@cosmicdrift/kumiko-bundled-features 0.363.0 → 0.364.0

package/dist/cap-counter/enforce-cap.js

@@ -17,8 +17,24 @@ export const CAP_TOLERANCES = {
 export function assertBelowHardCap(valueSeenByLastUnit, cap) {
     const tolerance = CAP_TOLERANCES[cap.profile];
     if (valueSeenByLastUnit >= cap.limit * tolerance.hard) {
-        throw new CapExceededError(cap.capName, cap.limit, valueSeenByLastUnit, tolerance);
+        const resetAt = resolvePeriodEndIso(cap.periodStartIso, cap.periodEndIso);
+        throw new CapExceededError(cap.capName, cap.limit, valueSeenByLastUnit, tolerance, {
+            ...(resetAt !== undefined && { resetAt }),
+            ...(cap.i18nKey !== undefined && { i18nKey: cap.i18nKey }),
+        });
+    }
+}
+function resolvePeriodEndIso(periodStartIso, periodEndIso) {
+    if (periodStartIso === undefined)
+        return periodEndIso;
+    if (periodEndIso === undefined)
+        return calendarMonthPeriodEndIso(periodStartIso);
+    const start = Temporal.Instant.from(periodStartIso);
+    const end = Temporal.Instant.from(periodEndIso);
+    if (Temporal.Instant.compare(end, start) <= 0) {
+        throw new Error(`cap-counter: periodEndIso (${periodEndIso}) must be after periodStartIso (${periodStartIso})`);
     }
+    return end.toString();
 }
 // =============================================================================
 // Enforce-Cap helper
@@ -115,6 +131,9 @@ export async function enforceRollingCap(ctx, options) {
  * Thrown by enforceCap/enforceRollingCap when value ≥ hard-threshold.
  * Extends `KumikoError` — the dispatcher auto-maps this to HTTP 429
  * with `code: "cap_exceeded"`, no caller-side catch needed.
+ *
+ * Calendar caps carry `resetAt` (end of the period) and `retryAfterSeconds`, which the API
+ * answers as Retry-After. Rolling caps have no fixed reset instant, so both stay undefined.
  */
 export class CapExceededError extends KumikoError {
     capName;
@@ -123,17 +142,32 @@ export class CapExceededError extends KumikoError {
     tolerance;
     code = "cap_exceeded";
     httpStatus = 429;
-    constructor(capName, limit, currentValue, tolerance) {
+    resetAt;
+    constructor(capName, limit, currentValue, tolerance, options) {
+        const resetAt = options?.resetAt;
+        const retryAfterSeconds = resetAt === undefined
+            ? undefined
+            : Math.max(0, Math.ceil(Temporal.Instant.from(resetAt).epochMilliseconds / 1000 -
+                (options?.now ?? Temporal.Now.instant()).epochMilliseconds / 1000));
         super({
-            message: `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.`,
-            i18nKey: "errors.cap.exceeded",
-            i18nParams: { capName, limit, currentValue },
-            details: { capName, limit, currentValue, tolerance },
+            message: `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.${resetAt === undefined ? "" : ` Resets at ${resetAt}.`}`,
+            i18nKey: options?.i18nKey ?? "errors.cap.exceeded",
+            i18nParams: { capName, limit, currentValue, ...(resetAt !== undefined && { resetAt }) },
+            details: {
+                capName,
+                limit,
+                currentValue,
+                tolerance,
+                ...(resetAt !== undefined && { resetAt, retryAfterSeconds }),
+            },
+            ...(retryAfterSeconds !== undefined && { retryAfterSeconds }),
+            ...(options?.cause && { cause: options.cause }),
         });
         this.capName = capName;
         this.limit = limit;
         this.currentValue = currentValue;
         this.tolerance = tolerance;
+        this.resetAt = resetAt;
     }
 }
 // =============================================================================
@@ -158,6 +192,13 @@ export function currentCalendarMonthStartIso(now = Temporal.Now.instant()) {
     });
     return start.toInstant().toString();
 }
+export function calendarMonthPeriodEndIso(periodStartIso) {
+    return Temporal.Instant.from(periodStartIso)
+        .toZonedDateTimeISO("UTC")
+        .add({ months: 1 })
+        .toInstant()
+        .toString();
+}
 /**
  * Calendar-Period-enforcement + automatische soft-hit-Notification.
  * Ruft `enforceCap`, bei `crossed: true` den Notifier UND
@@ -175,6 +216,8 @@ export async function enforceCapAndMaybeNotify(ctx, options) {
         limit: options.limit,
         profile: options.profile,
         ...(options.amount !== undefined && { amount: options.amount }),
+        ...(options.periodEndIso !== undefined && { periodEndIso: options.periodEndIso }),
+        ...(options.i18nKey !== undefined && { i18nKey: options.i18nKey }),
     });
     if (result.state === "soft-hit" && result.crossed) {
         await options.notify({

package/dist/cap-counter/index.d.ts

@@ -2,7 +2,7 @@ export { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id.js"
 export { type BookCapUsageOptions, bookCapUsage, type MarkCapSoftWarnedOptions, markCapSoftWarned, type ReadRollingCapUsageOptions, readRollingCapUsage, } from "./book-cap-usage.js";
 export { type CalendarCapUsageReservation, type CalendarCapUsageReservationSpec, reserveCalendarCapUsage, } from "./calendar-cap-usage-reservation.js";
 export { CAP_COUNTER_FEATURE, CAP_COUNTER_ROLLING_AGGREGATE_TYPE, CapCounterHandlers, CapCounterQueries, ROLLING_INCREMENTED_EVENT_QN, ROLLING_INCREMENTED_EVENT_SHORT, ROLLING_RELEASED_EVENT_QN, ROLLING_RELEASED_EVENT_SHORT, } from "./constants.js";
-export { CAP_TOLERANCES, CapExceededError, type CapToleranceProfile, type CapToleranceProfileName, currentCalendarMonthStartIso, type EnforceCapResult, enforceCap, enforceCapAndMaybeNotify, enforceRollingCap, enforceRollingCapAndMaybeNotify, enforceStockCap, type SoftHitNotifier, type StockCapResult, } from "./enforce-cap.js";
+export { CAP_TOLERANCES, CapExceededError, type CapToleranceProfile, type CapToleranceProfileName, calendarMonthPeriodEndIso, currentCalendarMonthStartIso, type EnforceCapResult, enforceCap, enforceCapAndMaybeNotify, enforceRollingCap, enforceRollingCapAndMaybeNotify, enforceStockCap, type SoftHitNotifier, type StockCapResult, } from "./enforce-cap.js";
 export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";

package/dist/cap-counter/index.js

@@ -3,7 +3,7 @@ export { capCounterAggregateId, rollingCapAggregateId } from "./aggregate-id.js"
 export { bookCapUsage, markCapSoftWarned, readRollingCapUsage, } from "./book-cap-usage.js";
 export { reserveCalendarCapUsage, } from "./calendar-cap-usage-reservation.js";
 export { CAP_COUNTER_FEATURE, CAP_COUNTER_ROLLING_AGGREGATE_TYPE, CapCounterHandlers, CapCounterQueries, ROLLING_INCREMENTED_EVENT_QN, ROLLING_INCREMENTED_EVENT_SHORT, ROLLING_RELEASED_EVENT_QN, ROLLING_RELEASED_EVENT_SHORT, } from "./constants.js";
-export { CAP_TOLERANCES, CapExceededError, currentCalendarMonthStartIso, enforceCap, enforceCapAndMaybeNotify, enforceRollingCap, enforceRollingCapAndMaybeNotify, enforceStockCap, } from "./enforce-cap.js";
+export { CAP_TOLERANCES, CapExceededError, calendarMonthPeriodEndIso, currentCalendarMonthStartIso, enforceCap, enforceCapAndMaybeNotify, enforceRollingCap, enforceRollingCapAndMaybeNotify, enforceStockCap, } from "./enforce-cap.js";
 export { capCounterEntity } from "./entity.js";
 export { capCounterFeature } from "./feature.js";
 export { readPayloadField } from "./payload-field.js";

package/dist/cap-counter/with-cap-enforcement.d.ts

@@ -10,6 +10,8 @@ import { type CapToleranceProfileName, type SoftHitNotifier } from "./enforce-ca
 export type CalendarCapDef = {
     readonly capName: string;
     readonly periodStartIso: string;
+    readonly periodEndIso?: string;
+    readonly i18nKey?: string;
     readonly limit: number;
     readonly profile: CapToleranceProfileName;
     /** Increment-amount post-success. Default 1. */

package/dist/channel-email/email-channel.js

@@ -138,13 +138,20 @@ export function createEmailChannel(options) {
             throw new Error(`email channel: notification "${notificationType}" has a mail template but the channel context carries no renderMail`);
         }
         const unsubscribeUrl = message.data?.["unsubscribeUrl"];
-        const { subject, html, text, attachments } = await ctx.renderMail({
+        const { subject, html, text, attachments, fromName, replyTo } = await ctx.renderMail({
             slug: notificationType,
             locale: message.locale ?? "en",
             variables: message.data ?? {},
             ...(typeof unsubscribeUrl === "string" && { unsubscribeUrl }),
         });
-        return { html, subject, text, ...(attachments !== undefined && { attachments }) };
+        return {
+            html,
+            subject,
+            text,
+            ...(fromName !== undefined && { fromName }),
+            ...(replyTo !== undefined && { replyTo }),
+            ...(attachments !== undefined && { attachments }),
+        };
     }
     return {
         name: EMAIL_CHANNEL_NAME,
@@ -161,8 +168,13 @@ export function createEmailChannel(options) {
             return renderMessage(message, ctx);
         },
         async send(address, message, ctx, rendered) {
-            const { html, subject, text, attachments } = rendered ?? (await renderMessage(message, ctx));
-            const envelope = emailEnvelopeFrom(message.data);
+            const { html, subject, text, attachments, fromName, replyTo } = rendered ?? (await renderMessage(message, ctx));
+            // Template-level sender defaults; notify data wins.
+            const envelope = {
+                ...(fromName && { fromName }),
+                ...(replyTo && { replyTo }),
+                ...emailEnvelopeFrom(message.data),
+            };
             const resolvedAttachments = await resolveAttachments([
                 ...(attachments ?? []).map((ref) => ({ ref, origin: "template" })),
                 ...fileAttachmentsFrom(message.data, message.locale).map((ref) => ({ ref, origin: "message" })),

package/dist/channel-in-app/handlers/mark-all-read.write.d.ts

@@ -1,4 +1,4 @@
 import * as z from "zod";
 export declare const markAllReadWrite: import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"markAllRead", z.ZodObject<{}, z.core.$strip>, {
     marked: number;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/channel-in-app/handlers/mark-read.write.d.ts

@@ -3,4 +3,4 @@ export declare const markReadWrite: import("@cosmicdrift/kumiko-types/define-han
     id: z.ZodNumber;
 }, z.core.$strip>, {
     id: number | undefined;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/compliance-profiles/handlers/set-profile.write.d.ts

@@ -10,4 +10,4 @@ export declare const setProfileWrite: import("@cosmicdrift/kumiko-types/define-h
 }, z.core.$strip>, {
     profileKey: "de-hr-dsgvo-hgb" | "eu-dsgvo" | "swiss-dsg";
     isNew: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/config/handlers/reset.write.d.ts

@@ -9,4 +9,4 @@ export declare const resetWrite: import("@cosmicdrift/kumiko-types/define-handle
 }, z.core.$strip>, {
     key: string;
     scope: import("@cosmicdrift/kumiko-types/config-scope").ConfigScope;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/config/handlers/set.write.d.ts

@@ -11,4 +11,4 @@ export declare const setWrite: import("@cosmicdrift/kumiko-types/define-handler"
     key: string;
     value: string | number | boolean;
     scope: import("@cosmicdrift/kumiko-types/config-scope").ConfigScope;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/config/handlers/set.write.js

@@ -1,6 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, encryptPiiValueForSubject, } from "@cosmicdrift/kumiko-framework/crypto";
-import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, scopeTenantDbToTenant } from "@cosmicdrift/kumiko-framework/db";
 import { ConfigScopes, defineWriteHandler, isEncryptedAtRest, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, isKumikoError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
@@ -74,7 +74,7 @@ export const setWrite = defineWriteHandler({
                     scope,
                     tenantId,
                     userId,
-                    db,
+                    db: scopeTenantDbToTenant(db, tenantId),
                 });
             }
             catch (error) {

package/dist/config/resolver.d.ts

@@ -7,6 +7,7 @@ export type ConfigResolverOptions = {
     cipher?: EnvelopeCipher;
     appOverrides?: AppConfigOverrides;
 };
+export declare function decryptStoredValue(raw: string, keyDef: ConfigKeyDefinition, cipher: EnvelopeCipher | undefined, qualifiedKey: string): Promise<string>;
 export declare function createConfigResolver(options?: ConfigResolverOptions): ConfigResolver;
 export declare function validateAppOverrides(registry: {
     getConfigKey: (key: string) => import("@cosmicdrift/kumiko-framework/engine").ConfigKeyDefinition | undefined;

package/dist/config/resolver.js

@@ -57,6 +57,15 @@ async function decryptPiiEncrypted(raw, qualifiedKey) {
     const kmsCtx = { requestId: requestContext.get()?.requestId ?? "config:resolver" };
     return decryptPiiValueForSubject(kms, raw, kmsCtx, qualifiedKey);
 }
+// Plaintext form of a stored config_values.value for every read path (resolver,
+// bootstrap idempotency check).
+export async function decryptStoredValue(raw, keyDef, cipher, qualifiedKey) {
+    if (keyDef.encrypted)
+        return decryptEncrypted(cipher, raw, qualifiedKey);
+    if (keyDef.piiEncrypted)
+        return decryptPiiEncrypted(raw, qualifiedKey);
+    return raw;
+}
 // backing="secrets" keys store their value in the secrets store (flat per
 // (tenant,key) at SYSTEM_TENANT_ID), not in config_values. Both read paths
 // (getWithSource + buildCascade) route the system rung here. Missing reader =
@@ -142,13 +151,7 @@ async function buildCascade(qualifiedKey, keyDef, tenantId, userId, db, fetchRow
         }
         const row = await fetchRow(lookup.tenantId, lookup.userId);
         if (row?.value !== null && row?.value !== undefined) {
-            let raw = row.value;
-            if (keyDef.encrypted) {
-                raw = await decryptEncrypted(cipher, raw, qualifiedKey);
-            }
-            else if (keyDef.piiEncrypted) {
-                raw = await decryptPiiEncrypted(raw, qualifiedKey);
-            }
+            const raw = await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey);
             if (activeIndex === -1)
                 activeIndex = levels.length;
             levels.push({
@@ -296,13 +299,7 @@ export function createConfigResolver(options = {}) {
             for (const lookup of lookups) {
                 const row = await findRow(qualifiedKey, lookup.tenantId, lookup.userId, db);
                 if (row?.value !== null && row?.value !== undefined) {
-                    let raw = row.value;
-                    if (keyDef.encrypted) {
-                        raw = await decryptEncrypted(cipher, raw, qualifiedKey);
-                    }
-                    else if (keyDef.piiEncrypted) {
-                        raw = await decryptPiiEncrypted(raw, qualifiedKey);
-                    }
+                    const raw = await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey);
                     return { value: deserializeValue(raw, keyDef.type), source: lookup.source };
                 }
             }

package/dist/config/write-helpers.d.ts

@@ -2,12 +2,14 @@ import type { SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { type ConfigKeyDefinition, type ConfigScope, type Registry, type SessionUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { type KumikoError, type WriteFailure } from "@cosmicdrift/kumiko-framework/errors";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 export type ConfigRowLookup = {
     readonly id: string;
     readonly version: number;
     readonly value: string | null;
 };
 export declare function findConfigRow(db: DbConnection | TenantDb, key: string, tenantId: TenantId, userId: string | null): Promise<ConfigRowLookup | null>;
+export declare function configRowHoldsValue(row: ConfigRowLookup | null, keyDef: ConfigKeyDefinition | undefined, cipher: EnvelopeCipher | undefined, qualifiedKey: string, serializedValue: string): Promise<boolean>;
 export type PrepareConfigWriteArgs = {
     readonly registry: Registry;
     readonly user: SessionUser;

package/dist/config/write-helpers.js

@@ -6,6 +6,7 @@ import { ConfigScopes, extensionSelectorTargets, isEncryptedAtRest, SYSTEM_ROLE,
 import { AccessDeniedError, InternalError, NotFoundError, UnprocessableError, ValidationError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { assertUnreachable } from "@cosmicdrift/kumiko-framework/utils";
 import { ConfigErrors } from "./constants.js";
+import { decryptStoredValue } from "./resolver.js";
 import { configValuesTable } from "./table.js";
 // Locate an existing config_values row by the (key, tenant, user) triple —
 // the effective natural key. System-scope rows carry SYSTEM_TENANT_ID on
@@ -26,6 +27,24 @@ export async function findConfigRow(db, key, tenantId, userId) {
         value: row.value ?? null,
     };
 }
+// Idempotency check for declarative writers: does the stored row already hold
+// `serializedValue` (JSON of the plaintext)? Encrypted rows are decrypted
+// first, since their ciphertext differs on every encrypt.
+export async function configRowHoldsValue(row, keyDef, cipher, qualifiedKey, serializedValue) {
+    if (row?.value === null || row?.value === undefined)
+        return false;
+    if (!keyDef?.encrypted && !keyDef?.piiEncrypted)
+        return row.value === serializedValue;
+    if (!keyDef)
+        return false;
+    try {
+        return (await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey)) === serializedValue;
+    }
+    catch {
+        // Unreadable (rotated key, missing cipher/KMS): the caller rewrites the row, which is the repair.
+        return false;
+    }
+}
 export function prepareConfigWrite(args) {
     const { registry, user, key, scope: requestedScope } = args;
     const keyDef = registry.getConfigKey(key);

package/dist/crypto-shredding/handlers/forget-subject.write.d.ts

@@ -48,4 +48,4 @@ export declare const forgetSubjectWrite: import("@cosmicdrift/kumiko-types/defin
     reason: z.ZodString;
 }, z.core.$strip>, {
     subjectKey: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -1,6 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, runInSavepointIfSupported, runnerCanBeginTransaction, transaction, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
@@ -12,7 +12,7 @@ import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
 import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
-import { USER_STATUS } from "../../user/index.js";
+import { USER_STATUS, userTable } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
 import { CRYPTO_SHREDDING_AGGREGATE_TYPE, CRYPTO_SHREDDING_FEATURE_NAME, RECORD_ENTITY_NOT_REGISTERED, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, TARGET_RECORD_NOT_ADMIN_TENANT, TARGET_RECORD_RETENTION_BLOCK_DELETE, TARGET_TENANT_NOT_ADMIN_TENANT, } from "../constants.js";
 export { subjectIdSchema };
@@ -241,22 +241,29 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
         return sweepErrorLabel(err);
     }
 }
-// Graceful fail: email-subscribers and other non-user entities may use
-// user-style subject keys without having an actual user row — the key erase is
-// the important part for GDPR compliance; the lifecycle update is best-effort for
-// real users. The savepoint confines the failure so the handler transaction
-// stays usable for the audit event.
-async function closeUserLoginDoorBestEffort(ctx, userId, lifecycleRunner) {
-    try {
-        await runInSavepointIfSupported(lifecycleRunner, async (userLifecycleRunner) => {
-            await updateUserLifecycle(userLifecycleRunner, userId, { status: USER_STATUS.Deleted });
-            if (ctx.registry.features.has("personal-access-tokens")) {
-                await revokeAllPatTokensForUser(userLifecycleRunner, userId);
-            }
-        });
+// Email subscribers and other non-user entities use user-style subject keys
+// without a read_users row — the key erase is the GDPR-relevant part, so no row
+// means nothing to close. For an existing row, failures propagate: the handler
+// throws and the retry re-runs the (idempotent) erase plus the door close. With
+// an outside-transaction runner that can open its own transaction, the door
+// closes there and stays committed when the handler throws afterwards (sweep
+// error). Otherwise a savepoint confines a failure to the handler transaction.
+async function closeUserLoginDoor(ctx, userId, outsideRunner, handlerTxRunner) {
+    const userRow = await fetchOne(handlerTxRunner, userTable, { id: userId });
+    // skip: no user row for this subject key (e.g. email subscribers); there is no door to close.
+    if (!userRow)
+        return;
+    const closeDoor = async (runner) => {
+        await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted });
+        if (ctx.registry.features.has("personal-access-tokens")) {
+            await revokeAllPatTokensForUser(runner, userId);
+        }
+    };
+    if (outsideRunner && runnerCanBeginTransaction(outsideRunner)) {
+        await transaction(outsideRunner, closeDoor);
     }
-    catch {
-        // skip: no user row for this subject key (e.g. email subscribers); key erase and sweeps already ran.
+    else {
+        await runInSavepointIfSupported(handlerTxRunner, closeDoor);
     }
 }
 // Through the outside-transaction db when available, so the audit event commits
@@ -351,7 +358,6 @@ export const forgetSubjectWrite = defineWriteHandler({
             userId: event.user.id,
             eraseReason: event.payload.reason,
         });
-        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
         // User subject: close the login door. DEK-erase makes the passwordHash
         // ciphertext unreadable, but status + PATs are standalone credentials —
         // the PAT resolver only checks revokedAt/expiresAt, NOT user.status
@@ -367,9 +373,13 @@ export const forgetSubjectWrite = defineWriteHandler({
         // crash recovery is safe. User-feature guard: without the user feature
         // read_users doesn't exist (crypto-only stack). Tenant subjects have no
         // credentials.
+        // Runs before the sweep and in its own transaction: a failing sweep rolls the
+        // handler transaction back, and the handler tx holds no lock on this user's
+        // read_users row yet (only read gates ran), so there is no lock conflict.
         if (raw.kind === "user" && ctx.registry.features.has("user")) {
-            await closeUserLoginDoorBestEffort(ctx, raw.userId, ctx.db.unsafeRaw());
+            await closeUserLoginDoor(ctx, raw.userId, ctx.dbOutsideTransaction?.unsafeRaw(), ctx.db.unsafeRaw());
         }
+        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
         await appendSubjectForgotten(ctx, event, subjectAggregateId(raw), {
             subjectKey,
             reason: event.payload.reason,

package/dist/custom-fields/handlers/update-tenant-field.write.js

@@ -11,7 +11,6 @@ export function createUpdateTenantFieldHandler(opts = {}) {
         schema: updateFieldPayloadSchema,
         access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
         description: "Replaces a tenant-owned custom-field definition with a complete new spec; serializedField.type may be omitted, in which case the stored type applies, and a different type is refused. Use it to relabel or re-constrain an existing field rather than to create or remove one.",
-        excludedFields: ["type"],
         handler: async (event, ctx) => {
             const payload = event.payload; // @cast-boundary engine-payload
             const tenantId = event.user.tenantId;

package/dist/delivery/attachment-ref.d.ts

@@ -4,6 +4,8 @@ export type { FileAttachmentRef, InlineAttachmentRef, RenderedPdfAttachmentRef }
 export type EmailAttachmentRef = InlineAttachmentRef | FileAttachmentRef | RenderedPdfAttachmentRef;
 export declare const MAX_EMAIL_ATTACHMENTS = 20;
 export declare const MAX_RENDERED_PDF_VARIABLES_BYTES = 64000;
+export declare const DELIVERY_ENVELOPE_DATA_KEYS: readonly ["attachments", "from", "fromName", "replyTo", "headers", "unsubscribeUrl"];
+export declare function withoutDeliveryEnvelopeKeys(variables: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;
 export declare const inlineAttachmentRefSchema: z.ZodObject<{
     kind: z.ZodLiteral<"inline">;
     cid: z.ZodString;

package/dist/delivery/attachment-ref.js

@@ -3,6 +3,20 @@ import { attachmentFileNameSchema } from "../shared/index.js";
 import { isDocumentResourceKey, templateSlugSchema } from "../template-resolver/index.js";
 export const MAX_EMAIL_ATTACHMENTS = 20;
 export const MAX_RENDERED_PDF_VARIABLES_BYTES = 64_000;
+// Channel-data keys that steer delivery itself (envelope, headers, attachments);
+// they are not document variables and must not be copied into attached PDF refs.
+export const DELIVERY_ENVELOPE_DATA_KEYS = [
+    "attachments",
+    "from",
+    "fromName",
+    "replyTo",
+    "headers",
+    "unsubscribeUrl",
+];
+const DELIVERY_ENVELOPE_DATA_KEY_SET = new Set(DELIVERY_ENVELOPE_DATA_KEYS);
+export function withoutDeliveryEnvelopeKeys(variables) {
+    return Object.fromEntries(Object.entries(variables).filter(([key]) => !DELIVERY_ENVELOPE_DATA_KEY_SET.has(key)));
+}
 const MAX_ID_LENGTH = 64;
 const fileRefIdSchema = z.string().min(1).max(MAX_ID_LENGTH);
 export const inlineAttachmentRefSchema = z

package/dist/delivery/channel-context.js

@@ -1,5 +1,6 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import { readFileRefContent } from "../file-foundation/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../renderer-foundation/index.js";
 import { FALLBACK_LOCALE } from "../template-resolver/index.js";
@@ -15,7 +16,10 @@ export function createTemplateMailRenderer(db, registry, tenantId, config) {
             html: response.html,
             text: response.text,
             ...(response.previewText !== undefined && { previewText: response.previewText }),
+            ...(response.fromName !== undefined && { fromName: response.fromName }),
+            ...(response.replyTo !== undefined && { replyTo: response.replyTo }),
             ...(response.attachments !== undefined && { attachments: response.attachments }),
+            ...(response.layout !== undefined && { layout: response.layout }),
         };
     };
 }
@@ -40,6 +44,19 @@ function createPdfRenderer(db, registry, tenantId, config, filesForTenant) {
         return { content: response.pdfBytes, contentType: PDF_CONTENT_TYPE };
     };
 }
+// A decorative inline image (logo) that cannot be read must not fail the whole mail.
+async function readInlineImageOrNull(fileRefId, read) {
+    try {
+        return await read();
+    }
+    catch (err) {
+        createFallbackLogger("delivery").warn("inline image could not be read, sending without it", {
+            fileRefId,
+            errorName: err instanceof Error ? err.name : typeof err,
+        });
+        return null;
+    }
+}
 // Inline images and file attachments the renderer took from a template may come from the system
 // tenant (system template or tenant override of one). A file ref from notify data stays limited to
 // the job's own tenant, since a caller picks it. Inline content that is not an image is dropped, so
@@ -49,12 +66,13 @@ export function createEmailAttachmentReader(db, registry, tenantId, config, file
     return async (ref, origin = "message") => {
         if (ref.kind === "rendered-pdf")
             return renderPdf(ref);
-        const found = await readFileRefContent({
+        const readRef = () => readFileRefContent({
             db,
             filesForTenant,
             fileRefId: ref.fileRefId,
             allowedTenantIds: ref.kind === "file" && origin === "message" ? [tenantId] : [tenantId, SYSTEM_TENANT_ID],
         });
+        const found = ref.kind === "inline" ? await readInlineImageOrNull(ref.fileRefId, readRef) : await readRef();
         if (found === null)
             return null;
         if (ref.kind === "inline" && !found.contentType.startsWith(INLINE_IMAGE_CONTENT_TYPE_PREFIX)) {

package/dist/delivery/handlers/resubscribe-address.write.d.ts

@@ -6,4 +6,4 @@ export declare const resubscribeAddressWrite: import("@cosmicdrift/kumiko-types/
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/resubscribe-user.write.d.ts

@@ -6,4 +6,4 @@ export declare const resubscribeUserWrite: import("@cosmicdrift/kumiko-types/def
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/set-preference.write.d.ts

@@ -7,4 +7,4 @@ export declare const setPreferenceWrite: import("@cosmicdrift/kumiko-types/defin
     notificationType: string;
     channel: string;
     enabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/unsubscribe-address.write.d.ts

@@ -6,4 +6,4 @@ export declare const unsubscribeAddressWrite: import("@cosmicdrift/kumiko-types/
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/unsubscribe-user.write.d.ts

@@ -6,4 +6,4 @@ export declare const unsubscribeUserWrite: import("@cosmicdrift/kumiko-types/def
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/index.d.ts

@@ -1,6 +1,6 @@
 export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
-export { type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, } from "./attachment-ref.js";
+export { DELIVERY_ENVELOPE_DATA_KEYS, type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { type AttemptLogRetentionOptions, DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
 export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
 export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";

package/dist/delivery/index.js

@@ -1,6 +1,6 @@
 export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
-export { emailAttachmentRefSchema, fileAttachmentRefSchema, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, renderedPdfAttachmentRefSchema, toAttachmentRef, } from "./attachment-ref.js";
+export { DELIVERY_ENVELOPE_DATA_KEYS, emailAttachmentRefSchema, fileAttachmentRefSchema, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
 export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
 export { chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";