create-kumiko-app 0.406.0 → 0.409.0

package/feature-manifest.json

@@ -1,6 +1,6 @@
 {
   "source": "samples/apps/use-all-bundled APP_FEATURES (composeFeatures includeBundled + signup)",
-  "featureCount": 90,
+  "featureCount": 92,
   "features": [
     {
       "name": "account-security",
@@ -694,6 +694,94 @@
         "recommended": true
       }
     },
+    {
+      "name": "contact",
+      "description": "Contact inbox: an anonymous browser client (GET /contact/client.js) submits questions, contact requests, bug reports and wishes behind a honeypot, a minimum submit time and a single-use proof-of-work challenge; signed-in users file reports from the admin. Every request is stored platform-wide and every SystemAdmin is notified by mail, optionally also in a Telegram chat (option `telegram`, off by default); the notification names only the kind, the app and a link, never name, address, phone, subject or message, because mail and Telegram cannot be shredded. SystemAdmins reply by mail (Reply-To set, attachments, quoting the original) and mark requests done; a website sender gets a fixed acknowledgement, a signed-in reporter a copy and an in-app note. Personal data is crypto-shredding-ready and the EXT_USER_DATA hooks export and erase a user's requests.",
+      "toggleableDefault": null,
+      "adoptsBundledLists": true,
+      "requires": [
+        "config",
+        "delivery",
+        "user-data-rights",
+        "files",
+        "notes-history",
+        "channel-telegram"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [
+        {
+          "extensionName": "userData",
+          "entityName": "contact-request"
+        },
+        {
+          "extensionName": "userData",
+          "entityName": "contact-reply"
+        }
+      ],
+      "configKeys": [
+        {
+          "key": "reply-to",
+          "qualifiedName": "contact:config:reply-to",
+          "type": "text",
+          "scope": "system",
+          "default": "",
+          "encrypted": false,
+          "computed": false,
+          "validated": false,
+          "options": null,
+          "bounds": null,
+          "pattern": {
+            "regex": "^$|^[^\\s@<>]{1,64}@[^\\s@<>]{1,200}\\.[^\\s@<>]{2,24}$"
+          },
+          "writeRoles": [
+            "SystemAdmin"
+          ],
+          "readRoles": [
+            "SystemAdmin"
+          ]
+        },
+        {
+          "key": "telegram-chat",
+          "qualifiedName": "contact:config:telegram-chat",
+          "type": "text",
+          "scope": "system",
+          "default": "",
+          "encrypted": false,
+          "computed": false,
+          "validated": false,
+          "options": null,
+          "bounds": null,
+          "pattern": {
+            "regex": "^$|^(-?[0-9]{1,20}|@[A-Za-z0-9_]{5,32})$"
+          },
+          "writeRoles": [
+            "SystemAdmin"
+          ],
+          "readRoles": [
+            "SystemAdmin"
+          ]
+        }
+      ],
+      "secrets": [],
+      "writeHandlers": [
+        "contact:write:forward-request",
+        "contact:write:mark-done",
+        "contact:write:notify-reporter-in-app",
+        "contact:write:reply",
+        "contact:write:report",
+        "contact:write:send-reply-mail",
+        "contact:write:send-test",
+        "contact:write:submit"
+      ],
+      "uiHints": {
+        "displayLabel": "Contact",
+        "category": "communication",
+        "recommended": false
+      }
+    },
     {
       "name": "crypto-shredding",
       "description": "Operator-level crypto-shredding trigger. `forget-subject` erases a user or tenant subject key in the configured KMS adapter, making every PII field encrypted under it permanently unreadable (reads render the `[[erased]]` sentinel), and appends a `subject-forgotten` audit event. Requires a KMS adapter (`runProdApp({ kms })`). The automated Art.-17 deletion pipeline in `user-data-rights` erases keys itself; this command covers manual forgets (authority requests, operator recovery, tenant destroy).",
@@ -3164,6 +3252,37 @@
         "recommended": false
       }
     },
+    {
+      "name": "tenant-inactivity",
+      "description": "Deletes abandoned free accounts: warns the tenant owners before the deadline, then files the regular tenant-lifecycle deletion request. Activity or the keep-account link restarts the period; tiers without a rule are exempt.",
+      "toggleableDefault": null,
+      "requires": [
+        "sessions",
+        "tenant",
+        "tenant-lifecycle",
+        "delivery"
+      ],
+      "optionalRequires": [],
+      "configReads": [],
+      "exposesApis": [],
+      "usesApis": [],
+      "extensionsUsed": [
+        {
+          "extensionName": "tenantData",
+          "entityName": "tenant-inactivity-state"
+        }
+      ],
+      "configKeys": [],
+      "secrets": [],
+      "writeHandlers": [
+        "tenant-inactivity:write:keep-account"
+      ],
+      "uiHints": {
+        "displayLabel": "Tenant Inactivity · Deletion",
+        "category": "compliance",
+        "recommended": false
+      }
+    },
     {
       "name": "tenant-lifecycle",
       "description": "Tenant-destroy lifecycle: request/cancel destruction with compliance-profile grace, auth 410 gate for teardown states, cron trigger after grace, and staged destroy runner (extension fan-out, subject-key erase, tenant tombstone).",
@@ -3173,7 +3292,8 @@
         "compliance-profiles"
       ],
       "optionalRequires": [
-        "sessions"
+        "sessions",
+        "data-retention"
       ],
       "configReads": [],
       "exposesApis": [
@@ -3183,6 +3303,18 @@
         "compliance.forTenant"
       ],
       "extensionsUsed": [
+        {
+          "extensionName": "tenantDestructionHold",
+          "entityName": "tenant-lifecycle"
+        },
+        {
+          "extensionName": "tenantData",
+          "entityName": "tenant-compliance-profile"
+        },
+        {
+          "extensionName": "tenantData",
+          "entityName": "tenant-retention-override"
+        },
         {
           "extensionName": "tenantLifecycleStatus",
           "entityName": "tenant-lifecycle"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kumiko-app",
-  "version": "0.406.0",
+  "version": "0.409.0",
   "description": "`bun create kumiko-app <name>` — scaffold a new Kumiko app with an interactive feature picker.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -27,10 +27,10 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dev-server": "0.406.0",
-    "@cosmicdrift/kumiko-framework": "0.406.0",
-    "@cosmicdrift/kumiko-server-runtime": "0.406.0",
-    "@cosmicdrift/kumiko-testing": "0.406.0",
+    "@cosmicdrift/kumiko-dev-server": "0.409.0",
+    "@cosmicdrift/kumiko-framework": "0.409.0",
+    "@cosmicdrift/kumiko-server-runtime": "0.409.0",
+    "@cosmicdrift/kumiko-testing": "0.409.0",
     "@inquirer/core": "^10.3.2",
     "@inquirer/prompts": "^7.10.1"
   },

package/src/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.409.0",
+    "type": "improvement",
+    "title": "Feature manifest lists contact and its new options",
+    "detail": "`feature-manifest.json` describes the bundled feature `contact` with its config keys and dependencies (`config`, `delivery`, `user-data-rights`, `files`; `channel-telegram` with option `telegram`), so scaffolding and `kumiko check` know it."
+  },
   {
     "version": "0.363.0",
     "type": "improvement",