@cosmicdrift/kumiko-bundled-features 0.382.0 → 0.383.1

package/dist/audit/run-escape-hatch-retention.d.ts

@@ -7,6 +7,7 @@ export declare function runEscapeHatchRetention(args: {
     readonly configResolver: ConfigResolver | undefined;
     readonly userId: string;
     readonly batchSize?: number;
+    readonly scanPageSize?: number;
 }): Promise<{
     readonly deletedCount: number;
 }>;

package/dist/audit/run-escape-hatch-retention.js

@@ -32,6 +32,7 @@ async function resolveExplicitRetentionDays(args) {
 const COMPLIANCE_PROFILE_ENTITY = "tenant-compliance-profile";
 const PRUNE_CHUNK_SIZE = 1000;
 const PRUNE_BATCH_SIZE = 5000;
+const SCAN_PAGE_SIZE = 2000;
 // Overrides may only lengthen retention: the earlier cutoff (same `now`) is the longer period.
 function earlierInstant(a, b) {
     return Temporal.Instant.compare(a, b) <= 0 ? a : b;
@@ -49,14 +50,32 @@ function targetTenantOf(payload) {
     const parsed = escapeHatchUsedSchema.safeParse(payload);
     return parsed.success ? parseTenantId(parsed.data.targetTenantId) : null;
 }
-async function storingTenantIds(db) {
-    const groups = await aggregateWhere(db, eventsTable, { measure: { fn: "count" }, groupBy: [{ field: "tenantId" }] }, { aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE });
+// No tenant's cutoff can be later than the shortest built-in retention: overrides only lengthen it.
+function latestPossibleCutoff(now) {
+    const cutoffs = Object.values(COMPLIANCE_PROFILES).map((profile) => subtractRetentionSpec(now, profile.auditLog.retention));
+    return cutoffs.reduce((latest, cutoff) => Temporal.Instant.compare(cutoff, latest) > 0 ? cutoff : latest);
+}
+async function storingTenantIds(db, expirableBefore) {
+    const groups = await aggregateWhere(db, eventsTable, { measure: { fn: "count" }, groupBy: [{ field: "tenantId" }] }, { aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE, createdAt: { lt: expirableBefore } });
     return groups.flatMap((group) => {
         const tenantId = parseTenantId(group.keys[0]);
         return tenantId ? [tenantId] : [];
     });
 }
-async function pruneByTenantProfiles(db, operatorRetentionDays) {
+async function pruneAggregates(db, aggregateIds) {
+    const now = getTemporal().Now.instant();
+    let deletedCount = 0;
+    for (let i = 0; i < aggregateIds.length; i += PRUNE_CHUNK_SIZE) {
+        const result = await pruneEvents(db, {
+            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+            aggregateIds: aggregateIds.slice(i, i + PRUNE_CHUNK_SIZE),
+            olderThan: now,
+        });
+        deletedCount += result.deletedCount;
+    }
+    return deletedCount;
+}
+async function pruneByTenantProfiles(db, operatorRetentionDays, scanPageSize) {
     const now = getTemporal().Now.instant();
     const operatorFloor = operatorRetentionDays === undefined
         ? undefined
@@ -72,33 +91,39 @@ async function pruneByTenantProfiles(db, operatorRetentionDays) {
     };
     // The effective cutoff is never later than the storing tenant's, so only rows older than
     // that one can expire; everything younger stays in the database.
-    const expiredAggregateIds = [];
-    for (const storingTenantId of await storingTenantIds(db)) {
+    let deletedCount = 0;
+    for (const storingTenantId of await storingTenantIds(db, latestPossibleCutoff(now))) {
         const storeCutoff = await cutoffOf(storingTenantId);
-        const candidates = await selectMany(db, eventsTable, {
-            aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE,
-            tenantId: storingTenantId,
-            createdAt: { lt: storeCutoff },
-        });
-        for (const row of candidates) {
-            const targetTenantId = targetTenantOf(row.payload);
-            const cutoff = targetTenantId
-                ? earlierInstant(storeCutoff, await cutoffOf(targetTenantId))
-                : storeCutoff;
-            if (Temporal.Instant.compare(row.createdAt, cutoff) < 0) {
-                expiredAggregateIds.push(row.aggregateId);
+        // Keyset on id: pruning a page only removes rows at or below the cursor.
+        let afterId;
+        for (;;) {
+            const page = await selectMany(db, eventsTable, {
+                aggregateType: ESCAPE_HATCH_USE_AGGREGATE_TYPE,
+                tenantId: storingTenantId,
+                createdAt: { lt: storeCutoff },
+                ...(afterId !== undefined && { id: { gt: afterId } }),
+            }, {
+                fields: ["id", "aggregateId", "createdAt", "payload"],
+                orderBy: { col: "id", direction: "asc" },
+                limit: scanPageSize,
+            });
+            const expiredAggregateIds = [];
+            for (const row of page) {
+                const targetTenantId = targetTenantOf(row.payload);
+                const cutoff = targetTenantId
+                    ? earlierInstant(storeCutoff, await cutoffOf(targetTenantId))
+                    : storeCutoff;
+                if (Temporal.Instant.compare(row.createdAt, cutoff) < 0) {
+                    expiredAggregateIds.push(row.aggregateId);
+                }
             }
+            deletedCount += await pruneAggregates(db, expiredAggregateIds);
+            const lastRow = page[page.length - 1];
+            if (lastRow === undefined || page.length < scanPageSize)
+                break;
+            afterId = lastRow.id;
         }
     }
-    let deletedCount = 0;
-    for (let i = 0; i < expiredAggregateIds.length; i += PRUNE_CHUNK_SIZE) {
-        const result = await pruneEvents(db, {
-            aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
-            aggregateIds: expiredAggregateIds.slice(i, i + PRUNE_CHUNK_SIZE),
-            olderThan: now,
-        });
-        deletedCount += result.deletedCount;
-    }
     return deletedCount;
 }
 async function pruneInBatches(db, olderThanDays, batchSize = PRUNE_BATCH_SIZE) {
@@ -127,5 +152,7 @@ export async function runEscapeHatchRetention(args) {
         return { deletedCount: await pruneInBatches(db, olderThanDays, args.batchSize) };
     }
     const operatorRetentionDays = await resolveExplicitRetentionDays({ ...args, db });
-    return { deletedCount: await pruneByTenantProfiles(db, operatorRetentionDays) };
+    return {
+        deletedCount: await pruneByTenantProfiles(db, operatorRetentionDays, args.scanPageSize ?? SCAN_PAGE_SIZE),
+    };
 }

package/dist/auth-mfa/schema/user-mfa.d.ts

@@ -13,7 +13,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const userMfaEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -114,7 +114,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -137,7 +137,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -160,7 +160,7 @@ export declare const userMfaTable: import("@cosmicdrift/kumiko-framework/db").En
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/billing-foundation/entities.d.ts

@@ -13,7 +13,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -82,7 +82,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -105,7 +105,7 @@ export declare const subscriptionEntity: import("@cosmicdrift/kumiko-types/field
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -161,7 +161,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -184,7 +184,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -207,7 +207,7 @@ export declare const paymentEntity: import("@cosmicdrift/kumiko-types/fields").E
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/billing-foundation/projection.d.ts

@@ -13,7 +13,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -82,7 +82,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -105,7 +105,7 @@ export declare const subscriptionsProjectionTable: import("@cosmicdrift/kumiko-f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -160,7 +160,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -183,7 +183,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -206,7 +206,7 @@ export declare const paymentsProjectionTable: import("@cosmicdrift/kumiko-framew
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/cap-counter/entity.d.ts

@@ -13,7 +13,7 @@ export declare const capCounterEntity: import("@cosmicdrift/kumiko-types/fields"
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/cap-overview/handlers/tenant-caps-list.query.js

@@ -20,6 +20,12 @@ function billingLabel(subscription, tierSource) {
 }
 const FILTER_OP = z.enum(["eq", "ne", "lt", "gt", "in"]);
 const SORTABLE_FIELDS = ["name", "tier", "billing"];
+const DEFAULT_SORT_FIELD = "name";
+async function withDecryptedPageNames(db, pageRows) {
+    const decrypted = await decryptTenantNames(await selectMany(db, tenantTable, { id: { in: pageRows.map((row) => row.tenantId) } }, { fields: ["id", "name"] }), "cap-overview:tenant-caps:list");
+    const nameById = new Map(decrypted.map((tenant) => [tenant.id, tenant.name ?? ""]));
+    return pageRows.map((row) => ({ ...row, name: nameById.get(row.tenantId) ?? "" }));
+}
 function tenantCapKey(tenantId, capId) {
     return JSON.stringify([tenantId, capId]);
 }
@@ -105,9 +111,15 @@ export function createTenantCapsListQuery(caps, listCaps) {
                 });
             }
             const db = ctx.systemDb.acknowledgeCrossTenant("cap-overview:tenant-caps:list — SystemAdmin platform-wide tenant overview");
-            const tenants = await decryptTenantNames(
-            // Destroyed tenants decrypt to the erased sentinel, which a picker or list would show verbatim.
-            await selectMany(db, tenantTable, { destroyedAt: null }), "cap-overview:tenant-caps:list");
+            // Names are ciphertext at rest: only a name sort or search has to decrypt every tenant;
+            // otherwise rows stay name-less and just the page is decrypted afterwards.
+            const needsAllNames = (query.payload.sort ?? DEFAULT_SORT_FIELD) === "name" ||
+                (query.payload.search?.trim() ?? "") !== "";
+            const tenants = needsAllNames
+                ? await decryptTenantNames(
+                // Destroyed tenants decrypt to the erased sentinel, which a picker or list would show verbatim.
+                await selectMany(db, tenantTable, { destroyedAt: null }), "cap-overview:tenant-caps:list")
+                : await selectMany(db, tenantTable, { destroyedAt: null }, { fields: ["id"] });
             const assignments = await selectMany(db, tierAssignmentTable, {});
             const subscriptions = await selectMany(db, subscriptionsProjectionTable, {});
             const assignmentByTenant = new Map(assignments.map((row) => [row.tenantId, row]));
@@ -119,7 +131,7 @@ export function createTenantCapsListQuery(caps, listCaps) {
                 return {
                     id: tenant.id,
                     tenantId: tenant.id,
-                    name: tenant.name,
+                    name: tenant.name ?? "",
                     tier: assignment?.tier ?? "",
                     billing: billingLabel(subscriptionByTenant.get(tenant.id), assignment?.source ?? null),
                 };
@@ -130,10 +142,13 @@ export function createTenantCapsListQuery(caps, listCaps) {
             // tenant/team-list.query.ts. Holds up to tier-engine's documented
             // "single-pass scan" scale (a few thousand tenants); past that the fix
             // is a real combined read-projection.
-            const { rows: page, total } = pageRows(merged, query.payload, {
+            const { rows: pageWithoutNames, total } = pageRows(merged, query.payload, {
                 searchFields: ["name"],
-                defaultSort: "name",
+                defaultSort: DEFAULT_SORT_FIELD,
             });
+            const page = needsAllNames
+                ? pageWithoutNames
+                : await withDecryptedPageNames(db, pageWithoutNames);
             // Usage is computed only for this page's tenant ids, never for the
             // full tenant set; caps without usageBatch still cost one query per
             // tenant of the page, so those run in parallel.

package/dist/compliance-profiles-ops/handlers/tenants-missing-profile.query.js

@@ -28,13 +28,15 @@ export const tenantsMissingProfileQuery = defineQueryHandler({
             });
         }
         const db = ctx.systemDb.acknowledgeCrossTenant("platform operator scans every tenant for a missing compliance-profile selection");
-        const tenants = await decryptTenantNames(await db.selectMany(tenantTable, { isEnabled: true }), "compliance-profiles-ops:tenants-missing-profile");
+        const tenantRows = await db.selectMany(tenantTable, {
+            isEnabled: true,
+        });
         const profileRows = await db.selectMany(tenantComplianceProfileTable, {});
         const tenantIdsWithProfile = new Set(profileRows.map((row) => row.tenantId));
+        // Only tenants that stay in the answer need their name decrypted.
+        const tenants = await decryptTenantNames(tenantRows.filter((tenant) => !tenantIdsWithProfile.has(tenant.id)), "compliance-profiles-ops:tenants-missing-profile");
         return {
-            tenants: tenants
-                .filter((tenant) => !tenantIdsWithProfile.has(tenant.id))
-                .map((tenant) => ({ id: tenant.id, name: tenant.name })),
+            tenants: tenants.map((tenant) => ({ id: tenant.id, name: tenant.name })),
         };
     },
 });

package/dist/config/table.d.ts

@@ -13,7 +13,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const configValueEntity: import("@cosmicdrift/kumiko-types/fields
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -84,7 +84,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -107,7 +107,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -130,7 +130,7 @@ export declare const configValuesTable: import("@cosmicdrift/kumiko-framework/db
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/custom-fields/entity.d.ts

@@ -13,7 +13,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -36,7 +36,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -59,7 +59,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -109,7 +109,7 @@ export declare const fieldDefinitionEntity: import("@cosmicdrift/kumiko-types/fi
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/data-retention/schema/tenant-retention-override.d.ts

@@ -13,7 +13,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -52,7 +52,7 @@ export declare const tenantRetentionOverrideEntity: import("@cosmicdrift/kumiko-
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -77,7 +77,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {
@@ -116,7 +116,7 @@ export declare const tenantRetentionOverrideTable: import("@cosmicdrift/kumiko-f
         readonly sensitive?: boolean;
         readonly writeOnly?: boolean;
         readonly readAsInstruction?: boolean;
-        readonly format?: "email" | "url" | "phone" | "password" | "month";
+        readonly format?: "email" | "url" | "phone" | "password" | "month" | "iban";
         readonly default?: string;
         readonly access?: import("@cosmicdrift/kumiko-types/fields").FieldAccess;
         readonly multiline?: boolean | {

package/dist/delivery/attempt-log.d.ts

@@ -1,5 +1,7 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { type DeliveryLogEntry } from "./types.ts";
+export declare function rememberConnectionNameChannel(connectionNameChannels: Set<string>, channelName: string, channelOptions: unknown): void;
+export declare function projectedAttemptAddress(connectionNameChannels: ReadonlySet<string>, channel: string, recipientAddress: string | null): string | null;
 export declare function appendAttemptEvent(db: DbConnection, registry: Registry, attemptId: string, entry: DeliveryLogEntry): Promise<void>;
 export declare function logAttempt(db: DbConnection, registry: Registry, entry: DeliveryLogEntry): Promise<string>;

package/dist/delivery/attempt-log.js

@@ -7,7 +7,7 @@ import { runProjectionsForEvent } from "@cosmicdrift/kumiko-framework/pipeline";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { DELIVERY_ATTEMPT_EVENT, DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 import { deliveryAttemptSchema } from "./events.js";
-import { maskRecipientAddress } from "./mask-recipient-address.js";
+import { maskRecipientAddress, maskRecipientAddressOnce } from "./mask-recipient-address.js";
 import { isDeliveryChannelPlugin } from "./types.js";
 // Unknown channels count as personal: masking is the fail-closed default.
 function addressIsConnectionName(registry, channelName) {
@@ -22,6 +22,17 @@ function loggedAddress(registry, entry) {
         ? entry.recipientAddress
         : maskRecipientAddress(entry.recipientAddress);
 }
+// Projection-side counterpart of loggedAddress: legacy events were appended with the full address.
+export function rememberConnectionNameChannel(connectionNameChannels, channelName, channelOptions) {
+    if (isDeliveryChannelPlugin(channelOptions) && channelOptions.addressKind === "connection-name") {
+        connectionNameChannels.add(channelName);
+    }
+}
+export function projectedAttemptAddress(connectionNameChannels, channel, recipientAddress) {
+    return connectionNameChannels.has(channel)
+        ? recipientAddress
+        : maskRecipientAddressOnce(recipientAddress);
+}
 // Shared append + inline-projection write (low-level append() does not
 // auto-fire projections — only the dispatcher/executor paths do).
 async function writeAttemptEvent(db, registry, attemptId, expectedVersion, entry) {

package/dist/delivery/delivery-service.js

@@ -1,6 +1,6 @@
 import { createSystemDbView, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { assertNotificationVariables, bridgeStub, createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
-import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import { createFallbackLogger, scrubLogText, } from "@cosmicdrift/kumiko-framework/logging";
 import { assertNotifyTargetsOwnTenant, createEscapeHatchReporter, } from "@cosmicdrift/kumiko-framework/pipeline";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { fileContextFromResolver } from "../file-foundation/index.js";
@@ -374,8 +374,13 @@ export function createDeliveryService(options) {
                         continue;
                     addresses.set(key, await channel.resolve(userId, channelCtx));
                 }
-                catch {
-                    // skip: re-resolved (and logged) by deliverToUser
+                catch (err) {
+                    // The per-recipient delivery path resolves again and decides the outcome; this only surfaces the early failure.
+                    logError.warn("channel pre-resolve failed", {
+                        channel: channel.name,
+                        notificationType,
+                        error: scrubLogText(err instanceof Error ? err.message : String(err)),
+                    });
                 }
             }
         }