@cosmicdrift/kumiko-bundled-features 0.363.0 → 0.365.0

package/dist/delivery/delivery-service.js

@@ -79,11 +79,20 @@ export function createDeliveryService(options) {
     }
     // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
     // Partial success keeps it: a retry would re-send to those who got it.
-    async function releaseIdempotencyIfNothingDelivered(tenantId, key, run) {
+    // A failing release is logged and swallowed: it must neither replace the dispatch error the
+    // caller retries on nor fail a notify() that already dispatched.
+    async function releaseIdempotencyIfNothingDelivered(tenantId, key, run, notificationType) {
         // skip: no key claimed, or a recipient already got the notification
         if (!key || run.deliveries.some(isDeliveredOrQueued))
             return;
-        await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+        try {
+            await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+        }
+        catch (releaseErr) {
+            logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+                notificationType,
+            });
+        }
     }
     // Only a single-channel route lets the queued job free the key on terminal failure
     // without risking a duplicate send on another channel.
@@ -290,35 +299,50 @@ export function createDeliveryService(options) {
         return addressHash !== undefined && suppressed.has(addressOptOutKey(addressHash, channelName));
     }
     const recipientChannelKey = (userId, channelName) => `${userId}|${channelName}`;
-    async function isChannelDeliverable(run, userId, tenantId, notificationType, channelName) {
-        if (isChannelKilled && (await isChannelKilled(tenantId, channelName)))
-            return false;
-        return isChannelEnabled(run, userId, tenantId, notificationType, channelName);
+    // Kill switch, then the user's preference, then the rate limit — the order deliverToUser reports
+    // skips in. The rate limit consumes a token, so each recipient/channel pair is evaluated once.
+    async function evaluateChannelGate(run, userId, tenantId, notificationType, channelName, priority) {
+        if (isChannelKilled && (await isChannelKilled(tenantId, channelName))) {
+            return "channel_disabled";
+        }
+        // Critical priority skips the preference check
+        if (priority !== "critical" &&
+            !(await isChannelEnabled(run, userId, tenantId, notificationType, channelName))) {
+            return "preference_disabled";
+        }
+        if (rateLimit && !(await checkRateLimit(rateLimit, tenantId, channelName))) {
+            return "rate_limited";
+        }
+        return "open";
     }
     // Resolves every user's channel addresses up front so the opt-out lookup can
-    // cover them all at once. A resolve that throws stays out of the map: the
-    // delivery loop resolves it again and reports channel_error as before.
-    // Channels the kill switch or the user's preferences disable are never resolved
-    // here: resolve may have side effects and deliverToUser skips those channels.
-    async function prefetchUserAddresses(run, userIds, tenantId, notificationType) {
+    // cover them all at once. A resolve that throws stays out of the address map:
+    // the delivery loop resolves it again and reports channel_error as before.
+    // Channels that are gated (kill switch, preferences, rate limit) are never resolved
+    // here: resolve may have side effects and deliverToUser skips those channels. The
+    // gate verdict is kept so deliverToUser does not query it a second time.
+    async function prefetchRecipients(run, userIds, tenantId, notificationType, priority) {
         const addresses = new Map();
+        const gates = new Map();
         const channelCtx = buildChannelContext(run.db, registry, sseBroker, tenantId, secrets, tenantConfigFor?.(tenantId), run.filesForTenant);
         for (const userId of userIds) {
             for (const channel of channels) {
                 if (!channel.resolve)
                     continue;
+                const key = recipientChannelKey(userId, channel.name);
                 try {
-                    if (!(await isChannelDeliverable(run, userId, tenantId, notificationType, channel.name))) {
+                    const gate = await evaluateChannelGate(run, userId, tenantId, notificationType, channel.name, priority);
+                    gates.set(key, gate);
+                    if (gate !== "open")
                         continue;
-                    }
-                    addresses.set(recipientChannelKey(userId, channel.name), await channel.resolve(userId, channelCtx));
+                    addresses.set(key, await channel.resolve(userId, channelCtx));
                 }
                 catch {
                     // skip: re-resolved (and logged) by deliverToUser
                 }
             }
         }
-        return addresses;
+        return { addresses, gates };
     }
     // Check if user has disabled this notification+channel combo.
     // Specificity order: exact > any wildcard. When only wildcards match and they
@@ -341,68 +365,33 @@ export function createDeliveryService(options) {
         // and conservative — DB ordering no longer decides the outcome).
         return !prefs.some((p) => p.enabled === false);
     }
-    async function deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed) {
+    async function deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetched, suppressed) {
         const channelCtx = buildChannelContext(run.db, registry, sseBroker, tenantId, secrets, tenantConfigFor?.(tenantId), run.filesForTenant);
         for (const channel of channels) {
             // Route-only channel (no per-user address): not a user-notification target.
             if (!channel.resolve)
                 continue;
             const message = buildMessage(notificationType, data, channel.name, run.locale);
-            // Kill switch: tenant admin disabled this channel entirely
-            if (isChannelKilled) {
-                const killed = await isChannelKilled(tenantId, channel.name);
-                if (killed) {
-                    await logDelivery(run, {
-                        tenantId,
-                        notificationType,
-                        channel: channel.name,
-                        recipientId: userId,
-                        recipientAddress: null,
-                        status: "skipped",
-                        error: "channel_disabled",
-                        priority,
-                    });
-                    continue;
-                }
-            }
-            // Check preferences (critical priority skips preference check)
-            if (priority !== "critical") {
-                const enabled = await isChannelEnabled(run, userId, tenantId, notificationType, channel.name);
-                if (!enabled) {
-                    await logDelivery(run, {
-                        tenantId,
-                        notificationType,
-                        channel: channel.name,
-                        recipientId: userId,
-                        recipientAddress: null,
-                        status: "skipped",
-                        error: "preference_disabled",
-                        priority,
-                    });
-                    continue;
-                }
-            }
-            // Rate limiting
-            if (rateLimit) {
-                const allowed = await checkRateLimit(rateLimit, tenantId, channel.name);
-                if (!allowed) {
-                    await logDelivery(run, {
-                        tenantId,
-                        notificationType,
-                        channel: channel.name,
-                        recipientId: userId,
-                        recipientAddress: null,
-                        status: "skipped",
-                        error: "rate_limited",
-                        priority,
-                    });
-                    continue;
-                }
+            const prefetchKey = recipientChannelKey(userId, channel.name);
+            const gate = prefetched.gates.get(prefetchKey) ??
+                (await evaluateChannelGate(run, userId, tenantId, notificationType, channel.name, priority));
+            if (gate !== "open") {
+                await logDelivery(run, {
+                    tenantId,
+                    notificationType,
+                    channel: channel.name,
+                    recipientId: userId,
+                    recipientAddress: null,
+                    status: "skipped",
+                    error: gate,
+                    priority,
+                });
+                continue;
             }
             try {
-                const prefetchKey = recipientChannelKey(userId, channel.name);
-                const address = prefetchedAddresses.has(prefetchKey)
-                    ? prefetchedAddresses.get(prefetchKey)
+                const wasPrefetched = prefetched.addresses.has(prefetchKey);
+                const address = wasPrefetched
+                    ? prefetched.addresses.get(prefetchKey)
                     : await channel.resolve(userId, channelCtx);
                 if (!address) {
                     await logDelivery(run, {
@@ -417,7 +406,12 @@ export function createDeliveryService(options) {
                     });
                     continue;
                 }
-                if (priority !== "critical" && isAddressSuppressed(suppressed, address, channel.name)) {
+                // A fallback resolve yields an address the batched opt-out lookup never covered.
+                const suppressedForAddress = wasPrefetched
+                    ? suppressed
+                    : await loadSuppressedAddresses(run, tenantId, notificationType, priority, [address]);
+                if (priority !== "critical" &&
+                    isAddressSuppressed(suppressedForAddress, address, channel.name)) {
                     await logDelivery(run, {
                         tenantId,
                         notificationType,
@@ -551,12 +545,12 @@ export function createDeliveryService(options) {
             else {
                 userIds = to;
             }
-            const prefetchedAddresses = priority === "critical"
-                ? new Map()
-                : await prefetchUserAddresses(run, userIds, tenantId, notificationType);
-            const suppressed = await loadSuppressedAddresses(run, tenantId, notificationType, priority, [...prefetchedAddresses.values()].filter((address) => !!address));
+            const prefetched = priority === "critical"
+                ? { addresses: new Map(), gates: new Map() }
+                : await prefetchRecipients(run, userIds, tenantId, notificationType, priority);
+            const suppressed = await loadSuppressedAddresses(run, tenantId, notificationType, priority, [...prefetched.addresses.values()].filter((address) => !!address));
             for (const userId of userIds) {
-                await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetchedAddresses, suppressed);
+                await deliverToUser(userId, notificationType, data, tenantId, priority, run, prefetched, suppressed);
             }
         }
     }
@@ -599,15 +593,10 @@ export function createDeliveryService(options) {
                 await dispatchNotification(notificationType, options, tenantId, priority, run);
             }
             catch (err) {
-                // A failing release must not replace the dispatch error the caller retries on.
-                await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch((releaseErr) => {
-                    logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
-                        notificationType,
-                    });
-                });
+                await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run, notificationType);
                 throw err;
             }
-            await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
+            await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run, notificationType);
             return dispatched(run);
         },
     };

package/dist/delivery/handlers/resubscribe-address.write.d.ts

@@ -6,4 +6,4 @@ export declare const resubscribeAddressWrite: import("@cosmicdrift/kumiko-types/
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/resubscribe-user.write.d.ts

@@ -6,4 +6,4 @@ export declare const resubscribeUserWrite: import("@cosmicdrift/kumiko-types/def
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/set-preference.write.d.ts

@@ -7,4 +7,4 @@ export declare const setPreferenceWrite: import("@cosmicdrift/kumiko-types/defin
     notificationType: string;
     channel: string;
     enabled: boolean;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/unsubscribe-address.write.d.ts

@@ -6,4 +6,4 @@ export declare const unsubscribeAddressWrite: import("@cosmicdrift/kumiko-types/
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/handlers/unsubscribe-user.write.d.ts

@@ -6,4 +6,4 @@ export declare const unsubscribeUserWrite: import("@cosmicdrift/kumiko-types/def
 }, z.core.$strip>, {
     notificationType: string;
     channel: string;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/delivery/index.d.ts

@@ -1,6 +1,6 @@
 export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
-export { type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, } from "./attachment-ref.js";
+export { DELIVERY_ENVELOPE_DATA_KEYS, type EmailAttachmentRef, emailAttachmentRefSchema, type FileAttachmentRef, fileAttachmentRefSchema, type InlineAttachmentRef, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, type RenderedPdfAttachmentRef, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { type AttemptLogRetentionOptions, DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
 export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
 export { type ChatWebhookChannelOptions, chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";

package/dist/delivery/index.js

@@ -1,6 +1,6 @@
 export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
-export { emailAttachmentRefSchema, fileAttachmentRefSchema, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, renderedPdfAttachmentRefSchema, toAttachmentRef, } from "./attachment-ref.js";
+export { DELIVERY_ENVELOPE_DATA_KEYS, emailAttachmentRefSchema, fileAttachmentRefSchema, inlineAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, MAX_RENDERED_PDF_VARIABLES_BYTES, renderedPdfAttachmentRefSchema, toAttachmentRef, withoutDeliveryEnvelopeKeys, } from "./attachment-ref.js";
 export { DEFAULT_ATTEMPT_LOG_RETENTION_DAYS, runAttemptLogRetention, } from "./attempt-log-retention.js";
 export { createEmailAttachmentReader, createTemplateMailRenderer } from "./channel-context.js";
 export { chatMessageText, createChatWebhookChannel, resolveChatWebhookTarget, toChannelResult, } from "./chat-webhook-channel.js";

package/dist/delivery/jobs.js

@@ -36,6 +36,8 @@ const sendJobPayloadSchema = renderJobPayloadSchema.extend({
         html: z.string(),
         subject: z.string(),
         text: z.string().optional(),
+        fromName: z.string().optional(),
+        replyTo: z.string().optional(),
         attachments: z.array(emailAttachmentRefSchema).max(MAX_EMAIL_ATTACHMENTS).optional(),
     })
         .optional(),
@@ -63,6 +65,8 @@ function toSendRendered(rendered) {
         html: rendered.html,
         subject: rendered.subject,
         ...(rendered.text !== undefined && { text: rendered.text }),
+        ...(rendered.fromName !== undefined && { fromName: rendered.fromName }),
+        ...(rendered.replyTo !== undefined && { replyTo: rendered.replyTo }),
         ...(rendered.attachments !== undefined && {
             attachments: rendered.attachments.map(toAttachmentRef),
         }),
@@ -96,12 +100,11 @@ function entryFor(p, status, error, address, confirmed) {
         ...(confirmed === false && { confirmed }),
     };
 }
-// Only the final retry frees the key: earlier failures are retried by the runner and
-// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
-// wires the same instance into both.
-async function releaseIdempotencyOnTerminalFailure(ctx, p) {
-    // skip: nothing to release before the last attempt or without an idempotency key
-    if (!ctx.finalAttempt || !p.idempotencyKey)
+// Assumes ctx.redis is the handle the service claimed on; runProdApp wires the same
+// instance into both.
+async function releaseIdempotencyKey(ctx, p) {
+    // skip: no idempotency key was claimed for this notification
+    if (!p.idempotencyKey)
         return;
     if (!ctx.redis) {
         ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
@@ -118,6 +121,26 @@ async function releaseIdempotencyOnTerminalFailure(ctx, p) {
         });
     }
 }
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup.
+async function releaseIdempotencyOnTerminalFailure(ctx, p) {
+    // skip: not the last attempt, the runner retries and the key must keep deduplicating
+    if (!ctx.finalAttempt)
+        return;
+    await releaseIdempotencyKey(ctx, p);
+}
+// Covers every throw after the payload parsed, not just the attempt-logged ones: a
+// missing registry or unknown channel on the last attempt would otherwise hold the key
+// until its TTL.
+async function releasingKeyOnTerminalFailure(ctx, p, run) {
+    try {
+        return await run();
+    }
+    catch (err) {
+        await releaseIdempotencyOnTerminalFailure(ctx, p);
+        throw err;
+    }
+}
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -128,7 +151,6 @@ async function failAttempt(ctx, db, registry, p, code, err) {
         channel: p.channelName,
     });
     await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, "failed", code, p.address));
-    await releaseIdempotencyOnTerminalFailure(ctx, p);
     throw new Error(code);
 }
 // Render the message and hand off to delivery.send. On failure: record the
@@ -136,10 +158,13 @@ async function failAttempt(ctx, db, registry, p, code, err) {
 // the send step is never reached, so a stuck render can't half-send.
 export const deliveryRenderJob = async (payload, ctx) => {
     const p = renderJobPayloadSchema.parse(payload);
+    return releasingKeyOnTerminalFailure(ctx, p, () => renderStep(p, ctx));
+};
+async function renderStep(p, ctx) {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, fileTenantId));
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, ctx.systemUser.tenantId, fileTenantId));
     let rendered;
     try {
         if (!channel.render) {
@@ -157,21 +182,28 @@ export const deliveryRenderJob = async (payload, ctx) => {
     catch (err) {
         return failAttempt(ctx, db, registry, p, "channel_error", err);
     }
-};
+}
 // Deliver via the channel using the rendered payload (if any). On failure:
 // record the terminal failed event and rethrow so BullMQ retries the send with
 // the same already-rendered HTML — no re-render needed.
 export const deliverySendJob = async (payload, ctx) => {
     const p = sendJobPayloadSchema.parse(payload);
+    return releasingKeyOnTerminalFailure(ctx, p, () => sendStep(p, ctx));
+};
+async function sendStep(p, ctx) {
     const tenantId = p.tenantId; // @cast-boundary engine-payload — stream tenant
     const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
     const channel = resolveChannel(registry, p.channelName);
-    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, fileTenantId));
+    const channelCtx = buildChannelContext(db, registry, undefined, tenantId, ctx.secrets, ctx.config, (fileTenantId) => fileContextForTenant(ctx, ctx.systemUser.tenantId, fileTenantId));
     try {
         const result = await channel.send(p.address, toMessage(p), channelCtx, p.rendered);
         await appendAttemptEvent(db, registry, p.deliveryAttemptId, entryFor(p, result.status, result.error ?? null, result.address ?? p.address, result.confirmed));
+        // A soft failure ends the job successfully, so no retry follows and the caller's
+        // retry must not be skipped as a duplicate.
+        if (result.status === "failed")
+            await releaseIdempotencyKey(ctx, p);
     }
     catch (err) {
         return failAttempt(ctx, db, registry, p, "send_failed", err);
     }
-};
+}

package/dist/delivery/types.d.ts

@@ -3,7 +3,7 @@ import type { DbConnection, TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { DeliveryErrorCode, NotifyDeliveryStatus, NotifyDispatched, NotifyJobDispatcher, NotifyOptions, NotifyPriority, Registry, SessionUser, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import type { MailPayload } from "../renderer-foundation/index.js";
+import type { MailPayload, RenderedTemplateRef } from "../renderer-foundation/index.js";
 import type { EmailAttachmentRef } from "./attachment-ref.js";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 export type RenderedMail = {
@@ -11,7 +11,11 @@ export type RenderedMail = {
     readonly html: string;
     readonly text: string;
     readonly previewText?: string;
+    readonly fromName?: string;
+    readonly replyTo?: string;
     readonly attachments?: readonly EmailAttachmentRef[];
+    /** The layout version the html was rendered through; the editor preview names it. */
+    readonly layout?: RenderedTemplateRef;
 };
 export type ChannelContext = {
     readonly db: TenantDb;
@@ -43,6 +47,8 @@ export type RenderedMessage = {
     readonly html: string;
     readonly subject: string;
     readonly text?: string;
+    readonly fromName?: string;
+    readonly replyTo?: string;
     readonly attachments?: readonly EmailAttachmentRef[];
 };
 export declare const DELIVERY_CHANNEL_MODES: readonly ["inline", "queued"];

package/dist/feature-toggles/handlers/set.write.d.ts

@@ -7,4 +7,4 @@ export declare function createSetWriteHandler(getRuntime: (() => GlobalFeatureTo
     featureName: string;
     enabled: boolean;
     previousEnabled: boolean | null;
-}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+}, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;

package/dist/feature-toggles/toggle-runtime.d.ts

@@ -1,6 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import { type ClosableCacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
+import { type CacheSyncBus, type ClosableCacheSyncBus } from "@cosmicdrift/kumiko-framework/redis";
 export type ToggleSyncSignal = {
     publish(featureName: string, enabled: boolean): void;
     onMessage(listener: (featureName: string, enabled: boolean) => void): void;
@@ -12,14 +12,16 @@ export declare class GlobalFeatureToggleRuntime {
     private readonly syncSignal?;
     private readonly ownedBus?;
     private snapshot;
-    private appliedDuringLoad;
+    private readonly pendingFlipBuffers;
+    private loadInFlight;
     constructor(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal | undefined, ownedBus?: ClosableCacheSyncBus | undefined);
     close(): Promise<void>;
     initialize(): Promise<void>;
+    private loadSnapshot;
     refresh(): Promise<void>;
     apply(featureName: string, enabled: boolean): void;
     broadcastToggle(featureName: string, enabled: boolean): void;
     readOverride(featureName: string): boolean | undefined;
     effectiveFeatures: () => ReadonlySet<string>;
 }
-export declare function createFeatureToggleRuntime(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal): Promise<GlobalFeatureToggleRuntime>;
+export declare function createFeatureToggleRuntime(db: DbConnection, registry: Registry, syncSignal?: ToggleSyncSignal, cacheSyncBus?: CacheSyncBus): Promise<GlobalFeatureToggleRuntime>;

package/dist/feature-toggles/toggle-runtime.js

@@ -22,9 +22,11 @@ export class GlobalFeatureToggleRuntime {
     syncSignal;
     ownedBus;
     snapshot = new Map();
-    // Flips applied while a snapshot load is in flight. The load's SELECT may have
-    // started before the flip committed, so its rows can be older than these.
-    appliedDuringLoad;
+    // One buffer per requested load, open from the call until its SELECT finished: the SELECT
+    // may have started before a flip committed, so its rows can be older than the flips collected.
+    pendingFlipBuffers = new Set();
+    // Loads run one at a time so the older rows of one cannot overwrite the result of another.
+    loadInFlight = Promise.resolve();
     constructor(db, registry, syncSignal, ownedBus) {
         this.db = db;
         this.registry = registry;
@@ -47,9 +49,14 @@ export class GlobalFeatureToggleRuntime {
     async close() {
         await this.ownedBus?.close();
     }
-    async initialize() {
+    initialize() {
         const pendingFlips = new Map();
-        this.appliedDuringLoad = pendingFlips;
+        this.pendingFlipBuffers.add(pendingFlips);
+        const load = this.loadInFlight.then(() => this.loadSnapshot(pendingFlips));
+        this.loadInFlight = load.catch(() => undefined);
+        return load;
+    }
+    async loadSnapshot(pendingFlips) {
         try {
             const rows = await selectMany(this.db, globalFeatureStateTable);
             this.snapshot = new Map([
@@ -58,7 +65,7 @@ export class GlobalFeatureToggleRuntime {
             ]);
         }
         finally {
-            this.appliedDuringLoad = undefined;
+            this.pendingFlipBuffers.delete(pendingFlips);
         }
     }
     // Re-read the full snapshot. Called from the set-handler after a
@@ -74,7 +81,8 @@ export class GlobalFeatureToggleRuntime {
     // lock. Kept alongside refresh() so both options are explicit.
     apply(featureName, enabled) {
         this.snapshot.set(featureName, enabled);
-        this.appliedDuringLoad?.set(featureName, enabled);
+        for (const pendingFlips of this.pendingFlipBuffers)
+            pendingFlips.set(featureName, enabled);
     }
     // Called by the toggle-cache-sync MSP handler (feature.ts) — the one
     // process whose shared cursor won a given toggle-set event. With a
@@ -116,11 +124,16 @@ export class GlobalFeatureToggleRuntime {
 }
 // Factory for app-boot wiring: instantiate, initialize, return the runtime (for the
 // set-handler to refresh; its effectiveFeatures feeds createDispatcher). Without an explicit
-// syncSignal the runtime builds one on the framework cache-sync bus: Redis-backed when
-// REDIS_URL is set, process-local otherwise. close() releases a bus it created.
-export async function createFeatureToggleRuntime(db, registry, syncSignal) {
-    const ownedBus = syncSignal ? undefined : createDefaultCacheSyncBus();
-    const signal = syncSignal ?? (ownedBus ? createCacheSyncToggleSignal(ownedBus) : undefined);
+// syncSignal the signal runs on the given cacheSyncBus or, failing that, on a bus the runtime
+// creates itself (Redis-backed when REDIS_URL is set, process-local otherwise). close() releases
+// only a bus the runtime created.
+export async function createFeatureToggleRuntime(db, registry, syncSignal, 
+// The server's own bus (the one handed to the dispatcher): reusing it avoids a second set of
+// Redis connections that nothing closes at shutdown.
+cacheSyncBus) {
+    const ownedBus = syncSignal || cacheSyncBus ? undefined : createDefaultCacheSyncBus();
+    const sharedBus = cacheSyncBus ?? ownedBus;
+    const signal = syncSignal ?? (sharedBus ? createCacheSyncToggleSignal(sharedBus) : undefined);
     const runtime = new GlobalFeatureToggleRuntime(db, registry, signal, ownedBus);
     try {
         await runtime.initialize();

package/dist/file-derivatives/handlers/public-variant.query.js

@@ -99,7 +99,7 @@ export const publicVariantQuery = defineQueryHandler({
         if (!spec)
             return null;
         const result = await derivatives.variant(query.payload.fileRefId, spec, query.payload.variant);
-        const bytes = await files.ref(result.storageKey).read();
+        const bytes = await files.refFromFileRef(result).read();
         // ponytail: fully buffered (no streaming), +33% over the wire from
         // base64 — HttpRouteHandlerDeps only exposes {app, systemQuery} (no
         // direct ctx.files access from the Hono handler itself), and the local

package/dist/file-foundation/read-file-ref-content.d.ts

@@ -9,7 +9,7 @@ export type FileRefContent = {
 export declare function fileContextForTenant(ctx: {
     readonly _fileProviderResolver?: FileProviderResolver | undefined;
     readonly files?: FileContext | undefined;
-}, tenantId: string): FileContext | undefined;
+}, contextTenantId: string, tenantId: string): FileContext | undefined;
 export declare function fileContextFromResolver(resolver: FileProviderResolver, tenantId: string): FileContext;
 export declare class FileRefTooLargeError extends Error {
     readonly size: number;

package/dist/file-foundation/read-file-ref-content.js

@@ -1,11 +1,13 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { isUuid } from "@cosmicdrift/kumiko-framework/engine";
 import { createFileContext, fileRefsTable, } from "@cosmicdrift/kumiko-framework/files";
-// Tenant-bound on purpose: the FileContext of the current request only reaches its own key space.
-export function fileContextForTenant(ctx, tenantId) {
+// Tenant-bound on purpose: without a resolver `ctx.files` only reaches the storage of the
+// context's own tenant (`contextTenantId`), so a request for another tenant's files is
+// undefined instead of silently reading through the wrong tenant's storage.
+export function fileContextForTenant(ctx, contextTenantId, tenantId) {
     const resolver = ctx._fileProviderResolver;
     if (resolver === undefined)
-        return ctx.files;
+        return tenantId === contextTenantId ? ctx.files : undefined;
     return fileContextFromResolver(resolver, tenantId);
 }
 export function fileContextFromResolver(resolver, tenantId) {
@@ -44,6 +46,6 @@ export async function readFileRefContent(args) {
     if (files === undefined) {
         throw new Error("readFileRefContent: no file storage is available for the file's tenant");
     }
-    const content = await files.ref(row.storageKey).read();
+    const content = await files.refFromFileRef(row).read();
     return { content, contentType: row.mimeType, tenantId: row.tenantId, size };
 }

package/dist/files-tenant-data/hooks.js

@@ -97,6 +97,7 @@ export const fileRefTenantDestroyHook = async (ctx) => {
         },
         maxFailures: 1,
         deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+        minBatches: 1,
         onRowError: (_row, err) => {
             firstFailure = err instanceof Error ? err.message : String(err);
         },
@@ -176,6 +177,9 @@ export const fileRefStorageDestroyHook = async (tenantId, ctx) => {
             },
             maxFailures: 1,
             deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+            // list() and the survivor lookup above can use up the whole budget; one chunk per tick
+            // still deletes, so the stage never reports "no progress".
+            minBatches: 1,
             onRowError: (_key, err) => {
                 firstFailure = err instanceof Error ? err.message : String(err);
             },

package/dist/files-tenant-data/index.d.ts

@@ -1,4 +1,5 @@
 import { type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
+export declare const FILES_TENANT_DATA_FEATURE: "files-tenant-data";
 export declare function createFilesTenantDataFeature(): FeatureDefinition;
 export { sweepOrphanedDerivativesJob, sweepOrphanedDerivativesPayloadSchema, } from "./handlers/sweep-orphaned-derivatives.job.js";
 export { fileRefStorageDestroyHook, fileRefTenantDestroyHook } from "./hooks.js";

package/dist/files-tenant-data/index.js

@@ -14,8 +14,9 @@ import { defineFeature, EXT_STORAGE_PROVIDER, EXT_TENANT_DATA, } from "@cosmicdr
 import { sweepOrphanedDerivativesJob, sweepOrphanedDerivativesPayloadSchema, } from "./handlers/sweep-orphaned-derivatives.job.js";
 import { fileRefStorageDestroyHook, fileRefTenantDestroyHook } from "./hooks.js";
 const SWEEP_ORPHANED_DERIVATIVES_ESCAPE_HATCH_REASON = "iterates every tenant and checks fileRef owners per tenant";
+export const FILES_TENANT_DATA_FEATURE = "files-tenant-data";
 export function createFilesTenantDataFeature() {
-    return defineFeature("files-tenant-data", (r) => {
+    return defineFeature(FILES_TENANT_DATA_FEATURE, (r) => {
         r.describe("GDPR coverage for the `files` feature's `fileRef` entity: tenant-destroy row purge (EXT_TENANT_DATA) and full storage-prefix binary wipe (EXT_STORAGE_PROVIDER), plus a manual backfill/GC job that sweeps derivatives orphaned by a forget/tenant-destroy that ran before #2461 wired binary cleanup into those flows. Requires `tenant-lifecycle`, optionalRequires `files`.");
         r.uiHints({
             displayLabel: "Files · Tenant-Destroy & Derivative GC",

package/dist/form-draft/db/queries/owned-file-refs.d.ts

@@ -1,4 +1,4 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export declare function filterOwnedStorageKeys(db: DbRunner, tenantId: TenantId, ownerId: string, candidateKeys: readonly string[], draftInsertedAt: Temporal.Instant, isCreateMode: boolean): Promise<readonly string[]>;