@cosmicdrift/kumiko-bundled-features 0.364.0 → 0.365.1

package/dist/audit/feature.js

@@ -51,7 +51,7 @@ export function createAuditFeature() {
                     db: ctx.db.unsafeRaw(),
                     registry: ctx.registry,
                     configResolver: ctx.configResolver,
-                    userId: ctx._userId ?? SYSTEM_USER_ID,
+                    userId: SYSTEM_USER_ID,
                 });
             },
         });

package/dist/audit/run-escape-hatch-retention.d.ts

@@ -6,6 +6,7 @@ export declare function runEscapeHatchRetention(args: {
     readonly registry: Registry;
     readonly configResolver: ConfigResolver | undefined;
     readonly userId: string;
+    readonly batchSize?: number;
 }): Promise<{
     readonly deletedCount: number;
 }>;

package/dist/audit/run-escape-hatch-retention.js

@@ -1,4 +1,4 @@
-import { aggregateWhere, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { aggregateWhere, runnerCanBeginTransaction, selectMany, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { COMPLIANCE_PROFILES, subtractRetentionSpec, } from "@cosmicdrift/kumiko-framework/compliance";
 import { parseTenantId, SYSTEM_TENANT_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
@@ -10,7 +10,7 @@ import { DEFAULT_ESCAPE_HATCH_RETENTION_DAYS, ESCAPE_HATCH_RETENTION_DAYS_KEY, }
 import { ESCAPE_HATCH_USE_AGGREGATE_TYPE, escapeHatchUsedSchema, } from "./escape-hatch-audit-sink.js";
 // pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
 export function isDbConnection(runner) {
-    return "begin" in runner && typeof runner.begin === "function";
+    return runnerCanBeginTransaction(runner);
 }
 async function resolveRetentionDays(args) {
     if (!args.configResolver)
@@ -19,18 +19,29 @@ async function resolveRetentionDays(args) {
     const raw = await config(ESCAPE_HATCH_RETENTION_DAYS_KEY);
     return typeof raw === "number" && raw >= 1 ? raw : DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
 }
+// Only an operator-set value counts: the key's declared default must not override the tenant profiles.
+async function resolveExplicitRetentionDays(args) {
+    const keyDef = args.registry.getConfigKey(ESCAPE_HATCH_RETENTION_DAYS_KEY);
+    if (!args.configResolver || !keyDef)
+        return undefined;
+    const { value, source } = await args.configResolver.getWithSource(ESCAPE_HATCH_RETENTION_DAYS_KEY, keyDef, SYSTEM_TENANT_ID, args.userId, args.db);
+    const isOperatorSet = source !== "default" && source !== "missing";
+    return isOperatorSet && typeof value === "number" && value >= 1 ? value : undefined;
+}
 // Soft dependency: audit must stay mountable without compliance-profiles, so we probe its entity.
 const COMPLIANCE_PROFILE_ENTITY = "tenant-compliance-profile";
 const PRUNE_CHUNK_SIZE = 1000;
+const PRUNE_BATCH_SIZE = 5000;
 // Overrides may only lengthen retention: the earlier cutoff (same `now`) is the longer period.
 function earlierInstant(a, b) {
     return Temporal.Instant.compare(a, b) <= 0 ? a : b;
 }
-async function resolveTenantCutoff(db, tenantId, now) {
+async function resolveTenantCutoff(db, tenantId, now, operatorFloor) {
     const { profile } = await resolveProfileForTenant({ db, tenantId });
     const effective = subtractRetentionSpec(now, profile.auditLog.retention);
     const base = subtractRetentionSpec(now, COMPLIANCE_PROFILES[profile.key].auditLog.retention);
-    return earlierInstant(effective, base);
+    const profileCutoff = earlierInstant(effective, base);
+    return operatorFloor ? earlierInstant(profileCutoff, operatorFloor) : profileCutoff;
 }
 // A cross-tenant audit (e.g. identity-switch) lives under the actor's tenant but must also
 // satisfy the target tenant's retention. A malformed payload falls back to the storing tenant.
@@ -45,14 +56,17 @@ async function storingTenantIds(db) {
         return tenantId ? [tenantId] : [];
     });
 }
-async function pruneByTenantProfiles(db) {
+async function pruneByTenantProfiles(db, operatorRetentionDays) {
     const now = getTemporal().Now.instant();
+    const operatorFloor = operatorRetentionDays === undefined
+        ? undefined
+        : now.subtract({ hours: operatorRetentionDays * 24 });
     const cutoffByTenant = new Map();
     const cutoffOf = async (tenantId) => {
         const cached = cutoffByTenant.get(tenantId);
         if (cached)
             return cached;
-        const cutoff = await resolveTenantCutoff(db, tenantId, now);
+        const cutoff = await resolveTenantCutoff(db, tenantId, now, operatorFloor);
         cutoffByTenant.set(tenantId, cutoff);
         return cutoff;
     };
@@ -87,6 +101,22 @@ async function pruneByTenantProfiles(db) {
     }
     return deletedCount;
 }
+async function pruneInBatches(db, olderThanDays, batchSize = PRUNE_BATCH_SIZE) {
+    const olderThan = getTemporal()
+        .Now.instant()
+        .subtract({ hours: olderThanDays * 24 });
+    let deletedCount = 0;
+    for (;;) {
+        const batch = await pruneEvents(db, {
+            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+            olderThan,
+            batchSize,
+        });
+        deletedCount += batch.deletedCount;
+        if (batch.deletedCount < batchSize)
+            return deletedCount;
+    }
+}
 export async function runEscapeHatchRetention(args) {
     const { db } = args;
     if (!isDbConnection(db)) {
@@ -94,11 +124,8 @@ export async function runEscapeHatchRetention(args) {
     }
     if (!args.registry.getEntity(COMPLIANCE_PROFILE_ENTITY)) {
         const olderThanDays = await resolveRetentionDays({ ...args, db });
-        const { deletedCount } = await pruneEvents(db, {
-            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
-            olderThanDays,
-        });
-        return { deletedCount };
+        return { deletedCount: await pruneInBatches(db, olderThanDays, args.batchSize) };
     }
-    return { deletedCount: await pruneByTenantProfiles(db) };
+    const operatorRetentionDays = await resolveExplicitRetentionDays({ ...args, db });
+    return { deletedCount: await pruneByTenantProfiles(db, operatorRetentionDays) };
 }

package/dist/auth-email-password/bootstrap.d.ts

@@ -4,8 +4,7 @@ import { type Registry, type TenantId, type WriteResult } from "@cosmicdrift/kum
 import type { Dispatcher } from "@cosmicdrift/kumiko-framework/pipeline";
 import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import type { Redis } from "ioredis";
-import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+import type { GlobalRole } from "../user/constants.js";
 export type BootstrapInvite = {
     readonly email: string;
     /** Membership role in the tenant, validated like a tenant-admin invite
@@ -80,4 +79,3 @@ export declare class BootstrapPlanError extends Error {
 export declare class BootstrapWriteError extends Error {
 }
 export declare function bootstrapTenants(deps: BootstrapDeps, plan: BootstrapPlan): Promise<BootstrapReport>;
-export {};

package/dist/auth-email-password/feature.js

@@ -19,6 +19,7 @@ import { createSignupConfirmHandler } from "./handlers/signup-confirm.write.js";
 import { createSignupRequestHandler, } from "./handlers/signup-request.write.js";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
+import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./mail-i18n.js";
 import { AUTH_MAIL_VARIABLES, authMailLocalizedTemplate, INVITE_MAIL_VARIABLES, sendsMagicLinkMail, } from "./mail-notifications.js";
 /**
  * Env-vars contract for the `auth-email-password` feature.
@@ -89,6 +90,7 @@ export function createAuthEmailPasswordFeature(opts = {}) {
         if (sendsMagicLinkMail(opts))
             r.requires("delivery");
         r.envSchema(authEmailPasswordEnvSchema);
+        r.translations({ keys: AUTH_EMAIL_PASSWORD_MAIL_I18N });
         // Declared unconditionally: apps also issue the activation link from their
         // own flows (issueSignupActivation) without enabling the signup option.
         r.notification("password-reset", {

package/dist/auth-email-password/handlers/invite-accept-with-login.write.js

@@ -56,9 +56,8 @@ export function createInviteAcceptWithLoginHandler(opts = {}) {
         rateLimit: { per: "ip+handler", limit: 20, windowSeconds: 60 },
         escapeHatch: {
             grants: ["unsafeRaw"],
-            reason: "Anonymous invite-accept has no session in the invited tenant yet — checks existing " +
-                "membership via ctx.queryAs(SYSTEM, tenant:query:memberships) of the invitation's tenant. " +
-                "Also reads the pending invitation by id (the invitee is not yet a member of the " +
+            reason: "Anonymous invite-accept has no session in the invited tenant yet — reads the pending " +
+                "invitation by id (the invitee is not yet a member of the " +
                 "invitation's tenant), adds the membership and accepts the invitation in the " +
                 "invitation's tenant, which differs from the caller's tenant, and reads the MFA " +
                 "enrollment of that tenant via the mfaStatusChecker callback.",

package/dist/auth-email-password/handlers/invite-create.write.d.ts

@@ -1,7 +1,6 @@
 import * as z from "zod";
-import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
+import { type GlobalRole } from "../../user/constants.js";
 import type { AuthMailLocale } from "../email-templates.js";
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 export type InviteCreateData = {
     readonly kind: "invite-created";
     readonly invitationId: string;
@@ -40,5 +39,5 @@ export declare function createSystemInviteCreateHandler(opts: InviteCreateOption
     globalRoles: z.ZodDefault<z.ZodArray<z.ZodEnum<{
         SystemAdmin: "SystemAdmin";
     }>>>;
+    locale: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, InviteCreateData, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap, undefined>;
-export {};

package/dist/auth-email-password/handlers/invite-create.write.js

@@ -20,6 +20,7 @@ import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, assignableAppRolesOf, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
@@ -133,7 +134,7 @@ async function issueInvitation(opts, ttlSeconds, request, inviter, ctx, refuseAc
     }
     const token = generateToken();
     await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
-    const locale = resolveHandlerMailLocale(ctx, opts.locale);
+    const locale = request.locale ?? resolveHandlerMailLocale(ctx, opts.locale);
     await dispatchMagicLinkMail(ctx.notify, {
         handlerName: "invite-create",
         notificationType: AuthMailNotificationTypes.invite,
@@ -188,6 +189,8 @@ const SystemInviteCreateSchema = z.object({
     email: z.email(),
     role: z.string().min(1).max(50),
     globalRoles: z.array(z.enum(GLOBAL_ROLE_OPTIONS)).max(GLOBAL_ROLE_OPTIONS.length).default([]),
+    // Preferred over the request locale: provisioning callers know the invitee's language.
+    locale: z.string().max(35).refine(isValidLocaleTag, "invalid locale tag").optional(),
 });
 // System-only sibling of invite-create: the only path that can put global
 // roles (SystemAdmin) on an invitation. No session mint path yields the

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.d.ts

@@ -2,6 +2,7 @@ import * as z from "zod";
 import { gateEnforceMfa, type LoginHandlerOptions } from "./login.write.js";
 export type SwitchTenantMfaGateData = {
     readonly kind: "mfa-gate-clear";
+    readonly roles: readonly string[];
 } | NonNullable<Awaited<ReturnType<typeof gateEnforceMfa>>>;
 export declare function createSwitchTenantMfaGateHandler(opts: Pick<LoginHandlerOptions, "mfaStatusChecker">): import("@cosmicdrift/kumiko-types/define-handler").WriteHandlerDefinition<"switch-tenant-mfa-gate", z.ZodObject<{
     userId: z.ZodString;

package/dist/auth-email-password/handlers/switch-tenant-mfa-gate.write.js

@@ -33,7 +33,7 @@ export function createSwitchTenantMfaGateHandler(opts) {
             const userRow = parseAuthUserRow(await ctx.queryAs(createSystemUser(tenantId), UserQueries.findForAuth, { id: userId }));
             const roles = buildSessionRoles(parseRoles(userRow?.roles ?? null), active.membership.roles);
             const mfaGate = await gateEnforceMfa(ctx, opts, userId, tenantId, roles);
-            return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear" } };
+            return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear", roles } };
         },
     });
 }

package/dist/auth-email-password/magic-link-mail.js

@@ -37,21 +37,24 @@ export async function dispatchMagicLinkMail(notify, spec, params) {
     // mailT already root-falls-back; appUrl must use the same negotiated tag
     // or language-in-path apps 404 on e.g. /de-AT/activate.
     const urlLocale = resolveMailLocale(locale);
+    // Template, expiry formatting and app-name fallback must share one locale,
+    // otherwise an English template shows e.g. French "3 heures".
+    const templateLocale = authMailTemplateLocale(spec.notificationType, locale);
     const { validFor, validUntil } = tokenMailExpiry({
         expiresAt: params.expiresAt,
         ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
         ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
-    }, locale);
+    }, templateLocale);
     await notify(spec.notificationType, {
         route: { email: params.email },
         data: {
-            appName: params.appName ?? spec.fallbackAppName ?? mailT(locale, "auth.mail.appNameDefault"),
+            appName: params.appName ?? spec.fallbackAppName ?? mailT(templateLocale, "auth.mail.appNameDefault"),
             actionUrl: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
             validFor,
             validUntil,
             ...(params.role !== undefined && { role: params.role }),
         },
-        locale: authMailTemplateLocale(spec.notificationType, locale),
+        locale: templateLocale,
         priority: "critical",
     });
 }

package/dist/auth-email-password/mail-i18n.d.ts

@@ -0,0 +1,3 @@
+export declare const AUTH_EMAIL_PASSWORD_MAIL_I18N: Readonly<Record<string, {
+    readonly en: string;
+}>>;

package/dist/auth-email-password/mail-i18n.js

@@ -0,0 +1,10 @@
+// @runtime client
+// Server-registered so the document designer names the seeded auth mails.
+export const AUTH_EMAIL_PASSWORD_MAIL_I18N = {
+    "auth-email-password:feature.label": { en: "Sign-in" },
+    "auth-email-password:notify.password-reset.label": { en: "Password reset" },
+    "auth-email-password:notify.account-unlock.label": { en: "Account unlock" },
+    "auth-email-password:notify.email-verification.label": { en: "Email verification" },
+    "auth-email-password:notify.signup-activation.label": { en: "Sign-up activation" },
+    "auth-email-password:notify.invite.label": { en: "Invitation" },
+};

package/dist/billing-foundation/consumer-protection/termination-record.js

@@ -166,7 +166,14 @@ export function createRecordContractTerminationHandler(options, consumerProtecti
                 effectiveAtIso,
                 providerCancel,
             };
-            await stream.appendOne({
+            // Re-fetch after the external call: a webhook appended meanwhile would
+            // otherwise fail the append on a stale expectedVersion although the
+            // provider already cancelled.
+            const streamAfterProviderCall = await ctx.fetchForWriting({
+                aggregateId: subscriptionAggregateId(tenantId),
+                aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+            });
+            await streamAfterProviderCall.appendOne({
                 type: CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
                 payload: recorded,
             });

package/dist/billing-foundation/i18n.js

@@ -1,4 +1,10 @@
 export const BILLING_FOUNDATION_I18N = {
+    "billing-foundation:feature.label": { en: "Billing" },
+    "billing-foundation:notify.contract-confirmation.label": { en: "Contract confirmation" },
+    "billing-foundation:notify.contract-termination-receipt.label": { en: "Termination receipt" },
+    "billing-foundation:notify.contract-termination-operator-notice.label": {
+        en: "Termination notice to operator",
+    },
     "screen:billing-plans.title": { en: "Billing" },
     "billing-foundation.plans.billingDisabled": {
         en: "Billing is not active yet. Your current plan stays in place.",

package/dist/billing-foundation/subscription-tier-sync.js

@@ -2,7 +2,7 @@
 // near-identical webhook-route.ts app copies in show-pony and publicstatus
 // (infra#446) — the only per-app variables were the TierName union/default,
 // so it is now a factory parameter.
-import { TierAssignmentSources, TierEngineHandlers, TierEngineQueries, tierAssignmentAggregateId, } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
+import { isTierAssignmentSource, TierAssignmentSources, TierEngineHandlers, TierEngineQueries, tierAssignmentAggregateId, } from "@cosmicdrift/kumiko-bundled-features/tier-engine";
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import { subscriptionAggregateId } from "./aggregate-id.js";
 import { SubscriptionFoundationQueries, SubscriptionStatuses } from "./constants.js";
@@ -32,7 +32,13 @@ function findTierAssignment(rows, tenantId) {
     if (!row || typeof row["id"] !== "string" || typeof row["version"] !== "number") {
         return undefined;
     }
-    return { id: row["id"], version: row["version"], tier: row["tier"], source: row["source"] };
+    const source = row["source"];
+    return {
+        id: row["id"],
+        version: row["version"],
+        tier: row["tier"],
+        source: isTierAssignmentSource(source) ? source : null,
+    };
 }
 export function createSubscriptionTierSync(deps) {
     async function syncTierFromSubscription(tenantId, routeDeps) {

package/dist/cap-counter/book-cap-usage.js

@@ -173,6 +173,11 @@ export async function markCapSoftWarned(ctx, options) {
     }
     return retryCounterWriteOnVersionConflict(() => attemptMark(writeDb));
 }
+// A release is written up to a reservation TTL after its increment; once the increment left the
+// window the release must not subtract from other increments still inside it.
+function isBefore(isoInstant, cutoff) {
+    return Temporal.Instant.compare(Temporal.Instant.from(isoInstant), cutoff) < 0;
+}
 async function sumRollingEventAmounts(db, tenantId, options, type) {
     const aggregateId = rollingCapAggregateId(tenantId, options.capName);
     const cutoff = Temporal.Now.instant().subtract({ hours: options.windowDays * 24 });
@@ -189,6 +194,9 @@ async function sumRollingEventAmounts(db, tenantId, options, type) {
         // unknown by drizzle's $type<Record<string,unknown>>); narrowing the
         // shape here mirrors enforceRollingCap's own read-side contract.
         const payload = row["payload"];
+        if (typeof payload.incrementedAt === "string" && isBefore(payload.incrementedAt, cutoff)) {
+            continue;
+        }
         if (typeof payload.amount === "number") {
             total += payload.amount;
         }

package/dist/cap-counter/cap-reservation.js

@@ -61,13 +61,13 @@ export async function reserveCalendarCap(ctx, options, outsideTransaction = true
         counterValue: valueBeforeBooking + options.amount,
     };
 }
-function rollingEvent(user, capName, amount, expectedVersion, type) {
+function rollingEvent(user, capName, amount, expectedVersion, type, extraPayload = {}) {
     return {
         aggregateId: rollingCapAggregateId(user.tenantId, capName),
         aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
         expectedVersion,
         type,
-        payload: { capName, amount },
+        payload: { capName, amount, ...extraPayload },
         metadata: { userId: user.id },
     };
 }
@@ -104,7 +104,11 @@ async function giveBackCalendar(txDb, user, row) {
 }
 async function giveBackRolling(txDb, user, row) {
     const version = await getStreamVersionInTenantDb(txDb, rollingCapAggregateId(user.tenantId, row.capName));
-    await appendEventInTenantDb(txDb, rollingEvent(user, row.capName, row.amount, version, ROLLING_RELEASED_EVENT_QN));
+    await appendEventInTenantDb(txDb, 
+    // The window filter must use the increment's time: a sweep releases up to a TTL later.
+    rollingEvent(user, row.capName, row.amount, version, ROLLING_RELEASED_EVENT_QN, {
+        incrementedAt: row.createdAt.toString(),
+    }));
     return NOTHING_TO_RELEASE;
 }
 async function giveBackReservation(txDb, user, id) {

package/dist/cap-counter/handlers/increment-rolling.write.d.ts

@@ -10,5 +10,6 @@ export declare const rollingIncrementedSchema: z.ZodObject<{
 export declare const rollingReleasedSchema: z.ZodObject<{
     capName: z.ZodString;
     amount: z.ZodNumber;
+    incrementedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const incrementRollingCapHandler: WriteHandlerDef;

package/dist/cap-counter/handlers/increment-rolling.write.js

@@ -34,6 +34,8 @@ export const rollingIncrementedSchema = incrementRollingSchema;
 /** Payload of the event that gives a reserved rolling amount back. */
 export const rollingReleasedSchema = incrementRollingSchema.extend({
     amount: z.number().int().positive(),
+    /** When the released increment was booked; absent on events written before it was recorded. */
+    incrementedAt: z.string().optional(),
 });
 // Rolling-Increment-Handler — append-only. Race-frei: zwei parallele
 // Increments für (tenant, cap) hängen sich am selben aggregate-stream

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -116,7 +116,9 @@ export function createTenantCapsListQuery(caps, listCaps) {
                 });
             }
             const db = ctx.systemDb.acknowledgeCrossTenant("cap-overview:tenant-caps:list — SystemAdmin platform-wide tenant overview");
-            const tenants = await decryptTenantNames(await selectMany(db, tenantTable, {}), "cap-overview:tenant-caps:list");
+            const tenants = await decryptTenantNames(
+            // Destroyed tenants decrypt to the erased sentinel, which a picker or list would show verbatim.
+            await selectMany(db, tenantTable, { destroyedAt: null }), "cap-overview:tenant-caps:list");
             const assignments = await selectMany(db, tierAssignmentTable, {});
             const subscriptions = await selectMany(db, subscriptionsProjectionTable, {});
             const assignmentByTenant = new Map(assignments.map((row) => [row.tenantId, row]));

package/dist/cap-overview/handlers/tenant-options.query.js

@@ -15,7 +15,9 @@ export const tenantOptionsQuery = defineQueryHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("cap-overview:tenant-options — SystemAdmin dashboard tenant-filter options");
-        const tenants = await decryptTenantNames(await selectMany(db, tenantTable, {}), "cap-overview:tenant-options");
+        const tenants = await decryptTenantNames(
+        // Destroyed tenants decrypt to the erased sentinel, which the picker would show verbatim.
+        await selectMany(db, tenantTable, { destroyedAt: null }), "cap-overview:tenant-options");
         const sorted = [...tenants].sort((a, b) => a.name.localeCompare(b.name));
         return { rows: sorted.map((tenant) => ({ value: tenant.id, label: tenant.name })) };
     },

package/dist/channel-discord/discord-channel.js

@@ -1,7 +1,8 @@
 import { chatMessageText, createChatWebhookChannel, truncateChars, } from "../delivery/index.js";
+const DISCORD_WEBHOOK_PREFIX = "channel-discord:webhooks.";
 export const DISCORD_SECRET_KEYS = {
-    webhookPrefix: "channel-discord:webhooks.",
-    webhookKeyFor: (connection) => `channel-discord:webhooks.${connection}`,
+    webhookPrefix: DISCORD_WEBHOOK_PREFIX,
+    webhookKeyFor: (connection) => `${DISCORD_WEBHOOK_PREFIX}${connection}`,
 };
 export const DISCORD_DEFAULT_ALLOWED_HOSTS = ["discord.com", "discordapp.com"];
 export const DISCORD_WEBHOOK_PATH_PREFIX = "/api/webhooks/";

package/dist/channel-email/email-channel.js

@@ -1,7 +1,8 @@
 import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import * as z from "zod";
 import { DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE, DELIVERY_UNSUBSCRIBE_PATH, EMAIL_CHANNEL_NAME, fileAttachmentRefSchema, MAX_EMAIL_ATTACHMENTS, renderedPdfAttachmentRefSchema, } from "../delivery/index.js";
-import { decryptStoredPii } from "../shared/index.js";
+import { decryptStoredPii, extensionForResourceContentType } from "../shared/index.js";
 import { guardEmailMessage } from "./pii-guard.js";
 // Envelope (From / Reply-To / threading headers) rides on the channel data —
 // the notification's email template echoes it out of the notify() call, since
@@ -22,7 +23,8 @@ const UNSUBSCRIBE_HEADER_NAMES = new Set([
     "list-unsubscribe",
     "list-unsubscribe-post",
 ]);
-// Only the framework's own unsubscribe route can honor a one-click POST.
+// Only the framework's own unsubscribe route can honor a one-click POST; an app's
+// own unsubscribe page still gets the plain List-Unsubscribe link (RFC 2369).
 function listUnsubscribeHeaders(data) {
     const rawUrl = data?.["unsubscribeUrl"];
     if (typeof rawUrl !== "string")
@@ -36,8 +38,9 @@ function listUnsubscribeHeaders(data) {
     }
     if (url.protocol !== "https:" && url.protocol !== "http:")
         return undefined;
-    if (url.pathname !== DELIVERY_UNSUBSCRIBE_PATH)
-        return undefined;
+    if (url.pathname !== DELIVERY_UNSUBSCRIBE_PATH) {
+        return { "List-Unsubscribe": `<${url.toString()}>` };
+    }
     return {
         "List-Unsubscribe": `<${url.toString()}>`,
         "List-Unsubscribe-Post": DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE,
@@ -81,15 +84,13 @@ export function fileAttachmentsFrom(data, messageLocale) {
         ? { ...ref, locale: messageLocale }
         : ref);
 }
-const INLINE_EXTENSION_BY_CONTENT_TYPE = {
-    "image/png": "png",
-    "image/jpeg": "jpg",
-    "image/gif": "gif",
-    "image/webp": "webp",
-};
+function inlineFileName(cid, contentType) {
+    const extension = extensionForResourceContentType(contentType);
+    return extension === undefined ? cid : `${cid}.${extension}`;
+}
 async function resolveAttachments(sources, ctx) {
     if (sources.length === 0)
-        return [];
+        return { kind: "resolved", attachments: [] };
     if (ctx.readAttachment === undefined) {
         throw new Error("email channel: the message has attachments but the channel context cannot read files");
     }
@@ -113,16 +114,12 @@ async function resolveAttachments(sources, ctx) {
             // A missing inline image only degrades the look; a missing file is content the recipient expects.
             if (ref.kind === "inline")
                 continue;
-            throw new Error(`email channel: attachment file ${ref.fileRefId} was not found`);
+            return { kind: "missing-file", fileRefId: ref.fileRefId };
         }
-        const fileName = ref.kind === "file"
-            ? ref.fileName
-            : INLINE_EXTENSION_BY_CONTENT_TYPE[found.contentType]
-                ? `${ref.cid}.${INLINE_EXTENSION_BY_CONTENT_TYPE[found.contentType]}`
-                : ref.cid;
+        const fileName = ref.kind === "file" ? ref.fileName : inlineFileName(ref.cid, found.contentType);
         resolved.push({ ...ref, fileName, content: found.content, contentType: found.contentType });
     }
-    return resolved;
+    return { kind: "resolved", attachments: resolved };
 }
 export function createEmailChannel(options) {
     const { transport, resolveEmail } = options;
@@ -175,10 +172,18 @@ export function createEmailChannel(options) {
                 ...(replyTo && { replyTo }),
                 ...emailEnvelopeFrom(message.data),
             };
-            const resolvedAttachments = await resolveAttachments([
+            const resolution = await resolveAttachments([
                 ...(attachments ?? []).map((ref) => ({ ref, origin: "template" })),
                 ...fileAttachmentsFrom(message.data, message.locale).map((ref) => ({ ref, origin: "message" })),
             ], ctx);
+            if (resolution.kind === "missing-file") {
+                // A missing file is permanent, a retry cannot bring it back.
+                createFallbackLogger("delivery").warn("mail attachment file not found, send failed", {
+                    fileRefId: resolution.fileRefId,
+                });
+                return { status: "failed", error: "send_failed", address };
+            }
+            const resolvedAttachments = resolution.attachments;
             await transport.send(guardEmailMessage({
                 to: address,
                 subject,

package/dist/channel-email/smtp-transport.js

@@ -21,11 +21,16 @@ function isControlCharacter(char) {
     const code = char.charCodeAt(0);
     return code <= 0x1f || code === 0x7f;
 }
+// Mail clients often show only the display name: an embedded address ("<", ">", "@") would
+// pass for a foreign sender on the platform's own SPF/DKIM-signed domain.
+function isUnsafeDisplayNameCharacter(char) {
+    return isControlCharacter(char) || char === "<" || char === ">" || char === "@";
+}
 // Control characters in a display name would let a caller inject headers.
 function sanitizedDisplayName(name) {
     const cleaned = name
         ?.split("")
-        .map((char) => (isControlCharacter(char) ? " " : char))
+        .map((char) => (isUnsafeDisplayNameCharacter(char) ? " " : char))
         .join("")
         .trim();
     return cleaned === undefined || cleaned === "" ? undefined : cleaned;

package/dist/channel-slack/slack-channel.js

@@ -1,7 +1,8 @@
 import { chatMessageText, createChatWebhookChannel, } from "../delivery/index.js";
+const SLACK_WEBHOOK_PREFIX = "channel-slack:webhooks.";
 export const SLACK_SECRET_KEYS = {
-    webhookPrefix: "channel-slack:webhooks.",
-    webhookKeyFor: (connection) => `channel-slack:webhooks.${connection}`,
+    webhookPrefix: SLACK_WEBHOOK_PREFIX,
+    webhookKeyFor: (connection) => `${SLACK_WEBHOOK_PREFIX}${connection}`,
 };
 export const SLACK_DEFAULT_ALLOWED_HOSTS = ["hooks.slack.com"];
 // Slack mrkdwn treats & < > as control characters (links, @-mentions via <!channel>).

package/dist/channel-teams/teams-channel.js

@@ -1,7 +1,8 @@
 import { createChatWebhookChannel, } from "../delivery/index.js";
+const TEAMS_WEBHOOK_PREFIX = "channel-teams:webhooks.";
 export const TEAMS_SECRET_KEYS = {
-    webhookPrefix: "channel-teams:webhooks.",
-    webhookKeyFor: (connection) => `channel-teams:webhooks.${connection}`,
+    webhookPrefix: TEAMS_WEBHOOK_PREFIX,
+    webhookKeyFor: (connection) => `${TEAMS_WEBHOOK_PREFIX}${connection}`,
 };
 export const TEAMS_DEFAULT_ALLOWED_HOSTS = [
     ".webhook.office.com",

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -2,7 +2,7 @@ import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { fetchOne, runInSavepointIfSupported, runnerCanBeginTransaction, transaction, } from "@cosmicdrift/kumiko-framework/bun-db";
 import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
-import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, } from "@cosmicdrift/kumiko-framework/db";
+import { nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, subjectRowExistsInTenant, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
 import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { appendDomainEventCore, assertIrreversibleOperationAllowed, } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -254,7 +254,7 @@ async function closeUserLoginDoor(ctx, userId, outsideRunner, handlerTxRunner) {
     if (!userRow)
         return;
     const closeDoor = async (runner) => {
-        await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted });
+        await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted }, { writePurpose: WritePurposes.erasure });
         if (ctx.registry.features.has("personal-access-tokens")) {
             await revokeAllPatTokensForUser(runner, userId);
         }

package/dist/custom-fields/db/queries/retention.d.ts

@@ -1,3 +1,3 @@
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner } from "@cosmicdrift/kumiko-framework/db";
 export declare function selectHostRowsWithCustomFields(db: DbRunner, tableName: string, tenantId: string): Promise<readonly unknown[]>;
 export declare function applyRetentionRemovals(db: DbRunner, tableName: string, deleteKeys: readonly string[], anonymizeKeys: readonly string[], rowId: string): Promise<void>;

package/dist/custom-fields/db/queries/retention.js

@@ -1,4 +1,5 @@
 import { asRawClient, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { toPostgresArrayLiteral } from "@cosmicdrift/kumiko-framework/db";
 export async function selectHostRowsWithCustomFields(db, tableName, tenantId) {
     const quoted = `"${tableName.replace(/"/g, '""')}"`;
     const rowsResult = await unsafeReadRetrying(db, `SELECT id, modified_at, custom_fields FROM ${quoted} WHERE tenant_id = $1 AND custom_fields IS NOT NULL`, [tenantId]);
@@ -19,5 +20,5 @@ export async function applyRetentionRemovals(db, tableName, deleteKeys, anonymiz
             )
        ELSE custom_fields
      END
-     WHERE id = $3`, [deleteKeys, anonymizeKeys, rowId]);
+     WHERE id = $3`, [toPostgresArrayLiteral(deleteKeys), toPostgresArrayLiteral(anonymizeKeys), rowId]);
 }