@cosmicdrift/kumiko-types 0.264.1 → 0.266.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.264.1",
+  "version": "0.266.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/handlers.ts

@@ -16,13 +16,17 @@ import type { TzContext } from "./tz-context";
 
 // --- Access ---
 
-export type OpenToAllDeclaration = { readonly reason: string };
+// "tenant-members": signed-in members may write personal data not bound to the caller by an owner rule.
+export type OpenToAllPersonalData = "tenant-members";
+
+export type OpenToAllDeclaration = {
+  readonly reason: string;
+  readonly personalData?: OpenToAllPersonalData;
+};
 
 export type OpenToAllAccessRule = {
   // `true` is the deprecated pre-#2855 form, kept until the call-site migration (fw#2854).
   readonly openToAll: OpenToAllDeclaration | true;
-  // Write handler intentionally accepts personal data from any authenticated caller (boot-validator gate).
-  readonly publicIntake?: true;
 };
 
 // AccessRule is DEFAULT-DENY: a handler without an access rule is not reachable.
@@ -179,6 +183,25 @@ export type AuthClaimsHookDef = {
   readonly declaredKeys?: ReadonlySet<string>;
 };
 
+// --- Active Membership ---
+
+// Not a member of the target tenant, the principal is blocked (see
+// engine/active-membership.ts's principalStatus contract), or the tenant is in teardown.
+export type ActiveMembershipRejection = "not_a_member" | "principal_blocked" | "tenant_teardown";
+
+export type ActiveMembership = {
+  readonly tenantId: TenantId;
+  // Raw membership roles — the caller runs buildSessionRoles(globalRoles,
+  // roles) itself; this building block never merges global roles in.
+  readonly roles: readonly string[];
+  readonly tenantName?: string;
+  readonly tenantKey?: string;
+};
+
+export type ActiveMembershipResult =
+  | { readonly kind: "active"; readonly membership: ActiveMembership }
+  | { readonly kind: "rejected"; readonly reason: ActiveMembershipRejection };
+
 // --- Handler Events ---
 
 export type WriteEvent<TPayload = unknown> = {
@@ -610,6 +633,13 @@ export type HandlerContext<TMap extends object = KumikoEventTypeMap> = SharedCon
   // before the JWT is signed. Thin pass-through to dispatcher.resolveAuthClaims
   // so there's a single resolve impl — both entry-points can't drift.
   readonly resolveAuthClaims: (user: SessionUser) => Promise<Record<string, unknown>>;
+
+  // Membership check for interactive sign-in paths (login, MFA completion,
+  // tenant switch). Thin pass-through to dispatcher.resolveActiveMembership so there's a single resolve impl.
+  readonly resolveActiveMembership: (
+    userId: string,
+    tenantId: TenantId,
+  ) => Promise<ActiveMembershipResult>;
 };
 
 // Job execution: db + registry + systemUser + logging guaranteed, plus a