";
+import { userTable } from "../user/index.js";
 import { waitlistEntryEntity, waitlistEntryTable } from "./entity.js";
 
 export const WAITLIST_CROSS_TENANT_REASON = "waitlist is platform-wide (systemScope)";
@@ -34,3 +38,19 @@ export function waitlistDb(ctx: HandlerContext): TenantDb {
 export function platformActor(): SessionUser {
   return createSystemUser(SYSTEM_TENANT_ID);
 }
+
+// An admin re-invite can flip an accepted invitation back to pending, so the
+// invitation status alone cannot prove the person holds no access.
+export async function isTenantMember(
+  db: TenantDb,
+  email: string,
+  tenantId: TenantId,
+): Promise<boolean> {
+  const user = await fetchOne<{ id: string }>(db, userTable, {
+    email: normalizeEmail(email),
+    isDeleted: false,
+  });
+  if (!user) return false;
+  const membership = await fetchOne(db, tenantMembershipsTable, { userId: user.id, tenantId });
+  return membership !== undefined && membership !== null;
+}

package/packages/bundled-features/src/workflow-runner/feature.ts

@@ -32,7 +32,7 @@ import { workflowRunPendingTableMeta } from "./tables.js";
 
 // Kebab-case matching the "./workflow-runner" export subpath — every other
 // bundled feature's runtime name follows this convention, and
-// FEATURE_IMPORT_REGISTRY (use-all-bundled) keys off it.
+// use-all-bundled's check-coverage matches exports to mounted features by it.
 const FEATURE_NAME = "workflow-runner";
 
 export const workflowRunnerFeature = defineFeature(FEATURE_NAME, (r) => {

package/samples/apps/ui-walkthrough/src/run-config.ts

@@ -35,7 +35,20 @@ export const APP_FEATURES = [
   createDocumentDesignerFeature(),
   // Mounted individually: composeRendererStack() would add a second template-resolver.
   createRendererFoundationFeature(),
-  createRendererMailHtmlFeature(),
+  createRendererMailHtmlFeature({
+    footer: ({ locale }) =>
+      locale.startsWith("de")
+        ? {
+            text: "Gesendet über das Nordlicht Mieterportal",
+            imprint: { label: "Impressum", url: "https://nordlicht-immobilien.de/impressum" },
+            privacy: { label: "Datenschutz", url: "https://nordlicht-immobilien.de/datenschutz" },
+          }
+        : {
+            text: "Sent via the Nordlicht tenant portal",
+            imprint: { label: "Imprint", url: "https://nordlicht-immobilien.de/imprint" },
+            privacy: { label: "Privacy", url: "https://nordlicht-immobilien.de/privacy" },
+          },
+  }),
   // The PDF preview of the template editor prints through the puppeteer-service
   // (PUPPETEER_SERVICE_URL / PUPPETEER_AUTH_TOKEN); the e2e config starts one.
   createRendererPuppeteerClientFeature(),

package/samples/apps/use-all-bundled/README.md

@@ -33,24 +33,14 @@ Exits 0 on success; any feature-wiring fault throws and exits 1.
 
 ## Coverage status
 
-36/39 bundled-feature exports mounted, 3 held-back. M0.1 reduced this from 10. Held-back nach M0.1:
-
-- `auth-email-password` — auto-mounted via `composeFeatures(authOptions)` (no need to list)
-- `files-provider-s3` — utility helpers (`createS3Provider`), kein `defineFeature`
-- `foundation-shared` — pure utilities (`requireDefined`, `requireNonEmpty`), kein `defineFeature`
-
-The 3 remaining are utilities or auto-mounted — they cannot be added to `APP_FEATURES` by design.
+Every bundled-feature export is mounted except the held-back ones in `EXPECTED_HELD_BACK` (`scripts/check-coverage.ts`): utilities without `defineFeature` and scaffold-only features. They cannot be added to `APP_FEATURES` by design.
 
 ## Maintenance
 
 When you add a new feature-export to `@cosmicdrift/kumiko-bundled-features` you MUST either:
 
 1. Mount it in `src/run-config.ts`. `kumiko/schema.ts` picks up entities via
-   `composeFeatures(APP_FEATURES)` — then regenerate if schema changed:
-   ```sh
-   cd samples/apps/use-all-bundled
-   bun ../../bin/kumiko.ts schema generate feature-coverage
-   ```
+   `composeFeatures(APP_FEATURES)`; run `kumiko-schema generate` if the schema changed.
 2. Or, if the feature is not yet smoke-ready, add it to `EXPECTED_HELD_BACK` in `scripts/check-coverage.ts` with a one-line reason.
 
-CI fails otherwise via `Coverage lint (M5)`.
+CI fails otherwise via `Coverage lint`.

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -2122,7 +2122,7 @@
     },
     {
       "name": "renderer-mail-html",
-      "description": "A `renderer-foundation` plugin that handles `RenderRequest { kind: \"mail\" }` and returns `{ subject, html, text, previewText? }` suitable for sending via `channel-email`. The mail template (`kind: \"mail\"`, document HTML, subject in `meta`) resolves through `template-resolver`'s DB fallback, its body is compiled to Handlebars by template-resolver and rendered with escaping, then placed into an MJML layout (`kind: \"mail-layout\"`, slug `default` unless `meta.layoutSlug` says otherwise, in-code `DEFAULT_MAIL_LAYOUT_MJML` as last resort) that `mjml()` compiles to email-safe table HTML, with `html-to-text` producing the plain-text alternative. Seed an editable system layout with `seedSystemMailLayout(db)`. Requires `renderer-foundation` + `template-resolver`.",
+      "description": "A `renderer-foundation` plugin that handles `RenderRequest { kind: \"mail\" }` and returns `{ subject, html, text, previewText? }` suitable for sending via `channel-email`. The mail template (`kind: \"mail\"`, document HTML, subject in `meta`) resolves through `template-resolver`'s DB fallback, its body is compiled to Handlebars by template-resolver and rendered with escaping, then placed into an MJML layout (`kind: \"mail-layout\"`, slug `default` unless `meta.layoutSlug` says otherwise, an in-code structured layout with the tenant branding logo and accent color as last resort) that `mjml()` compiles to email-safe table HTML, with `html-to-text` producing the plain-text alternative. An optional `footer` resolver adds the platform imprint, privacy link and footer text below every structured layout, and an optional `brandSuffix` resolver adds a word after the tenant name in the brand row of the in-code layout. Mail meta `headerChip`, `tone` and `footerNote` add a chip beside the brand, the tone of the top line and chip, and a note above the site and unsubscribe links of the card. Seed an editable system layout with `seedSystemMailLayout(db)`. Requires `renderer-foundation` + `template-resolver`.",
       "toggleableDefault": null,
       "requires": [
         "renderer-foundation",
@@ -2170,7 +2170,7 @@
     },
     {
       "name": "renderer-puppeteer-client",
-      "description": "A `renderer-foundation` plugin that prints documents to PDF through a separately deployed `puppeteer-service`. A `document-pdf` request names a stored template (`{ slug, locale, variables }`): the plugin resolves the template and its `pdf-layout` (header, signature and footer regions), embeds every image as a data URI, turns repeating table header rows into a real table head and sends the finished HTML to the service, which performs no network fetches itself. The page format, margins, file name pattern and title come from the template meta. A write handler renders with `renderPdfBeforeTransaction(ctx, { slug, locale, variables })` as its `beforeTransaction` phase, so the print service call holds no database connection, and stores the result with `storeRenderedPdf(ctx, event.prepared)` in the handler: a file plus a `rendered-pdf` record that keeps the template and layout version, so a stored document can always be traced to the text it was created from. The `puppeteer-status` query tells a TenantAdmin whether the service answers; while it does not, rendering fails with a `puppeteer_unavailable` error (HTTP 503) and no PDF is created. `image-snapshot` requests still take ready HTML in `payload.content`. Configure the endpoint and token with `PUPPETEER_SERVICE_URL` and `PUPPETEER_AUTH_TOKEN`; the client retries 5xx and network errors with exponential backoff (default 3 retries), 4xx fails at once. The feature adds the `rendered_pdfs` table, so apps that mount it need a schema migration.",
+      "description": "A `renderer-foundation` plugin that prints documents to PDF through a separately deployed `puppeteer-service`. A `document-pdf` request names a stored template (`{ slug, locale, variables }`): the plugin resolves the template and its `pdf-layout` (header, signature and footer regions), embeds every image as a data URI, turns repeating table header rows into a real table head and sends the finished HTML to the service, which performs no network fetches itself. The page format, margins, file name pattern and title come from the template meta. A write handler renders with `renderPdfBeforeTransaction(ctx, { slug, locale, variables })` as its `beforeTransaction` phase, so the print service call holds no database connection, and stores the result with `storeRenderedPdf(ctx, event.prepared)` in the handler: a file plus a `rendered-pdf` record that keeps the template and layout version, so a stored document can always be traced to the text it was created from. The `puppeteer-status` query tells a TenantAdmin whether the service answers; while it does not, rendering fails with a `puppeteer_unavailable` error (HTTP 503) and no PDF is created. `image-snapshot` requests still take ready HTML in `payload.content`, which must embed all resources as data: URIs because the service fetches no http(s) resources. Configure the endpoint and token with `PUPPETEER_SERVICE_URL` and `PUPPETEER_AUTH_TOKEN`; the client retries 5xx and network errors with exponential backoff (default 3 retries), 4xx fails at once. The feature adds the `rendered_pdfs` table, so apps that mount it need a schema migration.",
       "toggleableDefault": null,
       "requires": [
         "renderer-foundation"
@@ -2391,7 +2391,7 @@
     },
     {
       "name": "step-dispatcher",
-      "description": "Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.",
+      "description": "Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. An `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event enqueues one `step-dispatcher:job:deliver` BullMQ job per dispatch (Redis carries only the stream id and tenant, never the request payload). The job performs the actual HTTP or mail delivery and appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream, so the outcome is recorded in the event log without a separate status table. Transient failures (network error, timeout, 5xx, 408, 429, any mail adapter failure) are retried 3 times with exponential backoff; the outcome is recorded after the final attempt and the payload key is erased only then. Permanent failures (invalid url, blocked host, other 4xx, unavailable auth secret) are recorded immediately. At most 2 deliveries per tenant run at once (`maxPerTenant` with `onLimit: \"defer\"`), so a slow receiver of one tenant does not delay other tenants. Requires a job runner (Redis) and a worker consuming the job's default `worker` lane; without a job runner the projection fails loudly. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`. Every `webhook.send` request carries `Idempotency-Key: <dispatch stream id>`, stable across retries and redeliveries of the same dispatch request; an explicit `Idempotency-Key` in `headers` takes precedence.",
       "toggleableDefault": null,
       "requires": [
         "secrets"
@@ -3209,7 +3209,7 @@
     },
     {
       "name": "waitlist",
-      "description": "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response never reveals whether an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
+      "description": "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
       "toggleableDefault": null,
       "requires": [
         "tenant",

package/samples/apps/use-all-bundled/scripts/check-coverage.ts

@@ -1,18 +1,13 @@
 #!/usr/bin/env bun
 // biome-ignore-all lint/suspicious/noConsole: CLI-Script, console ist Feature.
 //
-// C1 M5 coverage lint. Diffs bundled-features-Exports gegen den
-// FEATURE_IMPORT_REGISTRY in samples/apps/use-all-bundled/schema/
-// generate.ts. Fängt zwei Drifts:
+// Coverage lint. Diffs die Top-Level-Exports von bundled-features gegen die Features, die
+// use-all-bundled mountet (FEATURES aus kumiko/schema.ts: APP_FEATURES plus die von
+// composeFeatures ergänzten Auth-/Signup-Features). Fängt drei Drifts:
 //
-//   1. Ein neuer feature-export ohne Aufnahme in use-all-bundled
-//      → unreferenced exports
-//   2. Ein removed feature-export der noch im Registry steht
-//      → stale registry
-//
-// Held-back features für M0.1 (subscription-stripe, channel-email, …)
-// stehen in EXPECTED_HELD_BACK. Sobald sie mit stub-options gemountet
-// werden, müssen sie aus dieser Liste raus.
+//   1. Ein Export, der weder gemountet ist noch in EXPECTED_HELD_BACK steht
+//   2. Ein EXPECTED_HELD_BACK-Eintrag, der kein Export mehr ist
+//   3. Ein EXPECTED_HELD_BACK-Eintrag, der inzwischen gemountet ist (stale)
 //
 // Usage:
 //   bun samples/apps/use-all-bundled/scripts/check-coverage.ts
@@ -20,6 +15,7 @@
 
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { FEATURES } from "../kumiko/schema";
 
 const ROOT = resolve(import.meta.dir, "..");
 const FRAMEWORK_ROOT = resolve(ROOT, "..", "..", "..");
@@ -27,33 +23,13 @@ const FRAMEWORK_ROOT = resolve(ROOT, "..", "..", "..");
 // Held-back exports: existieren in bundled-features, sind aber nicht
 // als runtime-feature in use-all-bundled mountbar.
 //
-// Nach M0.1 nur noch utilities + auto-mounted:
-// - utilities: kein r.defineFeature (foundation-shared, files-provider-s3
-//   sind pure helpers).
-// - auto-mounted: kommt via composeFeatures(includeBundled:true) automatisch
-//   (auth-email-password) — wäre doppelt-mount wenn explizit gelistet.
+// Nur Utilities ohne defineFeature (foundation-shared, files-provider-s3 sind pure helpers)
+// und scaffold-only Features. Gemountete Features gehören nicht hierher.
 const EXPECTED_HELD_BACK = new Set([
-  "auth-email-password", // auto-mounted via composeFeatures(authOptions)
-  "agent-tools", // utility (buildToolCatalog: Registry -> ToolDefinition[]), kein defineFeature
   "files-provider-s3", // utility (createS3Provider helpers), kein defineFeature
   "foundation-shared", // utilities (requireDefined/requireNonEmpty), kein feature
   "page-render", // shared HTML render/cache helpers (legal/managed-pages), kein defineFeature
   "presets", // feature-bundle helpers (dsgvoSelfServiceFeatures, securityBaselineFeatures), kein defineFeature
-  "auth-foundation", // scaffold-only (#1368): bootCheck wirft ohne gemountete auth-provider-*, die es noch nicht gibt
-]);
-
-// Registry-only: mounted features that are NOT top-level package exports
-// (companion features living under another export path). schema-check still
-// needs them in FEATURE_IMPORT_REGISTRY; coverage must not flag them stale.
-const EXPECTED_REGISTRY_ONLY = new Set([
-  "auth-self-registration", // from ./auth-email-password, auto-mounted with signup (#1521)
-  "collection-labels", // app-local (src/app/), nav labels for this app's content collections
-  "cap-overview-labels", // app-local (src/app/), labels for this app's example cap-overview caps
-  "metrics-system", // from ./metrics, companion of createMetricsFeature (platform-wide scope)
-  "locale-de", // @cosmicdrift/kumiko-locale-de, not a bundled-features export
-  "renderer-mail-html", // @cosmicdrift/kumiko-renderer-mail-html, auto-mounted with auth by composeFeatures
-  "renderer-puppeteer-client", // @cosmicdrift/kumiko-renderer-puppeteer-client, not a bundled-features export
-  "document-designer", // @cosmicdrift/kumiko-document-designer, not a bundled-features export
 ]);
 
 // Sub-paths in bundled-features's package.json exports (./tenant/seeding,
@@ -87,120 +63,60 @@ function readBundledExports(): Set<string> {
   return out;
 }
 
-function extractRegistryBlock(src: string): string {
-  // Anchor auf den FEATURE_IMPORT_REGISTRY-Object-Body. Ohne diesen Anchor
-  // würde die kind-Regex jedes `<ident>: { kind: "factory"|"named" }` im File
-  // matchen (z.B. eine künftige Hilfsvariable) → false positive/negative.
-  const startMatch = /FEATURE_IMPORT_REGISTRY[^=]*=\s*\{/.exec(src);
-  if (!startMatch) {
-    throw new Error("check-coverage: FEATURE_IMPORT_REGISTRY block not found in generate.ts");
-  }
-  const bodyStart = startMatch.index + startMatch[0].length;
-  // Top-level-Close ist das erste `};` am Zeilenanfang nach bodyStart.
-  const closeMatch = /\n};/.exec(src.slice(bodyStart));
-  if (!closeMatch) {
-    throw new Error("check-coverage: FEATURE_IMPORT_REGISTRY closing `};` not found");
-  }
-  return src.slice(bodyStart, bodyStart + closeMatch.index);
-}
-
-function readRegistryFeatures(): Set<string> {
-  const generateSrc = readFileSync(resolve(ROOT, "schema", "generate.ts"), "utf-8");
-  const registryBlock = extractRegistryBlock(generateSrc);
-  // Match object-keys mit Discriminator `kind: "factory" | "named"`.
-  // Property-Keys können quoted ("billing-foundation") oder unquoted
-  // (config, user) sein — beides ist gültig wenn kebab-segment-free.
-  const re = /(?:"([a-z][a-z0-9-]*)"|([a-z][a-z0-9]*)):\s*\{\s*kind:\s*"(factory|named)"/g;
-  const out = new Set<string>();
-  for (const m of registryBlock.matchAll(re)) {
-    const name = m[1] ?? m[2];
-    if (name) out.add(name);
-  }
-  return out;
-}
-
 const exports = readBundledExports();
-const registry = readRegistryFeatures();
-
-const unreferenced: string[] = [];
-const stale: string[] = [];
-// Held-back-Einträge, die kein bundled-Export mehr sind → stale Konfig.
-// Ohne diese Prüfung hätte der Drift-Guard in seiner eigenen Konfig einen
-// Blind-Spot: ein umbenanntes/entferntes Feature bliebe still in der Liste.
-const staleHeldBack: string[] = [];
-
-for (const name of exports) {
-  if (registry.has(name)) continue;
-  if (EXPECTED_HELD_BACK.has(name)) continue;
-  unreferenced.push(name);
-}
-
-for (const name of registry) {
-  if (!exports.has(name) && !EXPECTED_REGISTRY_ONLY.has(name)) stale.push(name);
-}
+const mounted = new Set<string>(FEATURES.map((feature) => feature.name));
 
-for (const name of EXPECTED_HELD_BACK) {
-  if (!exports.has(name)) staleHeldBack.push(name);
-}
+const unreferenced = [...exports].filter(
+  (name) => !mounted.has(name) && !EXPECTED_HELD_BACK.has(name),
+);
+// Ohne diese Prüfungen hätte der Guard in seiner eigenen Konfig einen Blind-Spot: ein
+// umbenanntes oder entferntes Feature bliebe still in der Liste, ein gemountetes ebenso.
+const staleHeldBack = [...EXPECTED_HELD_BACK].filter((name) => !exports.has(name));
+const mountedHeldBack = [...EXPECTED_HELD_BACK].filter((name) => mounted.has(name));
 
 let ok = true;
 
 if (unreferenced.length > 0) {
   console.error(
-    `\n❌ ${unreferenced.length} bundled-feature export(s) NICHT in use-all-bundled/schema/generate.ts:`,
+    `\n❌ ${unreferenced.length} bundled-feature export(s) nicht in use-all-bundled gemountet:`,
   );
   for (const name of unreferenced.sort()) {
     console.error(`   - ${name}`);
   }
   console.error(
-    "\n  Action: in src/run-config.ts + schema/generate.ts FEATURE_IMPORT_REGISTRY aufnehmen,",
-  );
-  console.error(
-    "  oder (wenn mount-options noch fehlen) zu EXPECTED_HELD_BACK in dieser Datei hinzufügen.",
+    "\n  Action: in src/run-config.ts mounten, oder (wenn mount-options noch fehlen) zu EXPECTED_HELD_BACK in dieser Datei hinzufügen.",
   );
   ok = false;
 }
 
-if (stale.length > 0) {
+if (staleHeldBack.length > 0) {
   console.error(
-    `\n❌ ${stale.length} FEATURE_IMPORT_REGISTRY entry/entries ohne Match in bundled-features exports:`,
+    `\n❌ ${staleHeldBack.length} EXPECTED_HELD_BACK entry/entries ohne Match in bundled-features exports:`,
   );
-  for (const name of stale.sort()) {
+  for (const name of staleHeldBack.sort()) {
     console.error(`   - ${name}`);
   }
   console.error(
-    "\n  Action: aus schema/generate.ts FEATURE_IMPORT_REGISTRY entfernen, ggf. App-eigenes Feature.",
+    "\n  Action: aus EXPECTED_HELD_BACK in dieser Datei entfernen (Feature wurde umbenannt/entfernt).",
   );
   ok = false;
 }
 
-if (staleHeldBack.length > 0) {
+if (mountedHeldBack.length > 0) {
   console.error(
-    `\n❌ ${staleHeldBack.length} EXPECTED_HELD_BACK entry/entries ohne Match in bundled-features exports:`,
+    `\n❌ ${mountedHeldBack.length} EXPECTED_HELD_BACK entry/entries sind gemountet (stale):`,
   );
-  for (const name of staleHeldBack.sort()) {
+  for (const name of mountedHeldBack.sort()) {
     console.error(`   - ${name}`);
   }
-  console.error(
-    "\n  Action: aus EXPECTED_HELD_BACK in dieser Datei entfernen (Feature wurde umbenannt/entfernt).",
-  );
+  console.error("\n  Action: aus EXPECTED_HELD_BACK in dieser Datei entfernen.");
   ok = false;
 }
 
-if (ok) {
-  // Disjunkte Zahlen: `mountable` = exports ohne held-back; `coveredCount`
-  // zählt nur Registry-Einträge, die ein echter mountbarer Export sind
-  // (auth-email-password steht im Registry für schema-check-Konsistenz,
-  // ist aber held-back — würde sonst die Ratio >1 verfälschen).
-  const mountable = exports.size - EXPECTED_HELD_BACK.size;
-  let coveredCount = 0;
-  for (const name of registry) {
-    if (exports.has(name) && !EXPECTED_HELD_BACK.has(name)) coveredCount++;
-  }
-  console.log(
-    `✓ Coverage: ${coveredCount}/${mountable} mountable bundled-features im Registry, ${EXPECTED_HELD_BACK.size} held-back (M0.1).`,
-  );
-  process.exit(0);
-} else {
-  process.exit(1);
-}
+if (!ok) process.exit(1);
+
+const mountable = exports.size - EXPECTED_HELD_BACK.size;
+const mountedExports = [...exports].filter((name) => mounted.has(name)).length;
+console.log(
+  `✓ Coverage: ${mountedExports}/${mountable} mountable bundled-features gemountet, ${EXPECTED_HELD_BACK.size} held-back.`,
+);

package/samples/apps/use-all-bundled/src/app/notes-feature.ts

@@ -6,7 +6,7 @@
 // proving the "extend any object" promise on real, bootable screens.
 //
 // Deliberately NOT in src/run-config.ts APP_FEATURES: that set is bundled-only
-// (schema/generate.ts FEATURE_IMPORT_REGISTRY + check-coverage gate it). Like
+// (check-coverage compares it against the bundled-features exports). Like
 // appScreensFeature, this app-owned feature is mounted only in the dev server
 // (src/app/dev-app-options.ts), where runDevApp dev-pushes its table into the ephemeral
 // DB. Nothing here ships to prod / the schema pipeline.

package/samples/apps/use-all-bundled/src/run-config.ts

@@ -442,6 +442,3 @@ export const AUTH_COMPOSE_OPTIONS = {
     tokenTtlMinutes: 60,
   },
 } as const;
-
-/** schema-check: auth-self-registration is mounted when signup is set. */
-export const HAS_SIGNUP = true;

package/samples/recipes/auth-mfa/README.md

@@ -10,7 +10,7 @@ The production wiring shape: mount `createAuthMfaFeature()` next to `createAuthE
 
 1. `createAuthMfaFeature({ setupTokenSecret, challengeTokenSecret, issuer })` builds the feature; `mfaStatusCheckerFromFeature(mfaFeature)` reads its login-status callback back off.
 2. That callback goes into `createAuthEmailPasswordFeature({ mfaStatusChecker: ... })` — `login.write.ts` calls it after the password check to decide whether to mint a JWT or a challenge.
-3. `buildServer({ auth: { mfaVerifyHandler: AuthMfaHandlers.verify } })` mounts `POST /auth/mfa/verify`, a framework route (not a dispatcher write-handler) with its own rate limiter, since it runs before a JWT exists.
+3. `buildServer({ auth: { mfaVerifyHandler: AuthMfaHandlers.verify, switchTenantMfaGateHandler: AuthHandlers.switchTenantMfaGate } })` (the gate is required with `mfaVerifyHandler`, so a tenant switch asks for the second factor too) mounts `POST /auth/mfa/verify`, a framework route (not a dispatcher write-handler) with its own rate limiter, since it runs before a JWT exists.
 4. If `sessions` is mounted too, `bindMfaRevokeAllOtherSessionsFromFeature(mfaFeature)?.(sessionCallbacks.sessionRevokeAllOthers)` wires "enable/disable/regenerate signs out every other session."
 
 ## What to copy into your app
@@ -43,6 +43,7 @@ const server = buildServer({
     membershipQuery: "tenant:query:memberships",
     loginHandler: "auth-email-password:[REDACTED:API key param]",
     mfaVerifyHandler: AuthMfaHandlers.verify,
+    switchTenantMfaGateHandler: AuthHandlers.switchTenantMfaGate,
     sessionCreator: sessionCallbacks.sessionCreator,
     sessionRevoker: sessionCallbacks.sessionRevoker,
     sessionChecker: sessionCallbacks.sessionChecker,

package/samples/recipes/auth-mfa/src/feature.ts

@@ -37,6 +37,7 @@
 //       membershipQuery: "tenant:query:memberships",
 //       loginHandler: "auth-email-password:[REDACTED:API key param]",
 //       mfaVerifyHandler: AuthMfaHandlers.verify,
+//       switchTenantMfaGateHandler: AuthHandlers.switchTenantMfaGate,
 //       sessionCreator: sessionCallbacks.sessionCreator,
 //       sessionRevoker: sessionCallbacks.sessionRevoker,
 //       sessionChecker: sessionCallbacks.sessionChecker,

package/samples/recipes/custom-handlers/README.md

@@ -22,9 +22,10 @@ logic is yours.
 - **`skipOptimisticLock` for last-writer-wins** — `reset` deliberately
   bypasses the version check because the operation is admin-driven and
   resetting twice is semantically the same as resetting once.
-- **Custom queries** — `counter:active` filters the projection in
-  TypeScript after the executor's list returns. Useful when the filter is
-  computed (above-threshold) rather than indexed.
+- **Custom queries** — `counter:active` passes a server-side `filter`
+  (`eq`/`ne`/`lt`/`gt`/`lte`/`gte`/`in`) and `totalCount` to the executor's
+  list. Never filter a page in TypeScript: list is paginated, so rows after
+  the first page would be missed.
 - **`failNotFound` helper** — typed error response for the 404 case
   without a hand-built `KumikoError` subclass.
 

package/samples/recipes/custom-handlers/src/feature.ts

@@ -1,5 +1,5 @@
 // Custom Handlers Sample
-// Shows: writeHandler with business logic, queryHandler with custom filtering,
+// Shows: writeHandler with business logic, queryHandler with a server-side filter,
 // handler that modifies payload before DB write.
 
 import {
@@ -12,6 +12,9 @@ import {
 import { failNotFound } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 
+// detail() returns an untyped row; parse the two fields the increment needs once.
+const counterVersionRowSchema = z.object({ count: z.number(), version: z.number() });
+
 export const counterEntity = createEntity({
   table: "read_sample_counters",
   fields: {
@@ -48,13 +51,14 @@ export const counterFeature = defineFeature("counters", (r) => {
         return failNotFound("counter", event.payload.id);
       }
 
-      const newCount = (current["count"] as number) + event.payload.amount;
+      const { count, version } = counterVersionRowSchema.parse(current);
+      const newCount = count + event.payload.amount;
       // Read-modify-write on counter: use the version we just read so two
       // concurrent increments don't clobber each other's changes.
       return counterExecutor.update(
         {
           id: event.payload.id,
-          version: current["version"] as number,
+          version,
           changes: { count: newCount, lastIncrementedBy: `user:${event.user.id}` },
         },
         event.user,
@@ -80,17 +84,22 @@ export const counterFeature = defineFeature("counters", (r) => {
     { access: { roles: ["Admin"] } },
   );
 
-  // Custom query: only counters above a threshold
+  // Custom query: only counters above a threshold. list() returns one page
+  // (default 50, max 200, MAX_LIST_LIMIT), so a JS filter would miss rows after
+  // page 1; filter in the query instead. totalCount counts over the whole WHERE.
   r.queryHandler(
     "counter:active",
-    z.object({ minCount: z.number().default(1) }),
-    async (query, ctx) => {
-      const all = await counterExecutor.list({}, query.user, ctx.db);
-      return {
-        ...all,
-        rows: all.rows.filter((r) => (r["count"] as number) >= query.payload.minCount),
-      };
-    },
+    z.object({ minCount: z.number().int().default(1), cursor: z.string().optional() }),
+    async (query, ctx) =>
+      counterExecutor.list(
+        {
+          filter: { field: "count", op: "gte", value: query.payload.minCount },
+          totalCount: true,
+          cursor: query.payload.cursor,
+        },
+        query.user,
+        ctx.db,
+      ),
     {
       access: {
         openToAll: {