@cosmicdrift/kumiko-bundled-features 0.353.0 → 0.354.0

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -1,11 +1,11 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
-import { append } from "@cosmicdrift/kumiko-framework/event-store";
-import { assertIrreversibleOperationAllowed } from "@cosmicdrift/kumiko-framework/pipeline";
+import { appendDomainEventCore, assertIrreversibleOperationAllowed, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -13,7 +13,7 @@ import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
-import { CRYPTO_SHREDDING_AGGREGATE_TYPE, RECORD_ENTITY_NOT_REGISTERED, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, TARGET_RECORD_NOT_ADMIN_TENANT, TARGET_RECORD_RETENTION_BLOCK_DELETE, TARGET_TENANT_NOT_ADMIN_TENANT, } from "../constants.js";
+import { CRYPTO_SHREDDING_AGGREGATE_TYPE, CRYPTO_SHREDDING_FEATURE_NAME, RECORD_ENTITY_NOT_REGISTERED, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, TARGET_RECORD_NOT_ADMIN_TENANT, TARGET_RECORD_RETENTION_BLOCK_DELETE, TARGET_TENANT_NOT_ADMIN_TENANT, } from "../constants.js";
 export { subjectIdSchema };
 export const forgetSubjectSchema = z.object({
     subject: subjectIdSchema,
@@ -23,6 +23,9 @@ export const subjectForgottenSchema = z.object({
     subjectKey: z.string().min(1),
     reason: z.string().min(10),
     forgottenBy: z.string().min(1),
+    // Error code or name of a failed derived-data sweep, never its message (which
+    // can name the subject). Present only when the handler failed after the erase.
+    cleanupError: z.string().min(1).optional(),
 });
 export const subjectForgetDeniedSchema = z.object({
     subjectKeyDigest: z.string().min(1).optional(),
@@ -160,14 +163,8 @@ async function appendDenialAuditEvent(ctx, event, subjectKey, subjectKind, denia
                 "ctx.dbOutsideTransaction — dispatch wiring is missing the outside-tx db source.",
         }));
     }
-    const eventDef = ctx.registry.getEvent(SUBJECT_FORGET_DENIED_EVENT_NAME);
-    if (!eventDef) {
-        return writeFailure(new InternalError({
-            message: `[crypto-shredding] event "${SUBJECT_FORGET_DENIED_EVENT_NAME}" is not registered.`,
-        }));
-    }
     const blindIndexKey = configuredBlindIndexKey();
-    const payload = subjectForgetDeniedSchema.parse({
+    const payload = {
         // The denial lands in the REQUESTING actor's own tenant-scoped stream —
         // it must never materialise the foreign subject's identifiers there. A
         // plaintext subjectKey/aggregateId would survive as a permanent record
@@ -184,30 +181,103 @@ async function appendDenialAuditEvent(ctx, event, subjectKey, subjectKind, denia
         forgottenBy: event.user.id,
         actorTenantId: event.user.tenantId,
         denial: denialCode,
-    });
-    const reqCtx = requestContext.get();
-    // This event is the only proof the denial happened. Skipping
-    // runProjectionsForEvent here is fine — nothing projects
-    // crypto-shredding:event:forget-denied.
-    await append(denialAuditRunner, {
-        aggregateId: generateId(),
-        aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+    };
+    await appendDomainEventCore({
+        registry: ctx.registry,
+        db: denialAuditRunner,
         // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw
         // bypasses TenantDb's scoping, so this is the only guard against a cross-tenant denial event (fw#2452).
         tenantId: event.user.tenantId,
-        expectedVersion: 0,
+        userId: String(event.user.id),
+        callSiteLabel: "forget-subject denial audit",
+        callerFeature: CRYPTO_SHREDDING_FEATURE_NAME,
+    }, {
+        // Fresh stream per denial: no version to read, nothing to conflict with.
+        aggregateId: generateId(),
+        aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
         type: SUBJECT_FORGET_DENIED_EVENT_NAME,
-        eventVersion: eventDef.version,
         payload,
-        metadata: {
-            userId: event.user.id,
-            ...(reqCtx?.requestId ? { requestId: reqCtx.requestId } : {}),
-            ...(reqCtx?.correlationId ? { correlationId: reqCtx.correlationId } : {}),
-            ...(reqCtx?.causationId ? { causationId: reqCtx.causationId } : {}),
-        },
     });
     return null;
 }
+// Name or driver code of the error, never its message: a message can carry the
+// subject key or row values and would land in a permanent audit event.
+function sweepErrorLabel(err) {
+    if (typeof err === "object" && err !== null && "code" in err) {
+        const code = err.code;
+        if (typeof code === "string" && code.length > 0)
+            return code;
+    }
+    return err instanceof Error && err.name.length > 0 ? err.name : "UnknownError";
+}
+// The key is already erased when this runs, so a failing sweep must not skip the
+// audit event: the failure is returned as a label for the event instead of thrown.
+// The savepoint keeps a database error from aborting the handler transaction.
+async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner) {
+    try {
+        await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
+            // Blind-index sweep (#818): nulls bidx columns now so the deterministic
+            // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
+            await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
+            // Derived search index still holds plaintext (#1610) — purge next to the
+            // blind-index sweep. No adapter → no-op (apps without search).
+            if (ctx.searchAdapter) {
+                await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
+            }
+        });
+        return undefined;
+    }
+    catch (err) {
+        return sweepErrorLabel(err);
+    }
+}
+// Graceful fail: email-subscribers and other non-user entities may use
+// user-style subject keys without having an actual user row — the key erase is
+// the important part for GDPR compliance; the lifecycle update is best-effort for
+// real users. The savepoint confines the failure so the handler transaction
+// stays usable for the audit event.
+async function closeUserLoginDoorBestEffort(ctx, userId, lifecycleRunner) {
+    try {
+        await runInSavepointIfSupported(lifecycleRunner, async (userLifecycleRunner) => {
+            await updateUserLifecycle(userLifecycleRunner, userId, { status: USER_STATUS.Deleted });
+            if (ctx.registry.features.has("personal-access-tokens")) {
+                await revokeAllPatTokensForUser(userLifecycleRunner, userId);
+            }
+        });
+    }
+    catch {
+        // skip: no user row for this subject key (e.g. email subscribers); key erase and sweeps already ran.
+    }
+}
+// Through the outside-transaction db when available, so the audit event commits
+// even though the handler may fail afterwards (sweep error) and roll back its own
+// transaction. Without that source the event stays in the handler transaction.
+async function appendSubjectForgotten(ctx, event, aggregateId, payload, outsideRunner) {
+    if (!outsideRunner) {
+        await ctx.unsafeAppendEvent({
+            aggregateId,
+            aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+            type: SUBJECT_FORGOTTEN_EVENT_NAME,
+            payload,
+        });
+    }
+    else {
+        await appendDomainEventCore({
+            registry: ctx.registry,
+            db: outsideRunner,
+            // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw bypasses TenantDb's scoping (fw#2452).
+            tenantId: event.user.tenantId,
+            userId: String(event.user.id),
+            callSiteLabel: "forget-subject audit",
+            callerFeature: CRYPTO_SHREDDING_FEATURE_NAME,
+        }, {
+            aggregateId,
+            aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+            type: SUBJECT_FORGOTTEN_EVENT_NAME,
+            payload,
+        });
+    }
+}
 // Manual crypto-shred for a DPO / platform operator: erases the subject's
 // DEK immediately (all its PII ciphertext becomes unreadable, reads render
 // "[[erased]]") and appends the audit event. Forget is final — the adapter
@@ -227,7 +297,7 @@ export const forgetSubjectWrite = defineWriteHandler({
     agent: { expose: false, risk: "high" },
     escapeHatch: {
         grants: ["unsafeRaw"],
-        reason: "denial audit append names the prober's own tenant stream on the outside-transaction db; " +
+        reason: "the denial and SUBJECT_FORGOTTEN audit appends name the caller's own tenant stream on the outside-transaction db; " +
             "the tenant-scope and retention checks run against the subject's tenant, not necessarily the caller's; " +
             "the blind-index sweep and search purge address the subject across tenants; the user " +
             "lifecycle update and PAT revoke run on the SYSTEM user stream.",
@@ -270,15 +340,7 @@ export const forgetSubjectWrite = defineWriteHandler({
             userId: event.user.id,
             eraseReason: event.payload.reason,
         });
-        // Blind-index sweep (#818): nulls bidx columns now so the deterministic
-        // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
-        const crossTenantSubjectRunner = ctx.db.unsafeRaw();
-        await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
-        // Derived search index still holds plaintext (#1610) — purge next to the
-        // blind-index sweep. No adapter → no-op (apps without search).
-        if (ctx.searchAdapter) {
-            await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
-        }
+        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw());
         // User subject: close the login door. DEK-erase makes the passwordHash
         // ciphertext unreadable, but status + PATs are standalone credentials —
         // the PAT resolver only checks revokedAt/expiresAt, NOT user.status
@@ -294,33 +356,20 @@ export const forgetSubjectWrite = defineWriteHandler({
         // crash recovery is safe. User-feature guard: without the user feature
         // read_users doesn't exist (crypto-only stack). Tenant subjects have no
         // credentials.
-        // Graceful fail: email-subscribers and other non-user entities may use
-        // user-style subject keys without having an actual user row — the key
-        // erase above is the important part for GDPR compliance; the lifecycle
-        // update is best-effort for real users.
         if (raw.kind === "user" && ctx.registry.features.has("user")) {
-            try {
-                const userLifecycleRunner = ctx.db.unsafeRaw();
-                await updateUserLifecycle(userLifecycleRunner, raw.userId, { status: USER_STATUS.Deleted });
-                if (ctx.registry.features.has("personal-access-tokens")) {
-                    await revokeAllPatTokensForUser(userLifecycleRunner, raw.userId);
-                }
-            }
-            catch {
-                // User row may not exist (e.g. email subscribers with user-style
-                // subject keys). Key erase + blind-index sweep above already ran.
-            }
+            await closeUserLoginDoorBestEffort(ctx, raw.userId, ctx.db.unsafeRaw());
+        }
+        await appendSubjectForgotten(ctx, event, subjectAggregateId(raw), {
+            subjectKey,
+            reason: event.payload.reason,
+            forgottenBy: event.user.id,
+            ...(cleanupError !== undefined && { cleanupError }),
+        }, ctx.dbOutsideTransaction?.unsafeRaw());
+        if (cleanupError !== undefined) {
+            throw new InternalError({
+                message: `[crypto-shredding] forget-subject erased the key but a derived-data sweep failed (${cleanupError}); retry to finish the cleanup.`,
+            });
         }
-        await ctx.unsafeAppendEvent({
-            aggregateId: subjectAggregateId(raw),
-            aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
-            type: SUBJECT_FORGOTTEN_EVENT_NAME,
-            payload: {
-                subjectKey,
-                reason: event.payload.reason,
-                forgottenBy: event.user.id,
-            },
-        });
         return { isSuccess: true, data: { subjectKey } };
     },
 });

package/dist/delivery/db/queries/address-opt-outs.d.ts

@@ -1,3 +1,5 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-export declare function isAddressOptedOut(db: DbConnection, tenantId: TenantId, addressHash: string, notificationType: string, channel: string): Promise<boolean>;
+export type AddressOptOutKey = string;
+export declare function addressOptOutKey(addressHash: string, channel: string): AddressOptOutKey;
+export declare function selectOptedOutAddresses(db: DbConnection, tenantId: TenantId, notificationType: string, addressHashes: readonly string[]): Promise<ReadonlySet<AddressOptOutKey>>;

package/dist/delivery/db/queries/address-opt-outs.js

@@ -1,10 +1,15 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { notificationAddressOptOutsTable } from "../../tables.js";
+export function addressOptOutKey(addressHash, channel) {
+    return `${addressHash}|${channel}`;
+}
 // Exact match only — unlike notification-preferences there is no wildcard
 // ("*") semantics for address opt-outs, the token that creates a row always
-// carries one concrete notificationType/channel pair.
-export async function isAddressOptedOut(db, tenantId, addressHash, notificationType, channel) {
-    const rows = await unsafeReadRetrying(db, `SELECT id FROM read_notification_address_opt_outs
-     WHERE tenant_id = $1 AND address_hash = $2 AND notification_type = $3 AND channel = $4
-     LIMIT 1`, [tenantId, addressHash, notificationType, channel]);
-    return rows.length > 0;
+// carries one concrete notificationType/channel pair. One query covers every
+// recipient of a notify() call.
+export async function selectOptedOutAddresses(db, tenantId, notificationType, addressHashes) {
+    if (addressHashes.length === 0)
+        return new Set();
+    const rows = await selectMany(db, notificationAddressOptOutsTable, { tenantId, notificationType, addressHash: { in: addressHashes } });
+    return new Set(rows.map((row) => addressOptOutKey(row.addressHash, row.channel)));
 }

package/dist/delivery/delivery-service.js

@@ -9,7 +9,7 @@ import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
 import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryPriorityRank } from "./constants.js";
-import { isAddressOptedOut } from "./db/queries/address-opt-outs.js";
+import { addressOptOutKey, selectOptedOutAddresses, } from "./db/queries/address-opt-outs.js";
 import { selectNotificationPreferences } from "./db/queries/preferences.js";
 import { isDeliveryChannelPlugin, } from "./types.js";
 export function redactedMessageOf(err) {
@@ -255,12 +255,54 @@ export function createDeliveryService(options) {
     }
     // Shared by deliverToUser (resolved account address) and deliverDirect (a
     // route address with no user account) — same suppression rule either way:
-    // no blind-index key configured means no hash, so nothing to look up.
-    async function isAddressSuppressed(address, tenantId, notificationType, channelName) {
+    // no blind-index key configured means no hash, so nothing to look up. One
+    // query per notify() call, not per recipient and channel.
+    async function loadSuppressedAddresses(tenantId, notificationType, priority, addresses) {
+        // Critical priority skips address opt-outs, same rule as user preferences.
+        if (priority === "critical")
+            return new Set();
+        const addressHashes = new Set();
+        for (const address of addresses) {
+            const addressHash = hashUnsubscribeAddress(address);
+            if (addressHash !== undefined)
+                addressHashes.add(addressHash);
+        }
+        return selectOptedOutAddresses(db, tenantId, notificationType, [...addressHashes]);
+    }
+    function isAddressSuppressed(suppressed, address, channelName) {
         const addressHash = hashUnsubscribeAddress(address);
-        if (addressHash === undefined)
+        return addressHash !== undefined && suppressed.has(addressOptOutKey(addressHash, channelName));
+    }
+    const recipientChannelKey = (userId, channelName) => `${userId}|${channelName}`;
+    async function isChannelDeliverable(userId, tenantId, notificationType, channelName) {
+        if (isChannelKilled && (await isChannelKilled(tenantId, channelName)))
             return false;
-        return isAddressOptedOut(db, tenantId, addressHash, notificationType, channelName);
+        return isChannelEnabled(userId, tenantId, notificationType, channelName);
+    }
+    // Resolves every user's channel addresses up front so the opt-out lookup can
+    // cover them all at once. A resolve that throws stays out of the map: the
+    // delivery loop resolves it again and reports channel_error as before.
+    // Channels the kill switch or the user's preferences disable are never resolved
+    // here: resolve may have side effects and deliverToUser skips those channels.
+    async function prefetchUserAddresses(userIds, tenantId, notificationType) {
+        const addresses = new Map();
+        const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId, secrets);
+        for (const userId of userIds) {
+            for (const channel of channels) {
+                if (!channel.resolve)
+                    continue;
+                try {
+                    if (!(await isChannelDeliverable(userId, tenantId, notificationType, channel.name))) {
+                        continue;
+                    }
+                    addresses.set(recipientChannelKey(userId, channel.name), await channel.resolve(userId, channelCtx));
+                }
+                catch {
+                    // skip: re-resolved (and logged) by deliverToUser
+                }
+            }
+        }
+        return addresses;
     }
     // Check if user has disabled this notification+channel combo.
     // Specificity order: exact > any wildcard. When only wildcards match and they
@@ -283,7 +325,7 @@ export function createDeliveryService(options) {
         // and conservative — DB ordering no longer decides the outcome).
         return !prefs.some((p) => p.enabled === false);
     }
-    async function deliverToUser(userId, notificationType, data, tenantId, priority, run) {
+    async function deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed) {
         const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId, secrets);
         for (const channel of channels) {
             // Route-only channel (no per-user address): not a user-notification target.
@@ -342,7 +384,10 @@ export function createDeliveryService(options) {
                 }
             }
             try {
-                const address = await channel.resolve(userId, channelCtx);
+                const prefetchKey = recipientChannelKey(userId, channel.name);
+                const address = prefetchedAddresses.has(prefetchKey)
+                    ? prefetchedAddresses.get(prefetchKey)
+                    : await channel.resolve(userId, channelCtx);
                 if (!address) {
                     await logDelivery(run, {
                         tenantId,
@@ -356,8 +401,7 @@ export function createDeliveryService(options) {
                     });
                     continue;
                 }
-                if (priority !== "critical" &&
-                    (await isAddressSuppressed(address, tenantId, notificationType, channel.name))) {
+                if (priority !== "critical" && isAddressSuppressed(suppressed, address, channel.name)) {
                     await logDelivery(run, {
                         tenantId,
                         notificationType,
@@ -402,6 +446,7 @@ export function createDeliveryService(options) {
     }
     async function deliverDirect(route, notificationType, data, tenantId, priority, recipientId, run) {
         const channelCtx = buildChannelContext(db, registry, sseBroker, tenantId, secrets);
+        const suppressed = await loadSuppressedAddresses(tenantId, notificationType, priority, Object.values(route));
         // Direct routing skips preferences (no user account) but NOT rate limit
         // — direct sends can still be abused (webhook replays, test harnesses).
         for (const channel of channels) {
@@ -411,8 +456,7 @@ export function createDeliveryService(options) {
                 continue;
             // Address opt-out (critical priority skips it, same rule as user
             // preferences).
-            if (priority !== "critical" &&
-                (await isAddressSuppressed(address, tenantId, notificationType, channel.name))) {
+            if (priority !== "critical" && isAddressSuppressed(suppressed, address, channel.name)) {
                 await logDelivery(run, {
                     tenantId,
                     notificationType,
@@ -513,8 +557,12 @@ export function createDeliveryService(options) {
                 else {
                     userIds = to;
                 }
+                const prefetchedAddresses = priority === "critical"
+                    ? new Map()
+                    : await prefetchUserAddresses(userIds, tenantId, notificationType);
+                const suppressed = await loadSuppressedAddresses(tenantId, notificationType, priority, [...prefetchedAddresses.values()].filter((address) => !!address));
                 for (const userId of userIds) {
-                    await deliverToUser(userId, notificationType, data, tenantId, priority, run);
+                    await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed);
                 }
             }
             return { deliveries: run.deliveries };

package/dist/delivery/unsubscribe.js

@@ -32,6 +32,9 @@ const addressUnsubscribeJwtPayloadSchema = z.object({
     addressHash: z.string().min(1),
 });
 const UNSUBSCRIBE_EXPIRY = "7d";
+const RESUBSCRIBE_EXPIRY = "1h";
+const UNSUBSCRIBE_ISSUER = "kumiko:unsubscribe";
+const RESUBSCRIBE_AUDIENCE = "kumiko:resubscribe";
 const MIN_UNSUBSCRIBE_SECRET_LENGTH = 32;
 function assertUnsubscribeSecret(secret, caller) {
     if (secret.length < MIN_UNSUBSCRIBE_SECRET_LENGTH) {
@@ -51,7 +54,7 @@ export async function signUnsubscribeToken(payload, secret) {
     })
         .setProtectedHeader({ alg: "HS256" })
         .setSubject(String(payload.userId))
-        .setIssuer("kumiko:unsubscribe")
+        .setIssuer(UNSUBSCRIBE_ISSUER)
         .setIssuedAt()
         .setExpirationTime(UNSUBSCRIBE_EXPIRY)
         .sign(encodedSecret);
@@ -79,12 +82,10 @@ export async function signAddressUnsubscribeToken(payload, secret) {
     })
         .setProtectedHeader({ alg: "HS256" })
         .setSubject(addressHash)
-        .setIssuer("kumiko:unsubscribe")
+        .setIssuer(UNSUBSCRIBE_ISSUER)
         .setIssuedAt()
-        // No expiry, unlike the user token above: this same token also signs
-        // the resubscribe (undo) direction, and an unsubscribe link mailed out
-        // today must keep working indefinitely — there's no signed-in flow for
-        // a no-account address to request a fresh link from.
+        // Only opt-out, so no expiry: a link mailed out today must keep working,
+        // there's no signed-in flow for a no-account address to request a fresh one.
         .sign(encodedSecret));
 }
 // RFC 8058 fixed value — both the List-Unsubscribe-Post header and the body a
@@ -94,18 +95,50 @@ const CONFIRMATION_PAGE_HEADERS = {
     "Cache-Control": "no-store",
     "Referrer-Policy": "no-referrer",
 };
+// Undo token, handed out only in the response of a successful unsubscribe. A
+// separate audience and a short expiry keep the long-lived mailed unsubscribe
+// link from being able to undo an opt-out (and vice versa).
+async function signResubscribeToken(verified, encodedSecret) {
+    const claims = {
+        tenantId: verified.tenantId,
+        notificationType: verified.notificationType,
+        channel: verified.channel,
+    };
+    const jwt = verified.kind === "address"
+        ? new jose.SignJWT({
+            ...claims,
+            addressHash: verified.addressHash,
+            kind: "address",
+        }).setSubject(verified.addressHash)
+        : new jose.SignJWT(claims).setSubject(verified.userId);
+    return jwt
+        .setProtectedHeader({ alg: "HS256" })
+        .setIssuer(UNSUBSCRIBE_ISSUER)
+        .setAudience(RESUBSCRIBE_AUDIENCE)
+        .setIssuedAt()
+        .setExpirationTime(RESUBSCRIBE_EXPIRY)
+        .sign(encodedSecret);
+}
 // Every throw here must become the same ExtraRouteRejection(400,
 // unsubscribe_token_invalid) — anything else falls through to the
 // framework's generic 401 extra_route_signature_invalid mapping, which
 // would leak jose's internal error text into the response body.
-async function verifyUnsubscribeToken(token, encodedSecret) {
+async function verifyUnsubscribeToken(token, encodedSecret, purpose) {
     try {
         if (!token) {
             throw new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "missing unsubscribe token");
         }
-        const { payload: verifiedPayload } = await jose.jwtVerify(token, encodedSecret, {
-            issuer: "kumiko:unsubscribe",
-        });
+        const { payload: verifiedPayload } = purpose === "resubscribe"
+            ? await jose.jwtVerify(token, encodedSecret, {
+                issuer: UNSUBSCRIBE_ISSUER,
+                audience: RESUBSCRIBE_AUDIENCE,
+                requiredClaims: ["exp"],
+            })
+            : await jose.jwtVerify(token, encodedSecret, { issuer: UNSUBSCRIBE_ISSUER });
+        // jose only checks `aud` when asked to, so an unsubscribe route would accept an undo token.
+        if (purpose === "unsubscribe" && verifiedPayload.aud !== undefined) {
+            throw new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "resubscribe token used as unsubscribe token");
+        }
         const addressAttempt = addressUnsubscribeJwtPayloadSchema.safeParse(verifiedPayload);
         if (addressAttempt.success) {
             const parsed = addressAttempt.data;
@@ -211,6 +244,23 @@ function confirmationPage(token) {
 </body>
 </html>`;
 }
+function unsubscribedPage(resubscribeToken) {
+    return `<!doctype html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="robots" content="noindex">
+<title>Unsubscribed</title>
+</head>
+<body>
+<p>You have been unsubscribed.</p>
+<form method="post" action="${DELIVERY_RESUBSCRIBE_PATH}">
+<input type="hidden" name="token" value="${escapeHtmlAttr(resubscribeToken)}">
+<button type="submit">Undo</button>
+</form>
+</body>
+</html>`;
+}
 // One-click clients put the token in the query string; only the
 // confirmation-page form submits it in the body.
 function tokenFromPostRequest(request) {
@@ -251,7 +301,7 @@ export function createUnsubscribeRoutes(options) {
             if (!token) {
                 throw new ExtraRouteRejection(400, UNSUBSCRIBE_TOKEN_INVALID_BODY, "missing unsubscribe token");
             }
-            await verifyUnsubscribeToken(token, encodedSecret);
+            await verifyUnsubscribeToken(token, encodedSecret, "unsubscribe");
             return { token };
         },
         handler: async (c, { token }) => c.html(confirmationPage(token), 200, CONFIRMATION_PAGE_HEADERS),
@@ -260,7 +310,7 @@ export function createUnsubscribeRoutes(options) {
         method: "POST",
         path: DELIVERY_UNSUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyUnsubscribeToken(tokenFromPostRequest(request), encodedSecret),
+        verify: async (request) => verifyUnsubscribeToken(tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
         handler: async (c, verified, deps) => {
             // Token-verify passed — everything below is a legitimate write. Don't
             // swallow write-errors as "invalid token", that would mask real bugs
@@ -269,7 +319,9 @@ export function createUnsubscribeRoutes(options) {
             if (!succeeded) {
                 return c.html("Unsubscribe failed", 500, { "Cache-Control": "no-store" });
             }
-            return c.html("You have been unsubscribed.", 200, { "Cache-Control": "no-store" });
+            return c.html(unsubscribedPage(await signResubscribeToken(verified, encodedSecret)), 200, {
+                "Cache-Control": "no-store",
+            });
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
@@ -279,7 +331,7 @@ export function createUnsubscribeRoutes(options) {
         method: "POST",
         path: DELIVERY_RESUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyUnsubscribeToken(tokenFromRequestBody(request), encodedSecret),
+        verify: async (request) => verifyUnsubscribeToken(tokenFromRequestBody(request), encodedSecret, "resubscribe"),
         handler: async (c, verified, deps) => {
             const outcome = await dispatchResubscribeWrite(verified, deps);
             if (outcome === "limit_reached") {

package/dist/feature-toggles/feature.js

@@ -64,9 +64,8 @@ export function createFeatureTogglesFeature(options = {}) {
         // process's handler calls runtime.broadcastToggle, which publishes on
         // GlobalFeatureToggleRuntime's syncSignal so every process (including
         // the one that won the cursor) applies the flip to its own snapshot —
-        // see toggle-runtime.ts and toggle-sync-signal.ts. Without a syncSignal
-        // configured (no REDIS_URL — single-process dev/test), broadcastToggle
-        // applies directly; there is nobody else to reach. Named "cache-sync"
+        // see toggle-runtime.ts and toggle-sync-signal.ts. The signal defaults to
+        // the cache-sync bus (Redis with REDIS_URL, process-local without). Named "cache-sync"
         // (not "projection" or "audit") because it's side-effect-only
         // infrastructure.
         //

package/dist/feature-toggles/toggle-runtime.d.ts

@@ -1,16 +1,20 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
+import { type ClosableCacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 export type ToggleSyncSignal = {
     publish(featureName: string, enabled: boolean): void;
     onMessage(listener: (featureName: string, enabled: boolean) => void): void;
+    onResync?(listener: () => void): void;
 };
 export declare class GlobalFeatureToggleRuntime {
     private readonly db;
     private readonly registry;
     private readonly syncSignal?;
+    private readonly ownedBus?;
     private snapshot;
     private appliedDuringLoad;
-    constructor(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal | undefined);
+    constructor(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal | undefined, ownedBus?: ClosableCacheSyncBus | undefined);
+    close(): Promise<void>;
     initialize(): Promise<void>;
     refresh(): Promise<void>;
     apply(featureName: string, enabled: boolean): void;