@cosmicdrift/kumiko-bundled-features 0.234.0 → 0.235.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.234.0",
+  "version": "0.235.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.234.0",
-    "@cosmicdrift/kumiko-framework": "0.234.0",
-    "@cosmicdrift/kumiko-headless": "0.234.0",
-    "@cosmicdrift/kumiko-renderer": "0.234.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.234.0",
-    "@cosmicdrift/kumiko-types": "0.234.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.235.0",
+    "@cosmicdrift/kumiko-framework": "0.235.0",
+    "@cosmicdrift/kumiko-headless": "0.235.0",
+    "@cosmicdrift/kumiko-renderer": "0.235.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.235.0",
+    "@cosmicdrift/kumiko-types": "0.235.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.234.0",
-    "@cosmicdrift/kumiko-locale-es": "0.234.0"
+    "@cosmicdrift/kumiko-locale-de": "0.235.0",
+    "@cosmicdrift/kumiko-locale-es": "0.235.0"
   }
 }

package/src/auth-email-password/__tests__/auth.integration.test.ts

@@ -1,6 +1,11 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configureBlindIndexKey,
+  configurePiiSubjectKms,
+  InMemoryKmsAdapter,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createTestUser,
@@ -16,6 +21,9 @@ import {
   expectErrorIncludes,
   getSetCookieRaw,
   getSetCookieValue,
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+  updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config";
 import { createConfigResolver } from "../../config/resolver";
@@ -215,6 +223,50 @@ describe("scenario 3: login without membership", () => {
   });
 });
 
+// --- Scenario 3b: login resolves the live account when its email is shared
+// with a soft-deleted row (fw#2464 partial bidx index only covers live rows) ---
+
+describe("scenario 3b: login with an email shared by a soft-deleted row", () => {
+  // The DB-level dedup that lets a soft-deleted row and a live row share an
+  // email only exists on the blind-index column (see
+  // email-unique-blind-index.integration.test.ts) — without a configured
+  // key, email_bidx stays NULL and the plaintext-fallback unique index
+  // blocks the second create outright, never reaching the login path.
+  beforeAll(() => {
+    configurePiiSubjectKms(new InMemoryKmsAdapter());
+    configureBlindIndexKey(Buffer.alloc(32, 7).toString("base64"));
+  });
+
+  afterAll(() => {
+    resetPiiSubjectKmsForTests();
+    resetBlindIndexKeyForTests();
+  });
+
+  test("new account wins the login, not the soft-deleted original", async () => {
+    const original = await seedLoginUser({
+      email: "reused-login@example.com",
+      password: "original-password-123",
+    });
+    await updateRows(stack.db, userTable, { isDeleted: true }, { id: original.id });
+
+    const recreated = await seedLoginUser({
+      email: "reused-login@example.com",
+      password: "new-account-password-123",
+    });
+    expect(recreated.id).not.toBe(original.id);
+
+    const res = await stack.http.raw("POST", "/api/auth/login", {
+      email: "reused-login@example.com",
+      password: "new-account-password-123",
+    });
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.isSuccess).toBe(true);
+    expect(body.user.id).toBe(recreated.id);
+  });
+});
+
 // --- Scenario 4 + 5: change-password flow ---
 
 describe("scenario 4: change-password with wrong old password", () => {

package/src/auth-email-password/seeding.ts

@@ -139,11 +139,13 @@ export async function provisionSignupAccount(
   // create paths (#1478 — this was only wired for tenant before).
   hooks?: SeedTenantHooks,
 ): Promise<{ readonly userId: string; readonly tenantId: TenantId }> {
-  // Create-only-Guard VOR seedTenant: bei bereits registrierter Email hart
-  // abbrechen, sonst entstünde ein verwaister Tenant und seedUser (idempotent
-  // add-only) gäbe still die bestehende userId zurück → Confirm mintet eine
-  // Session für den fremden Account (#365).
-  const existingUser = await fetchOne(db, userTable, { email: options.email });
+  // Create-only guard BEFORE seedTenant: hard-abort on an already-registered
+  // email, otherwise an orphaned tenant would be created and seedUser
+  // (idempotent add-only) would silently return the existing userId ->
+  // confirm mints a session for the wrong account (#365).
+  // isDeleted: false — the partial bidx unique index only covers live rows,
+  // so a soft-deleted row must not block re-registering its email.
+  const existingUser = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
   if (existingUser) {
     throw new ConflictError({ message: "signup: email already registered" });
   }

package/src/config/i18n.ts

@@ -1,9 +1,4 @@
-type LocalizedString = { readonly en: string };
+import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 
 /** Server boot keys for the auto-generated Settings-Hub (mirrors web/i18n.ts). */
-export const CONFIG_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
-  "config.settings.title": { en: "Settings" },
-  "config.settings.system": { en: "Platform" },
-  "config.settings.tenant": { en: "Tenant" },
-  "config.settings.user": { en: "Personal" },
-};
+export const CONFIG_FEATURE_I18N = SETTINGS_HUB_I18N;

package/src/config/web/i18n.ts

@@ -11,6 +11,13 @@ import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
 export const defaultTranslations: TranslationsByLocale = {
   en: {
+    "config.secrets.delete": "Delete",
+    "config.secrets.notSet": "Not set",
+    "config.secrets.placeholder": "Enter a value",
+    "config.secrets.replacePlaceholder": "Enter a new value to replace",
+    "config.secrets.required": "Required",
+    "config.secrets.set": "Set",
+    "config.secrets.title": "Secrets",
     "config.settings.title": "Settings",
     "config.settings.system": "Platform",
     "config.settings.tenant": "Tenant",
@@ -18,5 +25,9 @@ export const defaultTranslations: TranslationsByLocale = {
     "config.errors.systemOnly": "This value can only be set by the system.",
     "config.errors.invalidScope": "This scope is not allowed for this key.",
     "config.errors.unknownKey": "Unknown configuration key.",
+    // Required by every generated screen (screenTitleKey, required-surface-keys.ts) —
+    // the secrets screen has a fixed id ("secrets"), so the framework ships its
+    // title translation directly instead of asking every app to declare it.
+    "screen:secrets.title": "Secrets",
   },
 };

package/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import {
@@ -55,7 +56,8 @@ export const subjectForgottenSchema = z.object({
 });
 
 export const subjectForgetDeniedSchema = z.object({
-  subjectKey: z.string().min(1),
+  subjectKeyDigest: z.string().min(1),
+  subjectKind: z.enum(["user", "tenant"]),
   reason: z.string().min(10),
   forgottenBy: z.string().min(1),
   actorTenantId: z.string().min(1),
@@ -138,13 +140,21 @@ export const forgetSubjectWrite = defineWriteHandler({
       raw,
     );
     if (tenantScopeDenial) {
-      // Denied cross-tenant probes must still leave an audit trail (fw#2348).
+      // Denied cross-tenant probes must still leave an audit trail (fw#2348),
+      // but the denial lands in the REQUESTING actor's own tenant-scoped
+      // stream — it must never materialise the foreign subject's identifiers
+      // there. A plaintext subjectKey/aggregateId would survive as a
+      // permanent record for the prober and would still be present when the
+      // owning tenant later runs its own (legitimate) forget-subject for that
+      // subject. The digest still lets an operator correlate repeated probes
+      // of the same subject without exposing it (fw#2452).
       await ctx.unsafeAppendEvent({
-        aggregateId: raw.kind === "user" ? raw.userId : raw.tenantId,
+        aggregateId: event.user.id,
         aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
         type: SUBJECT_FORGET_DENIED_EVENT_NAME,
         payload: {
-          subjectKey,
+          subjectKeyDigest: createHash("sha256").update(subjectKey, "utf8").digest("base64url"),
+          subjectKind: raw.kind,
           reason: event.payload.reason,
           forgottenBy: event.user.id,
           actorTenantId: event.user.tenantId,

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -451,10 +451,12 @@ describe("jobs:write:retry decrypts payload before dispatch (#2465)", () => {
   const RETRY_USER_ID = "u-pii-retry-1";
   const RETRY_JOB_NAME = "retryapp:job:capture-import";
   const capturedPayloads: Record<string, unknown>[] = [];
+  const capturedTriggeredBy: (string | null)[] = [];
 
   const retryAppFeature = defineFeature("retryapp", (r) => {
-    r.job("captureImport", { trigger: { manual: true } }, async (payload) => {
+    r.job("captureImport", { trigger: { manual: true } }, async (payload, ctx) => {
       capturedPayloads.push(payload);
+      capturedTriggeredBy.push(ctx.triggeredBy?.id ?? null);
     });
   });
 
@@ -476,6 +478,7 @@ describe("jobs:write:retry decrypts payload before dispatch (#2465)", () => {
 
   beforeEach(() => {
     capturedPayloads.length = 0;
+    capturedTriggeredBy.length = 0;
     retryKms = new InMemoryKmsAdapter();
     configurePiiSubjectKms(retryKms);
   });
@@ -527,6 +530,40 @@ describe("jobs:write:retry decrypts payload before dispatch (#2465)", () => {
     expect(errInfo.details).toMatchObject({ reason: "job_payload_erased" });
   });
 
+  // #2469: retry dispatched without a `meta` argument, so the retried run
+  // carried no triggeredById at all — job-run-logger's onJobStart then saw
+  // triggeredById: null, skipped encryption entirely, and the retried run's
+  // payload landed in job_runs as unshreddable plaintext. The asserted
+  // invariant is the input to that chain: the retried BullMQ job must carry
+  // the ORIGINAL run's owner, not the retrying SystemAdmin and not null.
+  // (Asserting the retried run's job_runs row directly is not possible here:
+  // this stack wires no job-run-logger into the runner, so a real dispatch
+  // writes no row — every other row in this file is seeded by calling
+  // retryLogger.onJobStart by hand.)
+  test("retry re-dispatches with the original run's triggeredById so the new run's payload stays encrypted", async () => {
+    await retryLogger.onJobStart?.(RETRY_JOB_NAME, "bull-retry-5", {
+      triggeredById: RETRY_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await retryLogger.onJobFailed?.(RETRY_JOB_NAME, "bull-retry-5", "boom", []);
+
+    const originalRow = await fetchOne(retryStack.db, jobRunsTable, { bullJobId: "bull-retry-5" });
+    expect(isPiiCiphertext(originalRow?.["payload"])).toBe(true);
+    expect(originalRow?.["triggeredById"]).toBe(RETRY_USER_ID);
+
+    await retryStack.http.writeOk<{
+      jobName: string;
+      bullJobId: string;
+      retriedFromRunId: string;
+    }>(JobHandlers.retry, { runId: originalRow?.["id"] }, TestUsers.systemAdmin);
+
+    await sleep(1000);
+
+    expect(capturedTriggeredBy).toEqual([RETRY_USER_ID]);
+    expect(capturedTriggeredBy[0]).not.toBe(TestUsers.systemAdmin.id);
+    expect(capturedPayloads).toEqual([JSON.parse(SECRET_PAYLOAD)]);
+  });
+
   // The other producer of PII_ERASED_SENTINEL: job-run-logger writes the
   // literal "[[erased]]" string (not ciphertext) when the key is already
   // gone at onJobStart time (see the mirrored case above this describe

package/src/jobs/handlers/retry.write.ts

@@ -18,6 +18,7 @@ type JobRunRow = {
   readonly status: string;
   readonly jobName: string;
   readonly payload: string | null;
+  readonly triggeredById: string | null;
 };
 
 export const retryWrite = defineWriteHandler({
@@ -61,6 +62,7 @@ export const retryWrite = defineWriteHandler({
     // PII_ERASED_SENTINEL, which is not JSON; reject the retry rather than
     // dispatch it with a silently emptied payload.
     let payload: Record<string, unknown> = {};
+    let decryptedPayloadJson: string | null = null;
     if (run.payload) {
       const decryptedPayload = await decryptStoredPii(
         run.payload,
@@ -78,9 +80,14 @@ export const retryWrite = defineWriteHandler({
         decryptedPayload,
         `job run ${event.payload.runId} payload`,
       );
+      decryptedPayloadJson = decryptedPayload;
     }
 
-    const bullJobId = await jobRunner.dispatch(run.jobName, payload);
+    // Retry re-uses the original run's DEK owner so the retry's logs/payload stay encrypted.
+    const bullJobId = await jobRunner.dispatch(run.jobName, payload, {
+      triggeredById: run.triggeredById ?? undefined,
+      ...(decryptedPayloadJson !== null && { payload: decryptedPayloadJson }),
+    });
 
     return {
       isSuccess: true,

package/src/legal-pages/README.md

@@ -110,8 +110,10 @@ routes.
 
 ## Boot check
 
-`r.job` with `runOnBoot: true` checks at app start whether the
-required blocks exist in SYSTEM_TENANT. **Default** (DACH):
+`r.job` with `bootGate: true` runs inline while the API job runner
+starts and checks whether the required blocks exist in SYSTEM_TENANT.
+A throw rejects the boot, so the process never reports ready.
+**Default** (DACH):
 
 | Slug + locale | What happens when missing |
 |---|---|

package/src/legal-pages/__tests__/legal-pages.integration.test.ts

@@ -12,7 +12,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { seedTextBlock } from "@cosmicdrift/kumiko-bundled-features/template-resolver/seeding";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createRegistry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
@@ -226,10 +226,21 @@ describe("markdown render helpers", () => {
   });
 });
 
-// Boot-Check direkt (ohne dev-server-Job-Runner-Path) — verifiziert
-// dass die Logik fehlende Blocks im SYSTEM_TENANT erkennt. Der eigentliche
-// runOnBoot-Trigger lebt im JobRunner und wird in jobs-feature integration-
-// tests separately exercised.
+describe("legal-pages :: boot gate wiring", () => {
+  // The abort behaviour itself is proven in the framework's job-runner
+  // integration tests ("boot gates"); this only pins that legal-pages is
+  // wired onto that path and not onto the fire-and-forget runOnBoot one.
+  test("boot check is declared as a bootGate, not as runOnBoot", () => {
+    const registry = createRegistry([textFeature, legalFeature]);
+    const job = registry.getJob("legal-pages:job:legal-pages-boot-check");
+    expect(job).toBeDefined();
+    expect(job?.bootGate).toBe(true);
+    expect(job?.runOnBoot).toBeUndefined();
+  });
+});
+
+// Boot check called directly (without the dev-server job-runner path) —
+// verifies that the logic detects blocks missing in SYSTEM_TENANT.
 describe("legal-pages :: SYSTEM_TENANT-routing (production-bug-regression)", () => {
   test("legal-pages serven SYSTEM_TENANT-Texte auch wenn tenantResolver einen anderen Tenant zurückgibt", async () => {
     // Simuliert publicstatus's Setup: host-basierter tenantResolver der

package/src/legal-pages/feature.ts

@@ -208,7 +208,10 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
       "legal-pages-boot-check",
       {
         trigger: { manual: true },
-        runOnBoot: true,
+        // bootGate, not runOnBoot: only an inline gate can actually abort the
+        // boot. runOnBoot merely enqueues, so a missing imprint would fail a
+        // queue job while the pod goes ready anyway (fw#2590).
+        bootGate: true,
         runIn: "api",
       },
       async (_payload, ctx) => runLegalPagesBootCheck(ctx, requiredBlocks),

package/src/secrets/__tests__/settings-hub-i18n.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, test } from "bun:test";
+import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createConfigFeature } from "../../config/feature";
+import { createSecretsFeature } from "../feature";
+
+// `secrets` is a foundation feature auto-mounted even when `config` is not
+// (dev-server scaffold-app.ts FOUNDATION_FEATURES). A declared r.secret()
+// makes buildConfigFeatureSchema emit a secretsEdit screen + Settings-Hub
+// chrome navs, whose dot-form labels (config.settings.title, etc.) must
+// resolve at boot without the config feature present (fw#2577).
+function stripeSecret() {
+  return defineFeature("stripe", (r) => {
+    r.secret("apiKey", { label: { en: "Stripe API Key" }, scope: "tenant" });
+  });
+}
+
+describe("Settings-Hub chrome i18n keys — secrets without config", () => {
+  test("boots with only the secrets feature mounted (no config feature)", () => {
+    expect(() => validateBoot([createSecretsFeature(), stripeSecret()])).not.toThrow();
+  });
+
+  test("boots with both secrets and config mounted", () => {
+    expect(() =>
+      validateBoot([createSecretsFeature(), createConfigFeature(), stripeSecret()]),
+    ).not.toThrow();
+  });
+});

package/src/secrets/feature.ts

@@ -4,6 +4,7 @@ import {
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { z } from "zod";
 import { DEFAULT_SECRETS_ACCESS } from "./constants";
@@ -129,6 +130,15 @@ export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureD
     });
     r.envSchema(secretsEnvSchema);
 
+    // `secrets` is a foundation feature auto-mounted even when `config` is
+    // not (see FOUNDATION_FEATURES, dev-server scaffold-app.ts), so it must
+    // ship the Settings-Hub chrome keys itself — server-authored
+    // r.translations are projected into FeatureSchema.translations and used
+    // as a client fallback bundle (create-app.tsx schemaTranslations),
+    // covering both boot-time validation and rendering without a web
+    // client-plugin for this feature.
+    r.translations({ keys: SETTINGS_HUB_I18N });
+
     // ES entity: set/delete go through the executor, `tenantSecret.created/
     // .updated/.deleted` events land on the aggregate stream. Reads fire a
     // separate `tenantSecretRead` event per call (see secrets-context.get

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -4,10 +4,10 @@ import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createConfigFeature } from "../../config/feature";
 import {
-  DEFAULT_INVITE_ROLE_OPTIONS,
   INVITE_CREATE_SCREEN_ID,
   MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBERS_SCREEN_ID,
+  OWNER_INVITE_ROLE_OPTIONS,
   TenantHandlers,
   TenantQueries,
 } from "../constants";
@@ -106,7 +106,7 @@ describe("tenant members screen + handler access alignment", () => {
     expect(section.fields).toEqual([{ field: "userId", readOnly: true }, "roles"]);
     expect(screen.fields["roles"]).toEqual({
       type: "multiSelect",
-      options: DEFAULT_INVITE_ROLE_OPTIONS,
+      options: OWNER_INVITE_ROLE_OPTIONS,
       required: true,
     });
     if (screen && "access" in screen && screen.access && "roles" in screen.access) {
@@ -116,6 +116,34 @@ describe("tenant members screen + handler access alignment", () => {
     }
   });
 
+  // fw-2452 regression: the roles-edit multiSelect is prefilled with a
+  // member's current roles, so it must list every rank updateMemberRoles can
+  // actually assign (incl. TenantAdmin) — while the invite picker stays a
+  // closed allowlist without TenantAdmin (fw#2414), since inviting always
+  // starts a brand-new membership rather than editing an existing one.
+  test("member-roles-edit options can represent every assignable rank; invite picker stays TenantAdmin-free", () => {
+    const tenant = createTenantFeature({ inviteScreen: true });
+    const rolesEditScreen = tenant.screens[MEMBER_ROLES_EDIT_SCREEN_ID];
+    if (rolesEditScreen?.type !== "actionForm") {
+      throw new Error("expected member-roles-edit screen to be actionForm");
+    }
+    const rolesField = rolesEditScreen.fields["roles"];
+    if (rolesField?.type !== "multiSelect") {
+      throw new Error("expected roles field to be multiSelect");
+    }
+    expect(rolesField.options).toContain("TenantAdmin");
+
+    const inviteScreen = tenant.screens[INVITE_CREATE_SCREEN_ID];
+    if (inviteScreen?.type !== "actionForm") {
+      throw new Error("expected invite-create screen to be actionForm");
+    }
+    const roleField = inviteScreen.fields["role"];
+    if (roleField?.type !== "select") {
+      throw new Error("expected role field to be select");
+    }
+    expect(roleField.options).not.toContain("TenantAdmin");
+  });
+
   // The generic drawer-open/submit/close/refetch mechanics for kind:"drawer"
   // toolbar actions are already covered end-to-end with a synthetic screen in
   // renderer-web's projection-list-actions.test.tsx — this only proves OUR

package/src/tenant/constants.ts

@@ -23,10 +23,12 @@ export const MEMBER_STATUS_CELL_COMPONENT = "MemberStatusCell" as const;
 export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
 
 /** Closed allowlist for invite-role picker — never free text (escalation guard). */
-// Admin (rank 2) shares these screens with TenantAdmin — TenantAdmin must not
-// appear here or Admin sees an unassignable option (fw#2414). Apps that need
-// owner invites compose OWNER_INVITE_ROLE_OPTIONS into a custom screen.
+// Admin (rank 2) shares the invite-create screen with TenantAdmin — TenantAdmin
+// must not appear here or Admin sees an unassignable option (fw#2414).
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"] as const;
+// Full assignable rank list, used by memberRolesEditScreen: that screen is
+// prefilled with a member's *current* roles, so it must be able to represent
+// every rank a membership can actually hold, including TenantAdmin (fw#2452).
 export const OWNER_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin", "TenantAdmin"] as const;
 
 // Qualified write handler names (QN format: scope:type:name)

package/src/tenant/screens.ts

@@ -12,6 +12,7 @@ import {
   MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBER_STATUS_CELL_COMPONENT,
   MEMBERS_SCREEN_ID,
+  OWNER_INVITE_ROLE_OPTIONS,
   TenantHandlers,
   TenantQueries,
 } from "./constants";
@@ -179,7 +180,11 @@ export const memberRolesEditScreen = {
   cancelTarget: MEMBERS_SCREEN_ID,
   fields: {
     userId: { type: "text", required: true },
-    roles: { type: "multiSelect", options: DEFAULT_INVITE_ROLE_OPTIONS, required: true },
+    // Prefilled with the member's current roles, so the option list must be
+    // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
+    // omits TenantAdmin and would silently strip it on submit. Escalation
+    // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+    roles: { type: "multiSelect", options: OWNER_INVITE_ROLE_OPTIONS, required: true },
   },
   layout: {
     // Prefill userId from rowAction; readOnly so the operator cannot retarget.

package/src/user/handlers/create.write.ts

@@ -54,8 +54,10 @@ export const createWrite = defineWriteHandler({
       "user rows are tenant-agnostic identity records; uniqueness check and create need no tenant filter",
     );
 
+    // Pre-flight must match the partial bidx unique index, which only covers live rows.
     const existing = await fetchOne<{ id: string }>(db, userTable, {
       email: event.payload.email,
+      isDeleted: false,
     });
 
     if (existing) {

package/src/user/handlers/find-for-auth.query.ts

@@ -29,9 +29,13 @@ export const findForAuthQuery = defineQueryHandler({
     ),
   access: { roles: access.system },
   handler: async (query, ctx) => {
-    const where: { email: string } | { id: string } =
+    // Soft-deleted rows can now share an email with a live row (the partial
+    // bidx unique index covers live rows only), so the email arm must resolve
+    // the live identity; every email-arm caller already rejects isDeleted
+    // rows after the fetch, so this only removes rows that would be discarded anyway.
+    const where: { email: string; isDeleted: false } | { id: string } =
       query.payload.email !== undefined
-        ? { email: query.payload.email }
+        ? { email: query.payload.email, isDeleted: false }
         : { id: query.payload.id as string }; // @cast-boundary engine-payload
 
     if (!ctx.systemDb) {

package/src/workflow-runner/__tests__/resume-loop.integration.test.ts

@@ -83,9 +83,30 @@ const retryWorkflow: WorkflowDefinition = defineWorkflow({
   ]),
 });
 
+// Counts real side-effect executions of the step AFTER the suspension point
+// — distinct from the recorded event log, so a double-resume that somehow
+// wrote a deduplicated event log but still re-ran the pipeline would still
+// be caught (framework#2552/1).
+let sideEffectCount = 0;
+
+const idempotentResumeWorkflow: WorkflowDefinition = defineWorkflow({
+  name: "rl-idempotent-resume",
+  trigger: { kind: "event", eventType: "rl-test.idempotent-resume" },
+  idempotencyKey: ({ payload }) => (payload as { runKey: string }).runKey,
+  steps: stepsPipeline(({ r }) => [
+    r.step.wait({ for: (ctx) => (ctx.event.payload as { forIso: string }).forIso }),
+    r.step.compute("sideEffect", () => {
+      sideEffectCount += 1;
+      return sideEffectCount;
+    }),
+    r.step.return({ isSuccess: true, data: undefined }),
+  ]),
+});
+
 const testTriggersFeature = defineFeature("workflow-runner-resume-loop-test-triggers", (r) => {
   registerEventTrigger(r, waitWorkflow);
   registerEventTrigger(r, retryWorkflow);
+  registerEventTrigger(r, idempotentResumeWorkflow);
 });
 
 const noopLogger: JobContext["log"] = {
@@ -274,4 +295,45 @@ describe("workflow-runner resume loop", () => {
       rowsAfterResume.filter((row) => row["type"] === WORKFLOW_RETRY_SCHEDULED_TYPE),
     ).toHaveLength(1);
   });
+
+  test("a second resume-due-runs tick landing before pending-projection deletes the row resumes exactly once (fw#2552/1)", async () => {
+    const runKey = crypto.randomUUID();
+    const runId = workflowRunAggregateId(idempotentResumeWorkflow.name, runKey);
+    const pastIso = T.Now.instant().subtract({ hours: 1 }).toString();
+    sideEffectCount = 0;
+
+    await fireTrigger("rl-test.idempotent-resume", { runKey, forIso: pastIso });
+    expect(await pendingRowExists(runId, 0)).toBe(true);
+
+    await runResumeDueRunsJob();
+
+    const rowsAfterFirstResume = await loadRunEvents(runId);
+    expect(rowsAfterFirstResume.map((row) => row["type"])).toEqual([
+      WORKFLOW_RUN_STARTED_TYPE,
+      WORKFLOW_WAITING_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RUN_COMPLETED_TYPE,
+    ]);
+    expect(sideEffectCount).toBe(1);
+
+    // pending-projection.ts only deletes this row on a LATER dispatcher pass
+    // reacting to WORKFLOW_RESUMED — deliberately not run here, reproducing
+    // the framework#2552/1 race window where a second resume-due-runs tick
+    // lands inside that async-delete gap and still finds the row.
+    expect(await pendingRowExists(runId, 0)).toBe(true);
+
+    await runResumeDueRunsJob();
+
+    const rowsAfterSecondDispatch = await loadRunEvents(runId);
+    expect(rowsAfterSecondDispatch).toHaveLength(4);
+    expect(
+      rowsAfterSecondDispatch.filter((row) => row["type"] === WORKFLOW_RESUMED_TYPE),
+    ).toHaveLength(1);
+    expect(
+      rowsAfterSecondDispatch.filter((row) => row["type"] === WORKFLOW_RUN_COMPLETED_TYPE),
+    ).toHaveLength(1);
+    // Not just the recorded event log — the step's own side effect (which a
+    // buggy second pipeline re-entry would double-run) executed exactly once.
+    expect(sideEffectCount).toBe(1);
+  });
 });

package/src/workflow-runner/__tests__/workflow-runner.integration.test.ts

@@ -9,9 +9,12 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   computeDefinitionFingerprint,
+  createSystemUser,
   defineFeature,
   defineWorkflow,
   stepsPipeline,
+  WORKFLOW_RESUMED_TYPE,
+  WORKFLOW_RETRY_SCHEDULED_TYPE,
   WORKFLOW_RUN_COMPLETED_TYPE,
   WORKFLOW_RUN_FAILED_TYPE,
   WORKFLOW_RUN_STARTED_TYPE,
@@ -19,6 +22,7 @@ import {
   type WorkflowDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { getConsumerState } from "@cosmicdrift/kumiko-framework/pipeline";
 import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { workflowRunAggregateId } from "../aggregate-id";
 import { registerEventTrigger } from "../event-trigger";
@@ -59,10 +63,56 @@ const suspendingWorkflow: WorkflowDefinition = defineWorkflow({
   ]),
 });
 
+// fw#2552/1 regression fixture — counts how often the step AFTER the wait
+// actually runs, keyed by runKey, so a double resume-run call can prove the
+// step executed exactly once instead of just inferring it from event counts.
+const doubleResumeStepRuns = new Map<string, number>();
+
+const doubleResumeWorkflow: WorkflowDefinition = defineWorkflow({
+  name: "wr-integration-double-resume",
+  trigger: { kind: "event", eventType: "wr-test.double-resume" },
+  idempotencyKey: ({ payload }) => (payload as { runKey: string }).runKey,
+  steps: stepsPipeline(({ r }) => [
+    r.step.wait({ for: "PT1H" }),
+    r.step.compute("afterResume", (ctx) => {
+      const runKey = (ctx.event.payload as { runKey: string }).runKey;
+      doubleResumeStepRuns.set(runKey, (doubleResumeStepRuns.get(runKey) ?? 0) + 1);
+      return doubleResumeStepRuns.get(runKey);
+    }),
+    r.step.return({ isSuccess: true, data: undefined }),
+  ]),
+});
+
+// fw#2552/1 regression fixture (Aufgabe 1 bug) — times: 3 forces TWO
+// retry-scheduled suspensions (attempt 1 and 2 both fail, attempt 3
+// succeeds), so resuming both must each thread a distinct retryAttempt
+// instead of the second resume being swallowed as already-resumed.
+const doubleRetryWorkflow: WorkflowDefinition = defineWorkflow({
+  name: "wr-integration-double-retry",
+  trigger: { kind: "event", eventType: "wr-test.double-retry" },
+  idempotencyKey: ({ payload }) => (payload as { runKey: string }).runKey,
+  steps: stepsPipeline(({ r }) => [
+    r.step.retry({
+      times: 3,
+      backoff: "linear",
+      do: [
+        r.step.compute("gate", (ctx) => {
+          const attempt = ctx.workflow?.retryAttempt ?? 1;
+          if (attempt < 3) throw new Error(`attempt-${attempt}-fails`);
+          return attempt;
+        }),
+      ],
+    }),
+    r.step.return({ isSuccess: true, data: undefined }),
+  ]),
+});
+
 const testTriggersFeature = defineFeature("workflow-runner-integration-test-triggers", (r) => {
   registerEventTrigger(r, happyWorkflow);
   registerEventTrigger(r, failingWorkflow);
   registerEventTrigger(r, suspendingWorkflow);
+  registerEventTrigger(r, doubleResumeWorkflow);
+  registerEventTrigger(r, doubleRetryWorkflow);
 });
 
 async function fireTrigger(eventType: string, payload: Record<string, unknown>): Promise<void> {
@@ -89,6 +139,17 @@ async function loadRunEvents(runId: string) {
   );
 }
 
+// Dispatches resume-run directly (SYSTEM_ROLE-gated) instead of going
+// through the resume-due-runs job — resume-run never checks wakeAt, so this
+// resumes a suspended step immediately regardless of its backoff/wait length.
+async function resumeRun(runId: string, stepIndex: number) {
+  return stack.dispatcher.write(
+    "workflow-runner:write:resume-run",
+    { runId, stepIndex },
+    createSystemUser(admin.tenantId),
+  );
+}
+
 describe("workflow-runner event-trigger", () => {
   beforeAll(async () => {
     stack = await setupTestStack({ features: [workflowRunnerFeature, testTriggersFeature] });
@@ -123,8 +184,28 @@ describe("workflow-runner event-trigger", () => {
   test("error path: a throwing step writes run-failed with the error text, no run-completed", async () => {
     const runKey = crypto.randomUUID();
     const runId = workflowRunAggregateId(failingWorkflow.name, runKey);
+    // The registrar namespaces every MSP as `<feature>:projection:<name>`.
+    const consumerName = `workflow-runner-integration-test-triggers:projection:workflow-${failingWorkflow.name}`;
+
+    await insertOne(stack.db, eventsTable, {
+      aggregateId: crypto.randomUUID(),
+      aggregateType: "wr-test-source",
+      tenantId: admin.tenantId,
+      version: 1,
+      type: "wr-test.failure",
+      eventVersion: 1,
+      payload: { runKey },
+      metadata: { userId: admin.id },
+      createdBy: admin.id,
+    });
 
-    await fireTrigger("wr-test.failure", { runKey });
+    // fw#2482/2: run-failed is durably recorded, so the dispatcher must count
+    // the trigger event as delivered — not as a poison event to keep
+    // retrying (which would re-run every side-effect step until dead-letter).
+    const firstPass = await stack.eventDispatcher?.runOnce();
+    expect(firstPass?.byConsumer[consumerName]).toEqual({ processed: 1, failed: 0 });
+    const stateAfterFirstPass = await getConsumerState(stack.db, consumerName);
+    expect(stateAfterFirstPass?.status).toBe("idle");
 
     const rows = await loadRunEvents(runId);
     expect(rows.map((row) => row["type"])).toEqual([
@@ -133,6 +214,16 @@ describe("workflow-runner event-trigger", () => {
     ]);
     expect(rows[1]!["payload"]).toMatchObject({ workflowName: failingWorkflow.name, stepIndex: 0 });
     expect(String(rows[1]!["payload"]["error"])).toContain("boom-explicit-failure");
+
+    // Second pass has nothing left to redeliver — the same trigger event
+    // never spawns a second run-started for this runId. `processed` counts
+    // every event the cursor walks past (the run-started/run-failed rows the
+    // first pass appended included), so the redelivery invariant is asserted
+    // on the run stream itself plus a still-clean failure count.
+    const secondPass = await stack.eventDispatcher?.runOnce();
+    expect(secondPass?.byConsumer[consumerName]?.failed).toBe(0);
+    expect(await loadRunEvents(runId)).toHaveLength(2);
+    expect(await getConsumerState(stack.db, consumerName)).toMatchObject({ status: "idle" });
   });
 
   test("suspension: a wait step suspends the run instead of failing it — resumable by framework#2513 Phase 2, no run-completed yet", async () => {
@@ -147,4 +238,57 @@ describe("workflow-runner event-trigger", () => {
       WORKFLOW_WAITING_TYPE,
     ]);
   });
+
+  test("fw#2552/1: a second resume-run for the same (runId, stepIndex) before pending-projection deletes the row reports already-resumed and never re-runs the step", async () => {
+    const runKey = crypto.randomUUID();
+    const runId = workflowRunAggregateId(doubleResumeWorkflow.name, runKey);
+
+    await fireTrigger("wr-test.double-resume", { runKey });
+    // pending-projection observes the suspension on a pass after it exists.
+    await stack.eventDispatcher?.runOnce();
+
+    const first = await resumeRun(runId, 0);
+    // No runOnce() in between — pending-projection has not yet deleted the
+    // pending row, so the second call still finds it (the race window).
+    const second = await resumeRun(runId, 0);
+
+    expect(first).toMatchObject({ isSuccess: true, data: { outcome: "completed" } });
+    expect(second).toMatchObject({ isSuccess: true, data: { outcome: "already-resumed" } });
+    expect(doubleResumeStepRuns.get(runKey)).toBe(1);
+
+    const rows = await loadRunEvents(runId);
+    expect(rows.map((row) => row["type"])).toEqual([
+      WORKFLOW_RUN_STARTED_TYPE,
+      WORKFLOW_WAITING_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RUN_COMPLETED_TYPE,
+    ]);
+  });
+
+  test("fw#2552/1 regression: a step retried twice gets both retry attempts, the second resume is not swallowed as already-resumed", async () => {
+    const runKey = crypto.randomUUID();
+    const runId = workflowRunAggregateId(doubleRetryWorkflow.name, runKey);
+
+    await fireTrigger("wr-test.double-retry", { runKey });
+    await stack.eventDispatcher?.runOnce(); // pending-projection materialises attempt 1's row
+
+    const firstResume = await resumeRun(runId, 0);
+    expect(firstResume).toMatchObject({ isSuccess: true, data: { outcome: "suspended" } });
+
+    await stack.eventDispatcher?.runOnce(); // pending-projection materialises attempt 2's row
+
+    const secondResume = await resumeRun(runId, 0);
+    expect(secondResume).toMatchObject({ isSuccess: true, data: { outcome: "completed" } });
+
+    const rows = await loadRunEvents(runId);
+    expect(rows.map((row) => row["type"])).toEqual([
+      WORKFLOW_RUN_STARTED_TYPE,
+      WORKFLOW_RETRY_SCHEDULED_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RETRY_SCHEDULED_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RUN_COMPLETED_TYPE,
+    ]);
+    expect(rows.filter((row) => row["type"] === WORKFLOW_RESUMED_TYPE)).toHaveLength(2);
+  });
 });

package/src/workflow-runner/event-trigger.ts

@@ -7,7 +7,8 @@
 // The MSP apply-fn runs in the dispatcher's own tx, so `workflow.run-started`
 // plus the synchronous portion of the pipeline land atomically. Any throw
 // from startAndRunWorkflow is recorded as `workflow.run-failed` and
-// rethrown so the dispatcher's retry/dead-letter handling still applies.
+// swallowed — the failure is already durable, so the dispatcher advances
+// past the trigger event instead of redelivering it.
 
 import type {
   FeatureRegistrar,
@@ -43,6 +44,9 @@ export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefi
 
   r.multiStreamProjection({
     name: `workflow-${workflow.name}`,
+    // Mounting an event-triggered workflow into an existing app must not
+    // replay the historical log and fire every side-effect step retroactively.
+    startFrom: "now",
     apply: {
       [eventType]: async (event, _tx, ctx) => {
         // skip: unreachable — the guard above already established this, but the
@@ -97,7 +101,10 @@ export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefi
             type: WORKFLOW_RUN_FAILED_TYPE,
             payload: failedPayload,
           });
-          throw error;
+          // No rethrow: the failure is now durably recorded as
+          // workflow.run-failed. Rethrowing would make the dispatcher
+          // redeliver the same trigger event up to maxAttempts, re-running
+          // every side-effect step and eventually killing the consumer.
         }
       },
     },

package/src/workflow-runner/handlers/resume-run.write.ts

@@ -99,13 +99,91 @@ function checkQ7Fingerprint(
   };
 }
 
-async function recoverTriggerEvent(
-  ctx: HandlerContext,
+type ResolvedWorkflow =
+  | { readonly workflow: WorkflowDefinition; readonly failure: null }
+  | { readonly workflow: null; readonly failure: WorkflowRunFailedPayload };
+
+// Both preconditions fail the run the same way, so they resolve together: the
+// workflow must still be registered AND its definition must still match the
+// fingerprint the run was started against.
+function resolveRunnableWorkflow(
+  workflowName: string,
+  runId: string,
+  stepIndex: number,
+  storedFingerprint: string | null,
+): ResolvedWorkflow {
+  const workflow = getWorkflow(workflowName);
+  if (!workflow) {
+    return {
+      workflow: null,
+      failure: {
+        workflowName,
+        stepIndex,
+        error: `Workflow "${workflowName}" is not registered — cannot resume run ${runId}.`,
+        reason: "workflow_definition_changed",
+      },
+    };
+  }
+  const fingerprintFailure = checkQ7Fingerprint(
+    workflow,
+    workflowName,
+    runId,
+    stepIndex,
+    storedFingerprint,
+  );
+  return fingerprintFailure
+    ? { workflow: null, failure: fingerprintFailure }
+    : { workflow, failure: null };
+}
+
+function readResumedPayload(payload: unknown): {
+  readonly stepIndex: number | undefined;
+  readonly retryAttempt: number | undefined;
+} {
+  if (typeof payload !== "object" || payload === null) {
+    return { stepIndex: undefined, retryAttempt: undefined };
+  }
+  const stepIndex =
+    "stepIndex" in payload && typeof payload.stepIndex === "number" ? payload.stepIndex : undefined;
+  const retryAttempt =
+    "retryAttempt" in payload && typeof payload.retryAttempt === "number"
+      ? payload.retryAttempt
+      : undefined;
+  return { stepIndex, retryAttempt };
+}
+
+// The workflow_run_pending row is only deleted asynchronously by
+// pending-projection, so a resume-due-runs tick inside that window finds the
+// row again and the append-claim no longer conflicts — the event stream is the
+// authoritative idempotency source.
+//
+// retryAttempt must match too, not just stepIndex: a retry suspension resumes
+// the SAME stepIndex on every attempt, so matching on stepIndex alone would
+// mistake attempt 1's WORKFLOW_RESUMED for attempt 2's and skip the second
+// retry entirely.
+function isRunAlreadySettled(
+  runEvents: Awaited<ReturnType<HandlerContext["loadAggregate"]>>,
+  stepIndex: number,
+  expectedRetryAttempt: number | undefined,
+): boolean {
+  return runEvents.some((e) => {
+    if (e.type === WORKFLOW_RUN_COMPLETED_TYPE || e.type === WORKFLOW_RUN_FAILED_TYPE) {
+      return true;
+    }
+    if (e.type !== WORKFLOW_RESUMED_TYPE) {
+      return false;
+    }
+    const resumed = readResumedPayload(e.payload);
+    return resumed.stepIndex === stepIndex && resumed.retryAttempt === expectedRetryAttempt;
+  });
+}
+
+function recoverTriggerEvent(
+  runEvents: Awaited<ReturnType<HandlerContext["loadAggregate"]>>,
   runId: string,
   user: WriteEvent["user"],
-): Promise<WriteEvent> {
-  const startedEvents = await ctx.loadAggregate(runId);
-  const started = startedEvents.find((e) => e.type === WORKFLOW_RUN_STARTED_TYPE);
+): WriteEvent {
+  const started = runEvents.find((e) => e.type === WORKFLOW_RUN_STARTED_TYPE);
   if (!started) {
     throw new InternalError({
       message: `workflow-runner:write:resume-run: run ${runId} has no ${WORKFLOW_RUN_STARTED_TYPE} event — cannot recover its trigger event.`,
@@ -177,29 +255,23 @@ export const resumeRunHandler: WriteHandlerDef = {
     }
 
     const { workflowName } = pending;
-    const workflow = getWorkflow(workflowName);
-    if (!workflow) {
-      const failedPayload: WorkflowRunFailedPayload = {
-        workflowName,
-        stepIndex,
-        error: `Workflow "${workflowName}" is not registered — cannot resume run ${runId}.`,
-        reason: "workflow_definition_changed",
-      };
-      await appendRunFailed(ctx, runId, failedPayload);
-      return { isSuccess: true, data: { outcome: "failed" as const } };
-    }
-
-    const fingerprintFailure = checkQ7Fingerprint(
-      workflow,
+    const resolved = resolveRunnableWorkflow(
       workflowName,
       runId,
       stepIndex,
       pending.definitionFingerprint,
     );
-    if (fingerprintFailure) {
-      await appendRunFailed(ctx, runId, fingerprintFailure);
+    if (resolved.failure !== null) {
+      await appendRunFailed(ctx, runId, resolved.failure);
       return { isSuccess: true, data: { outcome: "failed" as const } };
     }
+    const workflow = resolved.workflow;
+
+    const runEvents = await ctx.loadAggregate(runId);
+
+    if (isRunAlreadySettled(runEvents, stepIndex, pending.retryAttempt ?? undefined)) {
+      return { isSuccess: true, data: { outcome: "already-resumed" as const } };
+    }
 
     const claim = await ctx.tryAppendEvent({
       aggregateId: runId,
@@ -217,7 +289,7 @@ export const resumeRunHandler: WriteHandlerDef = {
       return { isSuccess: true, data: { outcome: "already-resumed" as const } };
     }
 
-    const triggerEvent = await recoverTriggerEvent(ctx, runId, event.user);
+    const triggerEvent = recoverTriggerEvent(runEvents, runId, event.user);
 
     const resumeFrom =
       pending.suspensionEventType === WORKFLOW_RETRY_SCHEDULED_TYPE ? stepIndex : stepIndex + 1;