@cosmicdrift/kumiko-bundled-features 0.249.0 → 0.250.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.249.0",
+  "version": "0.250.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.249.0",
-    "@cosmicdrift/kumiko-framework": "0.249.0",
-    "@cosmicdrift/kumiko-headless": "0.249.0",
-    "@cosmicdrift/kumiko-renderer": "0.249.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.249.0",
-    "@cosmicdrift/kumiko-types": "0.249.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.250.0",
+    "@cosmicdrift/kumiko-framework": "0.250.0",
+    "@cosmicdrift/kumiko-headless": "0.250.0",
+    "@cosmicdrift/kumiko-renderer": "0.250.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.250.0",
+    "@cosmicdrift/kumiko-types": "0.250.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.249.0",
-    "@cosmicdrift/kumiko-locale-es": "0.249.0"
+    "@cosmicdrift/kumiko-locale-de": "0.250.0",
+    "@cosmicdrift/kumiko-locale-es": "0.250.0"
   }
 }

package/src/auth-email-password/__tests__/invite-accept-with-login-gates.integration.test.ts

@@ -353,3 +353,72 @@ describe("invite-accept-with-login: account-status gate", () => {
     expect(memberships).toHaveLength(0);
   });
 });
+
+describe("invite-accept-with-login: soft-deleted email predecessor (fw#2593)", () => {
+  // read_users_email_unique is now a partial index (WHERE is_deleted = false),
+  // so a soft-deleted row and a live row can share an email. The password
+  // lookup must resolve the live row, never the soft-deleted one.
+  test("logs in as the live user, not the soft-deleted predecessor with the same email", async () => {
+    const email = "reused-invitee@example.com";
+    const deletedUserId = crypto.randomUUID();
+    const liveUserId = crypto.randomUUID();
+    const deletedPassword = "deleted-predecessor-pw-1234";
+    const livePassword = "live-successor-pw-5678";
+
+    await seedRow(stack.db, userTable, {
+      id: deletedUserId,
+      tenantId: TENANT_A_ID,
+      email,
+      passwordHash: await hashPassword(deletedPassword),
+      displayName: "Deleted Predecessor",
+      locale: "de",
+      emailVerified: true,
+      roles: "[]",
+      status: USER_STATUS.Active,
+    });
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET is_deleted = true WHERE id = $1`,
+      [deletedUserId],
+    );
+
+    await seedRow(stack.db, userTable, {
+      id: liveUserId,
+      tenantId: TENANT_A_ID,
+      email,
+      passwordHash: await hashPassword(livePassword),
+      displayName: "Live Successor",
+      locale: "de",
+      emailVerified: true,
+      roles: "[]",
+      status: USER_STATUS.Active,
+    });
+
+    const token = await inviteEmail(email, "Editor");
+
+    // The deleted predecessor's password must never authenticate this
+    // invite, even though it shares the email — proves the lookup didn't
+    // just happen to land on the live row by insertion order. A failed
+    // password check unburns the token (see the handler's `finally`), so
+    // the same token is still usable for the real attempt below.
+    const deletedAttempt = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email,
+      password: deletedPassword,
+    });
+    expect(deletedAttempt.status).not.toBe(200);
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email,
+      password: livePassword,
+    });
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      isSuccess: boolean;
+      user?: { id: string };
+    };
+    expect(body.isSuccess).toBe(true);
+    expect(body.user?.id).toBe(liveUserId);
+  });
+});

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -171,8 +171,11 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
 
         // Password check against userTable, through the same gates
         // login.write.ts runs (see login-gates.test.ts for the gate contracts).
+        // Email uniqueness is partial on live rows (framework#2593) — without
+        // this filter the lookup can resolve a soft-deleted row.
         const userRow = await fetchOne<UserAuthRow>(ctx.db.raw, userTable, {
           email: invitationEmail,
+          isDeleted: false,
         });
         if (!userRow?.passwordHash) return invalidInviteToken();
 

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -129,8 +129,11 @@ export function createInviteSignupCompleteHandler() {
         // muss der User Branch 2 (acceptWithLogin) nutzen. Hier ist
         // explizit "neue Email" — sonst hätten wir zwei Wege ein
         // Password zu setzen für denselben User.
+        // Email uniqueness is partial on live rows (framework#2593) — without
+        // this filter the lookup can resolve a soft-deleted row.
         const existingUser = await fetchOne(ctx.db.raw, userTable, {
           email: invitationEmail,
+          isDeleted: false,
         });
         if (existingUser) return invalidInviteToken();
 

package/src/billing-foundation/feature.ts

@@ -86,11 +86,20 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
   // shape (= subscription-state-snapshot); der event-type taggt was
   // passiert ist. Future-consumer (billing-history, accounting)
   // listenen direkt auf den event-type ohne payload-discriminator.
-  r.defineEvent(SUBSCRIPTION_CREATED_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(SUBSCRIPTION_UPDATED_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(SUBSCRIPTION_CANCELED_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(INVOICE_PAID_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(INVOICE_PAYMENT_FAILED_EVENT_SHORT, subscriptionEventPayloadSchema);
+  // piiFields: "none" — provider ids are tenantOwned ciphertext, not plaintext personal data.
+  r.defineEvent(SUBSCRIPTION_CREATED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(SUBSCRIPTION_UPDATED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(SUBSCRIPTION_CANCELED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(INVOICE_PAID_EVENT_SHORT, subscriptionEventPayloadSchema, { piiFields: "none" });
+  r.defineEvent(INVOICE_PAYMENT_FAILED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
 
   // Inline projection: materialized current state in `read_subscriptions`.
   // Apply läuft in derselben TX wie ctx.unsafeAppendEvent — read-your-

package/src/cap-counter/feature.ts

@@ -84,7 +84,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
   // dasselbe Schema für Append-Time-Validation. QN nach Prefixing:
   // "cap-counter:event:rolling-incremented" (siehe
   // ROLLING_INCREMENTED_EVENT_QN).
-  r.defineEvent(ROLLING_INCREMENTED_EVENT_SHORT, rollingIncrementedSchema);
+  r.defineEvent(ROLLING_INCREMENTED_EVENT_SHORT, rollingIncrementedSchema, { piiFields: "none" });
 
   // Custom write-handlers.
   // - increment: Calendar-Period (CRUD via projection-row).

package/src/crypto-shredding/feature.ts

@@ -16,8 +16,10 @@ export function createCryptoShreddingFeature(): FeatureDefinition {
       category: "compliance",
     });
 
-    r.defineEvent("subject-forgotten", subjectForgottenSchema);
-    r.defineEvent("forget-denied", subjectForgetDeniedSchema);
+    // `reason` is operator free text and may name the subject; encrypting it under
+    // the subject key is pointless (that key is being erased) — see #2776.
+    r.defineEvent("subject-forgotten", subjectForgottenSchema, { piiFields: "none" });
+    r.defineEvent("forget-denied", subjectForgetDeniedSchema, { piiFields: "none" });
     r.writeHandler(forgetSubjectWrite);
   });
 }

package/src/custom-fields/feature.ts

@@ -128,11 +128,18 @@ function registerCustomFields(
   // Event-types — qualified als "custom-fields:event:<short-name>".
   // Returned EventDefs liefern .name als compile-time literal-typed string,
   // den Handler + MSP-keys konsumieren statt Template-Literal-Konstruktion.
-  const setEvent = r.defineEvent(CUSTOM_FIELD_SET_EVENT, customFieldSetSchema);
-  const clearedEvent = r.defineEvent(CUSTOM_FIELD_CLEARED_EVENT, customFieldClearedSchema);
+  // `value: z.unknown()` has no field-level schema to catalog under piiFields;
+  // "no PII" is a naming convention (#972), not an enforced guarantee — see #2776.
+  const setEvent = r.defineEvent(CUSTOM_FIELD_SET_EVENT, customFieldSetSchema, {
+    piiFields: "none",
+  });
+  const clearedEvent = r.defineEvent(CUSTOM_FIELD_CLEARED_EVENT, customFieldClearedSchema, {
+    piiFields: "none",
+  });
   const fieldDefinitionDeletedEvent = r.defineEvent(
     FIELD_DEFINITION_DELETED_EVENT,
     fieldDefinitionDeletedSchema,
+    { piiFields: "none" },
   );
 
   // Extension-Registrar — registriert dass diese Extension existiert.

package/src/document-ingest-foundation/feature.ts

@@ -102,8 +102,14 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
     }),
   );
 
-  r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema);
-  r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema);
+  // "fileName" can carry a real person's name; the payload has no user-subject
+  // field to encrypt it under, so piiFields stays "none" pending #2776.
+  r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema, {
+    piiFields: "none",
+  });
 
   r.multiStreamProjection({
     name: "request-ingest",

package/src/feature-toggles/feature.ts

@@ -61,7 +61,7 @@ export function createFeatureTogglesFeature(
     // alongside every other write — audit.list picks it up automatically,
     // no dedicated projection needed. Qualified name after prefixing:
     // "feature-toggles:event:toggle-set" (see constants.FEATURE_TOGGLE_SET_EVENT_NAME).
-    r.defineEvent("toggle-set", featureToggleSetSchema);
+    r.defineEvent("toggle-set", featureToggleSetSchema, { piiFields: "none" });
 
     const handlers = {
       set: r.writeHandler(createSetWriteHandler(options.getRuntime)),

package/src/inbound-mail-foundation/feature.ts

@@ -109,11 +109,25 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
   r.requires("tenant-lifecycle");
 
   // 5 fine-grained domain-events (Payload-Schemas: events.ts).
-  r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema);
-  r.defineEvent(MAIL_ACCOUNT_UPDATED_EVENT_SHORT, mailAccountEventPayloadSchema);
-  r.defineEvent(MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema);
-  r.defineEvent(INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, inboundMessageEventPayloadSchema);
-  r.defineEvent(MAIL_THREAD_UPDATED_EVENT_SHORT, mailThreadEventPayloadSchema);
+  // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).
+  // "displayName" stays plaintext (often the mailbox owner's real name for
+  // personal accounts); encrypting it would break the entity-projection read
+  // path that carries it as `personal: false` (#2776).
+  r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(MAIL_ACCOUNT_UPDATED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, inboundMessageEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(MAIL_THREAD_UPDATED_EVENT_SHORT, mailThreadEventPayloadSchema, {
+    piiFields: "none",
+  });
 
   // Inline projections — apply in derselben TX wie der Append.
   r.projection({

package/src/secrets/feature.ts

@@ -153,7 +153,7 @@ export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureD
     // discover the type; secrets-context.get parses payloads against
     // `secretReadSchema` at write time because the low-level append() path
     // skips ctx.appendEvent's schema-validation guard.
-    r.defineEvent("read", secretReadSchema);
+    r.defineEvent("read", secretReadSchema, { piiFields: "none" });
 
     // Per-tenant handlers (set/delete/list) run in the default tenant-scope,
     // giving them the automatic ctx.db tenant-filter as extra defense.

package/src/sessions/feature.ts

@@ -146,7 +146,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // sessionRevokedSchema explicitly, same guarantee via a different path.
     // No projection: the payload IS the read, consumed directly off the
     // event-store NOTIFY (#1560).
-    r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema);
+    r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, { piiFields: "none" });
 
     const handlers = {
       revoke: r.writeHandler(revokeWrite),

package/src/tenant-lifecycle/feature.ts

@@ -60,24 +60,41 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
     // guard's "tenant-lifecycle mounted" gate exactly.
     r.bootCheck(({ features }) => validateTenantDataHookCoverage(features));
 
-    r.defineEvent(DESTRUCTION_REQUESTED_EVENT_SHORT, destructionRequestedSchema);
-    r.defineEvent(DESTRUCTION_CANCELLED_EVENT_SHORT, destructionCancelledSchema);
-    r.defineEvent(TENANT_DESTRUCTION_STARTED_EVENT_SHORT, tenantDestructionStartedSchema);
+    r.defineEvent(DESTRUCTION_REQUESTED_EVENT_SHORT, destructionRequestedSchema, {
+      piiFields: "none",
+    });
+    r.defineEvent(DESTRUCTION_CANCELLED_EVENT_SHORT, destructionCancelledSchema, {
+      piiFields: "none",
+    });
+    r.defineEvent(TENANT_DESTRUCTION_STARTED_EVENT_SHORT, tenantDestructionStartedSchema, {
+      piiFields: "none",
+    });
     r.defineEvent(
       TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT,
       tenantDestructionStageStartedSchema,
+      {
+        piiFields: "none",
+      },
     );
     r.defineEvent(
       TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
       tenantDestructionStageSucceededSchema,
+      { piiFields: "none" },
     );
-    r.defineEvent(TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, tenantDestructionStageFailedSchema);
+    r.defineEvent(TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, tenantDestructionStageFailedSchema, {
+      piiFields: "none",
+    });
     r.defineEvent(
       TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT,
       tenantDestructionStageAbandonedSchema,
+      { piiFields: "none" },
     );
-    r.defineEvent(TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT, tenantDestructionCompletedSchema);
-    r.defineEvent(TENANT_DESTRUCTION_FAILED_EVENT_SHORT, tenantDestructionFailedSchema);
+    r.defineEvent(TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT, tenantDestructionCompletedSchema, {
+      piiFields: "none",
+    });
+    r.defineEvent(TENANT_DESTRUCTION_FAILED_EVENT_SHORT, tenantDestructionFailedSchema, {
+      piiFields: "none",
+    });
 
     r.writeHandler(requestDestructionWrite);
     r.writeHandler(cancelDestructionWrite);

package/src/user/__tests__/email-unique-plaintext-soft-delete.integration.test.ts

@@ -0,0 +1,139 @@
+// fw#2593 — the plaintext `read_users_email_unique` index used to be a full
+// unique index regardless of softDelete: a soft-deleted user permanently
+// blocked reuse of its email whenever PII/blind-index wasn't configured
+// (the *_bidx partial index from fw#2464 only helps once a blind-index key
+// is actually configured). buildEntityTable / deriveEntityTableMeta now
+// attach `WHERE "is_deleted" = false` to any explicitly declared unique
+// index on a softDelete entity that doesn't carry an author-provided
+// `where` of its own — this proves the plaintext path directly, with no
+// blind-index key configured at all.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestDb,
+  type TestDb,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { userEntity, userTable } from "../schema/user";
+
+let testDb: TestDb;
+const executor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  await unsafeCreateEntityTable(testDb.db, userEntity, "user");
+  await createEventsTable(testDb.db);
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(testDb.db).unsafe(
+    `TRUNCATE kumiko_events, read_users RESTART IDENTITY CASCADE`,
+  );
+  // The premise of this file is "nothing configured" — global crypto state
+  // from another test file running first in the same process must not leak
+  // in and accidentally exercise the bidx path instead of the plaintext one.
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+describe("fw#2593 — email unique constraint on the plaintext column (no blind index configured)", () => {
+  test("a soft-deleted user's email is reusable when no blind index is configured", async () => {
+    const email = "plaintext-soft-deleted@example.com";
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+
+    const created = await executor.create(
+      { email, displayName: "Departing Plaintext User" },
+      systemUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("expected create to succeed");
+
+    const deleted = await executor.delete({ id: created.data.id }, systemUser, tdb);
+    if (!deleted.isSuccess) throw new Error("expected soft-delete to succeed");
+
+    const reCreated = await executor.create(
+      { email, displayName: "Plaintext Squatter" },
+      systemUser,
+      tdb,
+    );
+    if (!reCreated.isSuccess) {
+      throw new Error(
+        "expected re-create with the same email to succeed once the original row is soft-deleted",
+      );
+    }
+    expect(reCreated.data.id).not.toBe(created.data.id);
+
+    // DB-proof: both rows survive under the plaintext email — the
+    // soft-deleted original stays untouched, the new live row now also
+    // carries the email, since the partial index only enforces uniqueness
+    // among non-deleted rows.
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT "id", "is_deleted" FROM "read_users" WHERE "email" = $1 ORDER BY "is_deleted"`,
+      [email],
+    )) as ReadonlyArray<{ id: string; is_deleted: boolean }>;
+    expect(rows).toHaveLength(2);
+    expect(rows[0]).toEqual({ id: String(reCreated.data.id), is_deleted: false });
+    expect(rows[1]).toEqual({ id: String(created.data.id), is_deleted: true });
+
+    // Proves the plaintext path was actually exercised, not the bidx one:
+    // no blind-index key is configured in this file, so email_bidx stays NULL.
+    const plaintextRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT "email", "email_bidx" FROM "read_users" WHERE "id" = $1::uuid`,
+      [reCreated.data.id],
+    )) as ReadonlyArray<{ email: string; email_bidx: string | null }>;
+    expect(plaintextRows[0]?.email).toBe(email);
+    expect(plaintextRows[0]?.email_bidx).toBeNull();
+  });
+
+  test("a second live user with the same email is still rejected", async () => {
+    const email = "plaintext-live-collision@example.com";
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+
+    const first = await executor.create(
+      { email, displayName: "First Plaintext User" },
+      systemUser,
+      tdb,
+    );
+    if (!first.isSuccess) throw new Error("expected first create to succeed");
+
+    const second = await executor.create(
+      { email, displayName: "Second Plaintext User" },
+      systemUser,
+      tdb,
+    );
+    if (second.isSuccess) {
+      throw new Error("expected second create with the same live email to fail");
+    }
+
+    expect(second.error.code).toBe("unique_violation");
+    expect(second.error.httpStatus).toBe(409);
+    const details = second.error.details as { constraintName?: string };
+    expect(details.constraintName).toBe("read_users_email_unique");
+
+    // DB-proof: only the first row survives under that email.
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT count(*)::int AS n FROM "read_users" WHERE "email" = $1`,
+      [email],
+    )) as ReadonlyArray<{ n: number }>;
+    expect(rows[0]?.n).toBe(1);
+  });
+});

package/src/user/seeding.ts

@@ -66,7 +66,7 @@ export async function seedUser(
   // Interface braucht den Wrap.
   const tdb = createTenantDb(db, by.tenantId, "system");
 
-  const existing = await fetchOne(db, userTable, { email: options.email });
+  const existing = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
   // liefert die Projection-Row als Record<string, unknown>.
   if (existing) {

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -114,7 +114,7 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
   test("V3: pii field on a projection-only entity (no r.entity) is still caught", () => {
     const projectionTable = projectionProbeTable("crm_contact_summary");
     const bad = defineFeature("crm", (r) => {
-      const contactCreated = r.defineEvent("contact-created", z.unknown());
+      const contactCreated = r.defineEvent("contact-created", z.unknown(), { piiFields: "none" });
       r.projection({
         name: "contact-summary",
         source: "contact",
@@ -171,7 +171,9 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     const projectionTable = projectionProbeTable("crm_contact_summary_hooked");
     const hooked = defineFeature("crm-hooked", (r) => {
       r.requires("user-data-rights");
-      const contactCreated = r.defineEvent("contact-hooked-created", z.unknown());
+      const contactCreated = r.defineEvent("contact-hooked-created", z.unknown(), {
+        piiFields: "none",
+      });
       r.projection({
         name: "contact-summary",
         source: "contact",

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -15,7 +15,11 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  entityEventName,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
   createSystemUser,
@@ -337,6 +341,112 @@ describe("forget pipeline honours the effective tenant model", () => {
     // Payload-tenant latch must still see 2 historical members.
     expect(await rowCount()).toBe(1);
   });
+
+  test("single-user, sole member removed and re-added → rows still erased (#2608)", async () => {
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c7");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+
+    // Remove + re-add of the SAME person: removeMemberWrite only drops the
+    // projection row, so two `tenant-membership.created` events survive for a
+    // tenant that never had a co-member. Counting rows instead of identities
+    // latched such a tenant to multi-user forever, and every tenantScopedOnly
+    // erase hook skipped on the "co-members keep shared data" grounds.
+    const first = await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+    const deleteResult = await membershipExecutor.delete(
+      { id: first.id },
+      createSystemUser(TENANT),
+      createTenantDb(stack.db, TENANT, "system"),
+    );
+    if (!deleteResult.isSuccess) {
+      throw new Error(`test setup: member removal failed: ${deleteResult.error.code}`);
+    }
+    await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+
+    // Pins the premise: 2 created-events, 1 distinct userId, 1 live member.
+    const createdEvents = await asRawClient(stack.db).unsafe(
+      `SELECT payload->>'userId' AS user_id FROM kumiko_events
+        WHERE aggregate_type = 'tenant-membership' AND type = $1 AND payload->>'tenantId' = $2`,
+      [entityEventName("tenant-membership", "created"), TENANT],
+    );
+    expect(createdEvents.length).toBe(2);
+    const liveMemberships = await asRawClient(stack.db).unsafe(
+      "SELECT id FROM read_tenant_memberships WHERE tenant_id = $1",
+      [TENANT],
+    );
+    expect(liveMemberships.length).toBe(1);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: nowInstant(),
+      tenantModel: "single-user",
+    });
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.processedUserIds).toContain(FORGET_USER);
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("single-user, sole member, but a created-event with unreadable userId → rows preserved", async () => {
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c8");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+    await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+
+    // A created-event whose userId payload cannot be read may name a second
+    // member — the fail-safe branch must survive the #2608 fix.
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO kumiko_events
+         (aggregate_id, aggregate_type, tenant_id, version, type, payload, metadata, created_by)
+       VALUES ($1, 'tenant-membership', $2, 1, $3, $4, '{}'::jsonb, 'system')`,
+      [
+        "eeeeeeee-eeee-4eee-8eee-0000000000c8",
+        TENANT,
+        entityEventName("tenant-membership", "created"),
+        // Object, not JSON.stringify: a string param into a jsonb column is
+        // encoded a second time and lands as a JSON scalar, which no
+        // payload->>'...' lookup would ever match.
+        { tenantId: TENANT },
+      ],
+    );
+
+    const createdEvents = await asRawClient(stack.db).unsafe(
+      `SELECT payload->>'userId' AS user_id FROM kumiko_events
+        WHERE aggregate_type = 'tenant-membership' AND type = $1 AND payload->>'tenantId' = $2`,
+      [entityEventName("tenant-membership", "created"), TENANT],
+    );
+    expect(createdEvents.length).toBe(2);
+
+    // Without exactly one live member the live gate would answer multi-user
+    // before the history latch runs, and this test would prove nothing.
+    const liveMemberships = await asRawClient(stack.db).unsafe(
+      "SELECT id FROM read_tenant_memberships WHERE tenant_id = $1",
+      [TENANT],
+    );
+    expect(liveMemberships.length).toBe(1);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: nowInstant(),
+      tenantModel: "single-user",
+    });
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.processedUserIds).toContain(FORGET_USER);
+    expect(await rowCount()).toBe(1);
+  });
 });
 
 describe("run-forget-cleanup job — real glue-code, not a hand-set tenantModel", () => {

package/src/user-data-rights/handlers/request-deletion-by-email.write.ts

@@ -76,7 +76,7 @@ export function createRequestDeletionByEmailHandler(opts: RequestDeletionByEmail
       const userRow = await fetchOne<{ id: string; status: string; email: string }>(
         ctx.db.raw,
         userTable,
-        { email: event.payload.email },
+        { email: event.payload.email, isDeleted: false },
       );
       if (!userRow || userRow["status"] !== USER_STATUS.Active || !userRow["email"]) {
         return success;

package/src/user-data-rights/run-forget-cleanup.ts

@@ -573,19 +573,26 @@ async function resolveEffectiveTenantModel(
 // rows.
 //
 // Filter by payload->>'tenantId' (not the event column tenant_id): cross-
-// tenant SystemAdmin adds land under the actor's tenant_id (#2347). SQL
-// aggregation stays fail-safe when userId payloads are unreadable: more
-// created-rows than distinct userIds ⇒ treat as multi-user.
+// tenant SystemAdmin adds land under the actor's tenant_id (#2347).
+//
+// Counting created-ROWS against distinct userIds latched a tenant to
+// multi-user as soon as its sole member was removed and re-added (#2608) —
+// two created-events, one identity, no co-member ever. The fail-safe only
+// needs to cover payloads whose userId cannot be READ, so the unreadable
+// remainder is measured directly instead of inferred from the row count.
+// NULLIF folds an empty-string userId into that remainder (it names nobody).
 async function everHadMultipleMembers(db: DbRunner, tenantId: TenantId): Promise<boolean> {
   const eventType = entityEventName("tenant-membership", "created");
   const rows = await executeRawQuery<{
     event_count: number;
+    readable_users: number;
     distinct_users: number;
   }>(
     db,
     `SELECT
        COUNT(*)::int AS event_count,
-       COUNT(DISTINCT payload->>'userId')::int AS distinct_users
+       COUNT(NULLIF(payload->>'userId', ''))::int AS readable_users,
+       COUNT(DISTINCT NULLIF(payload->>'userId', ''))::int AS distinct_users
      FROM kumiko_events
      WHERE aggregate_type = 'tenant-membership'
        AND type = $1
@@ -595,11 +602,9 @@ async function everHadMultipleMembers(db: DbRunner, tenantId: TenantId): Promise
   const row = rows[0];
   if (!row) return false;
   if (row.distinct_users > 1) return true;
-  // Unreadable / missing userId payloads: fail-safe to multi-user
-  // (including a lone created-event with no readable userId).
-  if (row.event_count >= 1 && row.distinct_users < 1) return true;
-  if (row.event_count > 1 && row.distinct_users <= 1) return true;
-  return false;
+  // Unreadable / missing userId payloads: fail-safe to multi-user, each one
+  // could name a second member.
+  return row.event_count > row.readable_users;
 }
 
 // Mapping retention.strategy → user-data-rights.UserDataDeleteStrategy.