@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.335.0

package/dist/tenant/last-tenant-admin.js

@@ -8,14 +8,16 @@ import { tenantMembershipsTable } from "./membership-table.js";
 // (dispatcher batch wraps handlers in transaction — xact lock holds through update).
 export const LAST_TENANT_ADMIN_LOCK_NAMESPACE = 0x7461646d; // 'tadm'
 /** Refuse demoting/removing the last TenantAdmin for `tenantId`. */
-export async function assertNotLastTenantAdmin(db, tenantId, userId) {
+export async function assertNotLastTenantAdmin(db, tenantId, userId, action = "demote") {
     await acquireNamespacedAdvisoryLock(db, LAST_TENANT_ADMIN_LOCK_NAMESPACE, tenantId);
     const allMemberships = await selectMany(db, tenantMembershipsTable, { tenantId });
     const adminCount = allMemberships.filter((m) => parseRoles(m["roles"]).includes("TenantAdmin")).length;
     if (adminCount <= 1) {
         return writeFailure(new ConflictError({
-            message: "cannot demote the last tenant admin",
-            i18nKey: "tenant.errors.cannotDemoteLastTenantAdmin",
+            message: `cannot ${action} the last tenant admin`,
+            i18nKey: action === "remove"
+                ? "tenant.errors.cannotRemoveLastTenantAdmin"
+                : "tenant.errors.cannotDemoteLastTenantAdmin",
             details: {
                 reason: TenantErrors.lastTenantAdmin,
                 userId,

package/dist/tenant/seeding.d.ts

@@ -38,6 +38,10 @@ export declare function fireEntityPostSave(hooks: SeedTenantHooks | undefined, p
  * a second call for the same `id` is a no-op (no update path). Same
  * TX-semantics as the real `TenantHandlers.create`, minus the SystemAdmin-
  * access-check and minus ConflictError-on-duplicate.
+ *
+ * `hooks` run only for the call that actually creates the tenant: a call that
+ * finds the tenant/stream already present (or loses a concurrent create race)
+ * returns without firing postSave.
  */
 export declare function seedTenant(db: DbRunner, options: SeedTenantOptions, hooks?: SeedTenantHooks): Promise<{
     id: TenantId;

package/dist/tenant/seeding.js

@@ -124,6 +124,10 @@ target) {
  * a second call for the same `id` is a no-op (no update path). Same
  * TX-semantics as the real `TenantHandlers.create`, minus the SystemAdmin-
  * access-check and minus ConflictError-on-duplicate.
+ *
+ * `hooks` run only for the call that actually creates the tenant: a call that
+ * finds the tenant/stream already present (or loses a concurrent create race)
+ * returns without firing postSave.
  */
 export async function seedTenant(db, options, hooks) {
     const by = options.by ?? TestUsers.systemAdmin;
@@ -146,8 +150,11 @@ export async function seedTenant(db, options, hooks) {
     const result = await tenantExecutor.create({ id: options.id, key: options.key, name: options.name }, by, tdb);
     if (!result.isSuccess) {
         // Same idempotency case as the stream-version check above, only detected
-        // one instruction later: a dispatcher cycle appended to the stream between
-        // that read and this create. Both paths return without firing postSave.
+        // one instruction later: a concurrent writer (e.g. a parallel seedTenant
+        // for the same id) created the stream between the version read above and
+        // this create; the executor confines the failed append to a savepoint, so
+        // the surrounding TX stays usable. Both paths return without firing
+        // postSave — hooks only run for the call that actually created the tenant.
         if (result.error.code === "version_conflict")
             return { id: options.id };
         throw new Error(`seedTenant failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`);

package/dist/tenant-lifecycle/boot-checks.d.ts

@@ -1,2 +1,3 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export declare function validateTenantDataHookCoverage(features: readonly FeatureDefinition[]): void;
+export declare function validateTenantDestroyHookShapes(features: readonly FeatureDefinition[]): void;

package/dist/tenant-lifecycle/boot-checks.js

@@ -1,4 +1,4 @@
-import { EXT_TENANT_DATA, } from "@cosmicdrift/kumiko-framework/engine";
+import { EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
 import { entitiesOf } from "../shared/index.js";
 // V4: tenantOwned-entity-without-hook gate. Mirrors user-data-rights' V3
 // (validateGdprPiiHookCoverage) but for EXT_TENANT_DATA. Registered as this
@@ -34,3 +34,29 @@ export function validateTenantDataHookCoverage(features) {
         }
     }
 }
+const TENANT_RESOURCE_EXTENSIONS = new Set([
+    EXT_STORAGE_PROVIDER,
+    EXT_SEARCH_ADAPTER,
+    EXT_EXTERNAL_RESOURCE,
+    EXT_INFRA_RESOURCE,
+]);
+// Malformed destroy registrations would otherwise only throw when a tenant
+// destruction reaches the stage, possibly months after deploy, and stall the
+// whole pipeline (stages.ts keeps its own throw as defense in depth). JS
+// plugins and `as` casts slip past the type check.
+export function validateTenantDestroyHookShapes(features) {
+    for (const feature of features) {
+        for (const usage of feature.extensionUsages) {
+            const isTenantData = usage.extensionName === EXT_TENANT_DATA;
+            if (!isTenantData && !TENANT_RESOURCE_EXTENSIONS.has(usage.extensionName))
+                continue;
+            const isValid = isTenantData
+                ? isTenantDataExtensionHooks(usage.options)
+                : isTenantResourceExtensionHooks(usage.options);
+            if (isValid)
+                continue;
+            const requiredFn = isTenantData ? "destroy" : "destroyTenant";
+            throw new Error(`[kumiko:boot] ${usage.extensionName} registration for "${usage.entityName}" (feature "${feature.name}") has no ${requiredFn} function — tenant destroy would fail at this stage.`);
+        }
+    }
+}

package/dist/tenant-lifecycle/feature.js

@@ -1,5 +1,5 @@
 import { defineFeature, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, EXT_TENANT_LIFECYCLE_STATUS, } from "@cosmicdrift/kumiko-framework/engine";
-import { validateTenantDataHookCoverage } from "./boot-checks.js";
+import { validateTenantDataHookCoverage, validateTenantDestroyHookShapes } from "./boot-checks.js";
 import { DESTRUCTION_CANCELLED_EVENT_SHORT, DESTRUCTION_REQUESTED_EVENT_SHORT, TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT, TENANT_DESTRUCTION_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
 import { destructionCancelledSchema, destructionRequestedSchema, tenantDestructionCompletedSchema, tenantDestructionFailedSchema, tenantDestructionStageAbandonedSchema, tenantDestructionStageFailedSchema, tenantDestructionStageStartedSchema, tenantDestructionStageSucceededSchema, tenantDestructionStartedSchema, } from "./events.js";
 import { cancelDestructionWrite } from "./handlers/cancel-destruction.write.js";
@@ -36,6 +36,7 @@ export function createTenantLifecycleFeature() {
         // EXT_TENANT_DATA: its own mount is the trigger, matching the original
         // guard's "tenant-lifecycle mounted" gate exactly.
         r.bootCheck(({ features }) => validateTenantDataHookCoverage(features));
+        r.bootCheck(({ features }) => validateTenantDestroyHookShapes(features));
         r.defineEvent(DESTRUCTION_REQUESTED_EVENT_SHORT, destructionRequestedSchema, {
             piiFields: "none",
         });

package/dist/tenant-lifecycle/stages.js

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, EXT_EXTERNAL_RESOURCE, EXT_INFRA_RESOURCE, EXT_SEARCH_ADAPTER, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, extensionUsageEscapeHatchReason, isTenantDataExtensionHooks, isTenantResourceExtensionHooks, } from "@cosmicdrift/kumiko-framework/engine";
-import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
+import { createEscapeHatchReporter, UNATTRIBUTED_ACTOR, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantMembershipEntity, tenantMembershipsTable, tenantTable, } from "../tenant/index.js";
 import { invalidateTenantLifecycleGate } from "./lifecycle-gate.js";
@@ -30,7 +30,7 @@ async function runTenantDataHooks(ctx) {
         const report = createEscapeHatchReporter({
             handler: `${EXT_TENANT_DATA}:${usage.entityName}`,
             tenantId: ctx.tenantId,
-            actor: ctx.actor ?? "system",
+            actor: ctx.actor ?? UNATTRIBUTED_ACTOR,
             sink: ctx.escapeHatchAuditSink,
         });
         const hookCtx = {

package/dist/tier-engine/feature.js

@@ -129,11 +129,12 @@ export function createTierEngineFeature(opts = {}) {
         // Standard-CRUD via Helper.
         r.writeHandler(defineEntityCreateHandler("tier-assignment", tierAssignmentEntity, {
             ...writeAccess,
-            description: "Creates the tier-assignment row of the caller's tenant with a tier name and its source; prefer `set-tenant-tier`, which upserts and refreshes the feature gate.",
+            // Bypasses the feature-gate refresh that set-tenant-tier performs.
+            agent: { expose: false },
         }));
         r.writeHandler(defineEntityUpdateHandler("tier-assignment", tierAssignmentEntity, {
             ...writeAccess,
-            description: "Updates an existing tier-assignment row by id; prefer `set-tenant-tier`, which resolves the tenant's row itself and refreshes the feature gate.",
+            agent: { expose: false },
         }));
         // Reads.
         r.queryHandler(defineEntityListHandler("tier-assignment", tierAssignmentEntity, {

package/dist/user/command-schemas.d.ts

@@ -3,7 +3,7 @@ export declare const UserCommandSchemas: {
         email: import("zod").ZodEmail;
         passwordHash: import("zod").ZodOptional<import("zod").ZodString>;
         displayName: import("zod").ZodString;
-        locale: import("zod").ZodOptional<import("zod").ZodString>;
+        locale: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>>;
         timezone: import("zod").ZodOptional<import("zod").ZodString>;
         roles: import("zod").ZodOptional<import("zod").ZodUnion<readonly [import("zod").ZodArray<import("zod").ZodString>, import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string[], string>>]>>;
     }, import("zod/v4/core").$strip>;
@@ -12,7 +12,7 @@ export declare const UserCommandSchemas: {
         version: import("zod").ZodNumber;
         changes: import("zod").ZodObject<{
             displayName: import("zod").ZodOptional<import("zod").ZodString>;
-            locale: import("zod").ZodOptional<import("zod").ZodString>;
+            locale: import("zod").ZodOptional<import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<string, string>>>;
             timezone: import("zod").ZodOptional<import("zod").ZodString>;
             email: import("zod").ZodOptional<import("zod").ZodEmail>;
             passwordHash: import("zod").ZodOptional<import("zod").ZodString>;

package/dist/user/handlers/create.write.d.ts

@@ -3,7 +3,7 @@ export declare const createWrite: import("@cosmicdrift/kumiko-types/define-handl
     email: z.ZodEmail;
     passwordHash: z.ZodOptional<z.ZodString>;
     displayName: z.ZodString;
-    locale: z.ZodOptional<z.ZodString>;
+    locale: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
     timezone: z.ZodOptional<z.ZodString>;
     roles: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>]>>;
 }, z.core.$strip>, import("@cosmicdrift/kumiko-types/hooks").SaveContext, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/user/handlers/create.write.js

@@ -2,7 +2,7 @@ import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, findForbiddenRoleAssignment, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, ConflictError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
+import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -28,7 +28,13 @@ export const createWrite = defineWriteHandler({
         email: z.email(),
         passwordHash: z.string().optional(),
         displayName: z.string().min(1).max(100),
-        locale: z.string().min(2).max(10).refine(isValidLocaleTag, "invalid locale tag").optional(),
+        locale: z
+            .string()
+            .min(2)
+            .max(10)
+            .refine(isValidLocaleTag, "invalid locale tag")
+            .transform(canonicalizeLocaleTag)
+            .optional(),
         timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
         // Field-level write access (privileged) is defense-in-depth — create is
         // already system/SystemAdmin-only.

package/dist/user/handlers/update.write.d.ts

@@ -4,7 +4,7 @@ export declare const updateWrite: import("@cosmicdrift/kumiko-types/define-handl
     version: z.ZodNumber;
     changes: z.ZodObject<{
         displayName: z.ZodOptional<z.ZodString>;
-        locale: z.ZodOptional<z.ZodString>;
+        locale: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
         timezone: z.ZodOptional<z.ZodString>;
         email: z.ZodOptional<z.ZodEmail>;
         passwordHash: z.ZodOptional<z.ZodString>;

package/dist/user/handlers/update.write.js

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, hasAccess } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
+import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { isValidIanaTimeZone } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { UserErrors } from "../constants.js";
@@ -24,7 +24,13 @@ export const updateWrite = defineWriteHandler({
         version: z.number(),
         changes: z.object({
             displayName: z.string().min(1).max(100).optional(),
-            locale: z.string().min(2).max(10).refine(isValidLocaleTag, "invalid locale tag").optional(),
+            locale: z
+                .string()
+                .min(2)
+                .max(10)
+                .refine(isValidLocaleTag, "invalid locale tag")
+                .transform(canonicalizeLocaleTag)
+                .optional(),
             timezone: z.string().max(64).refine(isValidIanaTimeZone, "invalid IANA time zone").optional(),
             email: z.email().optional(),
             passwordHash: z.string().optional(),

package/dist/user-data-rights/db/queries/export-jobs.d.ts

@@ -8,5 +8,7 @@ export type ExportJobCleanupCandidate = {
     readonly requestedFromTenantId: TenantId;
     readonly downloadStorageKey: string | null;
     readonly expiresAt: Temporal.Instant | null;
+    readonly completedAt: Temporal.Instant | null;
+    readonly startedAt: Temporal.Instant | null;
 };
 export declare function selectExportJobsForStorageCleanup(db: DbConnection, doneStatus: string, failedStatus: string): Promise<readonly ExportJobCleanupCandidate[]>;

package/dist/user-data-rights/feature.js

@@ -25,7 +25,7 @@ import { isMailTransportAvailable, makeDefaultDeletionExecutedEmail, makeDefault
 import { makeTenantMailTransportResolver } from "./lib/mail-transport-resolver.js";
 import { resolveAppTenantModel } from "./lib/resolve-tenant-model.js";
 import { makeTenantStorageProviderResolver } from "./lib/storage-provider-resolver.js";
-import { EXPORT_CLEANUP_BACKLOG_AGE_METRIC, runExportJobs, } from "./run-export-jobs.js";
+import { EXPORT_CLEANUP_BACKLOG_AGE_METRIC, EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC, runExportJobs, } from "./run-export-jobs.js";
 import { runForgetCleanup, sanitizeReasonForLog, } from "./run-forget-cleanup.js";
 import { downloadAttemptEntity } from "./schema/download-attempt.js";
 import { exportDownloadTokenEntity } from "./schema/download-token.js";
@@ -156,12 +156,18 @@ export function createUserDataRightsFeature(opts = {}) {
                 "userDataRights.privacyCenter.field.gracePeriodEnd": { en: "Scheduled deletion date" },
                 "userDataRights.privacyCenter.export.title": { en: "Export your data (Art. 20)" },
                 "userDataRights.privacyCenter.restriction.title": { en: "Restrict processing (Art. 18)" },
+                "userDataRights.privacyCenter.restriction.explainer": {
+                    en: "Freeze your account: processing of your data is paused and you are signed out. Lifting the restriction afterwards is only possible via support.",
+                },
                 "userDataRights.privacyCenter.restriction.restrict": { en: "Restrict account" },
                 "userDataRights.privacyCenter.restriction.dialogTitle": { en: "Restrict your account?" },
                 "userDataRights.privacyCenter.restriction.dialogDescription": {
                     en: "You will be signed out immediately and cannot sign in again until support lifts the restriction.",
                 },
                 "userDataRights.privacyCenter.deletion.title": { en: "Delete account (Art. 17)" },
+                "userDataRights.privacyCenter.deletion.explainer": {
+                    en: "Request deletion of your account. Until the grace period ends you can cancel the deletion.",
+                },
                 "userDataRights.privacyCenter.deletion.delete": { en: "Delete account" },
                 "userDataRights.privacyCenter.deletion.cancel": { en: "Cancel deletion" },
                 "userDataRights.privacyCenter.deletion.dialogTitle": { en: "Delete your account?" },
@@ -215,7 +221,7 @@ export function createUserDataRightsFeature(opts = {}) {
                         // when `showDeletion` is false, and status covers restriction
                         // AND deletion state, so it can't hang off the optional section.
                         title: i18nKey("userDataRights.privacyCenter.restriction.title"),
-                        description: "userDataRights.privacyCenter.restriction.explainer",
+                        description: i18nKey("userDataRights.privacyCenter.restriction.explainer"),
                         fields: [
                             {
                                 field: "status",
@@ -227,7 +233,7 @@ export function createUserDataRightsFeature(opts = {}) {
                         ? [
                             {
                                 title: i18nKey("userDataRights.privacyCenter.deletion.title"),
-                                description: "userDataRights.privacyCenter.deletion.explainer",
+                                description: i18nKey("userDataRights.privacyCenter.deletion.explainer"),
                                 // gracePeriodEnd is only meaningful once a deletion is
                                 // actually pending — hide it instead of showing an empty
                                 // date when status isn't deletionRequested.
@@ -269,6 +275,8 @@ export function createUserDataRightsFeature(opts = {}) {
                             handler: UserDataRightsHandlers.cancelDeletion,
                             visible: { field: "status", eq: "deletionRequested" },
                             style: "secondary",
+                            // Declared: the id's last segment ("deletion") would otherwise resolve to the destructive trash icon.
+                            icon: "x",
                         },
                     ]
                     : []),
@@ -372,15 +380,20 @@ export function createUserDataRightsFeature(opts = {}) {
         // Surfaces a stalled export-cleanup cron: if the daily
         // pass stops running, done-status export bundles keep sitting in
         // storage past their TTL+grace with downloadStorageKey still set
-        // (unencrypted PII at rest). Emitted from the same job that cleans up
-        // (see handler below) — a dead cron makes the metric go stale too,
-        // which an `absent()` alert catches without a second liveness signal.
-        // Scope: Done-status bundles only — Failed-status cleanup candidates
-        // have no expiresAt/TTL (immediate cleanup, see storageCleanupPass).
+        // (unencrypted PII at rest). Gauges keep their last value in-process, so
+        // a dead cron does NOT make the backlog gauge absent; the last-run
+        // timestamp gauge below is the liveness signal.
+        // Scope: Done-status bundles past expiresAt+grace plus Failed-status
+        // orphans (no TTL, due from completedAt ?? startedAt; see storageCleanupPass).
         r.metric(EXPORT_CLEANUP_BACKLOG_AGE_METRIC, {
             type: "gauge",
             unit: "seconds",
-            description: "Age in seconds of the oldest done-status export bundle whose expiresAt+grace has passed but downloadStorageKey is still set. 0 when the storage-cleanup pass has no backlog.",
+            description: "Age in seconds of the oldest export bundle (done: expiresAt+grace passed; failed: orphaned ZIP since completedAt or startedAt) whose downloadStorageKey is still set. 0 when the storage-cleanup pass has no backlog.",
+        });
+        r.metric(EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC, {
+            type: "gauge",
+            unit: "seconds",
+            description: "Unix timestamp of the last export storage-cleanup pass that completed. Alert on time() minus this value exceeding the cron interval plus a buffer; the backlog-age gauge alone stays at its last value when the cron stops.",
         });
         // S2.U3 Atom 3b — Worker fuer Async Export-Pipeline. Cron-getriggert.
         const RUN_EXPORT_JOBS_REASON = "processes pending export jobs across every tenant";

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -1,9 +1,9 @@
-import { createSystemUser, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS, userTable } from "../../user/index.js";
 import { redeemDeletionToken } from "../deletion-token.js";
-import { startDeletionGracePeriod } from "./deletion-grace-period.js";
+import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
 // Generischer 422 für jeden Token-Fehlerpfad (malformed / bad_signature /
 // expired / kein Secret) — kein Signal ob ein Token zu einem User gehört.
 function invalidToken() {
@@ -55,11 +55,8 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
                 "SYSTEM_TENANT_ID user stream.",
         },
         agent: { expose: false },
-        rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },
+        rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         handler: async (event, ctx) => {
-            // @cast-boundary engine-payload — queryAs returns unknown, narrowed to
-            // the compliance-profile shape.
-            const profile = (await ctx.queryAs(createSystemUser(event.user.tenantId), "compliance-profiles:query:for-tenant", {}));
             let gracePeriodEndIso;
             // The row's requestId is part of the verify key, so a token from a
             // cancelled or superseded cycle fails. Every error path ends in the same
@@ -71,7 +68,7 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
                 secret: opts.deletionTokenSecret,
                 loadPendingRequestId: (userId) => readPendingDeletionRequestId(ctx, userId),
                 commitDeletion: async (userId, requestId) => {
-                    const res = await startDeletionGracePeriod(ctx, userId, profile.profile.userRights.gracePeriod, ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), { pendingDeletionRequestId: requestId });
+                    const res = await startDeletionGracePeriod(ctx, userId, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"), { pendingDeletionRequestId: requestId });
                     if (!res.ok)
                         return false;
                     gracePeriodEndIso = res.gracePeriodEnd.toString();

package/dist/user-data-rights/handlers/deletion-grace-period.d.ts

@@ -1,9 +1,10 @@
 import { type DurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import { type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
+export declare function resolveGracePeriod(ctx: HandlerContext, tenantId: string): Promise<DurationSpec>;
 export type StartGracePeriodResult = {
     readonly ok: true;
     readonly gracePeriodEnd: Instant;
@@ -13,5 +14,5 @@ export type StartGracePeriodResult = {
     readonly ok: false;
     readonly error: UnprocessableError;
 };
-export declare function startDeletionGracePeriod(ctx: HandlerContext, userId: string, gracePeriod: DurationSpec, lifecycleRunner: DbRunner, additionalExpect?: Readonly<Record<string, string | number | boolean | null>>): Promise<StartGracePeriodResult>;
+export declare function startDeletionGracePeriod(ctx: HandlerContext, userId: string, resolveGracePeriodSpec: () => Promise<DurationSpec>, lifecycleRunner: DbRunner, additionalExpect?: Readonly<Record<string, string | number | boolean | null>>): Promise<StartGracePeriodResult>;
 export {};

package/dist/user-data-rights/handlers/deletion-grace-period.js

@@ -1,9 +1,21 @@
-import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
+import { addDurationSpec, } from "@cosmicdrift/kumiko-framework/compliance";
+import { createSystemUser, declareEscapeHatch, } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { decryptStoredPii } from "../../shared/index.js";
 import { USER_STATUS, userTable } from "../../user/index.js";
 import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
+// Single trust-boundary cast for the compliance-profile lookup: the query
+// handler's declared return type is EffectiveComplianceProfile, but queryAs
+// only hands back unknown. Needs the calling handler's escapeHatch (system
+// queryAs).
+export async function resolveGracePeriod(ctx, tenantId) {
+    declareEscapeHatch({
+        reason: "reads the tenant compliance profile via queryAs(SYSTEM, ...) to compute the grace period end; the calling user's own identity has no read access to that tenant-config projection",
+    });
+    const profile = (await ctx.queryAs(createSystemUser(tenantId), "compliance-profiles:query:for-tenant", {})); // @cast-boundary engine-payload
+    return profile.profile.userRights.gracePeriod;
+}
 // Flips an active user to DeletionRequested and sets gracePeriodEnd from the
 // caller-supplied grace period. Shared between the authenticated
 // request-deletion path (event.user) and the anonymous confirm-by-token path
@@ -13,7 +25,7 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 // ctx.db.global(userTable); only the grace period duration is tenant-configured.
 // That read only supplies email/locale for the caller's notification — it is
 // NOT the transition's guard. The guard is `expect: { status: Active }` on
-// the lifecycle write itself (#3024): the executor re-checks it against a
+// the lifecycle write itself: the executor re-checks it against a
 // fresh row right before writing, so a concurrent caller that already moved
 // the user off Active is rejected even though this read saw Active.
 //
@@ -31,11 +43,13 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle.js";
 // true). No-op for the authenticated request-deletion path, which never set
 // a pendingDeletionRequestId to begin with.
 //
-// `gracePeriod` and `lifecycleRunner` are resolved by the caller: both
-// require an escalation (reading the tenant compliance profile, appending to
-// the SYSTEM_TENANT_ID user stream) that only the declaring handler's
-// escapeHatch covers.
-export async function startDeletionGracePeriod(ctx, userId, gracePeriod, lifecycleRunner, additionalExpect) {
+// `resolveGracePeriodSpec` and `lifecycleRunner` are supplied by the caller:
+// both require an escalation (reading the tenant compliance profile,
+// appending to the SYSTEM_TENANT_ID user stream) that only the declaring
+// handler's escapeHatch covers. The grace period is a lazy provider so the
+// privileged compliance-profile query only runs for a user that is still
+// Active, not for replayed tokens or already-requested deletions.
+export async function startDeletionGracePeriod(ctx, userId, resolveGracePeriodSpec, lifecycleRunner, additionalExpect) {
     const userRow = await ctx.db
         .global(userTable)
         .fetchOne({ id: userId });
@@ -47,8 +61,16 @@ export async function startDeletionGracePeriod(ctx, userId, gracePeriod, lifecyc
             }),
         };
     }
+    if (userRow["status"] !== USER_STATUS.Active) {
+        return {
+            ok: false,
+            error: new UnprocessableError("user_not_in_active_state", {
+                details: { currentStatus: userRow["status"] },
+            }),
+        };
+    }
     const T = getTemporal();
-    const gracePeriodEnd = addDurationSpec(T.Now.instant(), gracePeriod);
+    const gracePeriodEnd = addDurationSpec(T.Now.instant(), await resolveGracePeriodSpec());
     const { applied } = await updateUserLifecycle(lifecycleRunner, userId, { status: USER_STATUS.DeletionRequested, gracePeriodEnd, pendingDeletionRequestId: null }, { expect: { status: USER_STATUS.Active, ...additionalExpect } });
     if (!applied) {
         return {

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -56,7 +56,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     // 30 attempts/min/IP reicht fuer legitime User (mehrere Klicks bei
     // Connection-Abbruch); blockiert automatisierte Probing-Loops.
     // Memory `feedback_security_default_on`.
-    rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
+    rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     escapeHatch: {
         reason: DOWNLOAD_BY_TOKEN_REASON,
     },

package/dist/user-data-rights/handlers/request-deletion-by-email.write.js

@@ -34,7 +34,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
         // Mails a deletion link to any address the caller names.
         agent: { risk: "high" },
         // Defense-in-depth gegen Email-Probing auf dem anonymen Endpoint.
-        rateLimit: { per: "ip", limit: 10, windowSeconds: 60 },
+        rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         escapeHatch: {
             reason: APPEND_LIFECYCLE_EVENT_REASON,
         },

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -1,10 +1,10 @@
 import { createTransportForTenant } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
-import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { USER_STATUS } from "../../user/index.js";
 import { isMailTransportAvailable, makeDefaultDeletionRequestedEmail, } from "../lib/default-mailers.js";
-import { startDeletionGracePeriod } from "./deletion-grace-period.js";
+import { resolveGracePeriod, startDeletionGracePeriod } from "./deletion-grace-period.js";
 // POST /api/user/request-deletion (S2.U5a) — DSGVO Art. 17 Forget-Antrag.
 // Flippt status=Active → deletionRequested, setzt gracePeriodEnd aus dem
 // Compliance-Profile (geteilte Logik: startDeletionGracePeriod). Account-
@@ -29,10 +29,7 @@ export function createRequestDeletionHandler(opts = {}) {
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },
         handler: async (event, ctx) => {
-            // @cast-boundary engine-payload — queryAs returns unknown, narrowed to
-            // the compliance-profile shape.
-            const profile = (await ctx.queryAs(createSystemUser(event.user.tenantId), "compliance-profiles:query:for-tenant", {}));
-            const res = await startDeletionGracePeriod(ctx, event.user.id, profile.profile.userRights.gracePeriod, ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"));
+            const res = await startDeletionGracePeriod(ctx, event.user.id, () => resolveGracePeriod(ctx, event.user.tenantId), ctx.db.unsafeRaw("appends the user lifecycle event on the SYSTEM_TENANT_ID user stream"));
             if (!res.ok)
                 return writeFailure(res.error);
             const { gracePeriodEnd, userEmail, userLocale } = res;

package/dist/user-data-rights/lib/update-user-lifecycle.js

@@ -26,25 +26,18 @@ const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityNam
 // longer held (precondition_failed) or a concurrent writer won the race on
 // the same stream version (version_conflict) — both mean "someone else's
 // transition already landed", the expected outcome for a caller that opted
-// into `expect`. Any other failure, or a failure with no `expect` set (every
-// pre-#3024 caller), still throws — those callers never checked a return
-// value, so silently dropping their write would be silent data loss.
+// into `expect`. Any other failure, or a failure with no `expect` set, still
+// throws — those callers never checked a return value, so silently dropping
+// their write would be silent data loss.
 export async function updateUserLifecycle(conn, userId, changes, options) {
     // user ist systemStream (#497): der Executor-Choke-Point addressiert den
     // Stream immer auf SYSTEM_TENANT_ID — ein Rescope auf die row-tenant_id
     // waere wirkungslos. "system"-Mode, damit loadById auch Legacy-Rows findet,
     // deren tenant_id noch vor dem #762-Backfill-Rebuild steht.
-    // skipOptimisticLock stays true (kept correct, not just carried over): it
-    // was set from this function's very first version (#494) because every
-    // caller here is a server-side business transition (restrict/lift-
-    // restriction/grace-period/cancel/forget), never a client edit-conflict UI
-    // round-trip — none of them read-then-hold a row version to pass as
-    // `payload.version`, so the executor's version gate would reject every
-    // call outright without it (`update()` requires `payload.version` unless
-    // skipOptimisticLock is set). #3024 replaces the safety that decision gave
-    // up with the purpose-built `expect:` precondition above, checked fresh at
-    // write time — the mechanism now genuinely matches the caller's shape
-    // (a business-field guard) instead of a repurposed version check.
+    // skipOptimisticLock: every caller is a server-side business transition
+    // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
+    // version to pass as `payload.version`, which update() requires otherwise.
+    // Callers needing a guard use `options.expect` instead.
     const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
     const result = await userExecutor.update({ id: userId, changes }, createSystemUser(SYSTEM_TENANT_ID), tenantDb, { skipOptimisticLock: true, ...(options?.expect && { expect: options.expect }) });
     if (result.isSuccess)

package/dist/user-data-rights/run-export-jobs.d.ts

@@ -5,6 +5,7 @@ import type { MetricsHandle } from "@cosmicdrift/kumiko-framework/observability"
 import type { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 export declare const EXPORT_CLEANUP_BACKLOG_AGE_METRIC = "export_cleanup_backlog_age";
+export declare const EXPORT_CLEANUP_LAST_RUN_TIMESTAMP_METRIC = "export_cleanup_last_run_timestamp";
 export declare const tokenCrud: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor;
 /**
  * Notification-Callback fuer den done-Pfad. Pattern matched