@cosmicdrift/kumiko-bundled-features 0.336.0 → 0.337.1

package/dist/secrets/handlers/set.write.js

@@ -2,6 +2,7 @@ import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 import { DEFAULT_SECRETS_ACCESS } from "../constants.js";
 import { requireSecretsContext } from "../feature.js";
+import { checkSecretKeyWrite } from "../write-gate.js";
 export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
     return defineWriteHandler({
         name: "set",
@@ -26,8 +27,10 @@ export function createSetHandler(access = DEFAULT_SECRETS_ACCESS) {
             // (via r.secret()) > generic default. A feature that declared a
             // domain-aware redact (Stripe keys: "sk_test...2345") wins over the
             // framework default unless the caller sent a specific preview.
-            const keyDef = ctx.registry.getSecretKey(key);
-            const featureRedact = keyDef?.redact;
+            const gate = checkSecretKeyWrite(ctx.registry, event.user.roles, key);
+            if (!gate.ok)
+                return gate.failure;
+            const featureRedact = gate.keyDef?.redact;
             const redactFn = redactedPreview
                 ? () => redactedPreview
                 : (featureRedact ?? defaultRedact);

package/dist/secrets/i18n.d.ts

@@ -0,0 +1,10 @@
+export declare const SECRETS_I18N: {
+    readonly "secrets.errors.unknownKey": {
+        readonly en: "Unknown secret key.";
+        readonly de: "Unbekannter Geheimnis-Schlüssel.";
+    };
+    readonly "secrets.errors.writeDenied": {
+        readonly en: "You are not allowed to change this secret.";
+        readonly de: "Dieses Geheimnis darf nicht geändert werden.";
+    };
+};

package/dist/secrets/i18n.js

@@ -0,0 +1,10 @@
+export const SECRETS_I18N = {
+    "secrets.errors.unknownKey": {
+        en: "Unknown secret key.",
+        de: "Unbekannter Geheimnis-Schlüssel.",
+    },
+    "secrets.errors.writeDenied": {
+        en: "You are not allowed to change this secret.",
+        de: "Dieses Geheimnis darf nicht geändert werden.",
+    },
+};

package/dist/secrets/write-gate.d.ts

@@ -0,0 +1,10 @@
+import type { Registry, SecretKeyDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+export type SecretKeyWriteCheck = {
+    readonly ok: true;
+    readonly keyDef: SecretKeyDefinition | undefined;
+} | {
+    readonly ok: false;
+    readonly failure: WriteFailure;
+};
+export declare function checkSecretKeyWrite(registry: Registry, userRoles: readonly string[], key: string): SecretKeyWriteCheck;

package/dist/secrets/write-gate.js

@@ -0,0 +1,36 @@
+import { AccessDeniedError, NotFoundError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+function unknownKeyFailure(key) {
+    return {
+        ok: false,
+        failure: writeFailure(new NotFoundError("secretKey", key, { i18nKey: "secrets.errors.unknownKey" })),
+    };
+}
+function namespaceAcceptsKey(namespace, key) {
+    const suffix = key.slice(namespace.qualifiedPrefix.length);
+    if (suffix.length === 0)
+        return false;
+    return namespace.nameSchema ? namespace.nameSchema.safeParse(suffix).success : true;
+}
+// Only keys declared via r.secret() or under a declared r.secretNamespace()
+// are writable through the API, so a tenant admin cannot plant arbitrary rows
+// next to the feature-owned ones. writeRoles narrows the handler access
+// further for a key or a whole namespace.
+export function checkSecretKeyWrite(registry, userRoles, key) {
+    const keyDef = registry.getSecretKey(key);
+    const namespace = keyDef ? undefined : registry.findSecretNamespace(key);
+    if (!keyDef && !(namespace && namespaceAcceptsKey(namespace, key))) {
+        return unknownKeyFailure(key);
+    }
+    const writeRoles = keyDef?.writeRoles ?? namespace?.writeRoles;
+    if (writeRoles !== undefined && !userRoles.some((role) => writeRoles.includes(role))) {
+        return {
+            ok: false,
+            failure: writeFailure(new AccessDeniedError({
+                message: "secret write access denied",
+                i18nKey: "secrets.errors.writeDenied",
+                details: { requiredRoles: writeRoles },
+            })),
+        };
+    }
+    return { ok: true, keyDef };
+}

package/dist/shared/index.d.ts

@@ -14,7 +14,6 @@ export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisi
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { type RowBoundGrantResult, redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { sessionField } from "./session-field.js";
 export { sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
 export { peekTokenSubject, signToken, TokenPurpose, type VerifyResult, verifyToken, } from "./signed-token.js";

package/dist/shared/index.js

@@ -14,7 +14,6 @@ export { denyUnlessJoinRowParentVisible, joinRowParentIsVisible, parentRowIsVisi
 export { hashPassword, verifyDummyPassword, verifyPassword } from "./password-hashing.js";
 export { redeemRowBoundGrant, signRowBoundGrant, } from "./row-bound-grant.js";
 export { runInSubTransaction } from "./run-in-sub-transaction.js";
-export { sessionField } from "./session-field.js";
 export { sessionLocaleField } from "./session-locale-field.js";
 export { sessionTimezoneField } from "./session-timezone-field.js";
 export { peekTokenSubject, signToken, TokenPurpose, verifyToken, } from "./signed-token.js";

package/dist/shared/session-locale-field.js

@@ -1,7 +1,6 @@
 import { canonicalizeLocaleTag, isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
-import { sessionField } from "./session-field.js";
 export function sessionLocaleField(locale) {
     if (locale === null || locale === undefined || !isValidLocaleTag(locale))
         return {};
-    return sessionField("locale", canonicalizeLocaleTag(locale));
+    return { locale: canonicalizeLocaleTag(locale) };
 }

package/dist/shared/session-timezone-field.js

@@ -1,4 +1,5 @@
-import { sessionField } from "./session-field.js";
 export function sessionTimezoneField(timezone) {
-    return sessionField("timezone", timezone);
+    if (timezone === null || timezone === undefined)
+        return {};
+    return { timezone };
 }

package/dist/step-dispatcher/feature.js

@@ -12,8 +12,8 @@ import { defineFeature, STEP_DISPATCH_AGGREGATE_TYPE, STEP_DISPATCH_FAILED_TYPE,
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { SYSTEM_USER_ID } from "@cosmicdrift/kumiko-types/identifiers";
 import * as z from "zod";
-import { mailSpecSchema, performMailDispatch } from "./mail-runner.js";
-import { performWebhookDispatch, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, webhookSpecSchema, } from "./webhook-runner.js";
+import { mailSpecSchema, performMailDispatch, redactEmailAddresses, } from "./mail-runner.js";
+import { performWebhookDispatch, WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR, WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS, webhookSpecSchema, } from "./webhook-runner.js";
 const log = createFallbackLogger("step-dispatcher");
 export const stepDispatcherEnvSchema = z.object({
     [WEBHOOK_ALLOWED_PRIVATE_HOSTS_ENV_VAR]: z
@@ -144,6 +144,7 @@ function buildDispatchSpec(payload, fields) {
 export function createStepDispatcherFeature() {
     return defineFeature("step-dispatcher", (r) => {
         r.describe("Internal system feature that drains deferred Tier-2 side-effects (currently `webhook.send` and `mail.send`) after their originating transaction commits. Listens via `r.multiStreamProjection` on the `kumiko:system:step.dispatch-requested` system event, performs the actual HTTP or mail delivery, then appends `kumiko:system:step.dispatched` or `kumiko:system:step.dispatch-failed` back onto the same stream so the outcome is recorded in the event log without a separate status table. Mount this feature explicitly via `createStepDispatcherFeature()` in your app's feature list alongside any features that use `r.step.webhook.send` or `r.step.mail.send`. Requires the `secrets` feature (`createSecretsFeature()`) to be mounted — `webhook.send` auth resolves per-tenant through it, under `step-dispatcher:webhook-auth.<name>`.");
+        r.secretNamespace("webhook-auth", WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS);
         r.uiHints({
             displayLabel: "Step Dispatcher · Deferred Side-Effects",
             category: "infrastructure",
@@ -216,7 +217,7 @@ export function createStepDispatcherFeature() {
                         if (payload.stepKind === "mail.send") {
                             log.warn("mail dispatch failed", {
                                 aggregateId: event.aggregateId,
-                                reason: result.error,
+                                reason: redactEmailAddresses(result.error),
                             });
                             await recordFailure(payload.stepKind, MAIL_DELIVERY_FAILED_ERROR);
                         }

package/dist/step-dispatcher/mail-runner.d.ts

@@ -15,3 +15,4 @@ export type MailDispatchResult = {
 };
 export declare function setMailRunner(fn: (spec: MailSpec) => Promise<MailDispatchResult>): void;
 export declare function performMailDispatch(spec: MailSpec): Promise<MailDispatchResult>;
+export declare function redactEmailAddresses(text: string): string;

package/dist/step-dispatcher/mail-runner.js

@@ -19,3 +19,8 @@ export function setMailRunner(fn) {
 export async function performMailDispatch(spec) {
     return mailRunner(spec);
 }
+// Adapter errors usually quote the rejected recipient ("550 <ops@example.com> rejected"); the
+// address must not outlive the crypto-shredded dispatch payload in logs.
+export function redactEmailAddresses(text) {
+    return text.replace(/[^\s<>,;"']+@[^\s<>,;"']+/g, "[redacted-address]");
+}

package/dist/step-dispatcher/webhook-runner.d.ts

@@ -7,6 +7,13 @@ export declare function readAllowedPrivateWebhookHostsFromEnv(env?: Readonly<Rec
 export declare function setWebhookHostLookup(fn: typeof lookup | undefined): void;
 export declare const WEBHOOK_AUTH_SECRET_KEY_PREFIX = "step-dispatcher:webhook-auth.";
 export declare function webhookAuthSecretKey(name: string): string;
+export declare const WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS: {
+    readonly label: {
+        readonly en: "Webhook auth secrets";
+    };
+    readonly scope: "tenant";
+    readonly nameSchema: z.ZodString;
+};
 export declare const webhookSpecSchema: z.ZodObject<{
     url: z.ZodString;
     method: z.ZodEnum<{

package/dist/step-dispatcher/webhook-runner.js

@@ -50,6 +50,15 @@ const webhookAuthSecretNameSchema = z
     .min(1)
     .max(WEBHOOK_AUTH_SECRET_NAME_MAX_LENGTH)
     .regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/);
+// The same schema validates `auth.secret` in the step spec and the suffix the
+// secrets handlers accept under the namespace, so the two cannot drift. The
+// prefix itself is derived from the feature name by r.secretNamespace; the
+// boot test pins it to WEBHOOK_AUTH_SECRET_KEY_PREFIX.
+export const WEBHOOK_AUTH_SECRET_NAMESPACE_OPTIONS = {
+    label: { en: "Webhook auth secrets" },
+    scope: "tenant",
+    nameSchema: webhookAuthSecretNameSchema,
+};
 export const webhookSpecSchema = z.object({
     url: z.string(),
     method: z.enum(["POST", "PUT", "PATCH"]),

package/dist/subscription-mollie/plugin-methods.js

@@ -32,11 +32,9 @@ export function createMollieCheckoutSession(client, priceToConfig, appWebhookUrl
             customerId = customer.id;
         }
         // mode "payment" (one-off top-up) → sequenceType.oneoff, no mandate
-        // setup. verify-webhook.ts's ensureSubscriptionForMandate already
-        // gates on sequenceType === "first" — a oneoff payment falls into
-        // its "not our domain" branch and creates NO Mollie subscription.
-        // Webhook resolution for oneoff payments is separate follow-up
-        // work (offlot#109), not part of this contract.
+        // setup. Oneoff payments carry no subscriptionId and are not
+        // sequenceType "first", so verifyAndParseMollieWebhook drops them before
+        // any mandate/subscription handling.
         const sequenceType = options.mode === "payment" ? SequenceType.oneoff : SequenceType.first;
         // payments.create ist overloaded (Promise OR void mit callback);
         // explicit cast auf Promise<Payment>-overload.

package/dist/subscription-stripe/plugin-methods.js

@@ -1,5 +1,6 @@
 // Stripe-Plugin-Methoden für die POST-tenant-resolution-Phase:
-// createCheckoutSession, createPortalSession, cancelSubscription.
+// createCheckoutSession, createPortalSession, cancelSubscription,
+// retrieveSubscription, retrievePrices, planSwitchSession.
 //
 // Werden vom Plugin-build (feature.ts) als methods auf dem
 // SubscriptionProviderPlugin registriert. Anders als
@@ -8,7 +9,7 @@
 // runtime auf (api-key aus system-secrets, audited), statt aus einem
 // mount-time-Closure. Key-Rotation wirkt damit ohne Redeploy.
 //
-// **Type-Ableitung:** die options-shapes der drei methods werden
+// **Type-Ableitung:** die options-shapes der methods werden
 // **direkt vom Plugin-Contract** abgeleitet (`Parameters<NonNullable
 // <SubscriptionProviderPlugin["...method"]>>[1]`). Wenn Foundation den
 // Contract erweitert (z.B. neuer optionaler Field), bemerkt der
@@ -18,6 +19,11 @@ import { KNOWN_RECURRING_INTERVALS, } from "@cosmicdrift/kumiko-bundled-features
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import Stripe from "stripe";
 import { isResourceMissingStripeError, mapStripeSubscriptionState } from "./verify-webhook.js";
+function isUnknownCustomerStripeError(error) {
+    return (isResourceMissingStripeError(error) &&
+        error instanceof Stripe.errors.StripeInvalidRequestError &&
+        error.param === "customer");
+}
 export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation = true } = {}) {
     return async (ctx, options) => {
         // #104-Invariante: ohne billing-live darf keine Stripe-Session
@@ -28,7 +34,7 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
         await runtime.assertBillingLive(ctx);
         const stripe = await runtime.clientForCtx(ctx);
         const mode = options.mode ?? "subscription";
-        const session = await stripe.checkout.sessions.create({
+        const sessionParams = (providerCustomerId) => ({
             mode,
             line_items: [{ price: options.priceId, quantity: 1 }],
             success_url: options.successUrl,
@@ -48,10 +54,22 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
                     // Without a customer, Stripe's default "if_required" makes a guest
                     // checkout when invoice_creation is off; the webhook then has no
                     // customer id and drops the paid payment as ignored.
-                    ...(!options.providerCustomerId && { customer_creation: "always" }),
+                    ...(!providerCustomerId && { customer_creation: "always" }),
                 }),
-            ...(options.providerCustomerId && { customer: options.providerCustomerId }),
+            ...(providerCustomerId && { customer: providerCustomerId }),
         });
+        let session;
+        try {
+            session = await stripe.checkout.sessions.create(sessionParams(options.providerCustomerId));
+        }
+        catch (error) {
+            if (!options.providerCustomerId || !isUnknownCustomerStripeError(error))
+                throw error;
+            // Stripe account switch (test -> live) or a customer deleted in the dashboard leaves a
+            // stored customer id Stripe no longer knows; checkout creates a fresh customer instead.
+            ctx.log?.warn("subscription-stripe: stored customer unknown to Stripe, retrying without it");
+            session = await stripe.checkout.sessions.create(sessionParams(undefined));
+        }
         if (!session.url) {
             // Defensive: Stripe returns a hosted url for both modes today —
             // guards against future API drift.
@@ -252,6 +270,13 @@ async function resolvePortalConfiguration(stripe, runtime, cache, portalConfigCa
         const price = cache.get(priceId);
         return price ? [price] : [];
     });
+    // A transient prices.retrieve failure would otherwise yield a different
+    // priceSetHash and persist an incomplete portal configuration at Stripe.
+    if (prices.length !== allowedPriceIds.length) {
+        throw new UnprocessableError("price_unavailable", {
+            i18nKey: "billing-foundation.errors.priceUnavailable",
+        });
+    }
     const hash = priceSetHash(prices);
     const cached = portalConfigCache.get(hash);
     if (cached)

package/dist/tenant/handlers/member-directory.query.js

@@ -13,9 +13,14 @@ const KMS_POOL_CONCURRENCY = 4;
 // are decrypted and filtered in memory. The cap keeps a SystemAdmin's global
 // search from decrypting every user.
 const SEARCH_SCAN_CAP = 1000;
+// Display names are encrypted, so id is the only stable SQL-side key; uuid text
+// order equals the uuid column's byte order.
+function compareIds(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
 async function loadMemberUserIds(db, tenantId) {
     const memberships = await selectMany(db, tenantMembershipsTable, { tenantId });
-    return [...new Set(memberships.map((row) => String(row["userId"])))];
+    return [...new Set(memberships.map((row) => String(row["userId"])))].sort(compareIds);
 }
 // Label source behind every `user:user` reference column (fw#3107). The
 // entity-convention lookup, user:query:user:list, is a SystemAdmin
@@ -52,12 +57,20 @@ export const memberDirectoryQuery = definePagedQueryHandler({
         let users;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as user:query:user:list did");
-            users = await selectMany(db, userTable, undefined, { limit: scanLimit });
+            users = await selectMany(db, userTable, undefined, {
+                limit: scanLimit,
+                orderBy: { col: "id", direction: "asc" },
+            });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
             const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
-            users = userIds.length > 0 ? await selectMany(db, userTable, { id: [...userIds] }) : [];
+            users =
+                userIds.length > 0
+                    ? await selectMany(db, userTable, { id: [...userIds] }, {
+                        orderBy: { col: "id", direction: "asc" },
+                    })
+                    : [];
         }
         const resolved = await mapWithConcurrency(users, KMS_POOL_CONCURRENCY, async (user) => {
             const id = String(user.id);

package/dist/tenant/handlers/tenant-directory.query.js

@@ -35,7 +35,13 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         let tenants;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did");
-            tenants = await selectMany(db, tenantTable, undefined, { limit: scanLimit });
+            tenants = await selectMany(db, tenantTable, undefined, {
+                limit: scanLimit,
+                orderBy: [
+                    { col: "name", direction: "asc" },
+                    { col: "id", direction: "asc" },
+                ],
+            });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);

package/dist/tenant-handover/feature.js

@@ -13,7 +13,7 @@ export function createTenantHandoverFeature(opts = {}) {
         r.describe("Try-before-signup ownership handover: claims the rows of a declared-transferable " +
             "entity graph (root plus its parentRef-linked children) from an anonymous/public " +
             "tenant into the caller's own tenant, legitimized by a row-bound grant the anonymous " +
-            "flow minted. Idempotent, audited via a `<entityType>.tenantHandover` domain event.");
+            "flow minted. Idempotent, audited via a `tenant-handover:event:claimed` event on its own `tenant-handover-claim` aggregate.");
         r.uiHints({
             displayLabel: "Tenant Handover",
             category: "identity",

package/dist/tenant-handover/move-entity-graph.js

@@ -175,7 +175,9 @@ export async function moveTransferGraph(args) {
         { entityName: rootEntityName, rowIds: [rootRowId] },
     ];
     for (let round = 0; round < MAX_TRANSFER_DEPTH && pending.length > 0; round++) {
-        const discovered = [];
+        // Merged per type so an edge leaving a type runs once per round, not once
+        // per edge that reached it.
+        const discovered = new Map();
         for (const { entityName, rowIds } of pending) {
             for (const edge of adjacency.get(entityName) ?? []) {
                 const childIds = await moveEdgeRows({
@@ -204,7 +206,13 @@ export async function moveTransferGraph(args) {
                 // (`note.vehicleId` and `note.campaignId`), and assigning would drop the
                 // earlier count.
                 movedCounts[edge.entityName] = (movedCounts[edge.entityName] ?? 0) + childIds.length;
-                discovered.push({ entityName: edge.entityName, rowIds: childIds });
+                const discoveredIds = discovered.get(edge.entityName);
+                if (discoveredIds === undefined) {
+                    discovered.set(edge.entityName, [...childIds]);
+                }
+                else {
+                    discoveredIds.push(...childIds);
+                }
                 await transferAggregateStreams(db, {
                     aggregateType: edge.entityName,
                     aggregateIds: childIds,
@@ -223,7 +231,7 @@ export async function moveTransferGraph(args) {
                 }));
             }
         }
-        pending = discovered;
+        pending = [...discovered].map(([entityName, rowIds]) => ({ entityName, rowIds }));
     }
     // The depth limit is a safety net, not a licence to move part of a graph: if
     // rounds ran out while rows remain whose type still leads somewhere, the

package/dist/tenant-lifecycle/lifecycle-gate.d.ts

@@ -4,6 +4,8 @@ export type TenantLifecycleGate = {
     readonly status: string;
     readonly gracePeriodEnd: string | null;
 };
+/** @internal exported for the bounded-cache test */
+export declare const GATE_CACHE_MAX_ENTRIES = 5000;
 export declare function invalidateTenantLifecycleGate(tenantId: TenantId): void;
 /** @internal test-only — resetTestTables/resetTestTable wipe rows directly
  *  via SQL, bypassing the write handlers that invalidate normally. Tests
@@ -11,4 +13,6 @@ export declare function invalidateTenantLifecycleGate(tenantId: TenantId): void;
  *  call this in beforeEach or a later test can read an earlier test's
  *  cached status for the same tenantId. */
 export declare function resetTenantLifecycleGateCacheForTests(): void;
+/** @internal test-only */
+export declare function tenantLifecycleGateCacheSizeForTests(): number;
 export declare function resolveTenantLifecycleGate(db: DbRunner, tenantId: TenantId): Promise<TenantLifecycleGate | null>;

package/dist/tenant-lifecycle/lifecycle-gate.js

@@ -11,9 +11,12 @@ import { tenantTable } from "../tenant/index.js";
 // never arrives).
 // Split into its own module (not run-tenant-destroy.ts) so stages.ts can
 // invalidate too without a stages.ts <-> run-tenant-destroy.ts import cycle.
-// ponytail: unbounded Map — fine while tenant counts stay in the thousands (a
-// few bytes/entry); swap for a bounded LRU if that ever changes.
+// The anonymous path feeds client-supplied X-Tenant ids in here, so unknown ids
+// (cached as null) must not grow the Map without bound: past the cap, expired
+// entries are swept and, if still full, the oldest-inserted entries are evicted.
 const GATE_TTL_MS = 3000;
+/** @internal exported for the bounded-cache test */
+export const GATE_CACHE_MAX_ENTRIES = 5000;
 const gateCache = new Map();
 export function invalidateTenantLifecycleGate(tenantId) {
     gateCache.delete(tenantId);
@@ -26,6 +29,25 @@ export function invalidateTenantLifecycleGate(tenantId) {
 export function resetTenantLifecycleGateCacheForTests() {
     gateCache.clear();
 }
+/** @internal test-only */
+export function tenantLifecycleGateCacheSizeForTests() {
+    return gateCache.size;
+}
+function cacheGate(tenantId, value) {
+    if (gateCache.size >= GATE_CACHE_MAX_ENTRIES && !gateCache.has(tenantId)) {
+        const now = Date.now();
+        for (const [id, entry] of gateCache) {
+            if (entry.expiresAt <= now)
+                gateCache.delete(id);
+        }
+        for (const id of gateCache.keys()) {
+            if (gateCache.size < GATE_CACHE_MAX_ENTRIES)
+                break;
+            gateCache.delete(id);
+        }
+    }
+    gateCache.set(tenantId, { value, expiresAt: Date.now() + GATE_TTL_MS });
+}
 export async function resolveTenantLifecycleGate(db, tenantId) {
     const cached = gateCache.get(tenantId);
     if (cached && cached.expiresAt > Date.now())
@@ -33,13 +55,13 @@ export async function resolveTenantLifecycleGate(db, tenantId) {
     const rows = await selectMany(db, tenantTable, { id: tenantId });
     const row = rows[0];
     if (!row) {
-        gateCache.set(tenantId, { value: null, expiresAt: Date.now() + GATE_TTL_MS });
+        cacheGate(tenantId, null);
         return null;
     }
     const gate = {
         status: row.status,
         gracePeriodEnd: row.gracePeriodEnd?.toString() ?? null,
     };
-    gateCache.set(tenantId, { value: gate, expiresAt: Date.now() + GATE_TTL_MS });
+    cacheGate(tenantId, gate);
     return gate;
 }

package/dist/user/schema/user.js

@@ -72,12 +72,13 @@ export const userEntity = createEntity({
         // login-critical read stays raw, so verifyPassword would compare a
         // plaintext password against ciphertext and every login would fail once
         // a KMS is active. Already an irreversible one-way hash, access-gated to
-        // privileged read/write — see PR body "Offene Fragen".
+        // privileged read/write. Needs a blind-index lookup before this can be
+        // subject-encrypted.
         passwordHash: createTextField({
             maxLength: 255,
             access: { read: access.privileged, write: access.privileged },
             personal: false,
-            reason: "credential_hash_read_without_decrypt_2809",
+            reason: "credential_hash_read_without_decrypt",
         }),
         // Profile — user-editable. Real name in most apps → PII. Searchable via
         // the derived Meili index; events/projection stay ciphertext (#1610).
@@ -164,7 +165,7 @@ export const userEntity = createEntity({
             reason: "technical_reference",
         }),
     },
-    // fw#2134 — email is `personal: "self", find: "exact"`, so the column holds
+    // email is `personal: "self", find: "fuzzy"` (lookupable), so the column holds
     // per-row ciphertext: a plain unique index on it can't catch duplicates.
     // `unique: true` over a lookupable column makes buildEntityTable /
     // deriveEntityTableMeta emit a second, partial unique index over the

package/dist/user-data-rights/handlers/confirm-deletion-by-token.write.js

@@ -49,10 +49,10 @@ export function createConfirmDeletionByTokenHandler(opts = {}) {
         schema: z.object({ token: z.string().min(1) }),
         access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
         escapeHatch: {
-            reason: "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+            reason: "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
                 "...) to compute the grace period end — the anonymous token holder has no read access " +
-                "to that tenant-config projection. It also appends the user lifecycle event on the " +
-                "SYSTEM_TENANT_ID user stream.",
+                "to that tenant-config projection. startDeletionGracePeriod also appends the user " +
+                "lifecycle event on the SYSTEM_TENANT_ID user stream.",
         },
         agent: { expose: false },
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },

package/dist/user-data-rights/handlers/deletion-grace-period.js

@@ -73,10 +73,12 @@ export async function startDeletionGracePeriod(ctx, userId, resolveGracePeriodSp
     const gracePeriodEnd = addDurationSpec(T.Now.instant(), await resolveGracePeriodSpec());
     const { applied } = await updateUserLifecycle(lifecycleRunner, userId, { status: USER_STATUS.DeletionRequested, gracePeriodEnd, pendingDeletionRequestId: null }, { expect: { status: USER_STATUS.Active, ...additionalExpect } });
     if (!applied) {
+        // userRow predates the write, so its status is stale for the concurrent loser.
+        const currentRow = await ctx.db.global(userTable).fetchOne({ id: userId });
         return {
             ok: false,
             error: new UnprocessableError("user_not_in_active_state", {
-                details: { currentStatus: userRow["status"] },
+                details: { currentStatus: currentRow?.["status"] ?? userRow["status"] },
             }),
         };
     }

package/dist/user-data-rights/handlers/request-deletion.write.js

@@ -21,10 +21,10 @@ export function createRequestDeletionHandler(opts = {}) {
             },
         },
         escapeHatch: {
-            reason: "startDeletionGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+            reason: "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
                 "...) to compute the grace period end — the calling user's own identity has no read " +
-                "access to that tenant-config projection. It also appends the user lifecycle event on " +
-                "the SYSTEM_TENANT_ID user stream.",
+                "access to that tenant-config projection. startDeletionGracePeriod also appends the " +
+                "user lifecycle event on the SYSTEM_TENANT_ID user stream.",
         },
         description: "Starts the GDPR Art. 17 deletion of the calling user's own account by arming the grace period from the tenant compliance profile and mailing a confirmation, after which only cancel-deletion can stop the erasure.",
         agent: { risk: "high" },

package/dist/workflow-runner/db/queries/due-runs.d.ts

@@ -4,4 +4,5 @@ export type DueRow = {
     readonly run_id: string;
     readonly step_index: number;
 };
+export declare const DUE_RUNS_BATCH_SIZE = 100;
 export declare function selectDueWorkflowRunPending(db: DbConnection, tenantId: TenantId): Promise<readonly DueRow[]>;

package/dist/workflow-runner/db/queries/due-runs.js

@@ -1,9 +1,12 @@
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+// Oldest first and capped, so a backlog after an outage drains over several
+// ticks instead of holding one tick's `concurrency: "skip"` slot for minutes.
+export const DUE_RUNS_BATCH_SIZE = 100;
 // Dedup happens solely via resume-run's VersionConflictError-checked claim
 // (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
 // row loses that race and no-ops. No row locks: in an autocommit statement
 // they would be released right after the SELECT and guard nothing.
 export async function selectDueWorkflowRunPending(db, tenantId) {
     // kumiko-lint-ignore raw-sql tenant-scoped due-row pickup
-    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now()`, [tenantId]));
+    return (await asRawClient(db).unsafe(`SELECT run_id, step_index FROM workflow_run_pending WHERE tenant_id = $1 AND wake_at < now() ORDER BY wake_at ASC LIMIT ${DUE_RUNS_BATCH_SIZE}`, [tenantId]));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.336.0",
+  "version": "0.337.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -483,12 +483,12 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.336.0",
-    "@cosmicdrift/kumiko-framework": "0.336.0",
-    "@cosmicdrift/kumiko-headless": "0.336.0",
-    "@cosmicdrift/kumiko-renderer": "0.336.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.336.0",
-    "@cosmicdrift/kumiko-types": "0.336.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.337.1",
+    "@cosmicdrift/kumiko-framework": "0.337.1",
+    "@cosmicdrift/kumiko-headless": "0.337.1",
+    "@cosmicdrift/kumiko-renderer": "0.337.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.337.1",
+    "@cosmicdrift/kumiko-types": "0.337.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -985,8 +985,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.336.0",
-    "@cosmicdrift/kumiko-locale-es": "0.336.0",
+    "@cosmicdrift/kumiko-locale-de": "0.337.1",
+    "@cosmicdrift/kumiko-locale-es": "0.337.1",
     "jsqr": "^1.4.0"
   }
 }

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.337.0",
+    "type": "fix",
+    "title": "agent tool name collisions are disambiguated, audit search is substring, encrypted config bounds errors do not echo the value",
+    "detail": "The agent manifest reports a detail screen's configured `idParam` and builds its label index once per manifest. Handler tools whose names collide after sanitizing or truncation are no longer dropped; the later one gets a QN-hash suffix. The audit log search matches event types by substring instead of exact equality. Config bounds errors no longer echo an encrypted value. The MFA account label never falls back to the internal user id. The tenant caps list resolves limits in parallel."
+  },
   {
     "version": "0.335.0",
     "type": "breaking",