@cosmicdrift/kumiko-bundled-features 0.288.0 → 0.290.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.288.0",
+  "version": "0.290.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -82,6 +82,7 @@
     "./tenant/web": "./src/tenant/web/index.ts",
     "./tenant/seeding": "./src/tenant/seeding.ts",
     "./tenant-lifecycle": "./src/tenant-lifecycle/index.ts",
+    "./tenant-handover": "./src/tenant-handover/index.ts",
     "./tenant/testing": "./src/tenant/testing.ts",
     "./user": "./src/user/index.ts",
     "./user/seeding": "./src/user/seeding.ts",
@@ -132,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.288.0",
-    "@cosmicdrift/kumiko-framework": "0.288.0",
-    "@cosmicdrift/kumiko-headless": "0.288.0",
-    "@cosmicdrift/kumiko-renderer": "0.288.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.288.0",
-    "@cosmicdrift/kumiko-types": "0.288.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.290.0",
+    "@cosmicdrift/kumiko-framework": "0.290.0",
+    "@cosmicdrift/kumiko-headless": "0.290.0",
+    "@cosmicdrift/kumiko-renderer": "0.290.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.290.0",
+    "@cosmicdrift/kumiko-types": "0.290.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -166,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.288.0",
-    "@cosmicdrift/kumiko-locale-es": "0.288.0",
+    "@cosmicdrift/kumiko-locale-de": "0.290.0",
+    "@cosmicdrift/kumiko-locale-es": "0.290.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/__tests__/query-as-member.integration.test.ts

@@ -104,6 +104,9 @@ const TRIES_UNSAFE_RAW_WRITE_QN = "queryasmemberprobe:query:tries-unsafe-raw-wri
 const TRIES_READ_WRITE_RESET_QN = "queryasmemberprobe:query:tries-read-write-reset";
 const NESTED_DB_WRITE_QN = "queryasmemberprobe:query:nested-db-write";
 const TRIES_SELECT_FOR_UPDATE_QN = "queryasmemberprobe:query:tries-select-for-update";
+const TRIES_COMMIT_THEN_WRITE_QN = "queryasmemberprobe:query:tries-commit-then-write";
+const TRIES_RAW_SELECT_QN = "queryasmemberprobe:query:tries-raw-select";
+const NESTED_RAW_SELECT_QN = "queryasmemberprobe:query:nested-raw-select";
 const TRIES_QUERY_AS_QN = "queryasmemberprobe:query:tries-query-as";
 const READ_AS_MEMBER_QUERY_QN = "queryasmemberprobe:query:read-as-member-query";
 const SYSTEM_SCOPE_READ_AS_MEMBER_QN = "queryasmembersystemscope:write:read-as-member";
@@ -240,6 +243,42 @@ const probeFeature = defineFeature("queryasmemberprobe", (r) => {
       escapeHatch: { reason: "test: select-for-update probe" },
     },
   );
+  // Transaction control, not a write: COMMIT ends the read-only scope, the
+  // UPDATE afterwards runs in a fresh, writable implicit transaction.
+  r.queryHandler(
+    "tries-commit-then-write",
+    z.object({}),
+    async (_query, ctx) => {
+      const raw = asRawClient(ctx.db.unsafeRaw("test: commit-then-write probe"));
+      await raw.unsafe("COMMIT");
+      await raw.unsafe("UPDATE qam_notes SET body = 'tampered'");
+      return { ok: true };
+    },
+    {
+      access: { roles: ["Admin", "User"] },
+      escapeHatch: { reason: "test: commit-then-write probe" },
+    },
+  );
+  r.queryHandler(
+    "tries-raw-select",
+    z.object({}),
+    async (_query, ctx) => {
+      const rows = await asRawClient(ctx.db.unsafeRaw("test: raw select probe")).unsafe(
+        "SELECT 1 AS one",
+      );
+      return { ok: true, count: Array.isArray(rows) ? rows.length : 0 };
+    },
+    {
+      access: { roles: ["Admin", "User"] },
+      escapeHatch: { reason: "test: raw select probe" },
+    },
+  );
+  r.queryHandler(
+    "nested-raw-select",
+    z.object({}),
+    async (_query, ctx) => ctx.query(TRIES_RAW_SELECT_QN, {}),
+    { access: { roles: ["Admin", "User"] } },
+  );
   r.queryHandler(
     "tries-query-as",
     z.object({}),
@@ -524,6 +563,19 @@ async function readAsMemberErr(
   );
 }
 
+// The request-level teardown gate (auth-middleware) answers 410 before a
+// handler runs, so a teardown tenant can only be probed for the dispatcher's
+// own active-membership rejection through the stack's dispatcher.
+async function readAsMemberErrViaDispatcher(userId: string, targetQn: string) {
+  const result = await stack.dispatcher.write(
+    "queryasmemberprobe:write:read-as-member",
+    { userId, targetQn, payload: {} },
+    admin,
+  );
+  if (result.isSuccess) throw new Error("expected read-as-member to fail");
+  return result.error;
+}
+
 async function createNote(ownerId: string, body: string): Promise<void> {
   await stack.http.writeOk("queryasmemberprobe:write:note:create", { ownerId, body }, admin);
 }
@@ -654,7 +706,7 @@ describe("ctx.queryAsMember — AccessDenied, same generic error for every rejec
     await addMembership(userId, TENANT_A);
     await setTenantStatus(TENANT_A, "destroying");
 
-    const err = await readAsMemberErr(userId, WHOAMI_QN);
+    const err = await readAsMemberErrViaDispatcher(userId, WHOAMI_QN);
     expect(err.code).toBe("access_denied");
     expect(err.message).toBe(GENERIC_MESSAGE);
     expect(err.details).toEqual(GENERIC_DETAILS);
@@ -668,7 +720,7 @@ describe("ctx.queryAsMember — AccessDenied, same generic error for every rejec
     await addMembership(userId, TENANT_A);
     await setTenantStatus(TENANT_A, "destroyRequested");
 
-    const err = await readAsMemberErr(userId, WHOAMI_QN);
+    const err = await readAsMemberErrViaDispatcher(userId, WHOAMI_QN);
     expect(err.code).toBe("access_denied");
     expect(err.message).toBe(GENERIC_MESSAGE);
     expect(err.details).toEqual(GENERIC_DETAILS);
@@ -951,9 +1003,10 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     await addMembership(userId, TENANT_A);
     await createNote(userId, "note-1");
 
-    // SQLSTATE 25001, not 25006 — surfaces as internal_error rather than member_resolution_read_only.
+    // Denied at ctx.db.unsafeRaw, before the SET TRANSACTION READ WRITE reaches Postgres.
     const err = await readAsMemberErr(userId, TRIES_READ_WRITE_RESET_QN);
-    expect(err.code).toBe("internal_error");
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
 
@@ -964,7 +1017,8 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     await createNote(userId, "note-1");
 
     const err = await readAsMemberViaQueryErr(userId, TRIES_READ_WRITE_RESET_QN);
-    expect(err.code).toBe("internal_error");
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
 
@@ -1047,4 +1101,70 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
+
+  test("j1) tries-commit-then-write via a write-caller (savepoint path) is denied, notes unchanged", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("committhenwrite-write@example.com", "pw-long-enough-36");
+    await addMembership(userId, TENANT_A);
+    await createNote(userId, "note-1");
+
+    const err = await readAsMemberErr(userId, TRIES_COMMIT_THEN_WRITE_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+    expect(await readNoteBodies()).toEqual(["note-1"]);
+  });
+
+  test("j2) tries-commit-then-write via a query-caller (pool path) is denied, notes unchanged", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("committhenwrite-query@example.com", "pw-long-enough-37");
+    await addMembership(userId, TENANT_A);
+    await createNote(userId, "note-1");
+
+    const err = await readAsMemberViaQueryErr(userId, TRIES_COMMIT_THEN_WRITE_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+    expect(await readNoteBodies()).toEqual(["note-1"]);
+  });
+
+  test("k1) tries-raw-select via a write-caller is denied — no raw handle, not even for reads", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("rawselect-write@example.com", "pw-long-enough-38");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberErr(userId, TRIES_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("k2) tries-raw-select via a query-caller (pool path) is denied", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("rawselect-query@example.com", "pw-long-enough-39");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberViaQueryErr(userId, TRIES_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("l) nested-raw-select: a ctx.query hop inside a member read stays without a raw handle", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("nestedrawselect@example.com", "pw-long-enough-40");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberErr(userId, NESTED_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("m) tries-raw-select via the normal dispatch path (no queryAsMember) still works", async () => {
+    await createTenant(TENANT_A);
+
+    const result = await stack.http.queryOk<{ ok: boolean; count: number }>(
+      TRIES_RAW_SELECT_QN,
+      {},
+      admin,
+    );
+    expect(result.ok).toBe(true);
+    expect(result.count).toBe(1);
+  });
 });

package/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -14,6 +14,7 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
   name: "signup-registration-status",
   schema: z.object({}),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
   description:
     "Reports whether self-registration is currently switched on, readable without signing in, so a signup page can hide its own form instead of collecting an address that would be silently ignored.",
   handler: async (_query, ctx) => {

package/src/auth-mfa/__tests__/verify.integration.test.ts

@@ -375,12 +375,16 @@ describe("mfa verify — re-checks account state the way login.write.ts does", (
     resetTenantLifecycleGateCacheForTests();
 
     try {
-      const err = await stack.http.writeErr(
+      // Via the dispatcher, not HTTP: the request-level teardown gate answers
+      // 410 before /api/write reaches the handler, and this test asserts the
+      // handler's own challenge-token gate.
+      const result = await stack.dispatcher.write(
         AuthMfaHandlers.verify,
         { challengeToken, code: currentTotpCode(secret) },
         GUEST,
       );
-      expectErrorIncludes(err, "invalid_challenge_token");
+      if (result.isSuccess) throw new Error("expected mfa verify to fail");
+      expectErrorIncludes(result.error, "invalid_challenge_token");
     } finally {
       await asRawClient(stack.db).unsafe(
         `UPDATE "${tenantTable.tableName}" SET status = $1 WHERE id = $2`,

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -44,6 +44,7 @@ import {
 } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { paymentAggregateId, subscriptionAggregateId } from "../aggregate-id";
 import {
@@ -147,6 +148,7 @@ beforeAll(async () => {
   // subscriptionsProjectionTable wird von setupTestStack automatisch
   // gepusht (r.projection mit `table`-Property → auto-push).
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   // providerCustomerId/providerSubscriptionId are `personal: "tenant"`
   // PII-subject fields — no executor wires the KMS automatically here (raw r.projection,

package/src/billing-foundation/__tests__/subscription-tier-sync.integration.test.ts

@@ -30,6 +30,7 @@ import {
 } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import type { TierMap } from "../../tier-engine/compose-app";
 import { TierEngineHandlers } from "../../tier-engine/constants";
@@ -112,6 +113,7 @@ beforeAll(async () => {
     ],
   });
   await createEventsTable(stack.db);
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
   await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
   await unsafePushTables(stack.db, { tier_assignments: tierAssignmentTable });
   configurePiiSubjectKms(new InMemoryKmsAdapter());

package/src/compliance-profiles/handlers/sub-processors.query.ts

@@ -25,6 +25,7 @@ export const subProcessorsQuery = defineQueryHandler({
   name: "sub-processors",
   schema: z.object({}),
   access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
   description:
     "Returns the publicly readable Kumiko sub-processor list split into active and planned entries, for the GDPR Art. 28(2) disclosure a privacy policy or data-processing agreement links to.",
   handler: async (): Promise<SubProcessorListResponse> => {

package/src/document-ingest-foundation/__tests__/feature.integration.test.ts

@@ -10,10 +10,16 @@ import {
   createInMemoryFileProvider,
   type InMemoryFileProvider,
 } from "@cosmicdrift/kumiko-framework/files";
-import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { documentIngestFoundationFeature } from "../feature";
 
@@ -48,6 +54,7 @@ beforeAll(async () => {
     ],
     files: { storageProvider: provider },
   });
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
 });
 
 afterAll(async () => {

package/src/files-tenant-data/__tests__/hooks.integration.test.ts

@@ -12,7 +12,11 @@ import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  type EntityId,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   append,
   createEventsTable,
@@ -133,6 +137,12 @@ async function seedFileRef(tenantId: TenantId, storageKey: string) {
   return { id: result.data.id };
 }
 
+// Stands in for a tenant-handover claim (kumiko-framework#3035): the row's
+// tenantId moves, the storageKey — and the bytes behind it — do not.
+async function handOverFileRef(fileRefId: EntityId, toTenantId: TenantId): Promise<void> {
+  await updateRows(db, fileRefsTable, { tenantId: toTenantId }, { id: String(fileRefId) });
+}
+
 // Sidesteps the `request-destruction` write handler (needs user/auth/sessions
 // features wired) by seeding the same "destroying" state it would produce —
 // same pattern as tenant-lifecycle's own poison-pill destroy tests.
@@ -279,4 +289,81 @@ describe("files-tenant-data :: tenant destroy", () => {
     // forget hook's resolution-failure stance.
     expect(await provider.exists(originalKeyA)).toBe(true);
   });
+
+  // kumiko-framework#3035 — tenant-handover leaves a fileRef row's tenantId
+  // pointing at a NEW tenant while its storageKey (and the bytes behind it)
+  // stay under the tenant that originally uploaded it.
+  describe("after a tenant-handover", () => {
+    test("the destination tenant's destroy deletes the handed-over binary even though it lives outside its own prefix", async () => {
+      await seedTenant(tenantA);
+      await seedTenant(tenantB);
+
+      const handedOverKey = buildStorageKey(
+        tenantA.tenantId,
+        "fileRef",
+        1,
+        "attachment",
+        "photo.jpg",
+        "u1",
+      );
+      const { id: fileRefId } = await seedFileRef(tenantA.tenantId, handedOverKey);
+      await provider.write(handedOverKey, new Uint8Array([1]));
+
+      await handOverFileRef(fileRefId, tenantB.tenantId);
+
+      await seedDestroyingTenant(tenantB.tenantId);
+      const finalStatus = await driveDestructionToCompletion(
+        tenantB.tenantId,
+        async () => provider,
+      );
+      expect(finalStatus).toBe("destroyed");
+
+      const rowsB = await selectMany(db, fileRefsTable, { tenantId: tenantB.tenantId });
+      expect(rowsB).toHaveLength(0);
+      expect(await provider.exists(handedOverKey)).toBe(false);
+    });
+
+    test("the SOURCE tenant's destroy does not delete a file — or its derivative — a foreign tenant claimed, but still sweeps a true orphan", async () => {
+      await seedTenant(tenantA);
+      await seedTenant(tenantB);
+
+      const originalKey = buildStorageKey(
+        tenantA.tenantId,
+        "fileRef",
+        1,
+        "attachment",
+        "photo.jpg",
+        "u1",
+      );
+      const derivativeKey = `${originalKey.replace(/\.jpg$/, "")}.medium.jpg`;
+      const orphanKey = `${tenantA.tenantId}/some-other-file.bin`;
+      const { id: fileRefId } = await seedFileRef(tenantA.tenantId, originalKey);
+      await provider.write(originalKey, new Uint8Array([1]));
+      await provider.write(derivativeKey, new Uint8Array([2]));
+      await provider.write(orphanKey, new Uint8Array([3]));
+
+      await handOverFileRef(fileRefId, tenantB.tenantId);
+
+      await seedDestroyingTenant(tenantA.tenantId);
+      const finalStatus = await driveDestructionToCompletion(
+        tenantA.tenantId,
+        async () => provider,
+      );
+      expect(finalStatus).toBe("destroyed");
+
+      // A's own app-data stage never even sees this row — by the time it ran,
+      // the handover had already moved it to B.
+      const rowsB = await selectMany(db, fileRefsTable, { tenantId: tenantB.tenantId });
+      expect(rowsB).toHaveLength(1);
+
+      // The silent-data-loss case the whole handover design exists to
+      // prevent: A's storage-prefix sweep must not delete bytes a foreign
+      // tenant's surviving row still references — original AND derivative.
+      expect(await provider.exists(originalKey)).toBe(true);
+      expect(await provider.exists(derivativeKey)).toBe(true);
+      // A true orphan (no fileRef row anywhere) is still swept — the
+      // exception above is narrow, not a general retreat from the sweep.
+      expect(await provider.exists(orphanKey)).toBe(false);
+    });
+  });
 });

package/src/files-tenant-data/hooks.ts

@@ -8,7 +8,20 @@
 //     every fileRef ROW for the tenant via forget() — rebuild-safe, mirrors
 //     document-ingest-foundation's documentExtractTenantDestroyHook. No
 //     isDeleted filter: tenant-destroy purges trashed rows too, a destroyed
-//     tenant has no "restore from trash" future.
+//     tenant has no "restore from trash" future. ALSO sweeps, per row, any
+//     storageKey that does NOT sit under one of this tenant's own
+//     tenantStoragePrefixes() — the shape a tenant-handover (kumiko-
+//     framework#3035) leaves behind: the fileRef row's tenantId moved to
+//     this tenant, but the bytes stayed under the SOURCE tenant's prefix
+//     (moving them would mean copying bytes, which the handover design
+//     explicitly rejects). Must run here, not in the "files" stage below —
+//     that stage's own prefix sweep only reaches keys under ITS tenant's
+//     prefixes by construction, and by the time it runs this hook has
+//     already forgotten (hard-deleted) the rows it would need to read the
+//     storageKey off. Deleted by STEM prefix (storageKeyStemPrefix), not the
+//     exact key: a derived variant (thumbnail, resized render) has no
+//     `file_refs` row of its own, so only the stem reaches original +
+//     derivatives together.
 //   - fileRefStorageDestroyHook ("files" stage, EXT_STORAGE_PROVIDER): wipes
 //     every BINARY (original + derivatives + anything else) under the
 //     tenant's storage prefixes. A full prefix sweep per tenantStoragePrefixes()
@@ -16,29 +29,67 @@
 //     first (see tenantExportPrefix), so this must sweep every known prefix,
 //     stays correct even though the "files" stage runs after "app-data"
 //     already forgot the rows, and can never cross into another tenant's keys
-//     (the provider's own list() prefix already scopes it).
+//     (the provider's own list() prefix already scopes it). Still catches a
+//     blob with no fileRef row at all (the orphan case the row-driven sweep
+//     above cannot see) — REFINED, not replaced, to skip a key a FOREIGN
+//     tenant's fileRef row still references (a tenant-handover, kumiko-
+//     framework#3035, leaves the row's tenantId moved but the storageKey
+//     under THIS tenant's prefix unchanged). By the time this stage runs,
+//     the "app-data" stage (stages.ts DESTRUCTION_STAGES: "app-data" before
+//     "files") has already hard-deleted every row THIS tenant owned, so any
+//     surviving row a listed key still matches is, by construction, a
+//     foreign tenant's — no tenant comparison needed, existence is enough.
+//     The exception is computed from the SURVIVING row's storageKeyStemPrefix
+//     (mirroring the deletion side above), not the listed key's exact match:
+//     a derivative has no fileRef row of its own, so excluding only exact
+//     matches would still delete it out from under the tenant that claimed
+//     its original. Batched: one existence query per chunk of listed keys,
+//     not one query per key.
 
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   type StorageProviderDestroyTenantHook,
+  type StorageProviderHookCtx,
   type TenantDataDestroyHook,
+  type TenantDataHookCtx,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   assertSafeStorageKey,
   fileRefEntity,
   fileRefsTable,
+  storageKeyStemPrefix,
   tenantStoragePrefixes,
 } from "@cosmicdrift/kumiko-framework/files";
 
 const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 
+// Existence-check batch size for fileRefStorageDestroyHook's survivor lookup
+// — bounds each query instead of one `storage_key = ANY(...)` per listed key,
+// or a single unbounded array for a tenant with a huge prefix.
+const SURVIVOR_CHECK_BATCH_SIZE = 500;
+
+function chunk<T>(items: readonly T[], size: number): T[][] {
+  const chunks: T[][] = [];
+  for (let i = 0; i < items.length; i += size) chunks.push(items.slice(i, i + size));
+  return chunks;
+}
+
+function isUnderOwnPrefix(storageKey: string, prefixes: readonly string[]): boolean {
+  return prefixes.some((prefix) => storageKey.startsWith(prefix));
+}
+
 export const fileRefTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
-  const rows = await ctx.db.selectMany<{ id: string }>(fileRefsTable, {
+  const rows = await ctx.db.selectMany<{ id: string; storageKey: string }>(fileRefsTable, {
     tenantId: ctx.tenantId,
   });
+  const ownPrefixes = tenantStoragePrefixes(ctx.tenantId);
   const user = createSystemUser(ctx.tenantId);
   for (const row of rows) {
+    if (!isUnderOwnPrefix(row.storageKey, ownPrefixes)) {
+      await deleteHandedOverBinary(ctx, row.storageKey);
+    }
     const result = await crud.forget({ id: row.id }, user, ctx.db);
     // Executor writes return {isSuccess:false} instead of throwing — a
     // discarded result would report this destroy stage "succeeded" while the
@@ -52,6 +103,32 @@ export const fileRefTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
   }
 };
 
+async function deleteHandedOverBinary(ctx: TenantDataHookCtx, storageKey: string): Promise<void> {
+  if (!ctx.fileProviderResolver) {
+    // skip: same graceful-degradation stance as fileRefStorageDestroyHook —
+    // no provider wired means the binary sweep is skipped, not fail-closed.
+    ctx.log?.(
+      `[files-tenant-data] no fileProviderResolver wired — handed-over binary for ${storageKey} is NOT deleted`,
+    );
+    // skip: no provider wired, so there is no store to delete from — logged above.
+    return;
+  }
+  let provider: Awaited<ReturnType<NonNullable<TenantDataHookCtx["fileProviderResolver"]>>>;
+  try {
+    provider = await ctx.fileProviderResolver(ctx.tenantId);
+  } catch (err) {
+    ctx.log?.(
+      `[files-tenant-data] no file provider resolvable for tenant ${ctx.tenantId}: ${err instanceof Error ? err.message : String(err)} — handed-over binary for ${storageKey} NOT deleted`,
+    );
+    // skip: provider resolution failed, so there is nothing this call can delete — logged above.
+    return;
+  }
+  for (const key of await provider.list(storageKeyStemPrefix(storageKey))) {
+    assertSafeStorageKey(key);
+    await provider.delete(key);
+  }
+}
+
 export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async (
   tenantId,
   ctx,
@@ -86,9 +163,30 @@ export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async
   // converges rather than double-deleting or erroring on a missing key).
   for (const prefix of tenantStoragePrefixes(tenantId)) {
     const keys = await provider.list(prefix);
+    const keptStemPrefixes = await survivorStemPrefixes(ctx.db, keys);
     for (const key of keys) {
+      if (keptStemPrefixes.some((stemPrefix) => key.startsWith(stemPrefix))) continue;
       assertSafeStorageKey(key);
       await provider.delete(key);
     }
   }
 };
+
+// Any listed key that is itself a surviving row's exact storageKey means a
+// foreign tenant still owns it (see header comment) — its stem prefix then
+// also protects any derivative of that same original sitting in the same
+// listed batch, none of which have their own fileRef row.
+async function survivorStemPrefixes(
+  db: StorageProviderHookCtx["db"],
+  keys: readonly string[],
+): Promise<readonly string[]> {
+  const stemPrefixes: string[] = [];
+  for (const batch of chunk(keys, SURVIVOR_CHECK_BATCH_SIZE)) {
+    if (batch.length === 0) continue;
+    const survivors = await selectMany<{ storageKey: string }>(db, fileRefsTable, {
+      storageKey: batch,
+    });
+    for (const survivor of survivors) stemPrefixes.push(storageKeyStemPrefix(survivor.storageKey));
+  }
+  return stemPrefixes;
+}

package/src/inbound-mail-foundation/__tests__/inbound-mail-foundation.integration.test.ts

@@ -46,6 +46,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id";
 import { InboundMailFoundationHandlers, InboundMailFoundationQueries } from "../constants";
@@ -83,6 +84,7 @@ beforeAll(async () => {
   });
   db = stack.db;
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   // Unmanaged direct-write stores — kein r.entity, kein Auto-Push.
   await unsafeCreateEntityTable(db, syncCursorEntity);

package/src/inbound-mail-foundation/__tests__/retention.integration.test.ts

@@ -27,6 +27,7 @@ import {
 import { createConfigFeature } from "../../config";
 import { inboundProviderInMemoryFeature } from "../../inbound-provider-inmemory";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { inboundMessageAggregateId } from "../aggregate-id";
 import { InboundMailFoundationHandlers } from "../constants";
@@ -51,6 +52,7 @@ beforeAll(async () => {
   });
   db = stack.db;
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   await unsafeCreateEntityTable(db, syncCursorEntity);
   await unsafeCreateEntityTable(db, seenMessageEntity);

package/src/inbound-mail-foundation/__tests__/watch-supervisor.integration.test.ts

@@ -33,6 +33,7 @@ import {
   seedInboundMessage,
 } from "../../inbound-provider-inmemory/feature";
 import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import {
   createInboundMailSupervisor,
@@ -65,6 +66,7 @@ beforeAll(async () => {
   });
   db = stack.db;
   await createEventsTable(db);
+  await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
   await unsafeCreateEntityTable(db, syncCursorEntity);
   await unsafeCreateEntityTable(db, seenMessageEntity);

package/src/managed-pages/handlers/branding.query.ts

@@ -19,6 +19,7 @@ export function createBrandingQuery(opts: { readonly allowCustomCss: boolean })
     name: "branding",
     schema: z.object({}),
     access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+    rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
     description:
       "Reads the tenant's public branding values for the rendered page shell, adding the raw custom CSS only when the app opted in and the per-tenant CSS toggle is on; anonymous callers may read it because it dresses public pages.",
     handler: async (_query, ctx) => {

package/src/managed-pages/handlers/by-slug.query.ts

@@ -16,6 +16,7 @@ export const bySlugQuery = defineQueryHandler({
     lang: z.string().min(2).max(8),
   }),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 60, windowSeconds: 60 },
   description:
     "Reads the body and metadata of one published managed page of the caller's tenant by slug and language, returning null for drafts and bodyless pages; use it to render a public page, not to load one for editing.",
   handler: async (query, ctx) => {