@cosmicdrift/kumiko-bundled-features 0.337.1 → 0.338.0

package/dist/subscription-mollie/verify-webhook.js

@@ -13,7 +13,7 @@
 // muss `customerSubscriptions.create` selbst aufrufen). Wir machen
 // das im Plugin (idempotent via list-check), damit Foundation einen
 // Created-Event mit subscription-id bekommt.
-import { SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { parseProviderConsentId, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { Temporal } from "temporal-polyfill";
 import { MOLLIE_PROVIDER_NAME } from "./constants.js";
@@ -85,17 +85,18 @@ export function verifyAndParseMollieWebhook(client, options) {
             throw new Error(`subscription-mollie: subscription ${subscription.id} has neither nextPaymentDate nor startDate`);
         }
         const currentPeriodEnd = mollieDateStringToInstantIso(periodEndSource);
+        const consentId = parseProviderConsentId(metadata["consentId"]);
         return {
             providerEventId: id,
             providerName: MOLLIE_PROVIDER_NAME,
             type,
             tenantId,
+            ...(consentId !== undefined && { consentId }),
             providerCustomerId: subscription.customerId,
             providerSubscriptionId: subscription.id,
             status,
             tier,
             currentPeriodEnd,
-            rawPayload: JSON.stringify({ webhookId: id, subscription, triggerPayment }),
         };
     };
 }
@@ -112,6 +113,7 @@ async function ensureSubscriptionForMandate(client, options, payment) {
     const paymentMetadata = payment.metadata ?? {}; // @cast-boundary engine-bridge
     const tenantId = paymentMetadata["tenantId"];
     const priceId = paymentMetadata["priceId"];
+    const consentId = parseProviderConsentId(paymentMetadata["consentId"]);
     if (!tenantId || !priceId)
         return null;
     const priceCfg = options.priceToConfig[priceId];
@@ -130,7 +132,7 @@ async function ensureSubscriptionForMandate(client, options, payment) {
         amount: { currency: priceCfg.amountCurrency, value: priceCfg.amountValue },
         interval: priceCfg.interval,
         description: priceCfg.description,
-        metadata: { tenantId, priceId },
+        metadata: { tenantId, priceId, ...(consentId && { consentId }) },
     });
 }
 // =============================================================================

package/dist/subscription-stripe/plugin-methods.d.ts

@@ -8,6 +8,7 @@ export type StripeCheckoutSessionRuntimeOptions = {
      *  Never applied in mode:"subscription" — Stripe rejects invoice_creation there. */
     readonly paymentInvoiceCreation?: boolean;
 };
+export declare function mapAppLocaleToStripeLocale(locale: string): Stripe.Checkout.SessionCreateParams.Locale;
 export declare function createStripeCheckoutSession(runtime: StripeCtxRuntime, { paymentInvoiceCreation }?: StripeCheckoutSessionRuntimeOptions): (ctx: HandlerContext, options: StripeCheckoutOptions) => Promise<{
     url: string;
 }>;
@@ -15,7 +16,8 @@ export type StripePortalOptions = Parameters<NonNullable<SubscriptionProviderPlu
 export declare function createStripePortalSession(runtime: StripeCtxRuntime): (ctx: HandlerContext, options: StripePortalOptions) => Promise<{
     url: string;
 }>;
-export declare function createStripeCancelSubscription(runtime: StripeCtxRuntime): (ctx: HandlerContext, providerSubscriptionId: string) => Promise<void>;
+export type StripeCancelOptions = Parameters<NonNullable<SubscriptionProviderPlugin["cancelSubscription"]>>[1];
+export declare function createStripeCancelSubscription(runtime: StripeCtxRuntime): (ctx: HandlerContext, options: StripeCancelOptions) => Promise<void>;
 export type StripeRetrieveSubscriptionOptions = {
     readonly priceToTier: Readonly<Record<string, string>>;
 };

package/dist/subscription-stripe/plugin-methods.js

@@ -15,10 +15,65 @@
 // Contract erweitert (z.B. neuer optionaler Field), bemerkt der
 // Stripe-Plugin das beim TS-Compile, nicht erst zur Laufzeit.
 import { createHash } from "node:crypto";
-import { KNOWN_RECURRING_INTERVALS, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { KNOWN_RECURRING_INTERVALS, SubscriptionCancelTimings, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { ConflictError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import Stripe from "stripe";
 import { isResourceMissingStripeError, mapStripeSubscriptionState } from "./verify-webhook.js";
+// Stripe's own Locale union also accepts arbitrary strings, so the known set
+// is spelled out here to pick a value Stripe actually renders.
+const STRIPE_CHECKOUT_LOCALES = [
+    "bg",
+    "cs",
+    "da",
+    "de",
+    "el",
+    "en",
+    "en-GB",
+    "es",
+    "es-419",
+    "et",
+    "fi",
+    "fil",
+    "fr",
+    "fr-CA",
+    "hr",
+    "hu",
+    "id",
+    "it",
+    "ja",
+    "ko",
+    "lt",
+    "lv",
+    "ms",
+    "mt",
+    "nb",
+    "nl",
+    "pl",
+    "pt",
+    "pt-BR",
+    "ro",
+    "ru",
+    "sk",
+    "sl",
+    "sv",
+    "th",
+    "tr",
+    "vi",
+    "zh",
+    "zh-HK",
+    "zh-TW",
+];
+// Stripe rejects custom_text.submit.message above 1200 characters.
+const STRIPE_CUSTOM_TEXT_MAX_LENGTH = 1200;
+export function mapAppLocaleToStripeLocale(locale) {
+    const normalized = locale.replace("_", "-");
+    const knownLocales = STRIPE_CHECKOUT_LOCALES;
+    const exact = knownLocales.find((known) => known.toLowerCase() === normalized.toLowerCase());
+    if (exact)
+        return exact;
+    const language = normalized.split("-")[0]?.toLowerCase();
+    return knownLocales.find((known) => known === language) ?? "auto";
+}
 function isUnknownCustomerStripeError(error) {
     return (isResourceMissingStripeError(error) &&
         error instanceof Stripe.errors.StripeInvalidRequestError &&
@@ -34,11 +89,22 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
         await runtime.assertBillingLive(ctx);
         const stripe = await runtime.clientForCtx(ctx);
         const mode = options.mode ?? "subscription";
+        const metadata = {
+            tenantId: options.tenantId,
+            ...(options.consentId && { consentId: options.consentId }),
+        };
         const sessionParams = (providerCustomerId) => ({
             mode,
             line_items: [{ price: options.priceId, quantity: 1 }],
             success_url: options.successUrl,
             cancel_url: options.cancelUrl,
+            submit_type: "pay",
+            ...(options.locale && { locale: mapAppLocaleToStripeLocale(options.locale) }),
+            ...(options.submitMessage && {
+                custom_text: {
+                    submit: { message: options.submitMessage.slice(0, STRIPE_CUSTOM_TEXT_MAX_LENGTH) },
+                },
+            }),
             // subscription_data is subscription-mode-only (Stripe rejects it in
             // payment-mode) — the subsequent webhook reads metadata.tenantId off
             // the subscription it creates. payment-mode has no subscription, so
@@ -47,9 +113,9 @@ export function createStripeCheckoutSession(runtime, { paymentInvoiceCreation =
             // rejects it in subscription-mode, which invoices via the subscription
             // itself.
             ...(mode === "subscription"
-                ? { subscription_data: { metadata: { tenantId: options.tenantId } } }
+                ? { subscription_data: { metadata } }
                 : {
-                    payment_intent_data: { metadata: { tenantId: options.tenantId } },
+                    payment_intent_data: { metadata },
                     invoice_creation: { enabled: paymentInvoiceCreation },
                     // Without a customer, Stripe's default "if_required" makes a guest
                     // checkout when invoice_creation is off; the webhook then has no
@@ -88,17 +154,17 @@ export function createStripePortalSession(runtime) {
         return { url: session.url };
     };
 }
-// =============================================================================
-// cancelSubscription
-// =============================================================================
-//
-// Stripe sendet danach `customer.subscription.deleted`-webhook → der
-// state-update läuft über den normalen webhook-pfad. Diese function
-// triggert nur die API-Cancellation.
 export function createStripeCancelSubscription(runtime) {
-    return async (ctx, providerSubscriptionId) => {
+    return async (ctx, options) => {
         const stripe = await runtime.clientForCtx(ctx);
-        await stripe.subscriptions.cancel(providerSubscriptionId);
+        if (options.when === SubscriptionCancelTimings.periodEnd) {
+            await stripe.subscriptions.update(options.providerSubscriptionId, {
+                cancel_at_period_end: true,
+            });
+        }
+        else {
+            await stripe.subscriptions.cancel(options.providerSubscriptionId);
+        }
     };
 }
 export function createStripeRetrieveSubscription(runtime, { priceToTier }) {
@@ -122,7 +188,6 @@ export function createStripeRetrieveSubscription(runtime, { priceToTier }) {
                 : subscription.customer.id,
             providerSubscriptionId: subscription.id,
             ...state,
-            rawPayload: JSON.stringify(subscription),
         };
     };
 }

package/dist/subscription-stripe/verify-webhook.js

@@ -31,7 +31,7 @@
 // status/tier/period-end mapping. resource_missing (deleted between webhook
 // and retrieve) returns null; any other Stripe error becomes 503 so Stripe
 // redelivers.
-import { BillingEventKinds, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
+import { BillingEventKinds, parseProviderConsentId, SubscriptionEventTypes, SubscriptionStatuses, } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import { ExtraRouteRejection } from "@cosmicdrift/kumiko-framework/api";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import Stripe from "stripe";
@@ -116,15 +116,16 @@ export function verifyAndParseStripeWebhook(runtime, options) {
         if (!state) {
             return null;
         }
+        const consentId = parseProviderConsentId(sub.metadata?.["consentId"]);
         return {
             providerEventId: event.id,
             providerName: STRIPE_PROVIDER_NAME,
             type: normalizedType,
             tenantId,
+            ...(consentId !== undefined && { consentId }),
             providerCustomerId: typeof sub.customer === "string" ? sub.customer : sub.customer.id,
             providerSubscriptionId: sub.id,
             ...state,
-            rawPayload: JSON.stringify(event),
         };
     };
 }
@@ -269,6 +270,7 @@ function dropPaidSession(event, session, reason) {
 }
 /** Parses a checkout.session.completed / .async_payment_succeeded event into
  *  a PaymentEvent, or null if it isn't a paid one-off-payment session. */
+// kumiko-lint-ignore complexity-budget optional-field spreads over the session, one branch per optional provider field
 async function parsePaymentEvent(event, stripe) {
     const session = event.data.object; // @cast-boundary engine-bridge
     // mode !== "payment" excludes subscription-checkout sessions (same event types);
@@ -326,13 +328,15 @@ async function parsePaymentEvent(event, stripe) {
     if (!providerCustomerId) {
         return dropPaidSession(event, session, "missing_customer");
     }
+    const consentId = parseProviderConsentId(paymentIntent.metadata?.["consentId"]);
     return {
         kind: BillingEventKinds.payment,
         providerEventId: event.id,
         providerName: STRIPE_PROVIDER_NAME,
         tenantId,
+        ...(consentId !== undefined && { consentId }),
+        providerCheckoutId: session.id,
         providerCustomerId,
         priceId,
-        rawPayload: JSON.stringify(event),
     };
 }

package/dist/tags/executor.d.ts

@@ -1,2 +1,4 @@
+import { type EntityDefinition } from "@cosmicdrift/kumiko-framework/engine";
 export declare const tagExecutor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor;
 export declare const tagAssignmentExecutor: import("@cosmicdrift/kumiko-types/event-store-executor-types").EventStoreExecutor;
+export declare function createTagAssignmentExecutor(ownership: EntityDefinition["access"] | undefined): typeof tagAssignmentExecutor;

package/dist/tags/executor.js

@@ -1,7 +1,15 @@
 import { createEntityExecutor } from "@cosmicdrift/kumiko-framework/engine";
-import { tagAssignmentEntity, tagEntity } from "./entity.js";
+import { createTagAssignmentEntity, tagAssignmentEntity, tagEntity } from "./entity.js";
 // Shared executors for the tag + tag-assignment write-handlers.
 // createEntityExecutor is side-effect-free; instantiating once keeps the
 // table+executor pair in one place instead of rebuilding it per handler module.
 export const { executor: tagExecutor } = createEntityExecutor("tag", tagEntity);
 export const { executor: tagAssignmentExecutor } = createEntityExecutor("tag-assignment", tagAssignmentEntity);
+// Carries only `ownership.write`: the executor enforces entity.access.write on
+// create/restore/delete, while a read rule would hide rows from the handlers'
+// own idempotency reads and the delete-tag cascade.
+export function createTagAssignmentExecutor(ownership) {
+    if (ownership?.write === undefined)
+        return tagAssignmentExecutor;
+    return createEntityExecutor("tag-assignment", createTagAssignmentEntity({ write: ownership.write })).executor;
+}

package/dist/tags/feature.d.ts

@@ -28,9 +28,10 @@ export type TagsFeatureOptions = {
      *  `tag-assignment`; the `tag` catalog stays tenant-wide by design.
      *
      *  `ownership.write` is separate and does NOT affect list/read. It's
-     *  consulted by the framework's generic delete/forget/restore paths (not by
-     *  this feature's own assign-tag handler — see createTagsFeature's
-     *  boot-guard comment). A `from()` rule there also gates GDPR erasure
+     *  consulted on every assignment write: assign-tag (create/restore),
+     *  remove-tag (delete) and the framework's generic forget path. The
+     *  delete-tag cascade stays ungated, since deleting a catalog tag detaches
+     *  it everywhere. A `from()` rule there also gates GDPR erasure
      *  (`forget`): if the rule's role map doesn't cover whatever role the
      *  erasure/retention pipeline runs as, `forget` denies instead of
      *  crypto-shredding — a silent Art.17 failure, not a thrown error. Make

package/dist/tags/feature.js

@@ -21,6 +21,7 @@ import { defineEntityDetailHandler, defineEntityListHandler, defineEntityUpdateH
 import { hasWhereRule } from "../shared/index.js";
 import { DEFAULT_TAG_ACCESS, TAGS_FEATURE_NAME } from "./constants.js";
 import { createTagAssignmentEntity, tagEntity } from "./entity.js";
+import { createTagAssignmentExecutor } from "./executor.js";
 import { createAssignTagHandler } from "./handlers/assign-tag.write.js";
 import { createCreateTagHandler } from "./handlers/create-tag.write.js";
 import { createDeleteTagHandler } from "./handlers/delete-tag.write.js";
@@ -45,8 +46,9 @@ function registerTags(r, access, toggleable, ownership, parents) {
     r.writeHandler(createCreateTagHandler(access));
     r.writeHandler(createUpdateTagHandler(access));
     r.writeHandler(createDeleteTagHandler(access));
-    r.writeHandler(createAssignTagHandler(access));
-    r.writeHandler(createRemoveTagHandler(access));
+    const assignmentExecutor = createTagAssignmentExecutor(ownership);
+    r.writeHandler(createAssignTagHandler(access, assignmentExecutor));
+    r.writeHandler(createRemoveTagHandler(access, assignmentExecutor));
     // Convention aliases for entityList/entityEdit — create stays flat-payload
     // (payloadMode=values); update must accept the {id,version,changes} envelope
     // entityEdit sends (legacy update-tag stays for TagManager). delete stays

package/dist/tags/handlers/assign-tag.write.d.ts

@@ -1,3 +1,4 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-export declare function createAssignTagHandler(access?: AccessRule): WriteHandlerDef;
+import { tagAssignmentExecutor } from "../executor.js";
+export declare function createAssignTagHandler(access?: AccessRule, assignmentExecutor?: typeof tagAssignmentExecutor): WriteHandlerDef;
 export declare const assignTagHandler: WriteHandlerDef;

package/dist/tags/handlers/assign-tag.write.js

@@ -25,7 +25,7 @@ import { assignTagPayloadSchema } from "../schemas.js";
 // the aggregate-id is tenant-scoped, so this is not a cross-tenant hole, but
 // without the check any dispatch-eligible tenant user could tag an object they
 // are not allowed to read. See shared/parent-visibility.ts.
-export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
+export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS, assignmentExecutor = tagAssignmentExecutor) {
     return {
         name: "assign-tag",
         schema: assignTagPayloadSchema,
@@ -37,11 +37,11 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
             if (denied)
                 return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
-            const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
+            const existing = await assignmentExecutor.detail({ id }, event.user, ctx.db);
             if (existing) {
                 return { isSuccess: true, data: { id } };
             }
-            const restored = await tagAssignmentExecutor.restore({ id }, event.user, ctx.db);
+            const restored = await assignmentExecutor.restore({ id }, event.user, ctx.db);
             if (restored.isSuccess)
                 return { isSuccess: true, data: { id } };
             // A concurrent first-time assign can also land here: the other caller's
@@ -57,7 +57,7 @@ export function createAssignTagHandler(access = DEFAULT_TAG_ACCESS) {
             const tag = await tagExecutor.detail({ id: payload.tagId }, event.user, ctx.db);
             if (!tag)
                 return writeFailure(new NotFoundError("tag", payload.tagId));
-            const created = await tagAssignmentExecutor.create({
+            const created = await assignmentExecutor.create({
                 id,
                 tagId: payload.tagId,
                 entityType: payload.entityType,

package/dist/tags/handlers/remove-tag.write.d.ts

@@ -1,3 +1,4 @@
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-export declare function createRemoveTagHandler(access?: AccessRule): WriteHandlerDef;
+import { tagAssignmentExecutor } from "../executor.js";
+export declare function createRemoveTagHandler(access?: AccessRule, assignmentExecutor?: typeof tagAssignmentExecutor): WriteHandlerDef;
 export declare const removeTagHandler: WriteHandlerDef;

package/dist/tags/handlers/remove-tag.write.js

@@ -10,7 +10,7 @@ import { removeTagPayloadSchema } from "../schemas.js";
 // Host reference: entityType/entityId are client input, so the caller must be
 // able to see the host row before detaching anything from it — see
 // shared/parent-visibility.ts.
-export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS) {
+export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS, assignmentExecutor = tagAssignmentExecutor) {
     return {
         name: "remove-tag",
         schema: removeTagPayloadSchema,
@@ -22,11 +22,11 @@ export function createRemoveTagHandler(access = DEFAULT_TAG_ACCESS) {
             if (denied)
                 return denied;
             const id = tagAssignmentAggregateId(event.user.tenantId, payload.tagId, payload.entityType, payload.entityId);
-            const existing = await tagAssignmentExecutor.detail({ id }, event.user, ctx.db);
+            const existing = await assignmentExecutor.detail({ id }, event.user, ctx.db);
             if (!existing) {
                 return { isSuccess: true, data: { id } };
             }
-            return tagAssignmentExecutor.delete({ id }, event.user, ctx.db);
+            return assignmentExecutor.delete({ id }, event.user, ctx.db);
         },
     };
 }

package/dist/tenant-handover/handlers/claim.write.js

@@ -28,6 +28,7 @@ export function createClaimTenantHandoverHandler(opts = {}) {
         schema: z.object({ token: z.string().min(1), entityType: z.string().min(1) }),
         access: { roles: ["Member", "User", "TenantAdmin", "SystemAdmin"] },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: "the ownership change moves rows OUT of a source tenant this caller has no membership " +
                 "in — the framework's declared cross-tenant operation for try-before-signup, not a " +
                 "per-consumer acknowledgeCrossTenant workaround",

package/dist/tenant-lifecycle/handlers/cancel-destruction.write.js

@@ -15,6 +15,7 @@ export const cancelDestructionWrite = defineWriteHandler({
     access: { roles: ["TenantOwner", "Admin"] },
     description: "Returns a tenant whose destruction was requested back to active and clears the grace period; use it to undo a close-account request while the grace period is still running.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: CANCEL_DESTRUCTION_TENANT_ROW_REASON,
     },
     handler: async (event, ctx) => {

package/dist/tenant-lifecycle/handlers/request-destruction.write.js

@@ -19,6 +19,7 @@ export const requestDestructionWrite = defineWriteHandler({
     description: "Puts the caller's own tenant into destroyRequested, starts the compliance-profile grace period after which its data is erased, and revokes every session in the tenant; use it when an account owner asks to close their account.",
     agent: { risk: "high" },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: REQUEST_DESTRUCTION_TENANT_ROW_REASON,
     },
     handler: async (event, ctx) => {

package/dist/tier-engine/handlers/get-tenant-tier.query.js

@@ -15,6 +15,7 @@ export const getTenantTierQuery = defineQueryHandler({
     schema: z.object({ tenantId: z.string().min(1) }),
     access: { roles: ["SystemAdmin"] },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: GET_TENANT_TIER_REASON,
     },
     handler: async (query, ctx) => {

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -46,6 +46,7 @@ export function createSetTenantTierWrite(opts = {}) {
         }),
         access: { roles: ["SystemAdmin"] },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: SET_TENANT_TIER_REASON,
         },
         handler: async (event, ctx) => {

package/dist/user/handlers/detail.query.js

@@ -6,6 +6,7 @@ import { attachTenantLabels, dbForList } from "./list.query.js";
 // bound to their own tenant's memberships (served by the tenant feature).
 const baseDetail = defineEntityDetailHandler("user", userEntity, {
     access: { roles: access.systemAdmin },
+    agent: { risk: "high" },
     description: "Loads one identity record by id for a SystemAdmin, enriched with the same derived `tenants` membership label as the user list; tenant-level admins do not reach it.",
 });
 // Same tenants enrichment as user:list — derived field placeholder is "".

package/dist/user/handlers/list.query.js

@@ -6,6 +6,7 @@ import { tenantMembershipsTable, tenantTable } from "../../tenant/index.js";
 import { userEntity } from "../schema/user.js";
 const baseList = defineEntityListHandler("user", userEntity, {
     access: { roles: access.systemAdmin },
+    agent: { risk: "high" },
     description: "Lists identity records across every tenant for a SystemAdmin roster, each row carrying a derived `tenants` label naming the tenants the user belongs to and their roles there.",
 });
 async function loadMemberships(db, userIds) {

package/dist/user-data-rights/handlers/cancel-deletion.write.js

@@ -27,6 +27,7 @@ export const cancelDeletionWrite = defineWriteHandler({
     },
     description: "Withdraws the calling user's own pending account-deletion request and puts the account back to active, accepted only while the grace period is still running.",
     escapeHatch: {
+        grants: ["unsafeRaw", "globalWrites"],
         reason: APPEND_LIFECYCLE_EVENT_REASON,
     },
     handler: async (event, ctx) => {

package/dist/user-data-rights/handlers/download-attempt-list.query.js

@@ -5,6 +5,7 @@ import { downloadAttemptEntity } from "../schema/download-attempt.js";
 // non-convention QN; entityList needs the convention `download-attempt:list`.
 export const downloadAttemptListQuery = defineEntityListHandler("download-attempt", downloadAttemptEntity, {
     access: { roles: access.systemAdmin },
+    agent: { risk: "high" },
     escapeHatch: {
         reason: "SystemAdmin DPO triage of invalid export-download attempts needs every tenant's rows to spot brute-force patterns across tenants",
     },

package/dist/user-data-rights/handlers/download-by-job.query.js

@@ -47,6 +47,7 @@ export const downloadByJobQuery = defineQueryHandler({
     }, // openToAll = auth-required, kein anonymous
     description: "Returns a short-lived signed download URL for the calling user's own finished data-export job named by job id, backing the download button in the privacy center once export-status reports the job done.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: DOWNLOAD_BY_JOB_REASON,
     },
     handler: async (query, ctx) => {

package/dist/user-data-rights/handlers/download-by-token.query.js

@@ -58,6 +58,7 @@ export const downloadByTokenQuery = defineQueryHandler({
     // Memory `feedback_security_default_on`.
     rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: DOWNLOAD_BY_TOKEN_REASON,
     },
     handler: async (query, ctx) => {

package/dist/user-data-rights/handlers/export-status.query.js

@@ -26,6 +26,7 @@ export const exportStatusQuery = defineQueryHandler({
     },
     description: "Returns the calling user's own most recent data-export job with its status, expiry and error, or hasJob false, for polling after a request-export while the job is still running.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: EXPORT_STATUS_REASON,
     },
     handler: async (query, ctx) => {

package/dist/user-data-rights/handlers/lift-restriction.write.js

@@ -33,6 +33,7 @@ export const liftRestrictionWrite = defineWriteHandler({
     access: { roles: access.admin },
     description: "Lifts a GDPR Art. 18 processing restriction on the named user and returns the account to active; operator-only, because a restricted user's own session is rejected and cannot reach this endpoint.",
     escapeHatch: {
+        grants: ["unsafeRaw", "globalWrites"],
         reason: LIFT_RESTRICTION_ESCAPE_HATCH_REASON,
     },
     handler: async (event, ctx) => {

package/dist/user-data-rights/handlers/my-audit-log.query.js

@@ -33,6 +33,7 @@ export const myAuditLogQuery = defineQueryHandler({
     },
     description: "Returns the calling user's own event-store entries across all their tenant memberships, paged and filterable by aggregate type, event type and time range, for the GDPR Art. 15 self-disclosure; it can never read another user's history.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: MY_AUDIT_LOG_REASON,
     },
     handler: async (query, ctx) => {

package/dist/user-data-rights/handlers/request-deletion-by-email.write.js

@@ -36,6 +36,7 @@ export function createRequestDeletionByEmailHandler(opts = {}) {
         // Defense-in-depth gegen Email-Probing auf dem anonymen Endpoint.
         rateLimit: { per: "ip+handler", limit: 10, windowSeconds: 60 },
         escapeHatch: {
+            grants: ["unsafeRaw", "globalWrites"],
             reason: APPEND_LIFECYCLE_EVENT_REASON,
         },
         handler: async (event, ctx) => {

package/dist/user-data-rights/handlers/request-export.write.js

@@ -51,6 +51,7 @@ export const requestExportWrite = defineWriteHandler({
     },
     description: "Queues a GDPR Art. 15 and 20 data export for the calling user and returns its job id, handing back the running job with isExisting true instead of a second one when an export is already pending.",
     escapeHatch: {
+        grants: ["unsafeRaw"],
         reason: REQUEST_EXPORT_REASON,
     },
     handler: async (event, ctx) => {

package/dist/user-data-rights/handlers/run-forget-cleanup.write.js

@@ -26,6 +26,7 @@ export function createRunForgetCleanupHandler(opts = {}) {
         // records without softDelete — an agent must never be able to trigger it.
         agent: { expose: false, risk: "high" },
         escapeHatch: {
+            grants: ["unsafeRaw"],
             reason: RUN_FORGET_CLEANUP_REASON,
         },
         handler: async (_event, ctx) => {

package/dist/user-data-rights/run-forget-cleanup.js

@@ -1,11 +1,13 @@
 // Forget-Cleanup-Runner (S2.U5b) — pure-Function Pipeline.
 //
-// Nach abgelaufener Grace-Period (S2.U5a setzt gracePeriodEnd) iteriert
-// dieser Runner ueber alle User in DeletionRequested-State und triggert
-// die EXT_USER_DATA-delete-Hooks pro Membership-Tenant.
+// After the grace period (S2.U5a sets gracePeriodEnd) this runner iterates
+// over all users in DeletionRequested state and triggers the EXT_USER_DATA
+// delete hooks in every tenant the user is or was a member of (membership
+// history from kumiko_events).
 //
-// **Cross-Tenant-Iteration:** Ein User-Forget-Antrag in Tenant A muss
-// die Daten des Users in ALLEN seinen Tenants entfernen — siehe
+// **Cross-tenant iteration:** a forget request in tenant A must remove the
+// user's data in ALL of their tenants, including tenants they left before
+// the request — see
 // docs/plans/architecture/user-data-rights.md "Cross-Tenant-Semantik".
 //
 // **Strategy-Dispatch:** Pro Entity entscheidet die data-retention-
@@ -177,15 +179,16 @@ async function processUser(args) {
     // memberships in der Tx loeschen. Orphan-User (0 memberships) liefert
     // [] in Email-args; App-Author-Template kann das case-handlen.
     const tenantIdsBeforeDelete = memberships.map((m) => m.tenantId);
-    // Edge-Case "0 Memberships": User hat alle Tenants schon verlassen
-    // bevor Forget triggerte. Wir laufen den Hook-Loop trotzdem mit einem
-    // Pseudo-Tenant — der user-Hook (user-data-rights-defaults) ist
-    // tenant-agnostisch und MUSS laufen damit email/displayName/passwordHash
-    // anonymisiert werden. Tenant-scoped Hooks (z.B. fileRefDeleteHook)
-    // finden im Pseudo-Tenant nichts und sind no-op. Ohne diesen Pfad
-    // wuerde status=Deleted gesetzt waehrend Original-PII liegen bleibt
-    // — sieht compliant aus, ist es nicht (advisor-Finding S2.U5b.fix1).
-    const tenantList = memberships.length > 0 ? memberships.map((m) => m.tenantId) : [SYSTEM_TENANT_ID_FOR_ORPHANS];
+    // Departed tenants: removeMember deletes only the projection row, so data
+    // the user left behind there (e.g. note mentions) must still be reached.
+    const historicalTenantIds = await readHistoricalMembershipTenantIds(db, userId);
+    const hookTenantIds = [...new Set([...tenantIdsBeforeDelete, ...historicalTenantIds])];
+    // Edge case "0 tenants" (neither membership nor history): the hook loop still
+    // runs with a pseudo tenant. The user hook is tenant-agnostic and MUST run so
+    // email/displayName/passwordHash get anonymized; tenant-scoped hooks find
+    // nothing there and no-op. Without this path status=Deleted would be set
+    // while the original PII stays — compliant-looking, but not compliant.
+    const tenantList = hookTenantIds.length > 0 ? hookTenantIds : [SYSTEM_TENANT_ID_FOR_ORPHANS];
     // Per-User-Sub-Tx: hooks + status-flip atomar. Bei Hook-Throw rollt
     // nur dieser User zurueck, andere User bleiben commit-fest. Die Sub-Tx
     // nestet korrekt: eine Top-Level-Connection oeffnet sie via `.begin`
@@ -342,7 +345,7 @@ async function resolveEffectiveTenantModel(db, tenantId, appTenantModel) {
 // rows.
 //
 // Filter by payload->>'tenantId' (not the event column tenant_id): cross-
-// tenant SystemAdmin adds land under the actor's tenant_id (#2347).
+// tenant SystemAdmin adds land under the actor's tenant_id.
 //
 // Counting created-ROWS against distinct userIds latched a tenant to
 // multi-user as soon as its sole member was removed and re-added (#2608) —
@@ -369,6 +372,18 @@ async function everHadMultipleMembers(db, tenantId) {
     // could name a second member.
     return row.event_count > row.readable_users;
 }
+// Filter by payload (not the event column tenant_id) for the same reason as
+// everHadMultipleMembers: cross-tenant SystemAdmin adds are billed to the
+// actor's tenant.
+async function readHistoricalMembershipTenantIds(db, userId) {
+    const rows = await executeRawQuery(db, `SELECT DISTINCT payload->>'tenantId' AS tenant_id
+     FROM kumiko_events
+     WHERE aggregate_type = 'tenant-membership'
+       AND type = $1
+       AND payload->>'userId' = $2
+       AND NULLIF(payload->>'tenantId', '') IS NOT NULL`, [entityEventName("tenant-membership", "created"), userId]);
+    return rows.map((row) => row.tenant_id); // @cast-boundary db-row
+}
 // Mapping retention.strategy → user-data-rights.UserDataDeleteStrategy.
 //   - "anonymize" / "blockDelete" → "anonymize" (Aufbewahrungs-Pflicht
 //     blockDelete: Daten muessen physisch bleiben, nur Personen-Bezug raus)