@cosmicdrift/kumiko-samples 0.368.0 → 0.370.0

package/packages/bundled-features/src/user-data-rights/run-user-export.ts

@@ -49,8 +49,8 @@ import {
   UNATTRIBUTED_ACTOR,
 } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { tenantMembershipsTable } from "../tenant/index.js";
-import { buildFileRefZipPath } from "./zip-path.js";
+import { tenantMembershipsTable } from "../tenant/index.ts";
+import { buildFileRefZipPath } from "./zip-path.ts";
 
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 

package/packages/bundled-features/src/user-data-rights/web/client-plugin.tsx

@@ -17,10 +17,10 @@
 
 import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { EXPORT_SECTION_EXTENSION_NAME, USER_DATA_RIGHTS_FEATURE } from "../constants.js";
-import { defaultTranslations } from "./i18n.js";
-import { ExportSection } from "./privacy-center-screen.js";
-import { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.js";
+import { EXPORT_SECTION_EXTENSION_NAME, USER_DATA_RIGHTS_FEATURE } from "../constants.ts";
+import { defaultTranslations } from "./i18n.ts";
+import { ExportSection } from "./privacy-center-screen.tsx";
+import { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";
 
 export type UserDataRightsClientOptions = {
   /** Key-weise Overrides über die Default-Bundles (de/en). */

package/packages/bundled-features/src/user-data-rights/web/i18n.ts

@@ -9,7 +9,7 @@ import {
   type TranslationsByLocale,
   translationsByLocaleFromKeys,
 } from "@cosmicdrift/kumiko-renderer";
-import { USER_DATA_RIGHTS_I18N } from "../i18n.js";
+import { USER_DATA_RIGHTS_I18N } from "../i18n.ts";
 
 const apexTranslations: TranslationsByLocale = {
   en: {

package/packages/bundled-features/src/user-data-rights/web/index.ts

@@ -5,11 +5,11 @@
 // Seite (defineFeature, Handler) lebt unter `.../user-data-rights` und hat
 // keine React-/DOM-Deps.
 
-export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.js";
-export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.js";
-export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
-export { defaultTranslations } from "./i18n.js";
-export { formatDate } from "./privacy-center-screen.js";
-export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.js";
-export type { RequestAccountDeletionScreenProps } from "./request-deletion-screen.js";
-export { RequestAccountDeletionScreen } from "./request-deletion-screen.js";
+export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.tsx";
+export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.tsx";
+export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+export { defaultTranslations } from "./i18n.ts";
+export { formatDate } from "./privacy-center-screen.tsx";
+export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";
+export type { RequestAccountDeletionScreenProps } from "./request-deletion-screen.tsx";
+export { RequestAccountDeletionScreen } from "./request-deletion-screen.tsx";

package/packages/bundled-features/src/user-data-rights/web/privacy-center-screen.tsx

@@ -24,7 +24,7 @@ import {
   type ExportJobStatus,
   UserDataRightsHandlers,
   UserDataRightsQueries,
-} from "../constants.js";
+} from "../constants.ts";
 
 // Export-Job läuft async (worker-Lane-Cron, ~1 Min). Solange er pending/running
 // ist, pollt der Screen den Status, damit der Download ohne manuellen Reload

package/packages/bundled-features/src/user-data-rights/web/public-deletion-gate.tsx

@@ -11,8 +11,8 @@
 // der ConfirmScreen liest das ?token aus eben dieser URL.
 
 import type { ComponentType, ReactNode } from "react";
-import { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
-import { RequestAccountDeletionScreen } from "./request-deletion-screen.js";
+import { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+import { RequestAccountDeletionScreen } from "./request-deletion-screen.tsx";
 
 export type PublicDeletionRoutes = {
   /** Login-freie Route für die Email-Antrags-Maske (z.B. "/account/delete"). */

package/packages/bundled-features/src/user-data-rights-defaults/feature.ts

@@ -3,38 +3,38 @@ import {
   EXT_USER_DATA,
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.js";
+import { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.ts";
 import {
   configValueDeleteHook,
   configValueExportHook,
-} from "./hooks/config-value.userdata-hook.js";
+} from "./hooks/config-value.userdata-hook.ts";
 import {
   deliveryAttemptDeleteHook,
   deliveryAttemptExportHook,
-} from "./hooks/delivery-attempt.userdata-hook.js";
+} from "./hooks/delivery-attempt.userdata-hook.ts";
 import {
   downloadAttemptDeleteHook,
   downloadAttemptExportHook,
-} from "./hooks/download-attempt.userdata-hook.js";
-import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook.js";
+} from "./hooks/download-attempt.userdata-hook.ts";
+import { fileRefDeleteHook, fileRefExportHook } from "./hooks/file-ref.userdata-hook.ts";
 import {
   inAppMessageDeleteHook,
   inAppMessageExportHook,
-} from "./hooks/in-app-message.userdata-hook.js";
-import { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.js";
+} from "./hooks/in-app-message.userdata-hook.ts";
+import { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.ts";
 import {
   notificationPreferenceDeleteHook,
   notificationPreferenceExportHook,
-} from "./hooks/notification-preference.userdata-hook.js";
+} from "./hooks/notification-preference.userdata-hook.ts";
 import {
   tenantInvitationDeleteHook,
   tenantInvitationExportHook,
-} from "./hooks/tenant-invitation.userdata-hook.js";
-import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook.js";
+} from "./hooks/tenant-invitation.userdata-hook.ts";
+import { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook.ts";
 import {
   userSessionDeleteHook,
   userSessionExportHook,
-} from "./hooks/user-session.userdata-hook.js";
+} from "./hooks/user-session.userdata-hook.ts";
 
 // user-data-rights-defaults — Default-Hooks für die Core-Entities
 // `user` (S2.H1) und `fileRef` (S2.H2).

package/packages/bundled-features/src/user-data-rights-defaults/hooks/api-token.userdata-hook.ts

@@ -1,6 +1,6 @@
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { apiTokenTable } from "../../personal-access-tokens/index.js";
-import { featureMounted } from "./feature-mounted.js";
+import { apiTokenTable } from "../../personal-access-tokens/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for personal-access-tokens rows. Same shape as user-session:
 // unmanaged direct-write store (no event stream, rebuild-safe DELETE), and a

package/packages/bundled-features/src/user-data-rights-defaults/hooks/config-value.userdata-hook.ts

@@ -4,9 +4,9 @@ import {
   type UserDataDeleteHook,
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { configValueEntity, configValuesTable } from "../../config/index.js";
-import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
-import { featureMounted } from "./feature-mounted.js";
+import { configValueEntity, configValuesTable } from "../../config/index.ts";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
 // scope rows carry no per-user subject and stay untouched. Event-sourced

package/packages/bundled-features/src/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.ts

@@ -6,8 +6,8 @@ import {
 import {
   DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT,
   deliveryAttemptsTable,
-} from "../../delivery/index.js";
-import { featureMounted } from "./feature-mounted.js";
+} from "../../delivery/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for delivery's attempt log (deferred from #797, closed by
 // #799). deliveryAttempt is an events-only aggregate — the export reads the

package/packages/bundled-features/src/user-data-rights-defaults/hooks/download-attempt.userdata-hook.ts

@@ -4,8 +4,8 @@ import {
   type UserDataDeleteHook,
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
-import { downloadAttemptEntity, downloadAttemptsTable } from "../../user-data-rights/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.ts";
+import { downloadAttemptEntity, downloadAttemptsTable } from "../../user-data-rights/index.ts";
 
 // Event-sourced entity: forget goes through the executor so the erasure replays
 // on rebuild and removes the projection row including ip_bidx.

package/packages/bundled-features/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -16,7 +16,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
-import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.ts";
 
 const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
 

package/packages/bundled-features/src/user-data-rights-defaults/hooks/in-app-message.userdata-hook.ts

@@ -1,6 +1,6 @@
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { inAppMessagesTable } from "../../channel-in-app/index.js";
-import { featureMounted } from "./feature-mounted.js";
+import { inAppMessagesTable } from "../../channel-in-app/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for channel-in-app's in_app_messages. Plain SQL table (no
 // r.entity, no event stream — see channel-in-app/tables.ts), written by

package/packages/bundled-features/src/user-data-rights-defaults/hooks/job-run.userdata-hook.ts

@@ -1,6 +1,6 @@
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { jobRunsTable } from "../../jobs/index.js";
-import { featureMounted } from "./feature-mounted.js";
+import { jobRunsTable } from "../../jobs/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for the jobs run log (deferred from #797, closed by #799).
 // Job runs live on the SYSTEM tenant regardless of who triggered them, so

package/packages/bundled-features/src/user-data-rights-defaults/hooks/notification-preference.userdata-hook.ts

@@ -7,9 +7,9 @@ import {
 import {
   notificationPreferenceEntity,
   notificationPreferencesTable,
-} from "../../delivery/index.js";
-import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
-import { featureMounted } from "./feature-mounted.js";
+} from "../../delivery/index.ts";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for delivery's notification-preference rows. Event-sourced
 // entity → forget goes through the executor so a rebuild replays the erasure.

package/packages/bundled-features/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -10,10 +10,10 @@ import {
   decryptStoredPii,
   mapWithConcurrency,
   throwIfErasureFailed,
-} from "../../shared/index.js";
-import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.js";
-import { userTable } from "../../user/index.js";
-import { featureMounted } from "./feature-mounted.js";
+} from "../../shared/index.ts";
+import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.ts";
+import { userTable } from "../../user/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for tenant-invitation rows. Event-sourced entity → all
 // forget writes go through the executor so a projection rebuild replays the

package/packages/bundled-features/src/user-data-rights-defaults/hooks/user-session.userdata-hook.ts

@@ -1,6 +1,6 @@
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { userSessionTable } from "../../sessions/index.js";
-import { featureMounted } from "./feature-mounted.js";
+import { userSessionTable } from "../../sessions/index.ts";
+import { featureMounted } from "./feature-mounted.ts";
 
 // userData-Hooks for the sessions feature's user-session rows (ip, userAgent).
 //

package/packages/bundled-features/src/user-data-rights-defaults/hooks/user.userdata-hook.ts

@@ -13,7 +13,7 @@ import {
   USER_STATUS,
   userEntity,
   userTable,
-} from "../../user/index.js";
+} from "../../user/index.ts";
 
 // Forget writes go through the executor (events), not a raw UPDATE: a
 // projection rebuild replays the events, so the anonymization survives it.

package/packages/bundled-features/src/user-data-rights-defaults/index.ts

@@ -1,32 +1,32 @@
-export { createUserDataRightsDefaultsFeature } from "./feature.js";
-export { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.js";
+export { createUserDataRightsDefaultsFeature } from "./feature.ts";
+export { apiTokenDeleteHook, apiTokenExportHook } from "./hooks/api-token.userdata-hook.ts";
 export {
   configValueDeleteHook,
   configValueExportHook,
-} from "./hooks/config-value.userdata-hook.js";
+} from "./hooks/config-value.userdata-hook.ts";
 export {
   deliveryAttemptDeleteHook,
   deliveryAttemptExportHook,
-} from "./hooks/delivery-attempt.userdata-hook.js";
+} from "./hooks/delivery-attempt.userdata-hook.ts";
 export {
   fileRefDeleteHook,
   fileRefExportHook,
-} from "./hooks/file-ref.userdata-hook.js";
+} from "./hooks/file-ref.userdata-hook.ts";
 export {
   inAppMessageDeleteHook,
   inAppMessageExportHook,
-} from "./hooks/in-app-message.userdata-hook.js";
-export { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.js";
+} from "./hooks/in-app-message.userdata-hook.ts";
+export { jobRunDeleteHook, jobRunExportHook } from "./hooks/job-run.userdata-hook.ts";
 export {
   notificationPreferenceDeleteHook,
   notificationPreferenceExportHook,
-} from "./hooks/notification-preference.userdata-hook.js";
+} from "./hooks/notification-preference.userdata-hook.ts";
 export {
   tenantInvitationDeleteHook,
   tenantInvitationExportHook,
-} from "./hooks/tenant-invitation.userdata-hook.js";
-export { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook.js";
+} from "./hooks/tenant-invitation.userdata-hook.ts";
+export { userDeleteHook, userExportHook } from "./hooks/user.userdata-hook.ts";
 export {
   userSessionDeleteHook,
   userSessionExportHook,
-} from "./hooks/user-session.userdata-hook.js";
+} from "./hooks/user-session.userdata-hook.ts";

package/packages/bundled-features/src/user-profile/feature.ts

@@ -9,8 +9,8 @@ import {
   PROFILE_SCREEN_ID,
   UserDataRightsHandlers,
   UserProfileQueries,
-} from "./constants.js";
-import { changeEmailWrite } from "./handlers/change-email.write.js";
+} from "./constants.ts";
+import { changeEmailWrite } from "./handlers/change-email.write.ts";
 
 export type UserProfileFeatureOptions = {
   /** Default true. false drops the change-email handler and the email

package/packages/bundled-features/src/user-profile/handlers/change-email.write.ts

@@ -5,10 +5,10 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { AuthErrors } from "../../auth-email-password/index.js";
-import { decryptStoredPii, verifyPassword } from "../../shared/index.js";
-import { UserErrors, UserHandlers, UserQueries } from "../../user/index.js";
-import { UserProfileErrors } from "../constants.js";
+import { AuthErrors } from "../../auth-email-password/index.ts";
+import { decryptStoredPii, verifyPassword } from "../../shared/index.ts";
+import { UserErrors, UserHandlers, UserQueries } from "../../user/index.ts";
+import { UserProfileErrors } from "../constants.ts";
 
 // Gleiche Failure-Shape wie auth-email-password (anti-enumeration):
 // dessen errors.ts ist nicht Teil des Feature-Barrels, der Reason-Code

package/packages/bundled-features/src/user-profile/index.ts

@@ -7,5 +7,5 @@ export {
   UserProfileErrors,
   UserProfileHandlers,
   UserProfileQueries,
-} from "./constants.js";
-export { createUserProfileFeature, type UserProfileFeatureOptions } from "./feature.js";
+} from "./constants.ts";
+export { createUserProfileFeature, type UserProfileFeatureOptions } from "./feature.ts";

package/packages/bundled-features/src/user-profile/web/client-plugin.ts

@@ -8,9 +8,9 @@ import type { ComponentType, ReactNode } from "react";
 import {
   CHANGE_EMAIL_SECTION_EXTENSION_NAME,
   CHANGE_PASSWORD_SECTION_EXTENSION_NAME,
-} from "../constants.js";
-import { defaultTranslations } from "../i18n.js";
-import { ChangeEmailSection, ChangePasswordSection } from "./profile-screen.js";
+} from "../constants.ts";
+import { defaultTranslations } from "../i18n.ts";
+import { ChangeEmailSection, ChangePasswordSection } from "./profile-screen.tsx";
 
 export type UserProfileClientOptions = {
   /** Per-key overrides on top of the default bundles (de/en). */

package/packages/bundled-features/src/user-profile/web/index.ts

@@ -2,5 +2,5 @@ export {
   type UserProfileClientFeature,
   type UserProfileClientOptions,
   userProfileClient,
-} from "./client-plugin.js";
-export { ChangeEmailSection, ChangePasswordSection } from "./profile-screen.js";
+} from "./client-plugin.ts";
+export { ChangeEmailSection, ChangePasswordSection } from "./profile-screen.tsx";

package/packages/bundled-features/src/user-profile/web/profile-screen.tsx

@@ -15,9 +15,9 @@ import {
 } from "@cosmicdrift/kumiko-renderer";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
 import { type ReactNode, useState } from "react";
-import { AuthHandlers } from "../../auth-email-password/constants.js";
-import { requestEmailVerification } from "../../auth-email-password/web/index.js";
-import { UserProfileHandlers } from "../constants.js";
+import { AuthHandlers } from "../../auth-email-password/constants.ts";
+import { requestEmailVerification } from "../../auth-email-password/web/index.ts";
+import { UserProfileHandlers } from "../constants.ts";
 
 type SectionStatus =
   | { kind: "idle" }

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.370.0",
+    "type": "breaking",
+    "title": "Waitlist gets linkOnSignup, a configurable submit rate limit, export and purge handlers and a status provisioned",
+    "detail": "createWaitlistFeature({ linkOnSignup: true }) marks an invited entry provisioned, with linkedTenantId and provisionedAt, when its email becomes the first TenantAdmin member of a tenant; a multi-stream consumer on the membership event does this asynchronously. rateLimit replaces the default of 5 submits per IP per 10 minutes, or { disabled: true, reason } turns it off. waitlist:write:export and waitlist:write:purge are SystemAdmin-only (exportPurge: false leaves them out); purge needs confirmCount to match the current number of entries and shreds the personal-data keys only after every entry was forgotten. The entity gains the status provisioned and the column provisionedAt, so apps that mount the feature generate a schema migration. kumiko ops waitlist-migrate --from offlot|publicstatus [--dry-run] copies a legacy waitlist table into the entity idempotently. Details in docs/guides/waitlist.md.",
+    "migration": "Apps that mount the waitlist feature run `kumiko schema generate <name>` and commit the migration: read_waitlist_entries gains the nullable column provisioned_at, and the status value provisioned is added. An app with its own waitlist (offlot-app, publicstatus, solon) mounts createWaitlistFeature() and copies the old rows with `kumiko ops waitlist-migrate --from offlot|publicstatus --dry-run` first. offlot-app keeps its legacy rows in the table read_waitlist_entries, the name the framework projection uses: copy or rename that table before the first boot and pass --source-table. The submit limit is keyed per IP and handler; behind a reverse proxy set trustedProxyHops, otherwise all visitors share one bucket of 5 submits per 10 minutes. With linkOnSignup the new consumer starts at the beginning of the event log and also provisions entries invited earlier."
+  },
   {
     "version": "0.365.0",
     "type": "improvement",

package/packages/bundled-features/src/waitlist/constants.ts

@@ -5,6 +5,7 @@ export const WAITLIST_FEATURE = "waitlist" as const;
 export const WAITLIST_STATUS = {
   Pending: "pending",
   Invited: "invited",
+  Provisioned: "provisioned",
   Rejected: "rejected",
 } as const;
 
@@ -14,6 +15,8 @@ export const WaitlistHandlers = {
   submit: "waitlist:write:submit",
   invite: "waitlist:write:invite",
   reject: "waitlist:write:reject",
+  export: "waitlist:write:export",
+  purge: "waitlist:write:purge",
 } as const;
 
 // Entity-convention list QN: entityList screens resolve their query by this shape.
@@ -24,6 +27,7 @@ export const WaitlistQueries = {
 export const WaitlistErrors = {
   notInvitable: "waitlist_not_invitable",
   notRejectable: "waitlist_not_rejectable",
+  confirmCountMismatch: "waitlist_confirm_count_mismatch",
 } as const;
 
 export const WAITLIST_NOTIFICATION_TYPES = {
@@ -42,3 +46,11 @@ export const WAITLIST_FIELD_LIMITS = {
   locale: 35,
   honeypot: 500,
 } as const;
+
+// Audit trail for the export/purge handlers: own aggregate per occurrence, payload
+// carries counts only (never addresses).
+export const WAITLIST_EXPORTED_EVENT_SHORT = "exported" as const;
+export const WAITLIST_PURGED_EVENT_SHORT = "purged" as const;
+export const WAITLIST_EXPORTED_EVENT_QN = "waitlist:event:exported" as const;
+export const WAITLIST_PURGED_EVENT_QN = "waitlist:event:purged" as const;
+export const WAITLIST_AUDIT_AGGREGATE_TYPE = "waitlist-audit" as const;

package/packages/bundled-features/src/waitlist/entity.ts

@@ -6,11 +6,12 @@ import {
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_STATUS, type WaitlistStatus } from "./constants.js";
+import { WAITLIST_STATUS, type WaitlistStatus } from "./constants.ts";
 
 const WAITLIST_STATUS_OPTIONS = [
   WAITLIST_STATUS.Pending,
   WAITLIST_STATUS.Invited,
+  WAITLIST_STATUS.Provisioned,
   WAITLIST_STATUS.Rejected,
 ] as const;
 
@@ -19,7 +20,7 @@ const OPEN_WAITLIST_STATUSES: readonly WaitlistStatus[] = [
   WAITLIST_STATUS.Invited,
 ];
 
-// Entries still awaiting a decision; rejected is terminal.
+// Entries still awaiting a decision; provisioned and rejected are terminal.
 export function isOpenWaitlistStatus(status: unknown): boolean {
   return OPEN_WAITLIST_STATUSES.some((open) => open === status);
 }
@@ -33,7 +34,7 @@ export function isOpenWaitlistStatus(status: unknown): boolean {
 export const waitlistEntryEntity = createEntity({
   table: "read_waitlist_entries",
   description:
-    "A prospect's signup on the platform waitlist, tracked through pending, invited and rejected status as admins process it; name, email and message are the entry's own personal data.",
+    "A prospect's signup on the platform waitlist, tracked through pending, invited, provisioned and rejected status as admins process it; name, email and message are the entry's own personal data.",
   systemStream: true,
   tenancy: "global",
   fields: {
@@ -68,6 +69,7 @@ export const waitlistEntryEntity = createEntity({
     }),
     invitedAt: createTimestampField(),
     invitedBy: createTextField({ personal: false, reason: "is_admin_audit_id" }),
+    provisionedAt: createTimestampField(),
     // Not named tenantId: that is the framework's physical tenant column.
     linkedTenantId: createTextField({ personal: false, reason: "is_tenant_reference" }),
   },

package/packages/bundled-features/src/waitlist/entries-admin.ts

@@ -0,0 +1,55 @@
+import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { collectErasureFailure, throwIfErasureFailed } from "../shared/index.ts";
+import { platformActor, waitlistExecutor } from "./lib.ts";
+
+const PAGE_SIZE = 200;
+const PURGE_REASON = "waitlist:purge";
+
+export type WaitlistRow = Record<string, unknown>;
+
+// Pages by offset on a stable sort; the list is small (a marketing waitlist) and
+// the callers hold the whole result anyway.
+export async function listAllWaitlistRows(db: TenantDb): Promise<readonly WaitlistRow[]> {
+  const rows: WaitlistRow[] = [];
+  for (let offset = 0; ; offset += PAGE_SIZE) {
+    const page = await waitlistExecutor.list(
+      { sort: "submittedAt", sortDirection: "asc", limit: PAGE_SIZE, offset },
+      platformActor(),
+      db,
+    );
+    rows.push(...page.rows);
+    if (page.rows.length < PAGE_SIZE) return rows;
+  }
+}
+
+// Same two-step erasure as the user-data delete hook: the executor forgets the
+// row (replays on rebuild), then the record subject key is shredded so the event
+// log's ciphertext becomes unreadable. Keys are shredded only after every forget
+// succeeded: a thrown failure rolls the handler transaction back, and a shredded
+// key cannot be restored.
+export async function purgeWaitlistRows(
+  db: TenantDb,
+  rows: readonly WaitlistRow[],
+  requestedBy: string,
+): Promise<void> {
+  const failures: string[] = [];
+  const forgottenIds: string[] = [];
+  for (const row of rows) {
+    const id = row["id"];
+    if (typeof id !== "string") continue;
+    const forgotten = await waitlistExecutor.forget({ id }, platformActor(), db);
+    collectErasureFailure(forgotten, "waitlistEntry", id, failures);
+    if (forgotten.isSuccess) forgottenIds.push(id);
+  }
+  throwIfErasureFailed(failures);
+  const kms = configuredPiiSubjectKms();
+  // skip: no PII key service configured, so there are no record keys to shred.
+  if (!kms) return;
+  for (const id of forgottenIds) {
+    await kms.eraseKey(
+      { kind: "record", entity: "waitlistEntry", id },
+      { requestId: PURGE_REASON, userId: requestedBy, eraseReason: PURGE_REASON },
+    );
+  }
+}

package/packages/bundled-features/src/waitlist/feature.ts

@@ -4,24 +4,31 @@ import {
   type FeatureDefinition,
   i18nKey,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { WAITLIST_FEATURE } from "./constants.js";
-import { waitlistEntryEntity } from "./entity.js";
-import { createInviteHandler } from "./handlers/invite.write.js";
-import { listQuery } from "./handlers/list.query.js";
-import { rejectHandler } from "./handlers/reject.write.js";
-import { createSubmitHandler } from "./handlers/submit.write.js";
-import { WAITLIST_I18N } from "./i18n.js";
-import { adminAccess } from "./lib.js";
+import {
+  WAITLIST_EXPORTED_EVENT_SHORT,
+  WAITLIST_FEATURE,
+  WAITLIST_PURGED_EVENT_SHORT,
+} from "./constants.ts";
+import { waitlistEntryEntity } from "./entity.ts";
+import { exportHandler, purgeHandler } from "./handlers/export-purge.write.ts";
+import { createInviteHandler } from "./handlers/invite.write.ts";
+import { listQuery } from "./handlers/list.query.ts";
+import { rejectHandler } from "./handlers/reject.write.ts";
+import { createSubmitHandler } from "./handlers/submit.write.ts";
+import { WAITLIST_I18N } from "./i18n.ts";
+import { adminAccess } from "./lib.ts";
+import { linkWaitlistOnSignup, WAITLIST_MEMBERSHIP_CREATED_EVENT } from "./link-on-signup.ts";
 import {
   WAITLIST_ADMIN_NOTICE_RECORD,
   WAITLIST_ADMIN_NOTICE_VARIABLES,
   WAITLIST_CONFIRMATION_VARIABLES,
   waitlistAdminNoticeTemplate,
   waitlistConfirmationTemplate,
-} from "./mail.js";
-import type { WaitlistOptions } from "./options.js";
-import { waitlistListScreen } from "./screens.js";
-import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
+} from "./mail.ts";
+import type { WaitlistOptions } from "./options.ts";
+import { WaitlistAuditEventSchema } from "./payloads.ts";
+import { waitlistListScreen } from "./screens.ts";
+import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.ts";
 
 export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefinition {
   return defineFeature(WAITLIST_FEATURE, (r) => {
@@ -49,6 +56,20 @@ export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefini
     r.writeHandler(rejectHandler);
     r.queryHandler(listQuery);
 
+    if (opts.exportPurge !== false) {
+      r.defineEvent(WAITLIST_EXPORTED_EVENT_SHORT, WaitlistAuditEventSchema, { piiFields: "none" });
+      r.defineEvent(WAITLIST_PURGED_EVENT_SHORT, WaitlistAuditEventSchema, { piiFields: "none" });
+      r.writeHandler(exportHandler);
+      r.writeHandler(purgeHandler);
+    }
+
+    if (opts.linkOnSignup === true) {
+      r.multiStreamProjection({
+        name: "link-on-signup",
+        apply: { [WAITLIST_MEMBERSHIP_CREATED_EVENT]: linkWaitlistOnSignup },
+      });
+    }
+
     r.screen(waitlistListScreen);
     r.nav({
       id: "waitlist",