@cosmicdrift/kumiko-bundled-features 0.371.1 → 0.373.0

package/dist/auth-mfa/db/queries.d.ts

@@ -1,5 +1,6 @@
 import { type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 export type UserMfaRow = {
     readonly id: string;
     readonly version: number;
@@ -8,7 +9,7 @@ export type UserMfaRow = {
     readonly recoveryCodes: {
         readonly hashes: readonly string[];
     };
-    readonly enabledAt: string;
-    readonly lastUsedAt: string | null;
+    readonly enabledAt: Temporal.Instant;
+    readonly lastUsedAt: Temporal.Instant | null;
 };
 export declare function findUserMfaRow(db: TenantDb, user: SessionUser): Promise<UserMfaRow | null>;

package/dist/auth-mfa/db/queries.js

@@ -22,9 +22,6 @@ export async function findUserMfaRow(db, user) {
     const detail = await executor.detail({ id: idLookup.id }, user, db);
     if (!detail)
         return null;
-    // @cast-boundary engine-payload — executor.detail returns a decrypted,
-    // untyped Record; the userMfa entity's own field shape narrows it.
-    const row = detail;
-    const recoveryCodes = parseJsonOrThrow(row.recoveryCodes, "user-mfa.recoveryCodes");
-    return { ...row, recoveryCodes };
+    const recoveryCodes = parseJsonOrThrow(detail.recoveryCodes, "user-mfa.recoveryCodes");
+    return { ...detail, recoveryCodes };
 }

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -1,5 +1,5 @@
 export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    userId: {
+    readonly userId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -22,7 +22,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    totpSecret: {
+    readonly totpSecret: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -45,7 +45,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    recoveryCodes: {
+    readonly recoveryCodes: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -68,7 +68,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    enabledAt: {
+    readonly enabledAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -83,7 +83,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    lastUsedAt: {
+    readonly lastUsedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -100,7 +100,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
     };
 }, "tenant">;
 export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    userId: {
+    readonly userId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -123,7 +123,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    totpSecret: {
+    readonly totpSecret: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -146,7 +146,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    recoveryCodes: {
+    readonly recoveryCodes: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -169,7 +169,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    enabledAt: {
+    readonly enabledAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -184,7 +184,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    lastUsedAt: {
+    readonly lastUsedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;

package/dist/billing-foundation/entities.d.ts

@@ -1,5 +1,5 @@
 export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    providerName: {
+    readonly providerName: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -22,7 +22,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    providerCustomerId: {
+    readonly providerCustomerId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -45,7 +45,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    providerSubscriptionId: {
+    readonly providerSubscriptionId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -68,7 +68,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    status: {
+    readonly status: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -91,7 +91,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    tier: {
+    readonly tier: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -114,7 +114,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    currentPeriodEnd: {
+    readonly currentPeriodEnd: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -129,7 +129,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    cancelAt: {
+    readonly cancelAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -147,7 +147,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
 }, "tenant">;
 export declare const SUBSCRIPTION_PII_FIELDS: readonly string[];
 export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    providerName: {
+    readonly providerName: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -170,7 +170,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    providerCustomerId: {
+    readonly providerCustomerId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -193,7 +193,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    priceId: {
+    readonly priceId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;

package/dist/billing-foundation/projection.d.ts

@@ -1,5 +1,5 @@
 export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    providerName: {
+    readonly providerName: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -22,7 +22,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    providerCustomerId: {
+    readonly providerCustomerId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -45,7 +45,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    providerSubscriptionId: {
+    readonly providerSubscriptionId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -68,7 +68,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    status: {
+    readonly status: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -91,7 +91,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    tier: {
+    readonly tier: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -114,7 +114,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    currentPeriodEnd: {
+    readonly currentPeriodEnd: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -129,7 +129,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    cancelAt: {
+    readonly cancelAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -146,7 +146,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
     };
 }, "tenant">>;
 export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    providerName: {
+    readonly providerName: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -169,7 +169,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    providerCustomerId: {
+    readonly providerCustomerId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -192,7 +192,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    priceId: {
+    readonly priceId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;

package/dist/cap-counter/entity.d.ts

@@ -1,5 +1,5 @@
 export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    capName: {
+    readonly capName: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -22,7 +22,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    value: {
+    readonly value: {
         readonly type: "bigInt";
         readonly description?: string;
         readonly required?: boolean;
@@ -34,7 +34,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    periodStart: {
+    readonly periodStart: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;
@@ -49,7 +49,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    lastSoftWarnedAt: {
+    readonly lastSoftWarnedAt: {
         readonly type: "timestamp";
         readonly description?: string;
         readonly required?: boolean;

package/dist/cap-overview/web/cap-cards-panel.js

@@ -1,4 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-headless";
 import { usePrimitives, useQuery, useTranslation } from "@cosmicdrift/kumiko-renderer";
 import { EmptyState, StatCard, StatusBadge, } from "@cosmicdrift/kumiko-renderer-web";
 import { Database, FileText, Gauge, Hash, Mail, Users } from "lucide-react";
@@ -56,7 +57,7 @@ export function CapCardsPanel({ filterParams }) {
                 // wraps any defined child in a spacing div, so pass undefined then.
                 const body = !isMeasured(cap) || cap.limit !== null ? (_jsxs("div", { className: "flex flex-col gap-2", children: [cap.percent !== null && (_jsx("div", { className: "flex items-center justify-between gap-2", children: _jsx(StatusBadge, { tone: TONE_TO_STATUS[cap.tone], children: `${cap.percent}%` }) })), _jsx(CapUsageBar, { usage: cap, showLabel: false })] })) : undefined;
                 return (_jsx(StatCard, { icon: Icon !== undefined ? _jsx(Icon, { className: "size-4" }) : undefined, label: t(cap.label), value: !isMeasured(cap)
-                        ? "—"
+                        ? EMPTY_VALUE_PLACEHOLDER
                         : cap.limit === null
                             ? String(cap.used)
                             : `${cap.used} / ${cap.limit}`, ...(cap.accentColor !== undefined && { accentColor: cap.accentColor }), testId: "cap-card", children: body }, cap.id));

package/dist/compliance-profiles/schema/profile-selection.d.ts

@@ -1,5 +1,5 @@
 export declare const tenantComplianceProfileEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    profileKey: {
+    readonly profileKey: {
         readonly type: "select";
         readonly description?: string;
         readonly options: readonly ["eu-dsgvo", "swiss-dsg", "de-hr-dsgvo-hgb", "minimal-no-region"];
@@ -23,7 +23,7 @@ export declare const tenantComplianceProfileEntity: import("@cosmicdrift/kumiko-
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    override: {
+    readonly override: {
         readonly type: "longText";
         readonly description?: string;
         readonly maxLength?: number;
@@ -41,7 +41,7 @@ export declare const tenantComplianceProfileEntity: import("@cosmicdrift/kumiko-
     };
 }, "tenant">;
 export declare const tenantComplianceProfileTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    profileKey: {
+    readonly profileKey: {
         readonly type: "select";
         readonly description?: string;
         readonly options: readonly ["eu-dsgvo", "swiss-dsg", "de-hr-dsgvo-hgb", "minimal-no-region"];
@@ -65,7 +65,7 @@ export declare const tenantComplianceProfileTable: import("@cosmicdrift/kumiko-f
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    override: {
+    readonly override: {
         readonly type: "longText";
         readonly description?: string;
         readonly maxLength?: number;

package/dist/config/table.d.ts

@@ -1,5 +1,5 @@
 export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    key: {
+    readonly key: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -22,7 +22,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    value: {
+    readonly value: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -45,7 +45,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    userId: {
+    readonly userId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -70,7 +70,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
     };
 }, "tenant">;
 export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db").EntityTable<import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    key: {
+    readonly key: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -93,7 +93,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    value: {
+    readonly value: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -116,7 +116,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: false;
     };
-    userId: {
+    readonly userId: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;

package/dist/config/web/index.d.ts

@@ -1,2 +1,3 @@
+export { ConfigQueries } from "../constants.ts";
 export { type ConfigClientFeature, type ConfigClientOptions, configClient, } from "./client-plugin.ts";
 export { defaultTranslations } from "./i18n.ts";

package/dist/config/web/index.js

@@ -1,3 +1,4 @@
 // @runtime client
+export { ConfigQueries } from "../constants.js";
 export { configClient, } from "./client-plugin.js";
 export { defaultTranslations } from "./i18n.js";

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -2,7 +2,7 @@ import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
 import { computeBlindIndex, configuredBlindIndexKey, configuredPiiSubjectKms, subjectIdSchema, subjectIdToKey, } from "@cosmicdrift/kumiko-framework/crypto";
 import { fetchOne, nullBlindIndexesForSubject, recordEventsOwnedExclusivelyByTenant, recordRowExistsInTenant, recordRowOwningTenantId, runInSavepointIfSupported, runnerCanBeginTransaction, subjectRowExistsInTenant, transaction, WritePurposes, } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
+import { defineWriteHandler, parseTenantId, } from "@cosmicdrift/kumiko-framework/engine";
 import { AccessDeniedError, InternalError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { appendDomainEventCore, assertIrreversibleOperationAllowed, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
@@ -11,9 +11,11 @@ import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
 import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
+import { purgeFilesReachingSubject } from "../../shared/index.js";
 import { USER_STATUS, userTable } from "../../user/index.js";
 import { denyIfTargetOutsideAdminTenant, isSystemAdminActor, updateUserLifecycle, } from "../../user-data-rights/index.js";
 import { CRYPTO_SHREDDING_AGGREGATE_TYPE, CRYPTO_SHREDDING_FEATURE_NAME, RECORD_ENTITY_NOT_REGISTERED, SUBJECT_FORGET_DENIED_EVENT_NAME, SUBJECT_FORGOTTEN_EVENT_NAME, TARGET_RECORD_NOT_ADMIN_TENANT, TARGET_RECORD_RETENTION_BLOCK_DELETE, TARGET_TENANT_NOT_ADMIN_TENANT, } from "../constants.js";
+import { resolveFileBytesDeleter } from "../resolve-file-bytes-deleter.js";
 export { subjectIdSchema };
 export const forgetSubjectSchema = z.object({
     subject: subjectIdSchema,
@@ -142,6 +144,13 @@ getRunner) {
     });
     return effective.policy?.strategy === "blockDelete" ? deny() : undefined;
 }
+// The tenant that owns a record subject's row; the file purge is scoped to it.
+async function owningTenantOfRecordSubject(runner, features, raw) {
+    if (raw.kind !== "record")
+        return undefined;
+    const owner = await recordRowOwningTenantId(runner, features, raw.entity, raw.id);
+    return parseTenantId(owner) ?? undefined;
+}
 // AccessDeniedError.code is the generic "access_denied" for every branch;
 // the specific branch lives in details.reason.
 function denialReasonOf(failure) {
@@ -212,33 +221,49 @@ function sweepErrorLabel(err) {
 }
 // The key is already erased when this runs, so a failing sweep must not skip the
 // audit event: the failure is returned as a label for the event instead of thrown.
-// The savepoint keeps a database error from aborting the handler transaction.
-async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner, audit) {
-    try {
-        await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
-            // Blind-index sweep (#818): nulls bidx columns now so the deterministic
-            // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
-            await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
-            // Derived search index still holds plaintext (#1610) — purge next to the
-            // blind-index sweep. No adapter → no-op (apps without search).
-            if (ctx.searchAdapter) {
-                await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
-            }
-            // Note bodies are keyed per note, so the subject's own key never reaches them.
-            if (ctx.registry.features.has("notes-history")) {
-                await eraseNoteBodiesReachingSubject({
-                    db: crossTenantSubjectRunner,
-                    subject,
-                    erasedBy: audit.erasedBy,
-                    requestId: audit.requestId,
-                });
-            }
-        });
-        return undefined;
-    }
-    catch (err) {
-        return sweepErrorLabel(err);
-    }
+// Each step runs in its own savepoint: a database error must not abort the handler
+// transaction, and one failing step must not skip or roll back the others.
+async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner, audit, rawSubject) {
+    const recordTenantId = await owningTenantOfRecordSubject(crossTenantRunner, ctx.registry.features, rawSubject);
+    const failureLabels = [];
+    const runStep = async (step) => {
+        try {
+            await runInSavepointIfSupported(crossTenantRunner, step);
+        }
+        catch (err) {
+            failureLabels.push(sweepErrorLabel(err));
+        }
+    };
+    await runStep(async (crossTenantSubjectRunner) => {
+        // Blind-index sweep (#818): nulls bidx columns now so the deterministic
+        // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
+        await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
+        // Derived search index still holds plaintext (#1610) — purge next to the
+        // blind-index sweep. No adapter → no-op (apps without search).
+        if (ctx.searchAdapter) {
+            await purgeSearchDocumentsForSubject(crossTenantSubjectRunner, ctx.registry.features, ctx.searchAdapter, subjectKey, subject);
+        }
+        // Note bodies are keyed per note, so the subject's own key never reaches them.
+        if (ctx.registry.features.has("notes-history")) {
+            await eraseNoteBodiesReachingSubject({
+                db: crossTenantSubjectRunner,
+                subject,
+                erasedBy: audit.erasedBy,
+                requestId: audit.requestId,
+            });
+        }
+    });
+    // File columns hold only the fileRef id, so the key erase never reaches the bytes.
+    await runStep((crossTenantSubjectRunner) => purgeFilesReachingSubject({
+        registry: ctx.registry,
+        db: crossTenantSubjectRunner,
+        subject,
+        subjectKey,
+        ...(recordTenantId !== undefined && { recordTenantId }),
+        resolveDeleteBytes: resolveFileBytesDeleter(ctx),
+        missingStorage: { mode: "fail" },
+    }));
+    return failureLabels[0];
 }
 // Email subscribers and other non-user entities use user-style subject keys
 // without a read_users row — the key erase is the GDPR-relevant part, so no row
@@ -319,7 +344,7 @@ export const forgetSubjectWrite = defineWriteHandler({
         grants: ["unsafeRaw"],
         reason: "the denial and SUBJECT_FORGOTTEN audit appends name the caller's own tenant stream on the outside-transaction db; " +
             "the tenant-scope and retention checks run against the subject's tenant, not necessarily the caller's; " +
-            "the blind-index sweep and search purge address the subject across tenants; the user " +
+            "the blind-index sweep, search purge and file purge address the subject across tenants; the user " +
             "lifecycle update and PAT revoke run on the SYSTEM user stream.",
     },
     handler: async (event, ctx) => {
@@ -382,7 +407,7 @@ export const forgetSubjectWrite = defineWriteHandler({
         if (raw.kind === "user" && ctx.registry.features.has("user")) {
             await closeUserLoginDoor(ctx, raw.userId, ctx.dbOutsideTransaction?.unsafeRaw(), ctx.db.unsafeRaw());
         }
-        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id });
+        const cleanupError = await sweepDerivedSubjectData(ctx, subject, subjectKey, ctx.db.unsafeRaw(), { requestId, erasedBy: event.user.id }, raw);
         await appendSubjectForgotten(ctx, event, subjectAggregateId(raw), {
             subjectKey,
             reason: event.payload.reason,

package/dist/crypto-shredding/resolve-file-bytes-deleter.d.ts

@@ -0,0 +1,3 @@
+import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { DeleteFileBytes } from "../shared/index.ts";
+export declare function resolveFileBytesDeleter(ctx: HandlerContext): (tenantId: TenantId) => Promise<DeleteFileBytes | undefined>;

package/dist/crypto-shredding/resolve-file-bytes-deleter.js

@@ -0,0 +1,24 @@
+import { deleteFileRefBytes } from "@cosmicdrift/kumiko-framework/derivatives";
+import { createFileContext } from "@cosmicdrift/kumiko-framework/files";
+const ERROR_CONTEXT = "crypto-shredding:forget-subject";
+// The upload resolver, not ctx.files: ctx.files is bound to the acting user's tenant, while a
+// subject's rows can live in any tenant. Resolved eagerly so a missing provider surfaces as
+// missing_file_storage instead of a failed delete.
+export function resolveFileBytesDeleter(ctx) {
+    return async (tenantId) => {
+        const resolver = ctx._fileProviderResolver;
+        if (resolver === undefined) {
+            const own = tenantId === ctx.user.tenantId ? ctx.files : undefined;
+            return own && ((key) => deleteFileRefBytes(own, { storageKey: key }, ERROR_CONTEXT));
+        }
+        try {
+            const provider = await resolver(tenantId);
+            const files = createFileContext(() => Promise.resolve(provider), tenantId);
+            return (key) => deleteFileRefBytes(files, { storageKey: key }, ERROR_CONTEXT);
+        }
+        catch {
+            // skip: no provider resolvable for this tenant; surfaces as missing_file_storage when files exist
+            return undefined;
+        }
+    };
+}

package/dist/custom-fields/entity.d.ts

@@ -1,5 +1,5 @@
 export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fields").EntityDefinition<{
-    entityName: {
+    readonly entityName: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -22,7 +22,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    fieldKey: {
+    readonly fieldKey: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -45,7 +45,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    type: {
+    readonly type: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;
@@ -68,13 +68,15 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    required: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
+    readonly required: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
         required: true;
+        default: boolean;
     };
-    searchable: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
+    readonly searchable: import("@cosmicdrift/kumiko-types/fields").BooleanFieldDef & {
         required: true;
+        default: boolean;
     };
-    displayOrder: {
+    readonly displayOrder: {
         readonly type: "number";
         readonly description?: string;
         readonly required?: boolean;
@@ -93,7 +95,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
     } & import("@cosmicdrift/kumiko-types/fields").ResolvedPiiFlags & {
         required: true;
     };
-    serializedField: {
+    readonly serializedField: {
         readonly type: "text";
         readonly description?: string;
         readonly maxLength?: number;