@cosmicdrift/kumiko-types 0.320.0 → 0.321.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-types",
-  "version": "0.320.0",
+  "version": "0.321.0",
   "description": "Framework-Type-Definitions für Kumiko — FeatureDefinition, BootCheck-Types und die reinen Engine-Types. Erlaubt Downstream-Konsumenten, gegen die Type-Contracts zu bauen, ohne das ganze Framework-Package zu importieren. Enthaelt keine identitaets-sensitiven Runtime-Werte mehr (Error-Klassen leben seit #1629 in kumiko-framework, Brand-Symbole nutzen Symbol.for) und ist deshalb eine plain dependency, keine peerDependency.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/src/multi-stream-apply-context-types.ts

@@ -4,6 +4,7 @@ import type { KumikoEventTypeMap } from "./event-type-map";
 import type { Registry } from "./feature";
 import type { FileContext } from "./file-handle-types";
 import type { AppendEventFn, UnsafeAppendEventFn } from "./handlers";
+import type { SecretsContext } from "./secrets-types";
 
 // Minimal, read+write surface handed to a MultiStreamProjection's apply()
 // when it needs to produce follow-up events (saga / process-manager
@@ -44,4 +45,8 @@ export type MultiStreamApplyContext<TMap extends object = KumikoEventTypeMap> =
   // Derive-on-first-use variants, mirrors AppContext.derivatives. Present
   // exactly when `files` is — same file-foundation-provider precondition.
   readonly derivatives?: DerivativesContext;
+  // Tenant-scoped secret reads for side-effect MSPs (e.g. step-dispatcher's
+  // webhook auth), audited via the read's own auditCtx. Present when the
+  // app booted with the secrets feature; undefined otherwise.
+  readonly secrets?: SecretsContext;
 };

package/src/step.ts

@@ -342,9 +342,12 @@ export type StepNamespace = {
       readonly method?: "POST" | "PUT" | "PATCH";
       readonly headers?: StepResolver<Readonly<Record<string, string>>>;
       readonly body?: StepResolver<unknown>;
+      // Name inside the tenant-owned secrets namespace
+      // `step-dispatcher:webhook-auth.<secret>` (secrets feature). Resolved
+      // per-tenant at dispatch time — never a global/env-scoped secret.
       readonly auth?:
-        | { readonly kind: "bearer"; readonly secretRef: string }
-        | { readonly kind: "header"; readonly name: string; readonly secretRef: string };
+        | { readonly kind: "bearer"; readonly secret: string }
+        | { readonly kind: "header"; readonly name: string; readonly secret: string };
       readonly mode: "deferred";
       readonly retry?: { readonly times: number; readonly backoff: "exponential" | "linear" };
     }) => StepInstance;