@cosmicdrift/kumiko-bundled-features 0.334.0 → 0.336.0

package/dist/config/handlers/set.write.js

@@ -1,10 +1,11 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { ConfigScopes, defineWriteHandler, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
+import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { requireConfigEncryption, requireSystemDb } from "../feature.js";
+import { MASKED } from "../read-redaction.js";
 import { configValueEntity, configValuesTable } from "../table.js";
 import { findConfigRow, prepareConfigWrite, resolvePiiSubject, validateBounds, validateExtensionPlugin, validatePattern, validateScope, validateType, } from "../write-helpers.js";
 const scopeEnum = z.enum([ConfigScopes.system, ConfigScopes.tenant, ConfigScopes.user]);
@@ -53,7 +54,7 @@ export const setWrite = defineWriteHandler({
         const typeError = validateType(event.payload.value, keyDef);
         if (typeError)
             return writeFailure(typeError);
-        const pluginError = validateExtensionPlugin(ctx.registry, event.payload.key, event.payload.value);
+        const pluginError = validateExtensionPlugin(ctx.registry, event.payload.key, event.payload.value, keyDef);
         if (pluginError)
             return writeFailure(pluginError);
         // Bounds enforcement: hard-reject (not silent-clamp). A caller that
@@ -66,6 +67,9 @@ export const setWrite = defineWriteHandler({
         const patternError = validatePattern(event.payload.value, keyDef);
         if (patternError)
             return writeFailure(patternError);
+        // The batch idempotency cache stores this result and only masks entity
+        // writeOnly fields, so an at-rest-encrypted value must not be echoed.
+        const echoedValue = isEncryptedAtRest(keyDef) ? MASKED : event.payload.value;
         // backing="secrets": persist into the secrets store (system tenant, own
         // envelope encryption + audit) instead of config_values. Same JSON
         // serialization as a config row so the read path round-trips via
@@ -82,7 +86,7 @@ export const setWrite = defineWriteHandler({
             });
             return {
                 isSuccess: true,
-                data: { key: event.payload.key, value: event.payload.value, scope },
+                data: { key: event.payload.key, value: echoedValue, scope },
             };
         }
         let serialized = JSON.stringify(event.payload.value);
@@ -139,7 +143,7 @@ export const setWrite = defineWriteHandler({
         }
         return {
             isSuccess: true,
-            data: { key: event.payload.key, value: event.payload.value, scope },
+            data: { key: event.payload.key, value: echoedValue, scope },
         };
     },
 });

package/dist/config/web/i18n.js

@@ -9,6 +9,7 @@
 export const defaultTranslations = {
     en: {
         "config.secrets.delete": "Remove",
+        "config.secrets.deleteConfirm": "Remove this secret? Anything using it stops working, and it cannot be restored.",
         "config.secrets.notSet": "Not set",
         "config.secrets.placeholder": "Enter a value",
         "config.secrets.replacePlaceholder": "Enter a new value to replace it",

package/dist/config/write-helpers.d.ts

@@ -38,7 +38,7 @@ export declare function resolveScopeIds(scope: ConfigScope, tenantId: TenantId,
     userId: string | null;
 };
 export declare function resolvePiiSubject(scope: Exclude<ConfigScope, "system">, tenantId: TenantId, userId: string | null): SubjectId;
-export declare function validateExtensionPlugin(registry: Registry, key: string, value: string | number | boolean): KumikoError | null;
+export declare function validateExtensionPlugin(registry: Pick<Registry, "getAllExtensionSelectors" | "getExtensionUsages">, key: string, value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validateType(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validateBounds(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;
 export declare function validatePattern(value: string | number | boolean, keyDef: ConfigKeyDefinition): KumikoError | null;

package/dist/config/write-helpers.js

@@ -2,7 +2,7 @@
 // Extracted from set.write.ts so reset.write.ts + values.query.ts don't
 // have to cross-import from another handler file.
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
-import { ConfigScopes, extensionSelectorTargets, SYSTEM_ROLE, SYSTEM_TENANT_ID, selectablePluginIds, } from "@cosmicdrift/kumiko-framework/engine";
+import { ConfigScopes, extensionSelectorTargets, isEncryptedAtRest, SYSTEM_ROLE, SYSTEM_TENANT_ID, selectablePluginIds, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, NotFoundError, UnprocessableError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { assertUnreachable } from "@cosmicdrift/kumiko-framework/utils";
 import { ConfigErrors } from "./constants.js";
@@ -134,9 +134,14 @@ export function resolvePiiSubject(scope, tenantId, userId) {
     }
     return { kind: "tenant", tenantId };
 }
+// An encrypted value must not travel back in an error (logs, idempotency cache),
+// so rejection details spread this instead of naming `value` directly.
+function echoableValue(keyDef, value) {
+    return isEncryptedAtRest(keyDef) ? {} : { value };
+}
 // An extension-selector key may only name a mounted plugin (or "" to clear) —
 // otherwise the settings screen would show no panel for a typo'd value.
-export function validateExtensionPlugin(registry, key, value) {
+export function validateExtensionPlugin(registry, key, value, keyDef) {
     const extensionName = extensionSelectorTargets(registry).get(key);
     if (extensionName === undefined || value === "")
         return null;
@@ -145,7 +150,7 @@ export function validateExtensionPlugin(registry, key, value) {
         return null;
     return new UnprocessableError(ConfigErrors.unknownExtensionPlugin, {
         i18nKey: "config.errors.unknownExtensionPlugin",
-        details: { key, value, allowed },
+        details: { key, ...echoableValue(keyDef, value), allowed },
     });
 }
 export function validateType(value, keyDef) {
@@ -172,7 +177,7 @@ export function validateType(value, keyDef) {
                             path: "value",
                             code: "invalid_option",
                             i18nKey: "errors.validation.invalid_option",
-                            params: { value, options: keyDef.options },
+                            params: { ...echoableValue(keyDef, value), options: keyDef.options },
                         },
                     ],
                 });
@@ -254,13 +259,14 @@ export function validatePattern(value, keyDef) {
     }
     if (re.test(value))
         return null;
+    const echoedParams = { ...echoableValue(keyDef, value), pattern: keyDef.pattern.regex };
     return new ValidationError({
         fields: [
             {
                 path: "value",
                 code: "invalid_format",
                 i18nKey: "errors.validation.invalid_format",
-                params: { value, pattern: keyDef.pattern.regex },
+                params: echoedParams,
             },
         ],
     });

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -133,6 +133,17 @@ getRunner) {
     });
     return effective.policy?.strategy === "blockDelete" ? deny() : undefined;
 }
+// AccessDeniedError.code is the generic "access_denied" for every branch;
+// the specific branch lives in details.reason.
+function denialReasonOf(failure) {
+    const details = failure.error.details;
+    if (typeof details === "object" && details !== null && "reason" in details) {
+        const { reason } = details;
+        if (typeof reason === "string")
+            return reason;
+    }
+    return failure.error.code;
+}
 // Denied cross-tenant probes must still leave an audit trail (fw#2348).
 // Appended outside the handler tx (fw#2592): the caller's
 // `return tenantScopeDenial` rolls that tx back.
@@ -228,18 +239,14 @@ export const forgetSubjectWrite = defineWriteHandler({
         const subjectKey = subjectIdToKey(subject);
         const tenantScopeDenial = await resolveTenantScopeDenial(ctx.db.unsafeRaw("tenant-scope check runs against the subject's tenant, not necessarily the caller's"), ctx.registry.features, event.user, raw);
         if (tenantScopeDenial) {
-            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, tenantScopeDenial.error.code, ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
+            const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, denialReasonOf(tenantScopeDenial), ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
             return auditFailure ?? tenantScopeDenial;
         }
-        // Runs AFTER the tenant gate (VORHER only means "before the shred"): a
-        // retention check ahead of the tenant gate would leak a foreign
-        // entity's retention posture to a cross-tenant prober.
+        // Runs after the tenant gate but before any key is touched: a retention
+        // check ahead of the tenant gate would leak a foreign entity's retention
+        // posture to a cross-tenant prober.
         const retentionDenial = await resolveRetentionDenial(ctx, raw, () => ctx.db.unsafeRaw("retention check reads the record row's owning tenant, not the caller's"));
         if (retentionDenial) {
-            // Own reason constant, not tenantScopeDenial's `.error.code` pattern:
-            // AccessDeniedError.code is the generic "access_denied" for every
-            // branch, so re-deriving it here would make a blockDelete refusal
-            // indistinguishable from a cross-tenant one in the audit trail.
             const auditFailure = await appendDenialAuditEvent(ctx, event, subjectKey, raw.kind, TARGET_RECORD_RETENTION_BLOCK_DELETE, ctx.dbOutsideTransaction?.unsafeRaw("denial audit append: names the prober's own tenant stream on the outside-transaction db"));
             return auditFailure ?? retentionDenial;
         }

package/dist/custom-fields/constants.js

@@ -19,10 +19,7 @@ export const CustomFieldsHandlers = {
 export const CustomFieldsQueries = {
     fieldDefinitionList: "custom-fields:query:field-definition:list",
 };
-// Name the web component registers under in ExtensionSectionsProvider —
-// apps reference it in the screen schema via:
-// { kind: "extension", title, contributesToFormSubmit: true,
-//   component: { react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME } } }
+// Name the web component registers under in ExtensionSectionsProvider.
 export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits
 // these as `${entityName}.created`/`.updated` (dot form) — they do NOT run

package/dist/data-retention/resolve-for-tenant.d.ts

@@ -10,9 +10,8 @@ export interface ResolveForTenantArgs {
     /**
      * Layer 2 — Tenant-Preset. `undefined` (the default) means this resolver
      * derives it itself via resolveTenantRetentionPreset — one compliance-
-     * profile read per call, fine for single-lookup callers (`policy-for`, a
-     * per-hook TenantDb caller like notes-history-user-data). A bulk caller
-     * iterating N entities × M tenants (the forget-cleanup runner, the
+     * profile read per call, fine for single-lookup callers (`policy-for`). A
+     * bulk caller iterating N entities × M tenants (the forget-cleanup runner, the
      * retention-cleanup cron) MUST resolve it ONCE per tenant and pass it in
      * here instead, or it re-derives per entity. `null` means "resolved
      * already, no preset applies" — the resolver falls back to Entity-Default

package/dist/data-retention/run-retention-cleanup.js

@@ -41,7 +41,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { collectPiiSubjectFields, configuredPiiSubjectKms, isSelfPiiField, resolveSubjectForField, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, nullBlindIndexesForSubject, } from "@cosmicdrift/kumiko-framework/db";
 import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/derivatives";
-import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, entityHasAnonymizableSubjectField, } from "@cosmicdrift/kumiko-framework/engine";
 import { fileRefEntity, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
 import { runInSubTransaction } from "../shared/index.js";
 import { computeCutoff } from "./keep-for.js";
@@ -204,22 +204,62 @@ function isFileRefBoundElsewhere(fileRef, entityName, rowId) {
         return true;
     return false;
 }
-// A single-field fileRef-id can be shared by more than one row of the SAME
-// table (e.g. a stock-photo re-picked across records). Purging its bytes
-// would corrupt the row that isn't being deleted. Bounded by batchLimit rows
-// per run and singleFields.length queries per fileRef — the same per-row
-// event-cost tradeoff as the rest of this cron (see header).
-async function isFileRefSharedByOtherRow(db, table, tableHasTenantId, tenantId, rowId, singleFields, fileRefId) {
-    for (const field of singleFields) {
-        const where = { [field]: fileRefId, id: { ne: rowId } };
-        if (tableHasTenantId)
-            where["tenantId"] = tenantId;
-        const others = await selectMany(db, table, where, { limit: 1 });
-        if (others.length > 0)
-            return true;
+// Every implicit entity table with file/image fields: an unbound fileRef
+// (POST /files without entityType/entityId) can sit in single fields of
+// several entity types, so the sharing check must look beyond the purged
+// row's own table.
+function collectSingleFileHolders(registry) {
+    const holders = [];
+    for (const proj of registry.getAllProjections().values()) {
+        if (proj.isImplicit !== true || typeof proj.source !== "string" || !proj.table)
+            continue;
+        const entity = registry.getEntity(proj.source);
+        if (!entity)
+            continue;
+        const { singleFields } = planFileFields(entity.fields);
+        if (singleFields.length === 0)
+            continue;
+        const table = proj.table; // @cast-boundary column-presence probe
+        holders.push({
+            table: proj.table,
+            tableHasTenantId: table["tenantId"] !== undefined,
+            singleFields,
+        });
+    }
+    return holders;
+}
+// A single-field fileRef-id can be shared by more than one row, in the SAME
+// table (e.g. a stock-photo re-picked across records) or in another entity's
+// table. Purging its bytes would corrupt the row that isn't being deleted.
+// Bounded by batchLimit rows per run and holderFields queries per fileRef —
+// the same per-row event-cost tradeoff as the rest of this cron (see header).
+async function isFileRefSharedByOtherRow(db, holders, ownTable, tenantId, rowId, fileRefId) {
+    for (const holder of holders) {
+        for (const field of holder.singleFields) {
+            const where = { [field]: fileRefId };
+            if (holder.table === ownTable)
+                where["id"] = { ne: rowId };
+            if (holder.tableHasTenantId)
+                where["tenantId"] = tenantId;
+            const others = await selectMany(db, holder.table, where, { limit: 1 });
+            if (others.length > 0)
+                return true;
+        }
     }
     return false;
 }
+// Throws (unsafe key, missing list permission) must fail this row closed,
+// not abort the whole tenant run.
+async function deleteFileFailingClosed(key, store, logContext) {
+    try {
+        return await deleteStoredFileAndDerivatives(key, store, "data-retention:hardDelete");
+    }
+    catch (err) {
+        // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
+        console.warn(`[data-retention:hardDelete] ${logContext} storage cleanup threw: ${err instanceof Error ? err.message : String(err)}`);
+        return [key];
+    }
+}
 // hardDelete for ONE row of an entity that has file/image/files/images
 // fields: delete the un-shared fileRefs' bytes (+ derivatives) first, then
 // their fileRef rows, then the entity row itself — bytes before rows so a
@@ -251,7 +291,7 @@ async function purgeHardDeleteRowWithFiles(args) {
     for (const fileRef of fileRefRows) {
         if (isFileRefBoundElsewhere(fileRef, args.entityName, rowId))
             continue;
-        const shared = await isFileRefSharedByOtherRow(args.db, args.table, args.tableHasTenantId, args.tenantId, rowId, args.plan.singleFields, String(fileRef["id"]));
+        const shared = await isFileRefSharedByOtherRow(args.db, args.fileHolders, args.table, args.tenantId, rowId, String(fileRef["id"]));
         if (shared)
             continue;
         toDelete.push(fileRef);
@@ -270,7 +310,7 @@ async function purgeHardDeleteRowWithFiles(args) {
         const key = fileRef["storageKey"];
         if (typeof key !== "string" || key.length === 0)
             continue;
-        const failedKeys = await deleteStoredFileAndDerivatives(key, store, "data-retention:hardDelete");
+        const failedKeys = await deleteFileFailingClosed(key, store, `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`);
         if (failedKeys.length > 0) {
             anyFailed = true;
             // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
@@ -295,9 +335,6 @@ async function purgeHardDeleteRowWithFiles(args) {
 // each skip reason at most once per entity per run (repeat skips would just
 // be noise; the per-row failure is already warned above).
 async function purgeHardDeleteRowsWithFiles(args) {
-    const rows = await selectMany(args.db, args.table, args.where, {
-        limit: args.batchLimit,
-    });
     const reasonsSeen = new Set();
     const onSkip = (reason) => {
         // skip: reason already reported for this entity in this run
@@ -306,28 +343,44 @@ async function purgeHardDeleteRowsWithFiles(args) {
         reasonsSeen.add(reason);
         args.skipped.push({ entityName: args.entityName, reason });
     };
+    // id-cursor paging: rows skipped (missing storage, failed delete) stay in the
+    // table, so an unordered limit-page would re-fetch the same stuck rows every
+    // run and starve every row behind them. batchLimit bounds the DELETES.
     let count = 0;
-    for (const row of rows) {
-        const ok = await purgeHardDeleteRowWithFiles({
-            db: args.db,
-            table: args.table,
-            tableHasTenantId: args.tableHasTenantId,
-            tenantId: args.tenantId,
-            entityName: args.entityName,
-            entity: args.entity,
-            row,
-            plan: args.plan,
-            files: args.files,
-            entityExecutor: args.entityExecutor,
-            fileRefExecutor: args.fileRefExecutor,
-            systemUser: args.systemUser,
-            tdb: args.tdb,
-            kms: args.kms,
-            registry: args.registry,
-            onSkip,
+    let cursor = null;
+    while (count < args.batchLimit) {
+        const pageWhere = cursor === null ? args.where : { ...args.where, id: { gt: cursor } };
+        const rows = await selectMany(args.db, args.table, pageWhere, {
+            limit: args.batchLimit,
+            orderBy: { col: "id" },
         });
-        if (ok)
-            count++;
+        if (rows.length === 0)
+            break;
+        for (const row of rows) {
+            cursor = row["id"]; // @cast-boundary db-row
+            const ok = await purgeHardDeleteRowWithFiles({
+                db: args.db,
+                table: args.table,
+                fileHolders: args.fileHolders,
+                tenantId: args.tenantId,
+                entityName: args.entityName,
+                entity: args.entity,
+                row,
+                plan: args.plan,
+                files: args.files,
+                entityExecutor: args.entityExecutor,
+                fileRefExecutor: args.fileRefExecutor,
+                systemUser: args.systemUser,
+                tdb: args.tdb,
+                kms: args.kms,
+                registry: args.registry,
+                onSkip,
+            });
+            if (ok)
+                count++;
+            if (count >= args.batchLimit)
+                break;
+        }
     }
     return count;
 }
@@ -394,6 +447,7 @@ export async function runRetentionCleanup(args) {
     // filter shrinks the set). A single batched forget/delete event is a follow-up.
     const systemUser = createSystemUser(tenantId);
     const tdb = createTenantDb(db, tenantId, "system");
+    const fileHolders = collectSingleFileHolders(registry);
     // Pre-load every override row for this tenant ONCE — N entities × M
     // tenants would otherwise mean one fetchOne per entity per tenant, even
     // though the whole set for a tenant is a single small, indexed read.
@@ -458,7 +512,7 @@ export async function runRetentionCleanup(args) {
                 hardDeleted += await purgeHardDeleteRowsWithFiles({
                     db,
                     table: proj.table,
-                    tableHasTenantId: table["tenantId"] !== undefined,
+                    fileHolders,
                     where,
                     batchLimit,
                     tenantId,
@@ -495,10 +549,12 @@ export async function runRetentionCleanup(args) {
             case "blockDelete": {
                 const targets = await resolveAnonymizeTargets(entity.fields);
                 if (!targets) {
-                    // blockDelete without anonymize fields is a pure hold: a subjectRef-only
-                    // person link outlives the hold and is cut only by the user-data
-                    // forget hook, so expiry has nothing to do here and is not reported.
-                    if (policy.strategy === "anonymize") {
+                    // blockDelete without anonymize fields is a pure hold only while the
+                    // entity has no field that CAN carry anonymize: a subjectRef-only
+                    // person link outlives the hold and is cut by the user-data forget
+                    // hook. A personal field lacking its anonymize function would stay
+                    // stored past the hold, so that case is still reported.
+                    if (policy.strategy === "anonymize" || entityHasAnonymizableSubjectField(entity.fields)) {
                         skipped.push({ entityName, reason: "missing_anonymize_fields" });
                     }
                     break;

package/dist/delivery/handlers/log.query.js

@@ -1,5 +1,5 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import { decodeKeysetCursor, encodeKeysetCursor } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
@@ -28,15 +28,15 @@ function isDeliveryLogSortField(value) {
 // PHYSICAL column, not the display alias — row only has the DB field names
 // (e.g. notificationType), never the alias (e.g. "type").
 function encodeSortCursor(column, row) {
-    if (column === "createdAt")
-        return encodeCursor(row.createdAt.toString());
-    return encodeCursor(String(row[column]));
+    const sortValue = column === "createdAt" ? row.createdAt.toString() : String(row[column]);
+    return encodeKeysetCursor(sortValue, row.id);
 }
+// lastId is undefined for a legacy sort-value-only cursor still in flight.
 function decodeSortCursor(column, cursor) {
-    const decoded = decodeCursor(cursor);
-    if (column === "createdAt")
-        return Temporal.Instant.from(decoded);
-    return decoded;
+    const decoded = decodeKeysetCursor(cursor);
+    const raw = decoded.sortValue ?? decoded.id;
+    const sortValue = column === "createdAt" ? Temporal.Instant.from(raw) : raw;
+    return { sortValue, lastId: decoded.sortValue === undefined ? undefined : decoded.id };
 }
 export const logQuery = definePagedQueryHandler({
     name: "log",
@@ -70,23 +70,32 @@ export const logQuery = definePagedQueryHandler({
         const sortColumn = DELIVERY_LOG_SORT_COLUMNS[sortField];
         // TenantAdmin/Admin stay strictly tenant-scoped; SystemAdmin sees every
         // tenant's attempts (platform waitlist confirmations live on SYSTEM_TENANT_ID).
-        const where = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
-        if (query.payload.cursor) {
-            where[sortColumn] = {
-                [sortDirection === "asc" ? "gt" : "lt"]: decodeSortCursor(sortColumn, query.payload.cursor),
-            };
-        }
-        const rows = await selectMany(db, deliveryAttemptsTable, where, {
-            // Tie-breaker on id keeps ordering stable across pages when the sort
-            // column has duplicate values (e.g. many rows with the same status).
-            orderBy: [
-                { col: sortColumn, direction: sortDirection },
-                { col: "id", direction: "asc" },
-            ],
-            limit: query.payload.limit,
-        });
+        const baseWhere = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
+        const limit = query.payload.limit;
+        const cursor = query.payload.cursor
+            ? decodeSortCursor(sortColumn, query.payload.cursor)
+            : undefined;
+        const beyondSortValue = sortDirection === "asc" ? "gt" : "lt";
+        // Keyset page = rows still tied on the cursor's sort value (id after the
+        // cursor's id), then rows strictly beyond it. Both halves are ordered the
+        // same way as the overall ORDER BY, so concatenation preserves it.
+        const tiedRows = cursor?.lastId !== undefined
+            ? await selectMany(db, deliveryAttemptsTable, { ...baseWhere, [sortColumn]: cursor.sortValue, id: { gt: cursor.lastId } }, { orderBy: [{ col: "id", direction: "asc" }], limit })
+            : [];
+        const beyondRows = tiedRows.length < limit
+            ? await selectMany(db, deliveryAttemptsTable, cursor
+                ? { ...baseWhere, [sortColumn]: { [beyondSortValue]: cursor.sortValue } }
+                : baseWhere, {
+                orderBy: [
+                    { col: sortColumn, direction: sortDirection },
+                    { col: "id", direction: "asc" },
+                ],
+                limit: limit - tiedRows.length,
+            })
+            : [];
+        const rows = [...tiedRows, ...beyondRows];
         const lastRow = rows[rows.length - 1];
-        const nextCursor = rows.length === query.payload.limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
+        const nextCursor = rows.length === limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
         // recipientAddress is stored encrypted under the recipient's DEK (#799)
         // — decrypt for the admin log view; forgotten subjects show [[erased]].
         // The notificationType/recipientAddress → type/recipient rename happens

package/dist/delivery/types.d.ts

@@ -23,7 +23,8 @@ export type RenderedMessage = {
     readonly html: string;
     readonly subject: string;
 };
-export type DeliveryChannelMode = "inline" | "queued";
+export declare const DELIVERY_CHANNEL_MODES: readonly ["inline", "queued"];
+export type DeliveryChannelMode = (typeof DELIVERY_CHANNEL_MODES)[number];
 export type DeliveryChannel = {
     readonly name: string;
     readonly mode: DeliveryChannelMode;

package/dist/delivery/types.js

@@ -1,8 +1,15 @@
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
+// `mode` decides how the delivery-service dispatches a channel:
+//   inline — sent synchronously inside notify() (inApp: DB insert + SSE).
+//   queued — sent asynchronously via the delivery.send job; channels with a
+//            render() additionally run through delivery.render first.
+export const DELIVERY_CHANNEL_MODES = ["inline", "queued"];
 export function isDeliveryChannelPlugin(o) {
     return (typeof o === "object" &&
         o !== null &&
         "mode" in o &&
+        DELIVERY_CHANNEL_MODES.some((mode) => mode === o.mode) &&
+        (!("render" in o) || o.render === undefined || typeof o.render === "function") &&
         "resolve" in o &&
         typeof o.resolve === "function" &&
         "send" in o &&

package/dist/delivery/unsubscribe.js

@@ -213,13 +213,7 @@ function confirmationPage(token) {
 // One-click clients put the token in the query string; only the
 // confirmation-page form submits it in the body.
 function tokenFromPostRequest(request) {
-    const contentType = request.headers["content-type"];
-    if (contentType?.includes("application/x-www-form-urlencoded")) {
-        const fromBody = new URLSearchParams(request.rawBody).get("token");
-        if (fromBody)
-            return fromBody;
-    }
-    return request.query["token"];
+    return tokenFromRequestBody(request) ?? request.query["token"];
 }
 // Resubscribe is deliberately NOT reachable via the query string — a mail
 // client's link prefetcher (or a scanner) following an unsubscribe link
@@ -227,10 +221,10 @@ function tokenFromPostRequest(request) {
 // convention is built to avoid; resubscribe carries the same risk in
 // reverse (a prefetch that undoes a real opt-out) and gets no query-param
 // fallback at all.
-function tokenFromResubscribeRequest(request) {
+function tokenFromRequestBody(request) {
     const contentType = request.headers["content-type"];
     if (contentType?.includes("application/x-www-form-urlencoded")) {
-        return new URLSearchParams(request.rawBody).get("token") ?? undefined;
+        return new URLSearchParams(request.rawBody).get("token") || undefined;
     }
     if (contentType?.includes("application/json")) {
         try {
@@ -278,13 +272,13 @@ export function createUnsubscribeRoutes(options) {
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
-    // (see tokenFromResubscribeRequest) — no GET confirmation-page variant,
+    // (see tokenFromRequestBody) — no GET confirmation-page variant,
     // this is a one-shot POST from the unsubscribe-page's "Undo" button.
     const resubscribeRoute = signatureRoute({
         method: "POST",
         path: DELIVERY_RESUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyUnsubscribeToken(tokenFromResubscribeRequest(request), encodedSecret),
+        verify: async (request) => verifyUnsubscribeToken(tokenFromRequestBody(request), encodedSecret),
         handler: async (c, verified, deps) => {
             const outcome = await dispatchResubscribeWrite(verified, deps);
             if (outcome === "limit_reached") {

package/dist/derivatives-sharp/render.js

@@ -124,24 +124,40 @@ function overlayPosition(gravity, marginPx, outputWidth, outputHeight, layerWidt
 // fraction of the output is a fraction of what the caller actually gets,
 // regardless of the source's own dimensions or `fit` crop.
 async function applyOverlays(pipeline, layers) {
-    const { data, info } = await pipeline.toBuffer({ resolveWithObject: true });
+    // PNG intermediate: a bare toBuffer() re-encodes in the source format, so a
+    // JPEG source would gain an extra lossy generation before applyEncoder runs.
+    const { data, info } = await pipeline.png().toBuffer({ resolveWithObject: true });
     const composites = [];
     for (const layer of layers) {
+        const targetWidth = Math.max(1, Math.round(info.width * layer.widthPct));
+        // The QR is square, so the output height bounds its side just like the width does.
+        const qrSide = Math.min(targetWidth, info.height);
+        if (layer.kind === "qr" && qrSide < MIN_QR_PIXEL_WIDTH) {
+            throw new Error(`derivatives-sharp: qr overlay would render at ${qrSide}px wide, below the ${MIN_QR_PIXEL_WIDTH}px minimum a camera can reliably scan.`);
+        }
+        // Rendered at its final size so the modules stay hard-edged; resampling a
+        // small default-size QR to a non-integer module size blurs them.
         const layerBytes = layer.kind === "qr"
-            ? await QRCode.toBuffer(layer.data, { margin: 1, errorCorrectionLevel: "M" })
+            ? await QRCode.toBuffer(layer.data, {
+                width: qrSide,
+                margin: 1,
+                errorCorrectionLevel: "M",
+            })
             : Buffer.from(layer.imageBase64, "base64");
         const layerMeta = await sharp(layerBytes, SHARP_INPUT_OPTIONS).metadata();
         assertNotSvg(layerMeta.format);
-        const targetWidth = Math.max(1, Math.round(info.width * layer.widthPct));
-        if (layer.kind === "qr" && targetWidth < MIN_QR_PIXEL_WIDTH) {
-            throw new Error(`derivatives-sharp: qr overlay would render at ${targetWidth}px wide, below the ${MIN_QR_PIXEL_WIDTH}px minimum a camera can reliably scan.`);
-        }
         // PNG (not the layer's own format) to keep any alpha through the resize.
         // height caps the other axis too — sharp's composite() rejects an input
         // larger than the base image, which a tall/square layer would otherwise
         // hit once widthPct alone drives its width past the output's height.
         const resized = await sharp(layerBytes, SHARP_INPUT_OPTIONS)
-            .resize({ width: targetWidth, height: info.height, fit: "inside" })
+            .resize({
+            width: targetWidth,
+            height: info.height,
+            fit: "inside",
+            // Only ever a sub-pixel correction for a QR; keeps module edges crisp.
+            kernel: layer.kind === "qr" ? "nearest" : "lanczos3",
+        })
             .png()
             .toBuffer({ resolveWithObject: true });
         const marginPx = Math.round(info.width * (layer.marginPct ?? 0));
@@ -212,7 +228,8 @@ function assertOverlayLayerBounds(layer) {
     if (!Number.isFinite(layer.widthPct) || layer.widthPct <= 0 || layer.widthPct > 1) {
         throw new Error(`derivatives-sharp: overlay widthPct ${layer.widthPct} is out of range — must be a finite number in (0, 1].`);
     }
-    if (layer.marginPct !== undefined && (layer.marginPct < 0 || layer.marginPct >= 0.5)) {
+    if (layer.marginPct !== undefined &&
+        (!Number.isFinite(layer.marginPct) || layer.marginPct < 0 || layer.marginPct >= 0.5)) {
         throw new Error(`derivatives-sharp: overlay marginPct ${layer.marginPct} is out of range — must be within [0, 0.5).`);
     }
     if (layer.kind === "qr") {
@@ -278,7 +295,8 @@ export const renderImage = async (input, spec, sourceMimeType) => {
     // the output.
     let pipeline = sharp(input, SHARP_INPUT_OPTIONS).rotate();
     if (spec.blurRegions && spec.blurRegions.length > 0) {
-        const { data, info } = await pipeline.toBuffer({ resolveWithObject: true });
+        // PNG intermediate for the same reason as in applyOverlays (no extra lossy generation).
+        const { data, info } = await pipeline.png().toBuffer({ resolveWithObject: true });
         const blurred = await applyBlurRegions(data, info.width, info.height, spec.blurRegions);
         pipeline = sharp(blurred, SHARP_INPUT_OPTIONS);
     }