@cosmicdrift/kumiko-bundled-features 0.335.0 → 0.336.0

package/dist/auth-mfa/handlers/status.query.js

@@ -12,6 +12,7 @@ import { userMfaTable } from "../schema/user-mfa.js";
 export const mfaStatusQuery = defineQueryHandler({
     name: "user-mfa:status",
     schema: z.object({}),
+    outputSchema: z.object({ enabled: z.boolean() }),
     access: {
         openToAll: {
             reason: "each signed-in user reads only their own MFA status; the query filters " +

package/dist/auth-mfa-user-data/hooks.js

@@ -9,7 +9,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { userMfaEntity, userMfaTable } from "../auth-mfa/index.js";
-import { assertErased } from "../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../shared/index.js";
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
     entityName: "user-mfa",
 });
@@ -41,7 +41,9 @@ export const userMfaDeleteHook = async (ctx) => {
     if (rows.length === 0)
         return;
     const systemUser = createSystemUser(ctx.tenantId);
+    const failures = [];
     for (const row of rows) {
-        assertErased(await executor.forget({ id: row.id }, systemUser, ctx.db), "user-mfa", row.id);
+        collectErasureFailure(await executor.forget({ id: row.id }, systemUser, ctx.db), "user-mfa", row.id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/cap-counter/book-cap-usage.js

@@ -84,6 +84,11 @@ export async function markCapSoftWarned(ctx, options) {
         if (!row) {
             throw new Error("cap-counter.markCapSoftWarned: row vanished between length-check and read");
         }
+        // A version-conflict retry lands here after a parallel warner already set the flag; a second
+        // write would only append a redundant event with a newer timestamp.
+        if (row["lastSoftWarnedAt"] !== null) {
+            return { isSuccess: true, data: row };
+        }
         const currentVersion = row["version"]; // @cast-boundary db-row
         return executor.update({
             id: aggregateId,

package/dist/delivery/handlers/log.query.js

@@ -1,5 +1,5 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import { decodeKeysetCursor, encodeKeysetCursor } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
@@ -28,15 +28,15 @@ function isDeliveryLogSortField(value) {
 // PHYSICAL column, not the display alias — row only has the DB field names
 // (e.g. notificationType), never the alias (e.g. "type").
 function encodeSortCursor(column, row) {
-    if (column === "createdAt")
-        return encodeCursor(row.createdAt.toString());
-    return encodeCursor(String(row[column]));
+    const sortValue = column === "createdAt" ? row.createdAt.toString() : String(row[column]);
+    return encodeKeysetCursor(sortValue, row.id);
 }
+// lastId is undefined for a legacy sort-value-only cursor still in flight.
 function decodeSortCursor(column, cursor) {
-    const decoded = decodeCursor(cursor);
-    if (column === "createdAt")
-        return Temporal.Instant.from(decoded);
-    return decoded;
+    const decoded = decodeKeysetCursor(cursor);
+    const raw = decoded.sortValue ?? decoded.id;
+    const sortValue = column === "createdAt" ? Temporal.Instant.from(raw) : raw;
+    return { sortValue, lastId: decoded.sortValue === undefined ? undefined : decoded.id };
 }
 export const logQuery = definePagedQueryHandler({
     name: "log",
@@ -70,23 +70,32 @@ export const logQuery = definePagedQueryHandler({
         const sortColumn = DELIVERY_LOG_SORT_COLUMNS[sortField];
         // TenantAdmin/Admin stay strictly tenant-scoped; SystemAdmin sees every
         // tenant's attempts (platform waitlist confirmations live on SYSTEM_TENANT_ID).
-        const where = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
-        if (query.payload.cursor) {
-            where[sortColumn] = {
-                [sortDirection === "asc" ? "gt" : "lt"]: decodeSortCursor(sortColumn, query.payload.cursor),
-            };
-        }
-        const rows = await selectMany(db, deliveryAttemptsTable, where, {
-            // Tie-breaker on id keeps ordering stable across pages when the sort
-            // column has duplicate values (e.g. many rows with the same status).
-            orderBy: [
-                { col: sortColumn, direction: sortDirection },
-                { col: "id", direction: "asc" },
-            ],
-            limit: query.payload.limit,
-        });
+        const baseWhere = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
+        const limit = query.payload.limit;
+        const cursor = query.payload.cursor
+            ? decodeSortCursor(sortColumn, query.payload.cursor)
+            : undefined;
+        const beyondSortValue = sortDirection === "asc" ? "gt" : "lt";
+        // Keyset page = rows still tied on the cursor's sort value (id after the
+        // cursor's id), then rows strictly beyond it. Both halves are ordered the
+        // same way as the overall ORDER BY, so concatenation preserves it.
+        const tiedRows = cursor?.lastId !== undefined
+            ? await selectMany(db, deliveryAttemptsTable, { ...baseWhere, [sortColumn]: cursor.sortValue, id: { gt: cursor.lastId } }, { orderBy: [{ col: "id", direction: "asc" }], limit })
+            : [];
+        const beyondRows = tiedRows.length < limit
+            ? await selectMany(db, deliveryAttemptsTable, cursor
+                ? { ...baseWhere, [sortColumn]: { [beyondSortValue]: cursor.sortValue } }
+                : baseWhere, {
+                orderBy: [
+                    { col: sortColumn, direction: sortDirection },
+                    { col: "id", direction: "asc" },
+                ],
+                limit: limit - tiedRows.length,
+            })
+            : [];
+        const rows = [...tiedRows, ...beyondRows];
         const lastRow = rows[rows.length - 1];
-        const nextCursor = rows.length === query.payload.limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
+        const nextCursor = rows.length === limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
         // recipientAddress is stored encrypted under the recipient's DEK (#799)
         // — decrypt for the admin log view; forgotten subjects show [[erased]].
         // The notificationType/recipientAddress → type/recipient rename happens

package/dist/feature-toggles/toggle-runtime.d.ts

@@ -9,6 +9,7 @@ export declare class GlobalFeatureToggleRuntime {
     private readonly registry;
     private readonly syncSignal?;
     private snapshot;
+    private appliedDuringLoad;
     constructor(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal | undefined);
     initialize(): Promise<void>;
     refresh(): Promise<void>;

package/dist/feature-toggles/toggle-runtime.js

@@ -17,6 +17,9 @@ export class GlobalFeatureToggleRuntime {
     registry;
     syncSignal;
     snapshot = new Map();
+    // Flips applied while a snapshot load is in flight. The load's SELECT may have
+    // started before the flip committed, so its rows can be older than these.
+    appliedDuringLoad;
     constructor(db, registry, syncSignal) {
         this.db = db;
         this.registry = registry;
@@ -30,8 +33,18 @@ export class GlobalFeatureToggleRuntime {
         });
     }
     async initialize() {
-        const rows = await selectMany(this.db, globalFeatureStateTable);
-        this.snapshot = new Map(rows.map((r) => [r.featureName, r.enabled]));
+        const pendingFlips = new Map();
+        this.appliedDuringLoad = pendingFlips;
+        try {
+            const rows = await selectMany(this.db, globalFeatureStateTable);
+            this.snapshot = new Map([
+                ...rows.map((r) => [r.featureName, r.enabled]),
+                ...pendingFlips,
+            ]);
+        }
+        finally {
+            this.appliedDuringLoad = undefined;
+        }
     }
     // Re-read the full snapshot. Called from the set-handler after a
     // successful write — cheap point-update would be an optimisation but
@@ -46,6 +59,7 @@ export class GlobalFeatureToggleRuntime {
     // lock. Kept alongside refresh() so both options are explicit.
     apply(featureName, enabled) {
         this.snapshot.set(featureName, enabled);
+        this.appliedDuringLoad?.set(featureName, enabled);
     }
     // Called by the toggle-cache-sync MSP handler (feature.ts) — the one
     // process whose shared cursor won a given toggle-set event. With a

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -12,30 +12,37 @@
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { mapWithConcurrency } from "../../../shared/index.js";
 import { encryptFailureError } from "../../job-run-logger.js";
 import { jobRunsTable } from "../../job-run-table.js";
+const KMS_POOL_CONCURRENCY = 4;
 export const STALE_JOB_RUN_ERROR = "job run exceeded the stale-run timeout without a completion signal (likely a crashed worker process)";
 export async function markStaleJobRunsFailed(db, timeoutHours) {
     const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
     const now = Temporal.Now.instant();
     // Fetch the matched rows first: `error` carries the same per-triggering-
     // user subject annotation as job-run-logger.ts's onJobFailed path
-    // (personal: { of: "triggeredById" } on job-run-table.ts), and a batch
-    // updateMany can't encrypt per-row — different matched runs can belong to
-    // different users, each under their own DEK. One updateMany per row keeps
-    // this crash-recovery sweep's write on the same encrypted footing as the
-    // normal failure path instead of writing STALE_JOB_RUN_ERROR in the clear.
+    // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
+    // under that subject's DEK. Runs are grouped by subject: one encrypt and one
+    // updateMany per subject instead of per run.
     const stale = await selectMany(db, jobRunsTable, {
         status: "running",
         startedAt: { lt: cutoff },
     });
+    const idsBySubject = new Map();
+    for (const run of stale) {
+        const ids = idsBySubject.get(run.triggeredById);
+        if (ids)
+            ids.push(run.id);
+        else
+            idsBySubject.set(run.triggeredById, [run.id]);
+    }
     // duration is deliberately left untouched: we don't know when the run
     // actually died, only that it crossed the timeout, so recording a
     // duration would misrepresent it as measured. detail-screen/list-screen
     // both already render a null duration as "—".
-    let runsMarkedFailed = 0;
-    for (const run of stale) {
-        const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, run.triggeredById);
+    const updatedPerSubject = await mapWithConcurrency([...idsBySubject], KMS_POOL_CONCURRENCY, async ([triggeredById, ids]) => {
+        const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, triggeredById);
         const updated = await updateMany(db, jobRunsTable, {
             status: "failed",
             error: encryptedError,
@@ -43,12 +50,12 @@ export async function markStaleJobRunsFailed(db, timeoutHours) {
             modifiedAt: now,
             modifiedById: "system",
         }, 
-        // Re-assert status: "running" here (not just id) — closes the race
-        // window between the selectMany above and this write, where the run
-        // could have completed/failed normally in between and must not be
-        // clobbered back to "failed" with the stale-timeout message.
-        { id: run.id, status: "running" });
-        runsMarkedFailed += updated.length;
-    }
+        // Re-assert status: "running" (not just id) — closes the race window
+        // between the selectMany above and this write, where a run could have
+        // completed/failed normally and must not be clobbered back to "failed".
+        { id: { in: ids }, status: "running" });
+        return updated.length;
+    });
+    const runsMarkedFailed = updatedPerSubject.reduce((sum, count) => sum + count, 0);
     return { runsMarkedFailed };
 }

package/dist/notes-history-user-data/hooks.js

@@ -64,21 +64,28 @@ export const noteEntryDeleteHook = async (ctx) => {
         registry: ctx.registry,
         tenantId: ctx.tenantId,
     });
-    for (const noteId of noteIds) {
-        const note = await ctx.db.fetchOne(noteEntryTable, { id: noteId });
-        // Defensive: append-only rows are never hard-deleted, so this shouldn't
-        // happen — but a missing host means no retention policy to consult.
-        if (!note)
-            continue;
-        const hostPolicy = await resolveRetentionPolicyForTenant({
-            db: ctx.db,
-            registry: ctx.registry,
-            tenantId: ctx.tenantId,
-            entityName: note.entityType,
-            preloadedTenantPreset: tenantPreset,
-        });
-        if (policyToStrategy(hostPolicy.policy?.strategy ?? null) === "anonymize")
+    // Append-only rows are never hard-deleted, so every mentioned note should
+    // resolve; a missing one has no host and thus no retention policy to consult.
+    const notes = await ctx.db.selectMany(noteEntryTable, {
+        id: { in: [...noteIds] },
+    });
+    const strategyByEntityType = new Map();
+    for (const note of notes) {
+        let strategy = strategyByEntityType.get(note.entityType);
+        if (strategy === undefined) {
+            const hostPolicy = await resolveRetentionPolicyForTenant({
+                db: ctx.db,
+                registry: ctx.registry,
+                tenantId: ctx.tenantId,
+                entityName: note.entityType,
+                preloadedTenantPreset: tenantPreset,
+            });
+            strategy = policyToStrategy(hostPolicy.policy?.strategy ?? null);
+            strategyByEntityType.set(note.entityType, strategy);
+        }
+        if (strategy === "anonymize")
             continue;
+        const noteId = note.id;
         await kms.eraseKey({ kind: "record", entity: "note-entry", id: noteId }, {
             requestId: "notes-history-user-data:forget-mentioned-notes",
             userId: ctx.userId,

package/dist/personal-access-tokens/revoke-for-user.js

@@ -1,15 +1,26 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN, patRevokedSchema, } from "./pat-revoked-event.js";
 import { apiTokenTable } from "./schema/api-token.js";
+// A pool has begin(); a tx/savepoint handle does not and is already atomic.
+function canBeginTransaction(db) {
+    return typeof db.begin === "function"; // @cast-boundary driver-handle-probe
+}
 // Cross-tenant revoke: password-change and MFA-enable/disable are account-
 // level security events, not scoped to one tenant. Mirrors sessions'
 // sessionMassRevoker (session-callbacks.ts) which passes the boot-time
 // DbConnection directly — not ctx.db, which would be tenant-scoped in a hook.
 export async function revokeAllPatTokensForUser(db, userId) {
+    // Update and event commit together: otherwise a failed append leaves the
+    // tokens revoked with no event, and a retry matches no live row.
+    return canBeginTransaction(db)
+        ? transaction(db, (tx) => revokeAndAppend(tx, userId))
+        : revokeAndAppend(db, userId);
+}
+async function revokeAndAppend(db, userId) {
     const updated = await updateMany(db, apiTokenTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
     // Same reasoning as sessionMassRevoker's append — this raw
     // callback has no dispatcher ctx to call unsafeAppendEvent from, so it

package/dist/sessions/session-callbacks.js

@@ -1,4 +1,4 @@
-import { fetchOne, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -37,30 +37,35 @@ export function createSessionCallbacks(opts) {
             // original timestamp. Double-revoke races land here via logout +
             // switch-tenant on the same sid. (Password-change uses a different
             // callback — sessionMassRevoker — and isn't in scope for this guard.)
-            const result = await updateMany(db, userSessionTable, { revokedAt: Temporal.Now.instant() }, { id: sid, revokedAt: null });
-            // This is the ONLY caller of sessionRevoker — logout and tenant-switch
-            // — so it's also the only source of streamScope: "revoked-sessions".
-            // Without this append, a live SSE stream on this exact sid outlives its
-            // own logout because the access-invalidation consumer never hears
-            // about it — same gap sessionMassRevoker closed for
-            // password-change.
-            const revoked = result[0];
-            if (revoked) {
-                const payload = sessionRevokedSchema.parse({
-                    userId: revoked.userId,
-                    sessionIds: [sid],
-                    streamScope: "revoked-sessions",
-                });
-                await append(db, {
-                    aggregateId: generateId(),
-                    aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
-                    tenantId: SYSTEM_TENANT_ID,
-                    expectedVersion: 0,
-                    type: SESSION_REVOKED_EVENT_QN,
-                    payload,
-                    metadata: { userId: revoked.userId },
-                });
-            }
+            // One transaction: if the append failed after the update committed, a
+            // retried logout would match no live row (revokedAt IS NULL) and never
+            // emit the event, leaving the SSE stream of this sid open until JWT expiry.
+            await transaction(db, async (tx) => {
+                const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, { id: sid, revokedAt: null });
+                // This is the ONLY caller of sessionRevoker — logout and tenant-switch
+                // — so it's also the only source of streamScope: "revoked-sessions".
+                // Without this append, a live SSE stream on this exact sid outlives its
+                // own logout because the access-invalidation consumer never hears
+                // about it — same gap sessionMassRevoker closed for
+                // password-change.
+                const revoked = result[0];
+                if (revoked) {
+                    const payload = sessionRevokedSchema.parse({
+                        userId: revoked.userId,
+                        sessionIds: [sid],
+                        streamScope: "revoked-sessions",
+                    });
+                    await append(tx, {
+                        aggregateId: generateId(),
+                        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+                        tenantId: SYSTEM_TENANT_ID,
+                        expectedVersion: 0,
+                        type: SESSION_REVOKED_EVENT_QN,
+                        payload,
+                        metadata: { userId: revoked.userId },
+                    });
+                }
+            });
         },
         // kumiko-lint-ignore complexity-budget session check + lastSeen refresh on hot path
         async sessionChecker(sid, expectedUserId) {
@@ -140,58 +145,64 @@ export function createSessionCallbacks(opts) {
         async sessionMassRevoker(userId) {
             // Count is accurate because we only touch live rows — a previously
             // revoked row stays in its state and isn't double-counted.
-            const result = await updateMany(db, userSessionTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
-            // Lightweight append alongside the direct-write above, same pattern
-            // as revoke.write.ts (#1559) — this callback is the password-change
-            // auto-revoke path (sessions/feature.ts postSave hook) and has no
-            // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
-            // append() like revoke-all-for-user.write.ts does. Without this, the
-            // access-invalidation consumer (#1560) never hears about a password
-            // change and an already-open SSE stream survives it — the exact
-            // "stale JWT mid-stream" gap this feature exists to close.
-            if (result.length > 0) {
-                const payload = sessionRevokedSchema.parse({
-                    userId,
-                    sessionIds: result.map((row) => row.id),
-                });
-                await append(db, {
-                    aggregateId: generateId(),
-                    aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
-                    tenantId: SYSTEM_TENANT_ID,
-                    expectedVersion: 0,
-                    type: SESSION_REVOKED_EVENT_QN,
-                    payload,
-                    metadata: { userId },
-                });
-            }
-            return result.length;
+            // One transaction, same reason as sessionRevoker: a failed append must
+            // not leave sessions revoked without the event.
+            return transaction(db, async (tx) => {
+                const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
+                // Lightweight append alongside the direct-write above, same pattern
+                // as revoke.write.ts (#1559) — this callback is the password-change
+                // auto-revoke path (sessions/feature.ts postSave hook) and has no
+                // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
+                // append() like revoke-all-for-user.write.ts does. Without this, the
+                // access-invalidation consumer (#1560) never hears about a password
+                // change and an already-open SSE stream survives it — the exact
+                // "stale JWT mid-stream" gap this feature exists to close.
+                if (result.length > 0) {
+                    const payload = sessionRevokedSchema.parse({
+                        userId,
+                        sessionIds: result.map((row) => row.id),
+                    });
+                    await append(tx, {
+                        aggregateId: generateId(),
+                        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+                        tenantId: SYSTEM_TENANT_ID,
+                        expectedVersion: 0,
+                        type: SESSION_REVOKED_EVENT_QN,
+                        payload,
+                        metadata: { userId },
+                    });
+                }
+                return result.length;
+            });
         },
         async sessionRevokeAllOthers(userId, currentSid) {
-            const result = await updateMany(db, userSessionTable, { revokedAt: Temporal.Now.instant() }, currentSid
-                ? { userId, revokedAt: null, id: { ne: currentSid } }
-                : { userId, revokedAt: null });
-            // Same reasoning as sessionMassRevoker above — this raw callback
-            // (used by auth-mfa and other internal callers, distinct from the
-            // user-facing revoke-all-others.write.ts handler which already
-            // appends this event) needs its own append so callers reached
-            // through here also cut open SSE streams.
-            if (result.length > 0) {
-                const payload = sessionRevokedSchema.parse({
-                    userId,
-                    sessionIds: result.map((row) => row.id),
-                    keptSessionId: currentSid,
-                });
-                await append(db, {
-                    aggregateId: generateId(),
-                    aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
-                    tenantId: SYSTEM_TENANT_ID,
-                    expectedVersion: 0,
-                    type: SESSION_REVOKED_EVENT_QN,
-                    payload,
-                    metadata: { userId },
-                });
-            }
-            return result.length;
+            return transaction(db, async (tx) => {
+                const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, currentSid
+                    ? { userId, revokedAt: null, id: { ne: currentSid } }
+                    : { userId, revokedAt: null });
+                // Same reasoning as sessionMassRevoker above — this raw callback
+                // (used by auth-mfa and other internal callers, distinct from the
+                // user-facing revoke-all-others.write.ts handler which already
+                // appends this event) needs its own append so callers reached
+                // through here also cut open SSE streams.
+                if (result.length > 0) {
+                    const payload = sessionRevokedSchema.parse({
+                        userId,
+                        sessionIds: result.map((row) => row.id),
+                        keptSessionId: currentSid,
+                    });
+                    await append(tx, {
+                        aggregateId: generateId(),
+                        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+                        tenantId: SYSTEM_TENANT_ID,
+                        expectedVersion: 0,
+                        type: SESSION_REVOKED_EVENT_QN,
+                        payload,
+                        metadata: { userId },
+                    });
+                }
+                return result.length;
+            });
         },
     };
 }

package/dist/shared/assert-erased.d.ts

@@ -1,2 +1,3 @@
 import type { WriteResult } from "@cosmicdrift/kumiko-framework/engine";
-export declare function assertErased(result: WriteResult<unknown>, entityName: string, id: string): void;
+export declare function collectErasureFailure(result: WriteResult<unknown>, entityName: string, id: string, failures: string[]): void;
+export declare function throwIfErasureFailed(failures: readonly string[]): void;

package/dist/shared/assert-erased.js

@@ -1,13 +1,21 @@
 // GDPR-forget hooks used to `await crud.forget(...)` and drop the result —
 // a silent ownership_denied (or any other failure) meant the row was never
-// actually erased, with nothing surfacing the miss. Callers must assert.
-export function assertErased(result, entityName, id) {
-    // skip: the happy path — the assertion below only concerns failures.
+// actually erased, with nothing surfacing the miss. Callers must collect the
+// failure of every row (so one bad row does not leave the rest of the
+// subject's rows untried) and throw once after the loop.
+export function collectErasureFailure(result, entityName, id, failures) {
+    // skip: the happy path — the collection below only concerns failures.
     if (result.isSuccess)
         return;
     // skip: erasure is idempotent — a row that is already gone (e.g. a parallel
     // forget sweep) satisfies the erase request just as well as one this call removed.
     if (result.error.code === "not_found")
         return;
-    throw new Error(`[user-data-rights] failed to erase ${entityName}/${id}: ${result.error.code} — ${result.error.message}`);
+    failures.push(`${entityName}/${id}: ${result.error.code} — ${result.error.message}`);
+}
+export function throwIfErasureFailed(failures) {
+    // skip: nothing failed, so there is nothing to report
+    if (failures.length === 0)
+        return;
+    throw new Error(`[user-data-rights] failed to erase ${failures.join("; ")}`);
 }

package/dist/shared/index.d.ts

@@ -1,4 +1,4 @@
-export { assertErased } from "./assert-erased.js";
+export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";

package/dist/shared/index.js

@@ -1,4 +1,4 @@
-export { assertErased } from "./assert-erased.js";
+export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
 export { runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";

package/dist/user/handlers/detail.query.d.ts

@@ -9,6 +9,7 @@ export declare const detailQuery: {
     agent?: import("@cosmicdrift/kumiko-types/handlers").AgentHandlerHints;
     rateLimit?: import("@cosmicdrift/kumiko-types/handlers").RateLimitDeclaration;
     outputSchema?: import("zod").ZodType;
+    liveEntities?: readonly string[];
     escapeHatch?: import("@cosmicdrift/kumiko-types/handlers").EscapeHatchDeclaration;
     handler: (query: Parameters<NonNullable<typeof baseDetail.handler>>[0], ctx: HandlerContext) => Promise<unknown>;
 };

package/dist/user-data-rights-defaults/hooks/config-value.userdata-hook.js

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { configValueEntity, configValuesTable } from "../../config/index.js";
-import { assertErased } from "../../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
 import { featureMounted } from "./feature-mounted.js";
 // userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
 // scope rows carry no per-user subject and stay untouched. Event-sourced
@@ -37,10 +37,12 @@ export const configValueDeleteHook = async (ctx) => {
         tenantId: ctx.tenantId,
         userId: ctx.userId,
     });
+    const failures = [];
     for (const row of rows) {
         const id = row["id"]; // @cast-boundary db-row
         if (typeof id !== "string")
             continue;
-        assertErased(await crud.forget({ id }, systemUser, ctx.db), "config-value", id);
+        collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "config-value", id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -3,7 +3,7 @@ import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/de
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
-import { assertErased } from "../../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
 const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
 // Forget writes go through the executor (events), not deleteMany/updateMany:
 // a projection rebuild replays the events, so the erasure survives. Eventless
@@ -242,10 +242,12 @@ export const fileRefDeleteHook = async (ctx, strategy) => {
     // auto-verb, the erasure replays on rebuild (created → forgotten → row gone).
     // The old hard deleteMany was resurrected on rebuild; this closes that Art.17
     // hole without a direct write.
+    const failures = [];
     for (const row of personalRows) {
         const id = row["id"]; // @cast-boundary db-row
         if (typeof id !== "string")
             continue;
-        assertErased(await crud.forget({ id }, systemUser, ctx.db), "fileRef", id);
+        collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "fileRef", id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/user-data-rights-defaults/hooks/notification-preference.userdata-hook.js

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { notificationPreferenceEntity, notificationPreferencesTable, } from "../../delivery/index.js";
-import { assertErased } from "../../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
 import { featureMounted } from "./feature-mounted.js";
 // userData-Hooks for delivery's notification-preference rows. Event-sourced
 // entity → forget goes through the executor so a rebuild replays the erasure.
@@ -40,10 +40,12 @@ export const notificationPreferenceDeleteHook = async (ctx) => {
         tenantId: ctx.tenantId,
         userId: ctx.userId,
     });
+    const failures = [];
     for (const row of rows) {
         const id = row["id"]; // @cast-boundary db-row
         if (typeof id !== "string")
             continue;
-        assertErased(await crud.forget({ id }, systemUser, ctx.db), "notification-preference", id);
+        collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "notification-preference", id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.js

@@ -1,6 +1,6 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
-import { assertErased, decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
+import { collectErasureFailure, decryptStoredPii, mapWithConcurrency, throwIfErasureFailed, } from "../../shared/index.js";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.js";
 import { userTable } from "../../user/index.js";
 import { featureMounted } from "./feature-mounted.js";
@@ -78,6 +78,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
     if (!featureMounted(ctx, "tenant"))
         return;
     const systemUser = createSystemUser(ctx.tenantId);
+    const failures = [];
     const email = await resolveUserEmail(ctx);
     if (email) {
         const inviteeRows = await ctx.db.selectMany(tenantInvitationsTable, {
@@ -89,7 +90,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             if (typeof id !== "string")
                 continue;
             if (strategy === "delete") {
-                assertErased(await crud.forget({ id }, systemUser, ctx.db), "tenant-invitation", id);
+                collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "tenant-invitation", id, failures);
             }
             else {
                 // Row-id in the pseudonym keeps the (tenantId, email) unique index
@@ -116,4 +117,5 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             skipOptimisticLock: true,
         });
     }
+    throwIfErasureFailed(failures);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.335.0",
+  "version": "0.336.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.335.0",
-    "@cosmicdrift/kumiko-framework": "0.335.0",
-    "@cosmicdrift/kumiko-headless": "0.335.0",
-    "@cosmicdrift/kumiko-renderer": "0.335.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.335.0",
-    "@cosmicdrift/kumiko-types": "0.335.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.336.0",
+    "@cosmicdrift/kumiko-framework": "0.336.0",
+    "@cosmicdrift/kumiko-headless": "0.336.0",
+    "@cosmicdrift/kumiko-renderer": "0.336.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.336.0",
+    "@cosmicdrift/kumiko-types": "0.336.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -985,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.335.0",
-    "@cosmicdrift/kumiko-locale-es": "0.335.0",
+    "@cosmicdrift/kumiko-locale-de": "0.336.0",
+    "@cosmicdrift/kumiko-locale-es": "0.336.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/cap-counter/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "markCapSoftWarned skips the redundant write when the soft-warned flag is already set",
+    "detail": "`markCapSoftWarned` no longer appends a second update event when a parallel warner already set `lastSoftWarnedAt`; the version-conflict retry now returns success without writing."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Delivery log paging no longer skips rows tied on the sort value",
+    "detail": "The delivery log query no longer skips rows at a page boundary when the sort column has duplicate values. A toggle flip received while the initial snapshot loads is no longer overwritten by the older DB read. The stale job-run sweep encrypts and updates once per triggering user instead of once per run."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/feature-toggles/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "A toggle flip signalled during the initial load survives the snapshot read"
+  },
   {
     "version": "0.165.0",
     "type": "fix",

package/src/jobs/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "improvement",
+    "title": "Stale job-run sweep batches its writes per triggering user"
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/personal-access-tokens/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "PAT revoke and its revoked-event commit atomically when called on a pool"
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/sessions/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Session revoke (single, mass, all-others) and its revoked-event commit atomically",
+    "detail": "Session logout, password-change/MFA mass revoke, revoke-all-others and PAT revoke now commit the revoke and its revoked-event in one transaction, so a failed append no longer leaves a revoked token whose SSE streams stay open. GDPR delete hooks now try every row of the subject and report all failures at once instead of stopping at the first. The notes mention-forget hook loads the mentioned notes with one query and resolves each host entity's retention policy once."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/user-data-rights-defaults/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Delete hooks erase every row and report all failures together"
+  },
   {
     "version": "0.116.0",
     "type": "fix",