@cosmicdrift/kumiko-bundled-features 0.335.0 → 0.336.1

package/dist/auth-email-password/handlers/login.write.js

@@ -179,8 +179,7 @@ export function createLoginHandler(opts = {}) {
             const statusGate = gateEnforceAccountStatus(found);
             if (!statusGate.ok)
                 return statusGate.result;
-            // Still needed for candidate ORDER (preferred tenant first) — the actual
-            // active/blocked/teardown decision comes from ctx.resolveActiveMembership below.
+            // Still needed for candidate ORDER (preferred tenant first) in gateResolveMembership.
             const memberships = (await ctx.queryAs(systemUser, TENANT_MEMBERSHIPS_QUERY, {
                 userId: found.id,
             })); // @cast-boundary db-runner

package/dist/auth-mfa/handlers/status.query.js

@@ -12,6 +12,7 @@ import { userMfaTable } from "../schema/user-mfa.js";
 export const mfaStatusQuery = defineQueryHandler({
     name: "user-mfa:status",
     schema: z.object({}),
+    outputSchema: z.object({ enabled: z.boolean() }),
     access: {
         openToAll: {
             reason: "each signed-in user reads only their own MFA status; the query filters " +

package/dist/auth-mfa-user-data/hooks.js

@@ -9,7 +9,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { userMfaEntity, userMfaTable } from "../auth-mfa/index.js";
-import { assertErased } from "../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../shared/index.js";
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
     entityName: "user-mfa",
 });
@@ -41,7 +41,9 @@ export const userMfaDeleteHook = async (ctx) => {
     if (rows.length === 0)
         return;
     const systemUser = createSystemUser(ctx.tenantId);
+    const failures = [];
     for (const row of rows) {
-        assertErased(await executor.forget({ id: row.id }, systemUser, ctx.db), "user-mfa", row.id);
+        collectErasureFailure(await executor.forget({ id: row.id }, systemUser, ctx.db), "user-mfa", row.id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/cap-counter/book-cap-usage.js

@@ -84,6 +84,11 @@ export async function markCapSoftWarned(ctx, options) {
         if (!row) {
             throw new Error("cap-counter.markCapSoftWarned: row vanished between length-check and read");
         }
+        // A version-conflict retry lands here after a parallel warner already set the flag; a second
+        // write would only append a redundant event with a newer timestamp.
+        if (row["lastSoftWarnedAt"] !== null) {
+            return { isSuccess: true, data: row };
+        }
         const currentVersion = row["version"]; // @cast-boundary db-row
         return executor.update({
             id: aggregateId,

package/dist/custom-fields/feature.js

@@ -79,8 +79,9 @@ function registerCustomFields(r, variant) {
     // Event-types — qualified als "custom-fields:event:<short-name>".
     // Returned EventDefs liefern .name als compile-time literal-typed string,
     // den Handler + MSP-keys konsumieren statt Template-Literal-Konstruktion.
-    // `value: z.unknown()` has no field-level schema to catalog under piiFields;
-    // "no PII" is a naming convention (#972), not an enforced guarantee — see #2776.
+    // `value: z.unknown()` has no field-level schema to catalog under piiFields
+    // (event PII covers string fields only), so "no PII" is a convention here,
+    // not an enforced guarantee.
     const setEvent = r.defineEvent(CUSTOM_FIELD_SET_EVENT, customFieldSetSchema, {
         piiFields: "none",
     });

package/dist/delivery/handlers/log.query.js

@@ -1,5 +1,5 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import { decodeKeysetCursor, encodeKeysetCursor } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
@@ -28,15 +28,15 @@ function isDeliveryLogSortField(value) {
 // PHYSICAL column, not the display alias — row only has the DB field names
 // (e.g. notificationType), never the alias (e.g. "type").
 function encodeSortCursor(column, row) {
-    if (column === "createdAt")
-        return encodeCursor(row.createdAt.toString());
-    return encodeCursor(String(row[column]));
+    const sortValue = column === "createdAt" ? row.createdAt.toString() : String(row[column]);
+    return encodeKeysetCursor(sortValue, row.id);
 }
+// lastId is undefined for a legacy sort-value-only cursor still in flight.
 function decodeSortCursor(column, cursor) {
-    const decoded = decodeCursor(cursor);
-    if (column === "createdAt")
-        return Temporal.Instant.from(decoded);
-    return decoded;
+    const decoded = decodeKeysetCursor(cursor);
+    const raw = decoded.sortValue ?? decoded.id;
+    const sortValue = column === "createdAt" ? Temporal.Instant.from(raw) : raw;
+    return { sortValue, lastId: decoded.sortValue === undefined ? undefined : decoded.id };
 }
 export const logQuery = definePagedQueryHandler({
     name: "log",
@@ -70,23 +70,32 @@ export const logQuery = definePagedQueryHandler({
         const sortColumn = DELIVERY_LOG_SORT_COLUMNS[sortField];
         // TenantAdmin/Admin stay strictly tenant-scoped; SystemAdmin sees every
         // tenant's attempts (platform waitlist confirmations live on SYSTEM_TENANT_ID).
-        const where = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
-        if (query.payload.cursor) {
-            where[sortColumn] = {
-                [sortDirection === "asc" ? "gt" : "lt"]: decodeSortCursor(sortColumn, query.payload.cursor),
-            };
-        }
-        const rows = await selectMany(db, deliveryAttemptsTable, where, {
-            // Tie-breaker on id keeps ordering stable across pages when the sort
-            // column has duplicate values (e.g. many rows with the same status).
-            orderBy: [
-                { col: sortColumn, direction: sortDirection },
-                { col: "id", direction: "asc" },
-            ],
-            limit: query.payload.limit,
-        });
+        const baseWhere = isSystemAdmin ? {} : { tenantId: query.user.tenantId };
+        const limit = query.payload.limit;
+        const cursor = query.payload.cursor
+            ? decodeSortCursor(sortColumn, query.payload.cursor)
+            : undefined;
+        const beyondSortValue = sortDirection === "asc" ? "gt" : "lt";
+        // Keyset page = rows still tied on the cursor's sort value (id after the
+        // cursor's id), then rows strictly beyond it. Both halves are ordered the
+        // same way as the overall ORDER BY, so concatenation preserves it.
+        const tiedRows = cursor?.lastId !== undefined
+            ? await selectMany(db, deliveryAttemptsTable, { ...baseWhere, [sortColumn]: cursor.sortValue, id: { gt: cursor.lastId } }, { orderBy: [{ col: "id", direction: "asc" }], limit })
+            : [];
+        const beyondRows = tiedRows.length < limit
+            ? await selectMany(db, deliveryAttemptsTable, cursor
+                ? { ...baseWhere, [sortColumn]: { [beyondSortValue]: cursor.sortValue } }
+                : baseWhere, {
+                orderBy: [
+                    { col: sortColumn, direction: sortDirection },
+                    { col: "id", direction: "asc" },
+                ],
+                limit: limit - tiedRows.length,
+            })
+            : [];
+        const rows = [...tiedRows, ...beyondRows];
         const lastRow = rows[rows.length - 1];
-        const nextCursor = rows.length === query.payload.limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
+        const nextCursor = rows.length === limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
         // recipientAddress is stored encrypted under the recipient's DEK (#799)
         // — decrypt for the admin log view; forgotten subjects show [[erased]].
         // The notificationType/recipientAddress → type/recipient rename happens

package/dist/feature-toggles/toggle-runtime.d.ts

@@ -9,6 +9,7 @@ export declare class GlobalFeatureToggleRuntime {
     private readonly registry;
     private readonly syncSignal?;
     private snapshot;
+    private appliedDuringLoad;
     constructor(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal | undefined);
     initialize(): Promise<void>;
     refresh(): Promise<void>;

package/dist/feature-toggles/toggle-runtime.js

@@ -17,6 +17,9 @@ export class GlobalFeatureToggleRuntime {
     registry;
     syncSignal;
     snapshot = new Map();
+    // Flips applied while a snapshot load is in flight. The load's SELECT may have
+    // started before the flip committed, so its rows can be older than these.
+    appliedDuringLoad;
     constructor(db, registry, syncSignal) {
         this.db = db;
         this.registry = registry;
@@ -30,8 +33,18 @@ export class GlobalFeatureToggleRuntime {
         });
     }
     async initialize() {
-        const rows = await selectMany(this.db, globalFeatureStateTable);
-        this.snapshot = new Map(rows.map((r) => [r.featureName, r.enabled]));
+        const pendingFlips = new Map();
+        this.appliedDuringLoad = pendingFlips;
+        try {
+            const rows = await selectMany(this.db, globalFeatureStateTable);
+            this.snapshot = new Map([
+                ...rows.map((r) => [r.featureName, r.enabled]),
+                ...pendingFlips,
+            ]);
+        }
+        finally {
+            this.appliedDuringLoad = undefined;
+        }
     }
     // Re-read the full snapshot. Called from the set-handler after a
     // successful write — cheap point-update would be an optimisation but
@@ -46,6 +59,7 @@ export class GlobalFeatureToggleRuntime {
     // lock. Kept alongside refresh() so both options are explicit.
     apply(featureName, enabled) {
         this.snapshot.set(featureName, enabled);
+        this.appliedDuringLoad?.set(featureName, enabled);
     }
     // Called by the toggle-cache-sync MSP handler (feature.ts) — the one
     // process whose shared cursor won a given toggle-set event. With a

package/dist/inbound-mail-foundation/feature.js

@@ -67,7 +67,7 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
     // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).
     // "displayName" stays plaintext (often the mailbox owner's real name for
     // personal accounts); encrypting it would break the entity-projection read
-    // path that carries it as `personal: false` (#2776).
+    // path that carries it as `personal: false`.
     r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
         piiFields: "none",
     });

package/dist/jobs/db/queries/stale-run-sweep.js

@@ -12,30 +12,37 @@
 // the run becomes retriable via the existing jobs:write:retry gate
 // (retry.write.ts only allows retry from "failed").
 import { selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { mapWithConcurrency } from "../../../shared/index.js";
 import { encryptFailureError } from "../../job-run-logger.js";
 import { jobRunsTable } from "../../job-run-table.js";
+const KMS_POOL_CONCURRENCY = 4;
 export const STALE_JOB_RUN_ERROR = "job run exceeded the stale-run timeout without a completion signal (likely a crashed worker process)";
 export async function markStaleJobRunsFailed(db, timeoutHours) {
     const cutoff = Temporal.Now.instant().subtract({ hours: timeoutHours });
     const now = Temporal.Now.instant();
     // Fetch the matched rows first: `error` carries the same per-triggering-
     // user subject annotation as job-run-logger.ts's onJobFailed path
-    // (personal: { of: "triggeredById" } on job-run-table.ts), and a batch
-    // updateMany can't encrypt per-row — different matched runs can belong to
-    // different users, each under their own DEK. One updateMany per row keeps
-    // this crash-recovery sweep's write on the same encrypted footing as the
-    // normal failure path instead of writing STALE_JOB_RUN_ERROR in the clear.
+    // (personal: { of: "triggeredById" } on job-run-table.ts), so it is encrypted
+    // under that subject's DEK. Runs are grouped by subject: one encrypt and one
+    // updateMany per subject instead of per run.
     const stale = await selectMany(db, jobRunsTable, {
         status: "running",
         startedAt: { lt: cutoff },
     });
+    const idsBySubject = new Map();
+    for (const run of stale) {
+        const ids = idsBySubject.get(run.triggeredById);
+        if (ids)
+            ids.push(run.id);
+        else
+            idsBySubject.set(run.triggeredById, [run.id]);
+    }
     // duration is deliberately left untouched: we don't know when the run
     // actually died, only that it crossed the timeout, so recording a
     // duration would misrepresent it as measured. detail-screen/list-screen
     // both already render a null duration as "—".
-    let runsMarkedFailed = 0;
-    for (const run of stale) {
-        const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, run.triggeredById);
+    const updatedPerSubject = await mapWithConcurrency([...idsBySubject], KMS_POOL_CONCURRENCY, async ([triggeredById, ids]) => {
+        const encryptedError = await encryptFailureError(STALE_JOB_RUN_ERROR, triggeredById);
         const updated = await updateMany(db, jobRunsTable, {
             status: "failed",
             error: encryptedError,
@@ -43,12 +50,12 @@ export async function markStaleJobRunsFailed(db, timeoutHours) {
             modifiedAt: now,
             modifiedById: "system",
         }, 
-        // Re-assert status: "running" here (not just id) — closes the race
-        // window between the selectMany above and this write, where the run
-        // could have completed/failed normally in between and must not be
-        // clobbered back to "failed" with the stale-timeout message.
-        { id: run.id, status: "running" });
-        runsMarkedFailed += updated.length;
-    }
+        // Re-assert status: "running" (not just id) — closes the race window
+        // between the selectMany above and this write, where a run could have
+        // completed/failed normally and must not be clobbered back to "failed".
+        { id: { in: ids }, status: "running" });
+        return updated.length;
+    });
+    const runsMarkedFailed = updatedPerSubject.reduce((sum, count) => sum + count, 0);
     return { runsMarkedFailed };
 }

package/dist/notes-history/feature.js

@@ -71,8 +71,8 @@ export function createNotesHistoryFeature(opts = {}) {
     // of passing an empty array.
     if (opts.parents !== undefined && opts.parents.length === 0) {
         throw new Error("createNotesHistoryFeature({ parents }): parents must not be an empty array — " +
-            "an empty allowlist rejects every add-note call. Omit `parents` to keep " +
-            "today's unrestricted behavior instead.");
+            "an empty allowlist rejects every add-note call. Omit `parents` to allow " +
+            "any registered entity the caller can read as a note parent.");
     }
     return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) => registerNotesHistory(r, resolveAccess(opts), opts.ownership, opts.parents));
 }

package/dist/notes-history/handlers/add-note.write.js

@@ -35,7 +35,8 @@ export function createAddNoteHandler(access = DEFAULT_NOTES_HISTORY_ACCESS) {
             try {
                 // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
                 // Bun.SQL poisons the whole tx after any error inside it, even one that's
-                // caught — a bare try/catch here would take the note write down with it.
+                // caught — so the lookup runs in a savepoint where available, otherwise directly
+                // (pool statements are their own units).
                 authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(READ_AUTHOR_DISPLAY_NAME_REASON), async (sp) => {
                     const userRow = await fetchOne(sp, userTable, {
                         id: event.user.id,

package/dist/notes-history-user-data/hooks.js

@@ -64,21 +64,28 @@ export const noteEntryDeleteHook = async (ctx) => {
         registry: ctx.registry,
         tenantId: ctx.tenantId,
     });
-    for (const noteId of noteIds) {
-        const note = await ctx.db.fetchOne(noteEntryTable, { id: noteId });
-        // Defensive: append-only rows are never hard-deleted, so this shouldn't
-        // happen — but a missing host means no retention policy to consult.
-        if (!note)
-            continue;
-        const hostPolicy = await resolveRetentionPolicyForTenant({
-            db: ctx.db,
-            registry: ctx.registry,
-            tenantId: ctx.tenantId,
-            entityName: note.entityType,
-            preloadedTenantPreset: tenantPreset,
-        });
-        if (policyToStrategy(hostPolicy.policy?.strategy ?? null) === "anonymize")
+    // Append-only rows are never hard-deleted, so every mentioned note should
+    // resolve; a missing one has no host and thus no retention policy to consult.
+    const notes = await ctx.db.selectMany(noteEntryTable, {
+        id: { in: [...noteIds] },
+    });
+    const strategyByEntityType = new Map();
+    for (const note of notes) {
+        let strategy = strategyByEntityType.get(note.entityType);
+        if (strategy === undefined) {
+            const hostPolicy = await resolveRetentionPolicyForTenant({
+                db: ctx.db,
+                registry: ctx.registry,
+                tenantId: ctx.tenantId,
+                entityName: note.entityType,
+                preloadedTenantPreset: tenantPreset,
+            });
+            strategy = policyToStrategy(hostPolicy.policy?.strategy ?? null);
+            strategyByEntityType.set(note.entityType, strategy);
+        }
+        if (strategy === "anonymize")
             continue;
+        const noteId = note.id;
         await kms.eraseKey({ kind: "record", entity: "note-entry", id: noteId }, {
             requestId: "notes-history-user-data:forget-mentioned-notes",
             userId: ctx.userId,

package/dist/personal-access-tokens/revoke-for-user.js

@@ -1,15 +1,26 @@
-import { updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { PAT_REVOKED_AGGREGATE_TYPE, PAT_REVOKED_EVENT_QN, patRevokedSchema, } from "./pat-revoked-event.js";
 import { apiTokenTable } from "./schema/api-token.js";
+// A pool has begin(); a tx/savepoint handle does not and is already atomic.
+function canBeginTransaction(db) {
+    return typeof db.begin === "function"; // @cast-boundary driver-handle-probe
+}
 // Cross-tenant revoke: password-change and MFA-enable/disable are account-
 // level security events, not scoped to one tenant. Mirrors sessions'
 // sessionMassRevoker (session-callbacks.ts) which passes the boot-time
 // DbConnection directly — not ctx.db, which would be tenant-scoped in a hook.
 export async function revokeAllPatTokensForUser(db, userId) {
+    // Update and event commit together: otherwise a failed append leaves the
+    // tokens revoked with no event, and a retry matches no live row.
+    return canBeginTransaction(db)
+        ? transaction(db, (tx) => revokeAndAppend(tx, userId))
+        : revokeAndAppend(db, userId);
+}
+async function revokeAndAppend(db, userId) {
     const updated = await updateMany(db, apiTokenTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
     // Same reasoning as sessionMassRevoker's append — this raw
     // callback has no dispatcher ctx to call unsafeAppendEvent from, so it

package/dist/personal-access-tokens/schema/api-token.js

@@ -42,27 +42,27 @@ export const apiTokenEntity = createEntity({
         // store ciphertext while the resolver keeps querying for the plaintext
         // hash — every bearer-token request would 401 once a KMS is active.
         // Fixing that needs a blind-index-backed lookup (like email's
-        // find:"exact" companion column), a resolver.ts rewrite out of scope
-        // here — see PR body "Offene Fragen".
+        // find:"exact" companion column), a resolver.ts rewrite, so this stays
+        // unencrypted until a blind-index lookup exists.
         tokenHash: createTextField({
             required: true,
             maxLength: 64,
             access: { write: access.privileged },
             personal: false,
-            reason: "credential_hash_used_as_exact_lookup_key_2809",
+            reason: "credential_hash_used_as_exact_lookup_key",
         }),
         // Short displayable prefix ("your tokens" list) — not the secret itself,
         // but still identifies which of the user's tokens this row is. Kept
         // Klasse 1: list.query.ts returns `r.prefix` straight through with no
         // decrypt call (unlike `name`, which goes through decryptStoredPii) — a
         // subject annotation would leak ciphertext to the UI once a KMS is
-        // active. See PR body "Offene Fragen".
+        // active.
         prefix: createTextField({
             required: true,
             maxLength: 16,
             access: { write: access.privileged },
             personal: false,
-            reason: "credential_prefix_read_without_decrypt_2809",
+            reason: "credential_prefix_read_without_decrypt",
         }),
         // JSON-encoded string[] of granted scope names — mirrors the roles-column
         // convention (parseRoles-style text); the resolver JSON.parses it.

package/dist/sessions/session-callbacks.js

@@ -1,4 +1,4 @@
-import { fetchOne, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertOne, transaction, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildSessionRoles, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { append } from "@cosmicdrift/kumiko-framework/event-store";
 import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
@@ -37,30 +37,35 @@ export function createSessionCallbacks(opts) {
             // original timestamp. Double-revoke races land here via logout +
             // switch-tenant on the same sid. (Password-change uses a different
             // callback — sessionMassRevoker — and isn't in scope for this guard.)
-            const result = await updateMany(db, userSessionTable, { revokedAt: Temporal.Now.instant() }, { id: sid, revokedAt: null });
-            // This is the ONLY caller of sessionRevoker — logout and tenant-switch
-            // — so it's also the only source of streamScope: "revoked-sessions".
-            // Without this append, a live SSE stream on this exact sid outlives its
-            // own logout because the access-invalidation consumer never hears
-            // about it — same gap sessionMassRevoker closed for
-            // password-change.
-            const revoked = result[0];
-            if (revoked) {
-                const payload = sessionRevokedSchema.parse({
-                    userId: revoked.userId,
-                    sessionIds: [sid],
-                    streamScope: "revoked-sessions",
-                });
-                await append(db, {
-                    aggregateId: generateId(),
-                    aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
-                    tenantId: SYSTEM_TENANT_ID,
-                    expectedVersion: 0,
-                    type: SESSION_REVOKED_EVENT_QN,
-                    payload,
-                    metadata: { userId: revoked.userId },
-                });
-            }
+            // One transaction: if the append failed after the update committed, a
+            // retried logout would match no live row (revokedAt IS NULL) and never
+            // emit the event, leaving the SSE stream of this sid open until JWT expiry.
+            await transaction(db, async (tx) => {
+                const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, { id: sid, revokedAt: null });
+                // This is the ONLY caller of sessionRevoker — logout and tenant-switch
+                // — so it's also the only source of streamScope: "revoked-sessions".
+                // Without this append, a live SSE stream on this exact sid outlives its
+                // own logout because the access-invalidation consumer never hears
+                // about it — same gap sessionMassRevoker closed for
+                // password-change.
+                const revoked = result[0];
+                if (revoked) {
+                    const payload = sessionRevokedSchema.parse({
+                        userId: revoked.userId,
+                        sessionIds: [sid],
+                        streamScope: "revoked-sessions",
+                    });
+                    await append(tx, {
+                        aggregateId: generateId(),
+                        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+                        tenantId: SYSTEM_TENANT_ID,
+                        expectedVersion: 0,
+                        type: SESSION_REVOKED_EVENT_QN,
+                        payload,
+                        metadata: { userId: revoked.userId },
+                    });
+                }
+            });
         },
         // kumiko-lint-ignore complexity-budget session check + lastSeen refresh on hot path
         async sessionChecker(sid, expectedUserId) {
@@ -140,58 +145,64 @@ export function createSessionCallbacks(opts) {
         async sessionMassRevoker(userId) {
             // Count is accurate because we only touch live rows — a previously
             // revoked row stays in its state and isn't double-counted.
-            const result = await updateMany(db, userSessionTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
-            // Lightweight append alongside the direct-write above, same pattern
-            // as revoke.write.ts (#1559) — this callback is the password-change
-            // auto-revoke path (sessions/feature.ts postSave hook) and has no
-            // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
-            // append() like revoke-all-for-user.write.ts does. Without this, the
-            // access-invalidation consumer (#1560) never hears about a password
-            // change and an already-open SSE stream survives it — the exact
-            // "stale JWT mid-stream" gap this feature exists to close.
-            if (result.length > 0) {
-                const payload = sessionRevokedSchema.parse({
-                    userId,
-                    sessionIds: result.map((row) => row.id),
-                });
-                await append(db, {
-                    aggregateId: generateId(),
-                    aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
-                    tenantId: SYSTEM_TENANT_ID,
-                    expectedVersion: 0,
-                    type: SESSION_REVOKED_EVENT_QN,
-                    payload,
-                    metadata: { userId },
-                });
-            }
-            return result.length;
+            // One transaction, same reason as sessionRevoker: a failed append must
+            // not leave sessions revoked without the event.
+            return transaction(db, async (tx) => {
+                const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, { userId, revokedAt: null });
+                // Lightweight append alongside the direct-write above, same pattern
+                // as revoke.write.ts (#1559) — this callback is the password-change
+                // auto-revoke path (sessions/feature.ts postSave hook) and has no
+                // dispatcher ctx to call unsafeAppendEvent from, so it uses the raw
+                // append() like revoke-all-for-user.write.ts does. Without this, the
+                // access-invalidation consumer (#1560) never hears about a password
+                // change and an already-open SSE stream survives it — the exact
+                // "stale JWT mid-stream" gap this feature exists to close.
+                if (result.length > 0) {
+                    const payload = sessionRevokedSchema.parse({
+                        userId,
+                        sessionIds: result.map((row) => row.id),
+                    });
+                    await append(tx, {
+                        aggregateId: generateId(),
+                        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+                        tenantId: SYSTEM_TENANT_ID,
+                        expectedVersion: 0,
+                        type: SESSION_REVOKED_EVENT_QN,
+                        payload,
+                        metadata: { userId },
+                    });
+                }
+                return result.length;
+            });
         },
         async sessionRevokeAllOthers(userId, currentSid) {
-            const result = await updateMany(db, userSessionTable, { revokedAt: Temporal.Now.instant() }, currentSid
-                ? { userId, revokedAt: null, id: { ne: currentSid } }
-                : { userId, revokedAt: null });
-            // Same reasoning as sessionMassRevoker above — this raw callback
-            // (used by auth-mfa and other internal callers, distinct from the
-            // user-facing revoke-all-others.write.ts handler which already
-            // appends this event) needs its own append so callers reached
-            // through here also cut open SSE streams.
-            if (result.length > 0) {
-                const payload = sessionRevokedSchema.parse({
-                    userId,
-                    sessionIds: result.map((row) => row.id),
-                    keptSessionId: currentSid,
-                });
-                await append(db, {
-                    aggregateId: generateId(),
-                    aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
-                    tenantId: SYSTEM_TENANT_ID,
-                    expectedVersion: 0,
-                    type: SESSION_REVOKED_EVENT_QN,
-                    payload,
-                    metadata: { userId },
-                });
-            }
-            return result.length;
+            return transaction(db, async (tx) => {
+                const result = await updateMany(tx, userSessionTable, { revokedAt: Temporal.Now.instant() }, currentSid
+                    ? { userId, revokedAt: null, id: { ne: currentSid } }
+                    : { userId, revokedAt: null });
+                // Same reasoning as sessionMassRevoker above — this raw callback
+                // (used by auth-mfa and other internal callers, distinct from the
+                // user-facing revoke-all-others.write.ts handler which already
+                // appends this event) needs its own append so callers reached
+                // through here also cut open SSE streams.
+                if (result.length > 0) {
+                    const payload = sessionRevokedSchema.parse({
+                        userId,
+                        sessionIds: result.map((row) => row.id),
+                        keptSessionId: currentSid,
+                    });
+                    await append(tx, {
+                        aggregateId: generateId(),
+                        aggregateType: SESSION_REVOKED_AGGREGATE_TYPE,
+                        tenantId: SYSTEM_TENANT_ID,
+                        expectedVersion: 0,
+                        type: SESSION_REVOKED_EVENT_QN,
+                        payload,
+                        metadata: { userId },
+                    });
+                }
+                return result.length;
+            });
         },
     };
 }

package/dist/shared/assert-erased.d.ts

@@ -1,2 +1,3 @@
 import type { WriteResult } from "@cosmicdrift/kumiko-framework/engine";
-export declare function assertErased(result: WriteResult<unknown>, entityName: string, id: string): void;
+export declare function collectErasureFailure(result: WriteResult<unknown>, entityName: string, id: string, failures: string[]): void;
+export declare function throwIfErasureFailed(failures: readonly string[]): void;

package/dist/shared/assert-erased.js

@@ -1,13 +1,21 @@
 // GDPR-forget hooks used to `await crud.forget(...)` and drop the result —
 // a silent ownership_denied (or any other failure) meant the row was never
-// actually erased, with nothing surfacing the miss. Callers must assert.
-export function assertErased(result, entityName, id) {
-    // skip: the happy path — the assertion below only concerns failures.
+// actually erased, with nothing surfacing the miss. Callers must collect the
+// failure of every row (so one bad row does not leave the rest of the
+// subject's rows untried) and throw once after the loop.
+export function collectErasureFailure(result, entityName, id, failures) {
+    // skip: the happy path — the collection below only concerns failures.
     if (result.isSuccess)
         return;
     // skip: erasure is idempotent — a row that is already gone (e.g. a parallel
     // forget sweep) satisfies the erase request just as well as one this call removed.
     if (result.error.code === "not_found")
         return;
-    throw new Error(`[user-data-rights] failed to erase ${entityName}/${id}: ${result.error.code} — ${result.error.message}`);
+    failures.push(`${entityName}/${id}: ${result.error.code} — ${result.error.message}`);
+}
+export function throwIfErasureFailed(failures) {
+    // skip: nothing failed, so there is nothing to report
+    if (failures.length === 0)
+        return;
+    throw new Error(`[user-data-rights] failed to erase ${failures.join("; ")}`);
 }

package/dist/shared/index.d.ts

@@ -1,4 +1,4 @@
-export { assertErased } from "./assert-erased.js";
+export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
 export { type ChunkedMigrationOptions, type ChunkedMigrationResult, type ChunkedMigrationStopReason, type MigrationRowOutcome, runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, type StoredEnvelopeClassification, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";

package/dist/shared/index.js

@@ -1,4 +1,4 @@
-export { assertErased } from "./assert-erased.js";
+export { collectErasureFailure, throwIfErasureFailed } from "./assert-erased.js";
 export { runChunkedMigration, } from "./chunked-entity-migration.js";
 export { classifyStoredEnvelope, } from "./classify-stored-envelope.js";
 export { decryptStoredPii } from "./decrypt-stored-pii.js";

package/dist/subscription-mollie/plugin-methods.js

@@ -32,11 +32,9 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
             customerId = customer.id;
         }
         // mode "payment" (one-off top-up) → sequenceType.oneoff, no mandate
-        // setup. verify-webhook.ts's ensureSubscriptionForMandate already
-        // gates on sequenceType === "first" — a oneoff payment falls into
-        // its "not our domain" branch and creates NO Mollie subscription.
-        // Webhook resolution for oneoff payments is separate follow-up
-        // work (offlot#109), not part of this contract.
+        // setup. Oneoff payments carry no subscriptionId and are not
+        // sequenceType "first", so verifyAndParseMollieWebhook drops them before
+        // any mandate/subscription handling.
         const sequenceType = options.mode === "payment" ? SequenceType.oneoff : SequenceType.first;
         // payments.create ist overloaded (Promise OR void mit callback);
         // explicit cast auf Promise<Payment>-overload.

package/dist/subscription-stripe/plugin-methods.js

@@ -1,5 +1,6 @@
 // Stripe-Plugin-Methoden für die POST-tenant-resolution-Phase:
-// createCheckoutSession, createPortalSession, cancelSubscription.
+// createCheckoutSession, createPortalSession, cancelSubscription,
+// retrieveSubscription, retrievePrices, planSwitchSession.
 //
 // Werden vom Plugin-build (feature.ts) als methods auf dem
 // SubscriptionProviderPlugin registriert. Anders als
@@ -8,7 +9,7 @@
 // runtime auf (api-key aus system-secrets, audited), statt aus einem
 // mount-time-Closure. Key-Rotation wirkt damit ohne Redeploy.
 //
-// **Type-Ableitung:** die options-shapes der drei methods werden
+// **Type-Ableitung:** die options-shapes der methods werden
 // **direkt vom Plugin-Contract** abgeleitet (`Parameters<NonNullable
 // <SubscriptionProviderPlugin["...method"]>>[1]`). Wenn Foundation den
 // Contract erweitert (z.B. neuer optionaler Field), bemerkt der
@@ -18,6 +19,11 @@ import { KNOWN_RECURRING_INTERVALS, } from "@cosmicdrift/kumiko-bundled-features
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import Stripe from "stripe";
 import { isResourceMissingStripeError, mapStripeSubscriptionState } from "./verify-webhook.js";
+function isUnknownCustomerStripeError(error) {
+    return (isResourceMissingStripeError(error) &&
+        error instanceof Stripe.errors.StripeInvalidRequestError &&
+        error.param === "customer");
+}
 export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation = true } = {}) {
     return async (ctx, options) => {
         // #104-Invariante: ohne billing-live darf keine Stripe-Session
@@ -28,7 +34,7 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
         await runtime.assertBillingLive(ctx);
         const stripe = await runtime.clientForCtx(ctx);
         const mode = options.mode ?? "subscription";
-        const session = await stripe.checkout.sessions.create({
+        const sessionParams = (providerCustomerId) => ({
             mode,
             line_items: [{ price: options.priceId, quantity: 1 }],
             success_url: options.successUrl,
@@ -48,10 +54,22 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
                     // Without a customer, Stripe's default "if_required" makes a guest
                     // checkout when invoice_creation is off; the webhook then has no
                     // customer id and drops the paid payment as ignored.
-                    ...(!options.providerCustomerId && { customer_creation: "always" }),
+                    ...(!providerCustomerId && { customer_creation: "always" }),
                 }),
-            ...(options.providerCustomerId && { customer: options.providerCustomerId }),
+            ...(providerCustomerId && { customer: providerCustomerId }),
         });
+        let session;
+        try {
+            session = await stripe.checkout.sessions.create(sessionParams(options.providerCustomerId));
+        }
+        catch (error) {
+            if (!options.providerCustomerId || !isUnknownCustomerStripeError(error))
+                throw error;
+            // Stripe account switch (test -> live) or a customer deleted in the dashboard leaves a
+            // stored customer id Stripe no longer knows; checkout creates a fresh customer instead.
+            ctx.log?.warn("subscription-stripe: stored customer unknown to Stripe, retrying without it");
+            session = await stripe.checkout.sessions.create(sessionParams(undefined));
+        }
         if (!session.url) {
             // Defensive: Stripe returns a hosted url for both modes today —
             // guards against future API drift.

package/dist/tenant/handlers/member-directory.query.js

@@ -13,9 +13,14 @@ const KMS_POOL_CONCURRENCY = 4;
 // are decrypted and filtered in memory. The cap keeps a SystemAdmin's global
 // search from decrypting every user.
 const SEARCH_SCAN_CAP = 1000;
+// Display names are encrypted, so id is the only stable SQL-side key; uuid text
+// order equals the uuid column's byte order.
+function compareIds(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
 async function loadMemberUserIds(db, tenantId) {
     const memberships = await selectMany(db, tenantMembershipsTable, { tenantId });
-    return [...new Set(memberships.map((row) => String(row["userId"])))];
+    return [...new Set(memberships.map((row) => String(row["userId"])))].sort(compareIds);
 }
 // Label source behind every `user:user` reference column (fw#3107). The
 // entity-convention lookup, user:query:user:list, is a SystemAdmin
@@ -52,12 +57,20 @@ export const memberDirectoryQuery = definePagedQueryHandler({
         let users;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as user:query:user:list did");
-            users = await selectMany(db, userTable, undefined, { limit: scanLimit });
+            users = await selectMany(db, userTable, undefined, {
+                limit: scanLimit,
+                orderBy: { col: "id", direction: "asc" },
+            });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
             const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
-            users = userIds.length > 0 ? await selectMany(db, userTable, { id: [...userIds] }) : [];
+            users =
+                userIds.length > 0
+                    ? await selectMany(db, userTable, { id: [...userIds] }, {
+                        orderBy: { col: "id", direction: "asc" },
+                    })
+                    : [];
         }
         const resolved = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
             const id = String(user.id);

package/dist/tenant/handlers/tenant-directory.query.js

@@ -35,7 +35,13 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         let tenants;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did");
-            tenants = await selectMany(db, tenantTable, undefined, { limit: scanLimit });
+            tenants = await selectMany(db, tenantTable, undefined, {
+                limit: scanLimit,
+                orderBy: [
+                    { col: "name", direction: "asc" },
+                    { col: "id", direction: "asc" },
+                ],
+            });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);

package/dist/tenant-handover/feature.js

@@ -13,7 +13,7 @@ export function createTenantHandoverFeature(opts = {}) {
         r.describe("Try-before-signup ownership handover: claims the rows of a declared-transferable " +
             "entity graph (root plus its parentRef-linked children) from an anonymous/public " +
             "tenant into the caller's own tenant, legitimized by a row-bound grant the anonymous " +
-            "flow minted. Idempotent, audited via a `<entityType>.tenantHandover` domain event.");
+            "flow minted. Idempotent, audited via a `tenant-handover:event:claimed` event on its own `tenant-handover-claim` aggregate.");
         r.uiHints({
             displayLabel: "Tenant Handover",
             category: "identity",

package/dist/user/handlers/detail.query.d.ts

@@ -9,6 +9,7 @@ export declare const detailQuery: {
     agent?: import("@cosmicdrift/kumiko-types/handlers").AgentHandlerHints;
     rateLimit?: import("@cosmicdrift/kumiko-types/handlers").RateLimitDeclaration;
     outputSchema?: import("zod").ZodType;
+    liveEntities?: readonly string[];
     escapeHatch?: import("@cosmicdrift/kumiko-types/handlers").EscapeHatchDeclaration;
     handler: (query: Parameters<NonNullable<typeof baseDetail.handler>>[0], ctx: HandlerContext) => Promise<unknown>;
 };

package/dist/user/schema/user.js

@@ -72,12 +72,13 @@ export const userEntity = createEntity({
         // login-critical read stays raw, so verifyPassword would compare a
         // plaintext password against ciphertext and every login would fail once
         // a KMS is active. Already an irreversible one-way hash, access-gated to
-        // privileged read/write — see PR body "Offene Fragen".
+        // privileged read/write. Needs a blind-index lookup before this can be
+        // subject-encrypted.
         passwordHash: createTextField({
             maxLength: 255,
             access: { read: access.privileged, write: access.privileged },
             personal: false,
-            reason: "credential_hash_read_without_decrypt_2809",
+            reason: "credential_hash_read_without_decrypt",
         }),
         // Profile — user-editable. Real name in most apps → PII. Searchable via
         // the derived Meili index; events/projection stay ciphertext (#1610).
@@ -164,7 +165,7 @@ export const userEntity = createEntity({
             reason: "technical_reference",
         }),
     },
-    // fw#2134 — email is `personal: "self", find: "exact"`, so the column holds
+    // email is `personal: "self", find: "fuzzy"` (lookupable), so the column holds
     // per-row ciphertext: a plain unique index on it can't catch duplicates.
     // `unique: true` over a lookupable column makes buildEntityTable /
     // deriveEntityTableMeta emit a second, partial unique index over the

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -49,10 +49,10 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
         schema: z.object({ token: z.string().min(1) }),
         access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
         escapeHatch: {
-            reason: "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+            reason: "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
                 "...) to compute the grace period end — the anonymous token holder has no read access " +
-                "to that tenant-config projection. It also appends the user lifecycle event on the " +
-                "SYSTEM_TENANT_ID user stream.",
+                "to that tenant-config projection. startDeletionGracePeriod also appends the user " +
+                "lifecycle event on the SYSTEM_TENANT_ID user stream.",
         },
         agent: { expose: false },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -21,10 +21,10 @@ export function createRequestDeletionHandler(opts = {}) {
             },
         },
         escapeHatch: {
-            reason: "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+            reason: "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
                 "...) to compute the grace period end — the calling user's own identity has no read " +
-                "access to that tenant-config projection. It also appends the user lifecycle event on " +
-                "the SYSTEM_TENANT_ID user stream.",
+                "access to that tenant-config projection. startDeletionGracePeriod also appends the " +
+                "user lifecycle event on the SYSTEM_TENANT_ID user stream.",
         },
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },

package/dist/user-data-rights-defaults/hooks/config-value.userdata-hook.js

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { configValueEntity, configValuesTable } from "../../config/index.js";
-import { assertErased } from "../../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
 import { featureMounted } from "./feature-mounted.js";
 // userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
 // scope rows carry no per-user subject and stay untouched. Event-sourced
@@ -37,10 +37,12 @@ export const configValueDeleteHook = async (ctx) => {
         tenantId: ctx.tenantId,
         userId: ctx.userId,
     });
+    const failures = [];
     for (const row of rows) {
         const id = row["id"]; // @cast-boundary db-row
         if (typeof id !== "string")
             continue;
-        assertErased(await crud.forget({ id }, systemUser, ctx.db), "config-value", id);
+        collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "config-value", id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/user-data-rights-defaults/hooks/file-ref.userdata-hook.js

@@ -3,7 +3,7 @@ import { deleteStoredFileAndDerivatives } from "@cosmicdrift/kumiko-framework/de
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
-import { assertErased } from "../../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
 const ERROR_CONTEXT = "user-data-rights-defaults:fileRef";
 // Forget writes go through the executor (events), not deleteMany/updateMany:
 // a projection rebuild replays the events, so the erasure survives. Eventless
@@ -242,10 +242,12 @@ export const fileRefDeleteHook = async (ctx, strategy) => {
     // auto-verb, the erasure replays on rebuild (created → forgotten → row gone).
     // The old hard deleteMany was resurrected on rebuild; this closes that Art.17
     // hole without a direct write.
+    const failures = [];
     for (const row of personalRows) {
         const id = row["id"]; // @cast-boundary db-row
         if (typeof id !== "string")
             continue;
-        assertErased(await crud.forget({ id }, systemUser, ctx.db), "fileRef", id);
+        collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "fileRef", id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/user-data-rights-defaults/hooks/notification-preference.userdata-hook.js

@@ -1,7 +1,7 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { notificationPreferenceEntity, notificationPreferencesTable, } from "../../delivery/index.js";
-import { assertErased } from "../../shared/index.js";
+import { collectErasureFailure, throwIfErasureFailed } from "../../shared/index.js";
 import { featureMounted } from "./feature-mounted.js";
 // userData-Hooks for delivery's notification-preference rows. Event-sourced
 // entity → forget goes through the executor so a rebuild replays the erasure.
@@ -40,10 +40,12 @@ export const notificationPreferenceDeleteHook = async (ctx) => {
         tenantId: ctx.tenantId,
         userId: ctx.userId,
     });
+    const failures = [];
     for (const row of rows) {
         const id = row["id"]; // @cast-boundary db-row
         if (typeof id !== "string")
             continue;
-        assertErased(await crud.forget({ id }, systemUser, ctx.db), "notification-preference", id);
+        collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "notification-preference", id, failures);
     }
+    throwIfErasureFailed(failures);
 };

package/dist/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.js

@@ -1,6 +1,6 @@
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
-import { assertErased, decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
+import { collectErasureFailure, decryptStoredPii, mapWithConcurrency, throwIfErasureFailed, } from "../../shared/index.js";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant/index.js";
 import { userTable } from "../../user/index.js";
 import { featureMounted } from "./feature-mounted.js";
@@ -78,6 +78,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
     if (!featureMounted(ctx, "tenant"))
         return;
     const systemUser = createSystemUser(ctx.tenantId);
+    const failures = [];
     const email = await resolveUserEmail(ctx);
     if (email) {
         const inviteeRows = await ctx.db.selectMany(tenantInvitationsTable, {
@@ -89,7 +90,7 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             if (typeof id !== "string")
                 continue;
             if (strategy === "delete") {
-                assertErased(await crud.forget({ id }, systemUser, ctx.db), "tenant-invitation", id);
+                collectErasureFailure(await crud.forget({ id }, systemUser, ctx.db), "tenant-invitation", id, failures);
             }
             else {
                 // Row-id in the pseudonym keeps the (tenantId, email) unique index
@@ -116,4 +117,5 @@ export const tenantInvitationDeleteHook = async (ctx, strategy) => {
             skipOptimisticLock: true,
         });
     }
+    throwIfErasureFailed(failures);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.335.0",
+  "version": "0.336.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.335.0",
-    "@cosmicdrift/kumiko-framework": "0.335.0",
-    "@cosmicdrift/kumiko-headless": "0.335.0",
-    "@cosmicdrift/kumiko-renderer": "0.335.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.335.0",
-    "@cosmicdrift/kumiko-types": "0.335.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.336.1",
+    "@cosmicdrift/kumiko-framework": "0.336.1",
+    "@cosmicdrift/kumiko-headless": "0.336.1",
+    "@cosmicdrift/kumiko-renderer": "0.336.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.336.1",
+    "@cosmicdrift/kumiko-types": "0.336.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -985,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.335.0",
-    "@cosmicdrift/kumiko-locale-es": "0.335.0",
+    "@cosmicdrift/kumiko-locale-de": "0.336.1",
+    "@cosmicdrift/kumiko-locale-es": "0.336.1",
     "jsqr": "^1.4.0"
   }
 }

package/src/cap-counter/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "markCapSoftWarned skips the redundant write when the soft-warned flag is already set",
+    "detail": "`markCapSoftWarned` no longer appends a second update event when a parallel warner already set `lastSoftWarnedAt`; the version-conflict retry now returns success without writing."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Delivery log paging no longer skips rows tied on the sort value",
+    "detail": "The delivery log query no longer skips rows at a page boundary when the sort column has duplicate values. A toggle flip received while the initial snapshot loads is no longer overwritten by the older DB read. The stale job-run sweep encrypts and updates once per triggering user instead of once per run."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",

package/src/feature-toggles/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "A toggle flip signalled during the initial load survives the snapshot read"
+  },
   {
     "version": "0.165.0",
     "type": "fix",

package/src/jobs/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "improvement",
+    "title": "Stale job-run sweep batches its writes per triggering user"
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/personal-access-tokens/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "PAT revoke and its revoked-event commit atomically when called on a pool"
+  },
   {
     "version": "0.330.0",
     "type": "fix",

package/src/sessions/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Session revoke (single, mass, all-others) and its revoked-event commit atomically",
+    "detail": "Session logout, password-change/MFA mass revoke, revoke-all-others and PAT revoke now commit the revoke and its revoked-event in one transaction, so a failed append no longer leaves a revoked token whose SSE streams stay open. GDPR delete hooks now try every row of the subject and report all failures at once instead of stopping at the first. The notes mention-forget hook loads the mentioned notes with one query and resolves each host entity's retention policy once."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/subscription-stripe/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.1",
+    "type": "fix",
+    "title": "Checkout retries without a customer id Stripe no longer knows",
+    "detail": "Stripe checkout now retries once without the customer when the stored customer id is unknown to Stripe (for example after switching from a test to a live account), instead of failing with \"No such customer\"."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.336.1",
+    "type": "fix",
+    "title": "Member and tenant directory lookups return a stable order under a limit",
+    "detail": "`tenant:query:member-directory` and `tenant:query:tenant-directory` now sort their rows (tenants by name then id, members by id), so a `limit` always keeps the same rows instead of whichever the database returned first."
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/src/user-data-rights-defaults/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Delete hooks erase every row and report all failures together"
+  },
   {
     "version": "0.116.0",
     "type": "fix",