@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.388.0

package/dist/config/write-helpers.js

@@ -33,10 +33,9 @@ export async function findConfigRow(db, key, tenantId, userId) {
 export async function configRowHoldsValue(row, keyDef, cipher, qualifiedKey, serializedValue) {
     if (row?.value === null || row?.value === undefined)
         return false;
-    if (!keyDef?.encrypted && !keyDef?.piiEncrypted)
+    if (keyDef === undefined || (!keyDef.encrypted && !keyDef.piiEncrypted)) {
         return row.value === serializedValue;
-    if (!keyDef)
-        return false;
+    }
     try {
         return (await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey)) === serializedValue;
     }
@@ -112,12 +111,7 @@ export function checkScopeWriteAccess(scope, userRoles) {
     });
 }
 export function validateScope(requestedScope, definedScope, key) {
-    const levels = {
-        [ConfigScopes.system]: 0,
-        [ConfigScopes.tenant]: 1,
-        [ConfigScopes.user]: 2,
-    };
-    if (levels[requestedScope] > levels[definedScope]) {
+    if (SCOPE_LEVEL[requestedScope] > SCOPE_LEVEL[definedScope]) {
         return new UnprocessableError("invalid_scope", {
             i18nKey: "config.errors.invalidScope",
             details: { key, definedScope, requestedScope },
@@ -125,6 +119,21 @@ export function validateScope(requestedScope, definedScope, key) {
     }
     return null;
 }
+const SCOPE_LEVEL = {
+    [ConfigScopes.system]: 0,
+    [ConfigScopes.tenant]: 1,
+    [ConfigScopes.user]: 2,
+};
+// Reads a tenant/user key at a narrower scope, e.g. system for a system-level screen.
+// Only a SystemAdmin may widen the read to the platform level; everyone else keeps the normal cascade.
+export function keyDefAtScope(keyDef, readScope, roles) {
+    if (readScope === undefined ||
+        !roles.includes("SystemAdmin") ||
+        SCOPE_LEVEL[readScope] >= SCOPE_LEVEL[keyDef.scope]) {
+        return keyDef;
+    }
+    return { ...keyDef, scope: readScope };
+}
 export function resolveScopeIds(scope, tenantId, userId) {
     switch (scope) {
         case ConfigScopes.system:

package/dist/crypto-shredding/handlers/forget-subject.write.js

@@ -224,7 +224,6 @@ function sweepErrorLabel(err) {
 // Each step runs in its own savepoint: a database error must not abort the handler
 // transaction, and one failing step must not skip or roll back the others.
 async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunner, audit, rawSubject) {
-    const recordTenantId = await owningTenantOfRecordSubject(crossTenantRunner, ctx.registry.features, rawSubject);
     const failureLabels = [];
     const runStep = async (step) => {
         try {
@@ -254,15 +253,19 @@ async function sweepDerivedSubjectData(ctx, subject, subjectKey, crossTenantRunn
         }
     });
     // File columns hold only the fileRef id, so the key erase never reaches the bytes.
-    await runStep((crossTenantSubjectRunner) => purgeFilesReachingSubject({
-        registry: ctx.registry,
-        db: crossTenantSubjectRunner,
-        subject,
-        subjectKey,
-        ...(recordTenantId !== undefined && { recordTenantId }),
-        resolveDeleteBytes: resolveFileBytesDeleter(ctx),
-        missingStorage: { mode: "fail" },
-    }));
+    await runStep(async (crossTenantSubjectRunner) => {
+        // Inside the step: a failing owner lookup must land in the audit label, not abort the handler.
+        const recordTenantId = await owningTenantOfRecordSubject(crossTenantSubjectRunner, ctx.registry.features, rawSubject);
+        await purgeFilesReachingSubject({
+            registry: ctx.registry,
+            db: crossTenantSubjectRunner,
+            subject,
+            subjectKey,
+            ...(recordTenantId !== undefined && { recordTenantId }),
+            resolveDeleteBytes: resolveFileBytesDeleter(ctx),
+            missingStorage: { mode: "fail" },
+        });
+    });
     return failureLabels[0];
 }
 // Email subscribers and other non-user entities use user-style subject keys

package/dist/delivery/channel-context.js

@@ -1,7 +1,7 @@
 import { createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
-import { readFileRefContent } from "../file-foundation/index.js";
+import { FileStorageUnavailableError, readFileRefContent, } from "../file-foundation/index.js";
 import { collectRendererPlugins, createRendererFoundationApi, RendererError, } from "../renderer-foundation/index.js";
 import { FALLBACK_LOCALE } from "../template-resolver/index.js";
 export function createTemplateMailRenderer(db, registry, tenantId, config) {
@@ -44,15 +44,18 @@ function createPdfRenderer(db, registry, tenantId, config, filesForTenant) {
         return { content: response.pdfBytes, contentType: PDF_CONTENT_TYPE };
     };
 }
-// A decorative inline image (logo) that cannot be read must not fail the whole mail.
+// A decorative inline image (logo) of a tenant without file storage must not fail the whole mail;
+// transient read errors rethrow so the send job retries.
 async function readInlineImageOrNull(fileRefId, read) {
     try {
         return await read();
     }
     catch (err) {
+        if (!(err instanceof FileStorageUnavailableError))
+            throw err;
         createFallbackLogger("delivery").warn("inline image could not be read, sending without it", {
             fileRefId,
-            errorName: err instanceof Error ? err.name : typeof err,
+            errorName: err.name,
         });
         return null;
     }

package/dist/delivery/db/queries/preferences.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
+import { toPostgresArrayLiteral, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 // @wrapper-known semantic-alias
 export async function selectNotificationPreferences(db, tenantId, userId, notificationTypeNames, channelName) {
     return unsafeReadRetrying(db, `SELECT notification_type AS "notificationType", channel, enabled
@@ -9,5 +9,5 @@ export async function selectNotificationPreferences(db, tenantId, userId, notifi
          (notification_type = ANY($3::text[]) AND channel = $4)
          OR (notification_type = '*' AND channel = $4)
          OR (notification_type = ANY($3::text[]) AND channel = '*')
-       )`, [tenantId, userId, notificationTypeNames, channelName]);
+       )`, [tenantId, userId, toPostgresArrayLiteral(notificationTypeNames), channelName]);
 }

package/dist/delivery/delivery-service.js

@@ -266,9 +266,27 @@ export function createDeliveryService(options) {
             });
         }
     }
+    // The app's tenantOrigin callback typically hits the DB: once per run and tenant, not per recipient.
+    const unsubscribeOriginsByRun = new WeakMap();
+    function unsubscribeOriginOnce(run, links, channelCtx, notificationType) {
+        let originsByTenant = unsubscribeOriginsByRun.get(run);
+        if (originsByTenant === undefined) {
+            originsByTenant = new Map();
+            unsubscribeOriginsByRun.set(run, originsByTenant);
+        }
+        let origin = originsByTenant.get(channelCtx.tenantId);
+        if (origin === undefined) {
+            origin = unsubscribeLinkOrigin(links, channelCtx, (reason) => logError.warn(`unsubscribe link falls back to the app origin: ${reason}`, {
+                tenantId: channelCtx.tenantId,
+                notificationType,
+            }));
+            originsByTenant.set(channelCtx.tenantId, origin);
+        }
+        return origin;
+    }
     // A caller-supplied unsubscribeUrl wins; the recipient comes from the server-side notify
     // context, never from the notification data.
-    async function withUnsubscribeUrl(message, channelName, recipient, channelCtx) {
+    async function withUnsubscribeUrl(run, message, channelName, recipient, channelCtx) {
         if (!unsubscribeLinks || channelName !== EMAIL_CHANNEL_NAME)
             return message;
         if (registry.getAllNotifications().get(message.notificationType)?.unsubscribe !== true) {
@@ -277,10 +295,7 @@ export function createDeliveryService(options) {
         const supplied = message.data?.["unsubscribeUrl"];
         if (typeof supplied === "string" && supplied !== "")
             return message;
-        const origin = await unsubscribeLinkOrigin(unsubscribeLinks, channelCtx, (reason) => logError.warn(`unsubscribe link falls back to the app origin: ${reason}`, {
-            tenantId: channelCtx.tenantId,
-            notificationType: message.notificationType,
-        }));
+        const origin = await unsubscribeOriginOnce(run, unsubscribeLinks, channelCtx, message.notificationType);
         const unsubscribeUrl = await buildUnsubscribeUrl(unsubscribeLinks, origin, recipient, {
             tenantId: channelCtx.tenantId,
             notificationType: message.notificationType,
@@ -476,7 +491,7 @@ export function createDeliveryService(options) {
                     run,
                     channel,
                     address,
-                    message: await withUnsubscribeUrl(message, channel.name, { kind: "user", userId }, channelCtx),
+                    message: await withUnsubscribeUrl(run, message, channel.name, { kind: "user", userId }, channelCtx),
                     channelCtx,
                     tenantId,
                     recipientId: userId,
@@ -549,7 +564,7 @@ export function createDeliveryService(options) {
                     run,
                     channel,
                     address,
-                    message: await withUnsubscribeUrl(message, channel.name, { kind: "address", address }, channelCtx),
+                    message: await withUnsubscribeUrl(run, message, channel.name, { kind: "address", address }, channelCtx),
                     channelCtx,
                     tenantId,
                     recipientId,

package/dist/delivery/handlers/preferences.query.d.ts

@@ -1,4 +1,4 @@
 import * as z from "zod";
 export declare const preferencesQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"preferences", z.ZodObject<{}, z.core.$strip>, {
-    rows: readonly any[];
+    rows: any[];
 }, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/delivery/handlers/preferences.query.js

@@ -2,6 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.js";
 import { notificationPreferencesTable } from "../tables.js";
 export const preferencesQuery = defineQueryHandler({
     name: "preferences",
@@ -31,6 +32,24 @@ export const preferencesQuery = defineQueryHandler({
             tenantId: query.user.tenantId,
             userId: query.user.id,
         });
-        return { rows };
+        // Rows stored under a former notification name are reported under the current
+        // one, collapsed with the same precedence as delivery: an exact row wins,
+        // otherwise any disabled former-name row disables.
+        const collapsed = new Map();
+        for (const row of rows) {
+            const notificationType = currentNotificationType(ctx.registry, row.notificationType);
+            const key = `${notificationType}\u0000${row.channel}`;
+            const isExact = row.notificationType === notificationType;
+            const existing = collapsed.get(key);
+            if (existing?.isExact)
+                continue;
+            const formerNameRowDisablesAlready = existing !== undefined &&
+                !isExact &&
+                (existing.row.enabled === false || row.enabled !== false);
+            if (formerNameRowDisablesAlready)
+                continue;
+            collapsed.set(key, { row: { ...row, notificationType }, isExact });
+        }
+        return { rows: [...collapsed.values()].map((entry) => entry.row) };
     },
 });

package/dist/delivery/handlers/unsubscribe-page-chrome.query.js

@@ -23,7 +23,7 @@ export const unsubscribePageChromeQuery = defineQueryHandler({
     // Only reachable via a system dispatch: the signed unsubscribe routes after verify(),
     // or createUnsubscribePageChromeReader for a tenant the app resolved server-side.
     agent: { expose: false },
-    description: "Returns the tenant's mail brand row and footer resolved for one locale, or null without a mail renderer; dispatched by the signed unsubscribe route to dress its pages like the mail, not meant for UI callers.",
+    description: "Returns the tenant's mail brand row and footer resolved for one locale, or null without a mail renderer; dispatched by the signed unsubscribe route or by createUnsubscribePageChromeReader for a tenant the app resolved server-side, to dress its pages like the mail; not meant for UI callers.",
     handler: async (query, ctx) => {
         const { tenantId } = query.user;
         if (!ctx.systemDb) {

package/dist/delivery/unsubscribe-link.d.ts

@@ -5,7 +5,9 @@ export type UnsubscribeLinkConfig = {
     readonly secret: string;
     readonly baseUrl: string;
     /** The sending tenant's own public origin (subdomain or custom domain), null when it has
-     *  none. The host must serve this app's `/api` routes. Null, a throw or an unusable value
+     *  none. The host must serve this app's `/api` routes, and the callback must only return a
+     *  verified, active domain of the tenant (the check that lets the app serve under it), else null:
+     *  the link carries a bearer token that unsubscribes and yields a resubscribe token. Null, a throw or an unusable value
      *  fall back to `baseUrl`, so a missing tenant origin never fails a send. */
     readonly tenantOrigin?: (ctx: ChannelContext) => Promise<string | null | undefined>;
 };

package/dist/delivery/unsubscribe-page-strings.d.ts

@@ -10,6 +10,7 @@ export declare const UNSUBSCRIBE_PAGE_EN: {
     readonly "mail.unsubscribe.resubscribedMessage": "You have been subscribed again.";
     readonly "mail.unsubscribe.failed": "That did not work. Please try again later.";
     readonly "mail.unsubscribe.failedTitle": "Something went wrong";
+    readonly "mail.unsubscribe.resubscribeLimitReached": "This address cannot be subscribed again here.";
     readonly "mail.unsubscribe.invalidTitle": "Link no longer valid";
     readonly "mail.unsubscribe.invalidMessage": "This link is invalid or has expired. Please use the unsubscribe link in a more recent email.";
 };

package/dist/delivery/unsubscribe-page-strings.js

@@ -13,6 +13,7 @@ export const UNSUBSCRIBE_PAGE_EN = {
     "mail.unsubscribe.resubscribedMessage": "You have been subscribed again.",
     "mail.unsubscribe.failed": "That did not work. Please try again later.",
     "mail.unsubscribe.failedTitle": "Something went wrong",
+    "mail.unsubscribe.resubscribeLimitReached": "This address cannot be subscribed again here.",
     "mail.unsubscribe.invalidTitle": "Link no longer valid",
     "mail.unsubscribe.invalidMessage": "This link is invalid or has expired. Please use the unsubscribe link in a more recent email.",
 };

package/dist/delivery/unsubscribe-page.d.ts

@@ -10,6 +10,8 @@ export type UnsubscribePageState = {
     readonly kind: "resubscribed";
 } | {
     readonly kind: "failed";
+} | {
+    readonly kind: "resubscribeLimitReached";
 } | {
     readonly kind: "invalid";
 };

package/dist/delivery/unsubscribe-page.js

@@ -135,6 +135,11 @@ ${tokenForm(DELIVERY_RESUBSCRIBE_PATH, state.resubscribeToken, mailT(lang, "mail
                 title: mailT(lang, "mail.unsubscribe.failedTitle"),
                 bodyHtml: paragraph("mail.unsubscribe.failed"),
             };
+        case "resubscribeLimitReached":
+            return {
+                title: mailT(lang, "mail.unsubscribe.failedTitle"),
+                bodyHtml: paragraph("mail.unsubscribe.resubscribeLimitReached"),
+            };
         case "invalid":
             return {
                 title: mailT(lang, "mail.unsubscribe.invalidTitle"),

package/dist/delivery/unsubscribe.js

@@ -373,10 +373,16 @@ async function verifyForPage(token, encodedSecret, purpose, headers) {
     }
 }
 async function verifyPost(request, token, encodedSecret, purpose) {
-    return isFormRequest(request.headers["content-type"])
+    return isFormRequest(request.headers["content-type"]) && !isOneClickPost(request)
         ? verifyForPage(token, encodedSecret, purpose, request.headers)
         : verifyUnsubscribeToken(token, encodedSecret, purpose);
 }
+// RFC 8058 mail-provider POSTs are form-encoded too, but nobody looks at the answer: they keep
+// the JSON rejection and get no branded page.
+function isOneClickPost(request) {
+    return (isFormRequest(request.headers["content-type"]) &&
+        request.rawBody.trim() === DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE);
+}
 function isFormRequest(contentType) {
     return contentType?.includes("application/x-www-form-urlencoded") === true;
 }
@@ -435,22 +441,31 @@ export function createUnsubscribeRoutes(options) {
         method: "POST",
         path: DELIVERY_UNSUBSCRIBE_PATH,
         entry: "signature",
-        verify: async (request) => verifyPost(request, tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
+        verify: async (request) => {
+            const verified = await verifyPost(request, tokenFromPostRequest(request), encodedSecret, "unsubscribe");
+            return verified.kind === "rejected"
+                ? verified
+                : { ...verified, oneClick: isOneClickPost(request) };
+        },
         handler: async (c, verified, deps) => {
             if (verified.kind === "rejected") {
                 return pageResponse(c, deps, { kind: "invalid" }, verified, 400);
             }
+            // No chrome lookup for a one-click client: it never renders the page.
+            const pageScope = verified.oneClick
+                ? { tenantId: undefined, locale: verified.locale }
+                : verified;
             // Token-verify passed — everything below is a legitimate write. Don't
             // swallow write-errors as "invalid token", that would mask real bugs
             // (e.g. events-table missing, DB down) behind a misleading 400.
             const succeeded = await dispatchUnsubscribeWrite(verified, deps);
             if (!succeeded) {
-                return pageResponse(c, deps, { kind: "failed" }, verified, 500);
+                return pageResponse(c, deps, { kind: "failed" }, pageScope, 500);
             }
             return pageResponse(c, deps, {
                 kind: "unsubscribed",
                 resubscribeToken: await signResubscribeToken(verified, encodedSecret),
-            }, verified, 200);
+            }, pageScope, 200);
         },
     });
     // Undo direction: token only from the JSON/form body, never the query
@@ -468,9 +483,12 @@ export function createUnsubscribeRoutes(options) {
             const outcome = await dispatchResubscribeWrite(verified, deps);
             // The undo button on the unsubscribed page posts a form; a browser should land on a page.
             if (isFormRequest(c.req.header("content-type"))) {
-                return outcome === "success"
-                    ? pageResponse(c, deps, { kind: "resubscribed" }, verified, 200)
-                    : pageResponse(c, deps, { kind: "failed" }, verified, outcome === "limit_reached" ? 409 : 500);
+                if (outcome === "success") {
+                    return pageResponse(c, deps, { kind: "resubscribed" }, verified, 200);
+                }
+                return outcome === "limit_reached"
+                    ? pageResponse(c, deps, { kind: "resubscribeLimitReached" }, verified, 409)
+                    : pageResponse(c, deps, { kind: "failed" }, verified, 500);
             }
             if (outcome === "limit_reached") {
                 return c.json({ error: { code: DeliveryErrors.resubscribeLimitReached } }, 409, NO_STORE_HEADERS);

package/dist/file-foundation/index.d.ts

@@ -1,2 +1,2 @@
 export { createFileFoundationFeature, createFileProviderForTenant, type FileProviderContext, type FileProviderPlugin, isFileProviderPlugin, } from "./feature.ts";
-export { type FileRefContent, FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.ts";
+export { type FileRefContent, FileRefTooLargeError, FileStorageUnavailableError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.ts";

package/dist/file-foundation/index.js

@@ -1,3 +1,3 @@
 // Public API of the file-foundation bundled-feature.
 export { createFileFoundationFeature, createFileProviderForTenant, isFileProviderPlugin, } from "./feature.js";
-export { FileRefTooLargeError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";
+export { FileRefTooLargeError, FileStorageUnavailableError, fileContextForTenant, fileContextFromResolver, readFileRefContent, } from "./read-file-ref-content.js";

package/dist/file-foundation/read-file-ref-content.d.ts

@@ -15,6 +15,9 @@ export declare class FileRefTooLargeError extends Error {
     readonly size: number;
     constructor(size: number);
 }
+export declare class FileStorageUnavailableError extends Error {
+    constructor();
+}
 export declare function readFileRefContent(args: {
     readonly db: DbRunner | TenantDb;
     readonly filesForTenant: (tenantId: string) => FileContext | undefined;

package/dist/file-foundation/read-file-ref-content.js

@@ -22,6 +22,11 @@ export class FileRefTooLargeError extends Error {
         this.size = size;
     }
 }
+export class FileStorageUnavailableError extends Error {
+    constructor() {
+        super("readFileRefContent: no file storage is available for the file's tenant");
+    }
+}
 // fileName of the row is never used: it is personal data and may be a PII ciphertext.
 export async function readFileRefContent(args) {
     if (!isUuid(args.fileRefId))
@@ -44,7 +49,7 @@ export async function readFileRefContent(args) {
     }
     const files = args.filesForTenant(row.tenantId);
     if (files === undefined) {
-        throw new Error("readFileRefContent: no file storage is available for the file's tenant");
+        throw new FileStorageUnavailableError();
     }
     const content = await files.refFromFileRef(row).read();
     return { content, contentType: row.mimeType, tenantId: row.tenantId, size };

package/dist/file-provider-s3/env-named-feature.d.ts

@@ -3,8 +3,6 @@ export type NamedS3EnvProviderOptions = {
     readonly name: string;
     /** Env prefix of the credential set, e.g. `RELEASES_S3_`. */
     readonly envPrefix: string;
-    /** Tolerate missing credentials at boot; the provider then fails on its first file operation. */
-    readonly lazy?: boolean;
 };
 /** An additional S3 provider next to `"s3-env"`, reading its credentials from `<envPrefix>BUCKET` etc. */
 export declare function createFileProviderS3NamedEnvFeature(options: NamedS3EnvProviderOptions): import("@cosmicdrift/kumiko-framework/env").FeatureWithEnvSchema<import("@cosmicdrift/kumiko-types/feature").FeatureDefinition & {

package/dist/form-draft/db/queries/cleanup.js

@@ -1,4 +1,4 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
+import { toPostgresArrayLiteral, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { readStoredDraft } from "../../decrypt-draft.js";
 // COALESCE(modified_at, inserted_at) — a draft's "last touched" timestamp is
@@ -17,7 +17,7 @@ export async function selectStaleDraftsBatch(db, olderThanDays, batchSize, exclu
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
      AND NOT ("id"::text = ANY($3::text[]))
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
-     LIMIT $2`, [olderThanDays, batchSize, [...excludeIds]]);
+     LIMIT $2`, [olderThanDays, batchSize, toPostgresArrayLiteral([...excludeIds])]);
     return Promise.all(rows.map(async (row) => {
         const base = {
             id: row.id,

package/dist/form-draft/decrypt-draft.js

@@ -1,5 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, } from "@cosmicdrift/kumiko-framework/crypto";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { formDraftBlobSchema } from "./schemas.js";
 // Raw reads (fetchOne/selectMany/SQL) return the stored column, which is
 // ciphertext once the owner's key exists. The field name is part of the AAD,
@@ -8,7 +9,10 @@ import { formDraftBlobSchema } from "./schemas.js";
 export async function readStoredDraft(stored) {
     let plain = stored;
     const kms = configuredPiiSubjectKms();
-    if (isPiiCiphertext(stored) && kms) {
+    if (isPiiCiphertext(stored)) {
+        // A silent null would make the stale-draft cleanup treat the draft as empty and leak its file refs.
+        if (!kms)
+            throw new InternalError({ message: "form-draft: pii kms not configured" });
         const out = await decryptPiiFieldValues({ draft: stored }, ["draft"], kms, {
             requestId: requestContext.get()?.requestId ?? "form-draft:read",
         });

package/dist/host-routing/dispatch.js

@@ -6,38 +6,29 @@ import { classifyHost, splitFirstSegment, tenantKeyFromPath } from "./host.js";
 import { matchRedirect, sameOriginPath } from "./redirects.js";
 import { validateHostRoutingOptions } from "./validate-options.js";
 const tenantKeyExistsResultSchema = z.object({ exists: z.boolean() });
-async function isTenantKeyKnown(systemQuery, key) {
+async function existsViaSystemQuery(systemQuery, queryType, payload) {
     let result;
     try {
-        result = await systemQuery(HostRoutingQueries.tenantKeyExists, { key }, SYSTEM_TENANT_ID);
+        result = await systemQuery(queryType, payload, SYSTEM_TENANT_ID);
     }
     catch (error) {
         if (error instanceof ValidationError)
             return false;
-        // Over the rate limit every key looks the same: serve the tenant shell,
-        // which leaks nothing; the API behind it still resolves the tenant itself.
+        // Over the rate limit every key looks the same: serve the shell, which
+        // leaks nothing. The API resolver is authoritative and answers
+        // tenant_required for unknown hosts, while a 404 would hit visitors
+        // behind a shared NAT under load.
         if (error instanceof RateLimitError)
             return true;
         throw error;
     }
     return tenantKeyExistsResultSchema.parse(result).exists;
 }
-async function isHostKnown(systemQuery, host) {
-    let result;
-    try {
-        result = await systemQuery(HostRoutingQueries.hostTenantExists, { host }, SYSTEM_TENANT_ID);
-    }
-    catch (error) {
-        if (error instanceof ValidationError)
-            return false;
-        // The shell is harmless: the API resolver is authoritative and answers
-        // tenant_required for unknown hosts, while a 404 would hit visitors behind
-        // a shared NAT under load.
-        if (error instanceof RateLimitError)
-            return true;
-        throw error;
-    }
-    return tenantKeyExistsResultSchema.parse(result).exists;
+function isTenantKeyKnown(systemQuery, key) {
+    return existsViaSystemQuery(systemQuery, HostRoutingQueries.tenantKeyExists, { key });
+}
+function isHostKnown(systemQuery, host) {
+    return existsViaSystemQuery(systemQuery, HostRoutingQueries.hostTenantExists, { host });
 }
 function serve(surface, file = surface.file) {
     return surface.csp === undefined

package/dist/inbound-mail-foundation/handlers/update-account.write.d.ts

@@ -1,4 +1,4 @@
-import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
 export declare const updateAccountSchema: z.ZodObject<{
     accountId: z.ZodUUID;
@@ -9,6 +9,6 @@ export declare const updateAccountSchema: z.ZodObject<{
     }>>;
     watchState: z.ZodOptional<z.ZodString>;
     displayName: z.ZodOptional<z.ZodString>;
-    reason: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const updateAccountHandler: WriteHandlerDef;

package/dist/inbound-mail-foundation/handlers/update-account.write.js

@@ -2,6 +2,8 @@
 // error/backoff, OAuth refresh fails (auth_error), or a tenant admin re-enables
 // the account after fixing its credentials. Full-snapshot event: loads the
 // latest state, merges the delta fields, and appends the new snapshot.
+import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { SYSTEM_USER_ID, } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { InboundMailAccountStatuses } from "../constants.js";
@@ -19,10 +21,16 @@ export const updateAccountSchema = z.object({
     /** Ops-Signal ("idle", "watching", "backoff:3", ...). */
     watchState: z.string().max(100).optional(),
     displayName: z.string().max(200).optional(),
-    /** Audit reason for metadata.headers ("watch_supervisor",
-     *  "oauth_refresh", "tenant_admin"). */
-    reason: z.string().min(1).max(100),
+    /** Audit reason for metadata.headers, honored for the system identity only
+     *  ("watch_supervisor", "oauth_refresh"); user callers get a role-derived reason. */
+    reason: z.string().min(1).max(100).optional(),
 });
+const SYSTEM_FALLBACK_REASON = "system";
+function auditReasonFor(user, requestedReason) {
+    if (user.id === SYSTEM_USER_ID)
+        return requestedReason ?? SYSTEM_FALLBACK_REASON;
+    return user.roles.includes(ROLES.SystemAdmin) ? "system_admin" : "tenant_admin";
+}
 export const updateAccountHandler = {
     name: "update-account",
     schema: updateAccountSchema,
@@ -52,7 +60,7 @@ export const updateAccountHandler = {
         };
         const headers = {
             providerName: current.provider,
-            reason: payload.reason,
+            reason: auditReasonFor(event.user, payload.reason),
         };
         await ctx.unsafeAppendEvent({
             aggregateId: payload.accountId,

package/dist/inbound-mail-foundation/i18n.js

@@ -31,5 +31,4 @@ export const INBOUND_MAIL_FOUNDATION_I18N = {
     },
     [formFieldKey("accountId")]: { en: "Mailbox" },
     [formFieldKey("displayName")]: { en: "Name" },
-    [formFieldKey("reason")]: { en: "Reason" },
 };

package/dist/inbound-mail-foundation/screens.js

@@ -63,8 +63,6 @@ export const mailAccountListScreen = {
     access: MAIL_ACCOUNT_ADMIN_ACCESS,
     dormant: true,
 };
-// The reason is the audit label update-account requires; it is not in the
-// layout, so the default is what gets written.
 export const mailAccountEditScreen = {
     id: MAIL_ACCOUNT_EDIT_SCREEN_ID,
     type: "actionForm",
@@ -73,7 +71,6 @@ export const mailAccountEditScreen = {
     fields: {
         accountId: { type: "text", required: true },
         displayName: { type: "text", required: true, maxLength: 200 },
-        reason: { type: "text", default: "tenant_admin" },
     },
     layout: {
         sections: [{ fields: [{ field: "accountId", readOnly: true }, "displayName"] }],

package/dist/inbound-mail-foundation/types.d.ts

@@ -8,8 +8,9 @@ import { INBOUND_MAIL_PROVIDER_EXTENSION, type InboundMailAccountStatus } from "
  *   config   — tenant config reads (host/port/... of the plugins)
  *   registry — extension lookup in the factory (not plugin-internal)
  *   secrets  — tenant secret reads (IMAP password, OAuth refresh token)
- *   auditUserId  — audit identity for secret reads. Handler path: the dispatcher
- *              sets the caller user ID; worker path: system identity.
+ *   auditUserId  — audit identity for secret reads. Handler path: unset,
+ *              requireSecretsContext falls back to ctx.user.id; worker/provider
+ *              path: system identity set by the resolver.
  *   metricsFor — metrics handle of a feature by name, same behavior as
  *              HandlerContext.metricsFor: unregistered metrics are a silent
  *              no-op instead of a throw.
@@ -146,7 +147,7 @@ export type InboundMailProviderPlugin = {
          *  for password accounts and providers without an oauth flow. */
         readonly accessToken?: string;
         /** Batch lookup of the provider message ids not yet ingested for this
-         *  account (committed seen anchors, one query per call). Call it after
+         *  account (committed seen anchors; lists of any size are fine, queried in chunks). Call it after
          *  the listing/delta page and download MIME only for the returned ids.
          *  Ingest dedup stays the correctness anchor; this only saves downloads. */
         readonly filterUnknownMessageIds?: (providerMessageIds: readonly string[]) => Promise<ReadonlySet<string>>;