@cosmicdrift/kumiko-bundled-features 0.157.0 → 0.157.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.157.0",
+  "version": "0.157.2",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -116,11 +116,11 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.157.0",
-    "@cosmicdrift/kumiko-framework": "0.157.0",
-    "@cosmicdrift/kumiko-headless": "0.157.0",
-    "@cosmicdrift/kumiko-renderer": "0.157.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.157.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.157.2",
+    "@cosmicdrift/kumiko-framework": "0.157.2",
+    "@cosmicdrift/kumiko-headless": "0.157.2",
+    "@cosmicdrift/kumiko-renderer": "0.157.2",
+    "@cosmicdrift/kumiko-renderer-web": "0.157.2",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/auth-mfa/__tests__/errors-i18n-parity.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import {
+  invalidChallengeToken,
+  invalidRecoveryCode,
+  invalidSetupToken,
+  invalidTotpCode,
+  mfaAlreadyEnabled,
+  mfaNotEnabled,
+  tooManyAttempts,
+} from "../errors";
+import { defaultTranslations } from "../web/i18n";
+
+const failures = {
+  mfaAlreadyEnabled: mfaAlreadyEnabled(),
+  mfaNotEnabled: mfaNotEnabled(),
+  invalidSetupToken: invalidSetupToken(),
+  invalidTotpCode: invalidTotpCode(),
+  invalidRecoveryCode: invalidRecoveryCode(),
+  invalidChallengeToken: invalidChallengeToken(),
+  tooManyAttempts: tooManyAttempts(30),
+};
+
+describe("auth-mfa errors.ts i18nKey / client-bundle parity", () => {
+  for (const [name, failure] of Object.entries(failures)) {
+    test(`${name}'s i18nKey is registered in en/de translations`, () => {
+      const key = failure.error.i18nKey;
+      expect(defaultTranslations["en"]?.[key]).toBeDefined();
+      expect(defaultTranslations["de"]?.[key]).toBeDefined();
+    });
+  }
+});

package/src/auth-mfa/constants.ts

@@ -19,10 +19,9 @@ export const AuthMfaQueries = {
   status: "auth-mfa:query:user-mfa:status",
 } as const;
 
-// Write-failure codes shared between errors.ts (server, mints them into
-// UnprocessableError) and web/mfa-error-keys.ts (client, maps them to i18n
-// keys) — one source so a renamed code can't drift out of sync between the
-// two switches.
+// Write-failure codes minted server-side into UnprocessableError (errors.ts).
+// The client reads the i18n key straight off the write result
+// (res.error.i18nKey) instead of re-deriving it from these codes.
 export const AuthMfaErrorCodes = {
   mfaAlreadyEnabled: "mfa_already_enabled",
   mfaNotEnabled: "mfa_not_enabled",
@@ -31,10 +30,6 @@ export const AuthMfaErrorCodes = {
   invalidRecoveryCode: "invalid_recovery_code",
   invalidChallengeToken: "invalid_challenge_token",
   tooManyAttempts: "too_many_attempts",
-  // Client-only: minted by mfa-enable-screen.tsx on a network/QR-render
-  // failure during enrollment, never by errors.ts server-side — kept here
-  // anyway so mfa-error-keys.ts's key-parity test covers it automatically.
-  setupFailed: "setup_failed",
 } as const;
 
 export const MFA_SETUP_TOKEN_TTL_MINUTES = 10;

package/src/auth-mfa/errors.ts

@@ -10,7 +10,7 @@ export { AuthMfaErrorCodes as AuthMfaErrors } from "./constants";
 export function mfaAlreadyEnabled(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.mfaAlreadyEnabled, {
-      i18nKey: "authMfa.errors.mfaAlreadyEnabled",
+      i18nKey: "auth.mfa.errors.mfaAlreadyEnabled",
     }),
   );
 }
@@ -18,7 +18,7 @@ export function mfaAlreadyEnabled(): WriteFailure {
 export function mfaNotEnabled(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.mfaNotEnabled, {
-      i18nKey: "authMfa.errors.mfaNotEnabled",
+      i18nKey: "auth.mfa.errors.mfaNotEnabled",
     }),
   );
 }
@@ -26,7 +26,7 @@ export function mfaNotEnabled(): WriteFailure {
 export function invalidSetupToken(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidSetupToken, {
-      i18nKey: "authMfa.errors.invalidSetupToken",
+      i18nKey: "auth.mfa.errors.invalidSetupToken",
     }),
   );
 }
@@ -34,7 +34,7 @@ export function invalidSetupToken(): WriteFailure {
 export function invalidTotpCode(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidTotpCode, {
-      i18nKey: "authMfa.errors.invalidTotpCode",
+      i18nKey: "auth.mfa.errors.invalidTotpCode",
     }),
   );
 }
@@ -42,7 +42,7 @@ export function invalidTotpCode(): WriteFailure {
 export function invalidRecoveryCode(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidRecoveryCode, {
-      i18nKey: "authMfa.errors.invalidRecoveryCode",
+      i18nKey: "auth.mfa.errors.invalidRecoveryCode",
     }),
   );
 }
@@ -50,7 +50,7 @@ export function invalidRecoveryCode(): WriteFailure {
 export function invalidChallengeToken(): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.invalidChallengeToken, {
-      i18nKey: "authMfa.errors.invalidChallengeToken",
+      i18nKey: "auth.mfa.errors.invalidChallengeToken",
     }),
   );
 }
@@ -59,7 +59,7 @@ export function invalidChallengeToken(): WriteFailure {
 export function tooManyAttempts(retryAfterSeconds: number): WriteFailure {
   return writeFailure(
     new UnprocessableError(AuthMfaErrorCodes.tooManyAttempts, {
-      i18nKey: "authMfa.errors.tooManyAttempts",
+      i18nKey: "auth.mfa.errors.tooManyAttempts",
       details: { retryAfterSeconds },
     }),
   );

package/src/auth-mfa/web/i18n.ts

@@ -15,6 +15,9 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.verify.submitting": "…",
     "auth.mfa.verify.backToLogin": "Zurück zum Login",
     "auth.mfa.errors.invalidCode": "Ungültiger Code. Bitte erneut versuchen.",
+    "auth.mfa.errors.invalidTotpCode": "Ungültiger Code. Bitte erneut versuchen.",
+    "auth.mfa.errors.invalidChallengeToken":
+      "Die Anmeldung ist abgelaufen. Bitte erneut einloggen.",
     "auth.mfa.errors.challengeExpired": "Die Anmeldung ist abgelaufen. Bitte erneut einloggen.",
     "auth.mfa.errors.tooManyAttempts": "Zu viele Fehlversuche. Bitte erneut einloggen.",
     "auth.mfa.errors.verifyFailed": "Bestätigung fehlgeschlagen.",
@@ -66,6 +69,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.mfa.verify.submitting": "…",
     "auth.mfa.verify.backToLogin": "Back to login",
     "auth.mfa.errors.invalidCode": "Invalid code. Please try again.",
+    "auth.mfa.errors.invalidTotpCode": "Invalid code. Please try again.",
+    "auth.mfa.errors.invalidChallengeToken": "Your sign-in has expired. Please sign in again.",
     "auth.mfa.errors.challengeExpired": "Your sign-in has expired. Please sign in again.",
     "auth.mfa.errors.tooManyAttempts": "Too many failed attempts. Please sign in again.",
     "auth.mfa.errors.verifyFailed": "Verification failed.",

package/src/auth-mfa/web/index.ts

@@ -13,7 +13,6 @@ export type { MfaDisableDialogProps } from "./mfa-disable-dialog";
 export { MfaDisableDialog } from "./mfa-disable-dialog";
 export type { MfaEnableScreenProps } from "./mfa-enable-screen";
 export { MfaEnableScreen } from "./mfa-enable-screen";
-export { mfaManageErrorKey } from "./mfa-error-keys";
 export type { MfaRecoveryCodesRevealProps } from "./mfa-recovery-codes-reveal";
 export { MfaRecoveryCodesReveal } from "./mfa-recovery-codes-reveal";
 export type { MfaRegenerateRecoveryDialogProps } from "./mfa-regenerate-recovery-dialog";

package/src/auth-mfa/web/mfa-disable-dialog.tsx

@@ -13,7 +13,6 @@
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { AuthMfaHandlers } from "../constants";
-import { mfaManageErrorKey } from "./mfa-error-keys";
 
 export type MfaDisableDialogProps = {
   readonly open: boolean;
@@ -37,7 +36,7 @@ export function MfaDisableDialog({
     const res = await dispatcher.write<{ disabled: boolean }>(AuthMfaHandlers.disable, { code });
     setCode("");
     if (!res.isSuccess) {
-      onError(mfaManageErrorKey(res.error.code));
+      onError(res.error.i18nKey);
       return;
     }
     onDisabled();

package/src/auth-mfa/web/mfa-enable-screen.tsx

@@ -21,7 +21,6 @@ import { type ReactNode, useState } from "react";
 // kumiko-lint-ignore cross-feature-import client-only hook, the feature's server barrel has no web/ re-export
 import { useSession } from "../../auth-email-password/web";
 import { AuthMfaHandlers } from "../constants";
-import { mfaManageErrorKey } from "./mfa-error-keys";
 
 type EnableStartResponse = {
   readonly setupToken: string;
@@ -77,7 +76,7 @@ export function MfaEnableScreen({
         accountLabel: session.user?.email ?? "",
       });
       if (!res.isSuccess) {
-        setError(res.error.code);
+        setError(res.error.i18nKey);
         return;
       }
       // errorCorrectionLevel "H" (~30% redundancy) — more resilient to
@@ -96,7 +95,7 @@ export function MfaEnableScreen({
       setAcknowledged(false);
       setCode("");
     } catch {
-      setError("setup_failed");
+      setError("auth.mfa.errors.setupFailed");
     } finally {
       setBusy(false);
     }
@@ -112,14 +111,14 @@ export function MfaEnableScreen({
         code,
       });
       if (!res.isSuccess) {
-        setError(res.error.code);
+        setError(res.error.i18nKey);
         return;
       }
       setEnabled(true);
       setSetup(null);
       onEnabled?.();
     } catch {
-      setError("setup_failed");
+      setError("auth.mfa.errors.setupFailed");
     } finally {
       setBusy(false);
     }
@@ -130,7 +129,7 @@ export function MfaEnableScreen({
       <Heading>{t("auth.mfa.enable.title")}</Heading>
 
       {enabled && <Banner variant="info">{t("auth.mfa.enable.success")}</Banner>}
-      {error !== null && <Banner variant="error">{t(mfaManageErrorKey(error))}</Banner>}
+      {error !== null && <Banner variant="error">{t(error)}</Banner>}
 
       {!setup && !enabled && (
         <Section

package/src/auth-mfa/web/mfa-regenerate-recovery-dialog.tsx

@@ -10,7 +10,6 @@
 import { useDispatcher, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { type ReactNode, useState } from "react";
 import { AuthMfaHandlers } from "../constants";
-import { mfaManageErrorKey } from "./mfa-error-keys";
 
 export type MfaRegenerateRecoveryDialogProps = {
   readonly open: boolean;
@@ -37,7 +36,7 @@ export function MfaRegenerateRecoveryDialog({
     );
     setCode("");
     if (!res.isSuccess) {
-      onError(mfaManageErrorKey(res.error.code));
+      onError(res.error.i18nKey);
       return;
     }
     onRegenerated(res.data.recoveryCodes);

package/src/config/__tests__/reencrypt-job-concurrent-write-race.integration.test.ts

@@ -0,0 +1,217 @@
+// Regression guard for kumiko-framework#1188: proves a write interleaved
+// with a running rotation survives — the event-store executor's optimistic
+// concurrency check rejects the rotation job's stale-version update, so the
+// version_conflict branch in reencrypt.job.ts's migrateRow (currently just
+// "a concurrent config:set beat us; the row now holds a fresh envelope —
+// already fine.") is verified, not just an unverified comment. Modeled on
+// reencrypt-job-kek-rotation.integration.test.ts (kumiko-framework#1187)
+// for the stack/rotation setup.
+//
+// The race is simulated deterministically: the job context's
+// configEncryption.encrypt is wrapped so the FIRST call (which migrateRow
+// makes right before its own executor.update) performs a second, unrelated
+// write to the same row first. That write lands on the row version the job
+// captured at batch-read time, so the job's own update — issued a moment
+// later with that now-stale version — is guaranteed to hit version_conflict.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { randomBytes } from "node:crypto";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  access,
+  createSystemConfig,
+  createSystemUser,
+  defineFeature,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  createEnvelopeCipher,
+  createEnvMasterKeyProvider,
+  type EnvelopeCipher,
+} from "@cosmicdrift/kumiko-framework/secrets";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createMutableMasterKeyProvider } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../feature";
+import { reencryptJob } from "../handlers/reencrypt.job";
+import { createConfigResolver } from "../resolver";
+import { configValueEntity, configValuesTable } from "../table";
+
+const KEY = "kek-rot-race:config:race-pass";
+const ORIGINAL_PLAINTEXT = "pre-race-value";
+const CONCURRENT_PLAINTEXT = "concurrent-write-value";
+const PROJECTION_NAME = "config:projection:config-value-entity";
+
+const v1Key = randomBytes(32).toString("base64");
+const v2Key = randomBytes(32).toString("base64");
+const mutableProvider = createMutableMasterKeyProvider(
+  createEnvMasterKeyProvider({
+    env: {
+      KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+      KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "1",
+    },
+  }),
+);
+const cipher = createEnvelopeCipher(mutableProvider, {});
+const resolver = createConfigResolver({ cipher });
+
+const keyDef = createSystemConfig("text", {
+  encrypted: true,
+  read: access.systemAdmin,
+  write: access.systemAdmin,
+});
+
+const rotFeature = defineFeature("kek-rot-race", (r) => {
+  r.requires("config");
+  r.config({ keys: { "race-pass": keyDef } });
+});
+
+const executor = createEventStoreExecutor(configValuesTable, configValueEntity, {
+  entityName: "config-value",
+});
+
+let stack: TestStack;
+
+type ConfigRow = {
+  id: string;
+  key: string;
+  value: string | null;
+  tenantId: string;
+  version: number;
+};
+
+async function readRow(): Promise<ConfigRow> {
+  const rows = await selectMany<ConfigRow>(stack.db, configValuesTable, { key: KEY });
+  const row = rows[0];
+  if (!row) throw new Error("no config row");
+  return row;
+}
+
+async function seedV1Row(): Promise<void> {
+  const envelope = await cipher.encrypt(JSON.stringify(ORIGINAL_PLAINTEXT), {
+    tenantId: SYSTEM_TENANT_ID,
+  });
+  const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+  const tdb = createTenantDb(stack.db, SYSTEM_TENANT_ID, "system");
+  const result = await executor.create(
+    { key: KEY, value: envelope, tenantId: SYSTEM_TENANT_ID, userId: null },
+    systemUser,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`seed failed: ${result.error.code}`);
+}
+
+// Writes CONCURRENT_PLAINTEXT to the row using the version the rotation job
+// itself captured at batch-read time — the same version-N -> N+1 bump a
+// real interleaved handler write would cause.
+async function writeConcurrently(atVersion: number): Promise<void> {
+  const envelope = await cipher.encrypt(JSON.stringify(CONCURRENT_PLAINTEXT), {
+    tenantId: SYSTEM_TENANT_ID,
+  });
+  const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+  const tdb = createTenantDb(stack.db, SYSTEM_TENANT_ID, "system");
+  const row = await readRow();
+  const result = await executor.update(
+    { id: row.id, version: atVersion, changes: { value: envelope } },
+    systemUser,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`concurrent write setup failed: ${result.error.code}`);
+}
+
+const noopLog = {
+  info: () => {},
+  warn: () => {},
+  error: () => {},
+  debug: () => {},
+  child: () => noopLog,
+};
+
+// Fires the concurrent write on the first encrypt() call the job makes —
+// that's the point in migrateRow right after decrypt, right before its own
+// executor.update, so the job's captured row.version is guaranteed stale by
+// the time it issues that update.
+function racyJobCtx(rowVersionAtBatchRead: number): Parameters<typeof reencryptJob>[1] {
+  let fired = false;
+  const racyCipher: EnvelopeCipher = {
+    decrypt: (stored, scope) => cipher.decrypt(stored, scope),
+    encrypt: async (plaintext, scope) => {
+      if (!fired) {
+        fired = true;
+        await writeConcurrently(rowVersionAtBatchRead);
+      }
+      return cipher.encrypt(plaintext, scope);
+    },
+  };
+  return {
+    db: stack.db,
+    registry: stack.registry,
+    masterKeyProvider: mutableProvider,
+    configEncryption: racyCipher,
+    log: noopLog,
+  } as unknown as Parameters<typeof reencryptJob>[1]; // @cast-boundary test-seam — job only reads db/registry/masterKeyProvider/configEncryption/log
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), rotFeature],
+    masterKeyProvider: mutableProvider,
+    extraContext: { configResolver: resolver, configEncryption: cipher },
+  });
+  await unsafePushTables(stack.db, { configValuesTable });
+  await seedV1Row();
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("config KEK-rotation job — concurrent write race (kumiko-framework#1188)", () => {
+  test("a write interleaved with a running rotation wins — rotation's stale update is rejected, not silently applied", async () => {
+    const seeded = await readRow();
+    expect(JSON.parse(seeded.value as string).kekVersion).toBe(1);
+
+    // "ops flips CURRENT=2 mid-flight" — same rotation trigger as #1187's test.
+    mutableProvider.replace(
+      createEnvMasterKeyProvider({
+        env: {
+          KUMIKO_SECRETS_MASTER_KEY_V1: v1Key,
+          KUMIKO_SECRETS_MASTER_KEY_V2: v2Key,
+          KUMIKO_SECRETS_MASTER_KEY_CURRENT_VERSION: "2",
+        },
+      }),
+    );
+
+    await reencryptJob({}, racyJobCtx(seeded.version));
+
+    // The concurrent write already lands under the current key — its
+    // envelope must survive untouched; the rotation job's own update lost
+    // the version_conflict race and must not have overwritten it.
+    const afterJobRow = await readRow();
+    expect(JSON.parse(afterJobRow.value as string).kekVersion).toBe(2);
+    expect(await resolver.get(KEY, keyDef, SYSTEM_TENANT_ID, "u1", stack.db)).toBe(
+      CONCURRENT_PLAINTEXT,
+    );
+
+    // Rebuild guard: a from-scratch replay must land on the concurrent
+    // write's event, not resurrect the rotation job's rejected update (it
+    // never became an event) nor the original pre-race value.
+    expect(stack.registry.getAllProjections().has(PROJECTION_NAME)).toBe(true);
+    const rebuildResult = await rebuildProjection(PROJECTION_NAME, {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(rebuildResult.eventsProcessed).toBeGreaterThan(0);
+
+    const afterRebuildRow = await readRow();
+    expect(JSON.parse(afterRebuildRow.value as string).kekVersion).toBe(2);
+    expect(await resolver.get(KEY, keyDef, SYSTEM_TENANT_ID, "u1", stack.db)).toBe(
+      CONCURRENT_PLAINTEXT,
+    );
+  });
+});

package/src/folders/web/__tests__/folder-manager.test.tsx

@@ -149,6 +149,22 @@ describe("FolderManager filing mode", () => {
     );
   });
 
+  test("deleting a folder in filing mode refetches AND tells the host to reassign", async () => {
+    folderRows = [{ id: "f1", name: "A", parentId: null, version: 1 }];
+    const onReassigned = mock(() => {});
+    render(
+      <Wrapper>
+        <FolderManager filing={filingWith(onReassigned)} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("folder-delete-f1"));
+    fireEvent.click(await screen.findByTestId("folder-manager-delete-dialog-confirm"));
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(FoldersHandlers.deleteFolder, { id: "f1" }),
+    );
+    await waitFor(() => expect(onReassigned).toHaveBeenCalled());
+  });
+
   test("the in-tree new-folder row opens a draft; submitting (Enter) creates a root folder", async () => {
     folderRows = [];
     render(

package/src/folders/web/folder-manager.tsx

@@ -181,6 +181,7 @@ export function FolderManager({
       if (await write()) {
         setPending(null);
         await catalog.refetch();
+        await filing?.onReassigned();
       }
     } finally {
       setBusy(false);

package/src/tenant/handlers/invitations.query.ts

@@ -22,13 +22,22 @@ export const invitationsQuery = defineQueryHandler({
       tenantId: query.user.tenantId,
       status: INVITATION_STATUS.pending,
     });
-    return Promise.all(
-      (rows ?? []).map(async (row) => {
-        const email = row["email"];
-        return typeof email === "string"
-          ? { ...row, email: await decryptStoredPii(email, "tenant:invitations") }
-          : row;
-      }),
-    );
+    // Sequential, not Promise.all: each decrypt hits the KMS adapter's own
+    // small dedicated pool (PgKmsAdapter default max: 4) — firing 2 calls
+    // per row concurrently for every row exhausts it once invitation counts
+    // exceed a handful, surfacing as "the connection was closed".
+    const out: Record<string, unknown>[] = [];
+    for (const row of rows ?? []) {
+      const email = row["email"];
+      const invitedBy = row["invitedBy"];
+      const decryptedEmail =
+        typeof email === "string" ? await decryptStoredPii(email, "tenant:invitations") : email;
+      const decryptedInvitedBy =
+        typeof invitedBy === "string"
+          ? await decryptStoredPii(invitedBy, "tenant:invitations")
+          : invitedBy;
+      out.push({ ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy });
+    }
+    return out;
   },
 });

package/src/tenant/handlers/members.query.ts

@@ -2,6 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { userTable } from "../../user";
 import { tenantMembershipsTable } from "../membership-table";
 
@@ -21,14 +22,33 @@ export const membersQuery = defineQueryHandler({
       userIds.length > 0 ? await selectMany<UserRow>(ctx.db, userTable, { id: userIds }) : [];
     const userById = new Map(users.map((u) => [String(u.id), u]));
 
+    // Sequential, not Promise.all: each decrypt hits the KMS adapter's own
+    // small dedicated pool (PgKmsAdapter default max: 4) — firing 2 calls
+    // per row concurrently for every row exhausts it once membership counts
+    // exceed a handful, surfacing as "the connection was closed".
+    const decryptedByUserId = new Map<
+      string,
+      { email: string | null; displayName: string | null }
+    >();
+    for (const user of users) {
+      const email =
+        typeof user.email === "string"
+          ? await decryptStoredPii(user.email, "tenant:members")
+          : null;
+      const displayName =
+        typeof user.displayName === "string"
+          ? await decryptStoredPii(user.displayName, "tenant:members")
+          : null;
+      decryptedByUserId.set(String(user.id), { email, displayName });
+    }
+
     return rows.map((row) => {
       const user = userById.get(String(row["userId"]));
-      const email = typeof user?.email === "string" ? user.email : null;
-      const displayName = typeof user?.displayName === "string" ? user.displayName : null;
+      const decrypted = user ? decryptedByUserId.get(String(user.id)) : undefined;
       return {
         ...row,
-        email,
-        displayName,
+        email: decrypted?.email ?? null,
+        displayName: decrypted?.displayName ?? null,
         roles: parseRoles(row["roles"]),
       };
     });

package/src/auth-mfa/web/__tests__/mfa-error-keys.test.ts

@@ -1,20 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { AuthMfaErrorCodes } from "../../constants";
-import { defaultTranslations } from "../i18n";
-import { mfaManageErrorKey } from "../mfa-error-keys";
-
-describe("mfaManageErrorKey", () => {
-  for (const code of Object.values(AuthMfaErrorCodes)) {
-    test(`${code} maps to a key registered in en/de translations`, () => {
-      const key = mfaManageErrorKey(code);
-      expect(defaultTranslations["en"]?.[key]).toBeDefined();
-      expect(defaultTranslations["de"]?.[key]).toBeDefined();
-    });
-  }
-
-  test("unknown code falls back to the generic verifyFailed key", () => {
-    const key = mfaManageErrorKey("some_future_server_code");
-    expect(key).toBe("auth.mfa.errors.verifyFailed");
-    expect(defaultTranslations["en"]?.[key]).toBeDefined();
-  });
-});

package/src/auth-mfa/web/mfa-error-keys.ts

@@ -1,29 +0,0 @@
-// @runtime client
-// Shared error-code → i18n-key mapping for the account-management write
-// handlers (enable-confirm/disable/regenerate-recovery) — distinct from
-// mfa-verify-screen.tsx's own mapper, which covers the login-challenge
-// error surface (challenge_expired/rate_limited) that these handlers never
-// return. Centralized so enable/disable/regenerate stay in sync instead of
-// each re-deriving the key ad hoc (enable-screen used to template-string
-// the raw snake_case code straight into the key, which never matched the
-// camelCase keys actually registered below).
-import { AuthMfaErrorCodes } from "../constants";
-
-export function mfaManageErrorKey(code: string): string {
-  switch (code) {
-    case AuthMfaErrorCodes.invalidTotpCode:
-      return "auth.mfa.errors.invalidCode";
-    case AuthMfaErrorCodes.invalidRecoveryCode:
-      return "auth.mfa.errors.invalidRecoveryCode";
-    case AuthMfaErrorCodes.mfaAlreadyEnabled:
-      return "auth.mfa.errors.mfaAlreadyEnabled";
-    case AuthMfaErrorCodes.mfaNotEnabled:
-      return "auth.mfa.errors.mfaNotEnabled";
-    case AuthMfaErrorCodes.invalidSetupToken:
-      return "auth.mfa.errors.invalidSetupToken";
-    case AuthMfaErrorCodes.setupFailed:
-      return "auth.mfa.errors.setupFailed";
-    default:
-      return "auth.mfa.errors.verifyFailed";
-  }
-}