@cosmicdrift/kumiko-bundled-features 0.387.0 → 0.389.0

package/dist/tenant/handlers/member-directory.query.js

@@ -40,6 +40,8 @@ export const memberDirectoryQuery = definePagedQueryHandler({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
         // Sent by the reference combobox while the user types.
         search: z.string().trim().min(1).optional(),
+        // Resolves exactly these users; callers that know their ids must not depend on the cap.
+        ids: z.array(z.string().min(1)).max(MAX_LIST_LIMIT).optional(),
     }),
     access: { roles: access.admin },
     description: "Lists users as id/label pairs for resolving user references to display names: the caller's own tenant members for an admin, every user for a SystemAdmin; carries no email or role data.",
@@ -50,21 +52,26 @@ export const memberDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:member-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit, search } = query.payload;
+        const { limit, search, ids } = query.payload;
+        if (ids?.length === 0)
+            return { rows: [], nextCursor: null };
         // Without a search the first `limit` rows are enough; with one, every
         // candidate must be decrypted before the limit can apply.
         const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let users;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as user:query:user:list did");
-            users = await selectMany(db, userTable, undefined, {
+            users = await selectMany(db, userTable, ids === undefined ? undefined : { id: ids }, {
                 limit: scanLimit,
                 orderBy: { col: "id", direction: "asc" },
             });
         }
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-            const userIds = (await loadMemberUserIds(db, query.user.tenantId)).slice(0, scanLimit);
+            const requestedIds = ids === undefined ? undefined : new Set(ids);
+            const userIds = (await loadMemberUserIds(db, query.user.tenantId))
+                .filter((id) => requestedIds === undefined || requestedIds.has(id))
+                .slice(0, scanLimit);
             users =
                 userIds.length > 0
                     ? await selectMany(db, userTable, { id: [...userIds] }, {

package/dist/tenant/handlers/team-list.query.js

@@ -1,9 +1,9 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { isUndefinedTable, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { errorCodeOf, isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { userSessionTable } from "../../sessions/index.js";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
@@ -110,7 +110,7 @@ export const teamListQuery = definePagedQueryHandler({
                 // ponytail: lean sample apps (admin-console) mount auth without
                 // sessions — store_user_sessions never gets pushed. Integration tests
                 // may seed the table without mounting the feature; prod mounts both.
-                if (errorCodeOf(err) !== "42P01")
+                if (!isUndefinedTable(err))
                     throw err;
             }
         }

package/dist/tenant/handlers/tenant-directory.query.d.ts

@@ -2,6 +2,7 @@ import * as z from "zod";
 export declare const tenantDirectoryQuery: import("@cosmicdrift/kumiko-framework/engine").PagedQueryHandlerDefinition<"tenantDirectory", z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
     search: z.ZodOptional<z.ZodString>;
+    ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>, {
     id: string;
     label: string;

package/dist/tenant/handlers/tenant-directory.query.js

@@ -21,9 +21,11 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(MAX_LIST_LIMIT),
         // Sent by the reference combobox while the user types.
         search: z.string().trim().min(1).optional(),
+        // Resolves exactly these tenants; callers that know their ids must not depend on the cap.
+        ids: z.array(z.string().min(1)).max(MAX_LIST_LIMIT).optional(),
     }),
     access: { roles: access.admin },
-    description: "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin.",
+    description: "Lists tenants as id/label pairs for resolving tenant references to display names: the caller's own tenant for an admin, every tenant for a SystemAdmin. A search returns the first `limit` matches in tenant-key order (sorted by label afterwards), not the alphabetically best matches.",
     agent: { expose: false },
     handler: async (query, ctx) => {
         if (!ctx.systemDb) {
@@ -31,12 +33,14 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
                 message: "tenant:query:tenant-directory requires ctx.systemDb — is r.systemScope() still set on the tenant feature?",
             });
         }
-        const { limit, search } = query.payload;
+        const { limit, search, ids } = query.payload;
+        if (ids?.length === 0)
+            return { rows: [], nextCursor: null };
         const scanLimit = search === undefined ? limit : SEARCH_SCAN_CAP;
         let tenants;
         if (isSystemAdmin(query.user)) {
             const db = ctx.systemDb.acknowledgeCrossTenant("SystemAdmin reference labels span every tenant, as tenant:query:tenant:list did");
-            tenants = await selectMany(db, tenantTable, undefined, {
+            tenants = await selectMany(db, tenantTable, ids === undefined ? undefined : { id: ids }, {
                 limit: scanLimit,
                 orderBy: [
                     { col: "key", direction: "asc" },
@@ -47,7 +51,7 @@ export const tenantDirectoryQuery = definePagedQueryHandler({
         else {
             const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
             const row = await fetchOne(db, tenantTable, { id: query.user.tenantId });
-            tenants = row ? [row] : [];
+            tenants = row && (ids === undefined || ids.includes(query.user.tenantId)) ? [row] : [];
         }
         // name is ciphertext at rest, so the SQL page is keyed by the plaintext
         // `key`; label order and search happen in memory after decrypting.

package/dist/tenant-lifecycle/constants.d.ts

@@ -27,3 +27,4 @@ export declare const TenantLifecycleHandlers: {
 export declare const TENANT_DESTRUCTION_STAGES: readonly ["external-resources", "search-indices", "cache", "app-data", "subject-keys", "files", "infra-resources", "tenant-row"];
 export type TenantDestructionStageName = (typeof TENANT_DESTRUCTION_STAGES)[number];
 export declare const DESTRUCTION_STAGE_TICK_BUDGET_MS = 30000;
+export declare const DESTRUCTION_STAGE_MIN_SLICE_MS = 2000;

package/dist/tenant-lifecycle/constants.js

@@ -38,3 +38,7 @@ export const TENANT_DESTRUCTION_STAGES = [
 // The sweep cron fires every minute with concurrency "skip", so a tick must
 // finish well inside that window or the next one is skipped.
 export const DESTRUCTION_STAGE_TICK_BUDGET_MS = 30_000;
+// Lower bound of a tenant's share of the tick budget. Below it a chunking hook
+// without a guaranteed first batch processes nothing, and a no-progress stage
+// counts as a failed attempt, which would abandon the pipeline under load.
+export const DESTRUCTION_STAGE_MIN_SLICE_MS = 2_000;

package/dist/tenant-lifecycle/run-tenant-destroy.js

@@ -3,7 +3,7 @@ import { createSystemUser, } from "@cosmicdrift/kumiko-framework/engine";
 import { append, loadAggregate, VersionConflictError, } from "@cosmicdrift/kumiko-framework/event-store";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { tenantEntity, tenantTable } from "../tenant/index.js";
-import { DESTRUCTION_STAGE_TICK_BUDGET_MS, TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_COMPLETED_EVENT_QN, TENANT_DESTRUCTION_FAILED_EVENT_QN, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_PROGRESSED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
+import { DESTRUCTION_STAGE_MIN_SLICE_MS, DESTRUCTION_STAGE_TICK_BUDGET_MS, TENANT_AGGREGATE_TYPE, TENANT_DESTRUCTION_COMPLETED_EVENT_QN, TENANT_DESTRUCTION_FAILED_EVENT_QN, TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_PROGRESSED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT, TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT, TENANT_DESTRUCTION_STARTED_EVENT_SHORT, } from "./constants.js";
 import { invalidateTenantLifecycleGate, TEARDOWN_GATE_SETTLE_MS } from "./lifecycle-gate.js";
 import { isDestructionPipelineComplete, pickNextStage, } from "./stages.js";
 const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
@@ -251,7 +251,7 @@ export async function runTenantDestructionSweep(args) {
     // window and starve the ones behind it. Each slice starts when its tenant
     // starts: anchoring to a shared tick deadline would hand tenants after an
     // overrun a zero slice, and a no-progress stage counts as a failed attempt.
-    const sliceMs = DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length);
+    const sliceMs = Math.max(DESTRUCTION_STAGE_MIN_SLICE_MS, DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length));
     for (const row of destroying) {
         const tenantDeadlineAt = Date.now() + sliceMs;
         try {

package/dist/tenant-lifecycle/stages.js

@@ -73,6 +73,27 @@ async function runTenantDataHooks(ctx) {
     }
     return total.outcome();
 }
+// A user key outlives the tenant while the user still belongs to another live tenant:
+// erasing it would tombstone the key and break every later PII write for that user.
+async function userIdsWithoutOtherLiveTenant(ctx, userIds) {
+    // skip: no members, nothing to look up.
+    if (userIds.length === 0)
+        return [];
+    const otherMemberships = (await selectMany(ctx.db, tenantMembershipsTable, {
+        userId: { in: [...userIds] },
+    })).filter((membership) => membership.tenantId !== ctx.tenantId);
+    // skip: every member belongs to this tenant only.
+    if (otherMemberships.length === 0)
+        return userIds;
+    const otherTenants = await selectMany(ctx.db, tenantTable, {
+        id: { in: [...new Set(otherMemberships.map((membership) => membership.tenantId))] },
+    });
+    const liveTenantIds = new Set(otherTenants.filter((tenant) => tenant.status !== "destroyed").map((tenant) => tenant.id));
+    const retainedUserIds = new Set(otherMemberships
+        .filter((membership) => liveTenantIds.has(membership.tenantId))
+        .map((membership) => membership.userId));
+    return userIds.filter((userId) => !retainedUserIds.has(userId));
+}
 async function eraseSubjectKeys(ctx) {
     const kms = configuredPiiSubjectKms();
     if (!kms) {
@@ -87,7 +108,7 @@ async function eraseSubjectKeys(ctx) {
     const subjects = [
         { kind: "tenant", tenantId: ctx.tenantId },
         tenantRecordSubject,
-        ...memberships.map((m) => ({ kind: "user", userId: m.userId })),
+        ...(await userIdsWithoutOtherLiveTenant(ctx, memberships.map((m) => m.userId))).map((userId) => ({ kind: "user", userId })),
     ];
     for (const subject of subjects) {
         await kms.eraseKey(subject, {

package/dist/tier-engine/handlers/set-tenant-tier.write.d.ts

@@ -16,9 +16,8 @@ export declare function createSetTenantTierWrite(opts?: SetTenantTierOptions): i
     tenantId: z.ZodString;
     tier: z.ZodString;
     source: z.ZodDefault<z.ZodEnum<{
-        readonly manual: "manual";
-        readonly billing: "billing";
-        readonly default: "default";
+        billing: "billing";
+        manual: "manual";
     }>>;
 }, z.core.$strip>, {
     tenantId: string;

package/dist/tier-engine/handlers/set-tenant-tier.write.js

@@ -38,7 +38,10 @@ export function createSetTenantTierWrite(opts = {}) {
                 .min(1)
                 .max(50)
                 .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
-            source: z.enum(TierAssignmentSources).default(TierAssignmentSources.manual),
+            // `default` is reserved for the signup default tier; the billing sync treats it like `billing`.
+            source: z
+                .enum([TierAssignmentSources.manual, TierAssignmentSources.billing])
+                .default(TierAssignmentSources.manual),
         }),
         access: { roles: ["SystemAdmin"] },
         agent: { risk: "high" },

package/dist/tier-engine/web/constants.js

@@ -3,6 +3,7 @@
 // category in the kumiko isolation model (runtime may import client, client
 // may only import client) — otherwise the runtime isolation guard throws on
 // the client imports. Same pattern as text-content/constants.
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 // Feature name
 export const TIER_ENGINE_FEATURE = "tier-engine";
 // Qualified write handler names (QN format: scope:type:name).
@@ -18,9 +19,8 @@ export const TierAssignmentSources = {
     billing: "billing",
     default: "default",
 };
-const TIER_ASSIGNMENT_SOURCE_VALUES = Object.values(TierAssignmentSources);
 export function isTierAssignmentSource(value) {
-    return typeof value === "string" && TIER_ASSIGNMENT_SOURCE_VALUES.includes(value);
+    return isOneOf(Object.values(TierAssignmentSources), value);
 }
 // Qualified query handler names.
 export const TierEngineQueries = {

package/dist/user/feature.js

@@ -14,6 +14,7 @@ import { userEditScreen, userListScreen } from "./screens.js";
 // Membership + tenant-specific roles live in the tenant feature.
 export function createUserFeature() {
     return defineFeature("user", (r) => {
+        r.adoptsBundledLists();
         r.describe("Manages the cross-tenant user identity: the `read_users` table holds each user's email, `displayName`, global `roles`, `emailVerified` flag, and lifecycle `status` (active / restricted / deletionRequested / deleted). Because users exist above any individual tenant, the feature runs with `r.systemScope()` \u2014 membership and tenant-specific roles live in the `tenant` feature instead. Add this feature whenever your app needs a persistent, tenant-agnostic user record that auth and GDPR pipelines can reference.");
         r.uiHints({
             displayLabel: "User Identity",

package/dist/user-data-rights/feature.js

@@ -51,6 +51,7 @@ export function createUserDataRightsFeature(opts = {}) {
     let warnedMissingMailDelivery = false;
     const showDeletion = opts.privacyCenterShowDeletion ?? true;
     return defineFeature("user-data-rights", (r) => {
+        r.adoptsBundledLists();
         r.describe('Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. When `mail-foundation` and a `mail-transport-*` are mounted, it also sends the four GDPR notifications (export ready/failed, deletion requested/executed) itself with no app callback code, rendered in each recipient’s locale. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.');
         r.uiHints({
             displayLabel: "User Data Rights \u00b7 GDPR",

package/dist/user-data-rights/index.d.ts

@@ -11,4 +11,4 @@ export type { UserExportBundle } from "./run-user-export.ts";
 export { runUserExport } from "./run-user-export.ts";
 export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.ts";
 export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, type ExportJobStatus, exportJobEntity, exportJobsTable, } from "./schema/export-job.ts";
-export { TENANT_MODEL_CONFIG_KEY } from "./web/constants.ts";
+export { TENANT_MODEL_CONFIG_KEY, USER_DATA_RIGHTS_FEATURE, UserDataRightsHandlers, UserDataRightsQueries, } from "./web/constants.ts";

package/dist/user-data-rights/index.js

@@ -15,4 +15,4 @@ export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
 export { runUserExport } from "./run-user-export.js";
 export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";
 export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, exportJobEntity, exportJobsTable, } from "./schema/export-job.js";
-export { TENANT_MODEL_CONFIG_KEY } from "./web/constants.js";
+export { TENANT_MODEL_CONFIG_KEY, USER_DATA_RIGHTS_FEATURE, UserDataRightsHandlers, UserDataRightsQueries, } from "./web/constants.js";

package/dist/user-data-rights/run-export-jobs.js

@@ -19,12 +19,11 @@
 // expiresAt + exportStorageCleanupGraceHours, so expired ZIPs do not stay in
 // storage indefinitely.
 import { addDurationSpec } from "@cosmicdrift/kumiko-framework/compliance";
-import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import { createEventStoreExecutor, createTenantDb, fetchOne, selectMany, } from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { createZipStream, tenantExportPrefix, } from "@cosmicdrift/kumiko-framework/files";
 import { resolveProfileForTenant } from "../compliance-profiles/index.js";
-import { decryptStoredPii } from "../shared/index.js";
+import { decryptStoredUserEmail } from "../shared/index.js";
 import { userTable } from "../user/index.js";
 import { selectExportJobsForStorageCleanup } from "./db/queries/export-jobs.js";
 import { runUserExport } from "./run-user-export.js";
@@ -539,8 +538,8 @@ async function lookupUserContact(db, userId) {
     const row = (await fetchOne(db, userTable, { id: userId }));
     if (!row?.email)
         return null;
-    const email = await decryptStoredPii(row.email, "email", "user-data-rights:export-ready");
-    if (email === PII_ERASED_SENTINEL)
+    const email = await decryptStoredUserEmail(row.email, "user-data-rights:export-ready");
+    if (email === null)
         return null;
     return { email, locale: row.locale ?? null };
 }

package/dist/user-data-rights/run-forget-cleanup.js

@@ -274,7 +274,8 @@ async function processUser(args) {
             // is what makes this crash-safe: eraseKey-throw → tx rollback → user
             // stays DeletionRequested → next run retries; flip-throw after a
             // successful erase → retry re-runs the idempotent hooks and eraseKey
-            // (contractually a no-op on an erased/unknown subject). Erasing after
+            // (idempotent: a repeat erase keeps the original tombstone, an unknown
+            // subject gets one). Erasing after
             // the flip instead would risk a permanent silent miss: user already
             // Deleted, no run ever picks him up again, key stays live.
             if (kms) {

package/dist/user-data-rights/web/constants.d.ts

@@ -6,13 +6,19 @@ export declare const UserDataRightsQueries: {
     readonly exportStatus: "user-data-rights:query:export-status";
     readonly myAuditLog: "user-data-rights:query:my-audit-log";
     readonly downloadByJob: "user-data-rights:query:download-by-job";
+    readonly downloadByToken: "user-data-rights:query:download-by-token";
+    readonly listDownloadAttempts: "user-data-rights:query:list-download-attempts";
 };
 export declare const TENANT_MODEL_CONFIG_KEY: "user-data-rights:config:tenant-model";
 export declare const UserDataRightsHandlers: {
     readonly requestExport: "user-data-rights:write:request-export";
     readonly requestDeletion: "user-data-rights:write:request-deletion";
+    readonly requestDeletionByEmail: "user-data-rights:write:request-deletion-by-email";
+    readonly confirmDeletionByToken: "user-data-rights:write:confirm-deletion-by-token";
     readonly cancelDeletion: "user-data-rights:write:cancel-deletion";
     readonly restrictAccount: "user-data-rights:write:restrict-account";
+    readonly liftRestriction: "user-data-rights:write:lift-restriction";
+    readonly runForgetCleanup: "user-data-rights:write:run-forget-cleanup";
 };
 export declare const USER_ME_QUERY: "user:query:user:me";
 export declare const EXPORT_JOB_STATUS: {

package/dist/user-data-rights/web/constants.js

@@ -21,6 +21,8 @@ export const UserDataRightsQueries = {
     exportStatus: "user-data-rights:query:export-status",
     myAuditLog: "user-data-rights:query:my-audit-log",
     downloadByJob: "user-data-rights:query:download-by-job",
+    downloadByToken: "user-data-rights:query:download-by-token",
+    listDownloadAttempts: "user-data-rights:query:list-download-attempts",
 };
 // App-level config: tenant-occupancy model. "single-user" tells the forget
 // pipeline that each tenant has exactly one user, so tenant-scoped contributors
@@ -31,8 +33,12 @@ export const TENANT_MODEL_CONFIG_KEY = "user-data-rights:config:tenant-model";
 export const UserDataRightsHandlers = {
     requestExport: "user-data-rights:write:request-export",
     requestDeletion: "user-data-rights:write:request-deletion",
+    requestDeletionByEmail: "user-data-rights:write:request-deletion-by-email",
+    confirmDeletionByToken: "user-data-rights:write:confirm-deletion-by-token",
     cancelDeletion: "user-data-rights:write:cancel-deletion",
     restrictAccount: "user-data-rights:write:restrict-account",
+    liftRestriction: "user-data-rights:write:lift-restriction",
+    runForgetCleanup: "user-data-rights:write:run-forget-cleanup",
 };
 // Foreign QN: the lifecycle status (active / deletionRequested / restricted)
 // comes from the user feature. Pinned locally instead of importing the user

package/dist/user-data-rights/web/index.d.ts

@@ -1,6 +1,7 @@
 export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.tsx";
 export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.tsx";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+export { UserDataRightsHandlers, UserDataRightsQueries } from "./constants.ts";
 export { defaultTranslations } from "./default-translations.ts";
 export { formatDate } from "./privacy-center-screen.tsx";
 export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";

package/dist/user-data-rights/web/index.js

@@ -5,6 +5,7 @@
 // no React/DOM dependencies.
 export { userDataRightsClient } from "./client-plugin.js";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
+export { UserDataRightsHandlers, UserDataRightsQueries } from "./constants.js";
 export { defaultTranslations } from "./default-translations.js";
 export { formatDate } from "./privacy-center-screen.js";
 export { makePublicDeletionGate } from "./public-deletion-gate.js";

package/dist/waitlist/feature.js

@@ -15,6 +15,7 @@ import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-ho
 import { WAITLIST_EXPORTED_EVENT_SHORT, WAITLIST_FEATURE, WAITLIST_PURGED_EVENT_SHORT, } from "./web/constants.js";
 export function createWaitlistFeature(opts = {}) {
     return defineFeature(WAITLIST_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
         r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
         r.systemScope();

package/dist/waitlist/handlers/export-purge.write.js

@@ -54,8 +54,9 @@ export const purgeHandler = defineWriteHandler({
                 details: { confirmCount: event.payload.confirmCount, actualCount: rows.length },
             }));
         }
-        await purgeWaitlistRows(db, rows, event.user.id);
+        // Audit first: purgeWaitlistRows shreds KMS keys, which a later failure cannot roll back.
         await appendAudit(ctx, WAITLIST_PURGED_EVENT_QN, rows.length);
+        await purgeWaitlistRows(db, rows, event.user.id);
         return { isSuccess: true, data: { purged: rows.length } };
     },
 });

package/dist/waitlist/handlers/submit.write.js

@@ -1,4 +1,4 @@
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, createSystemDbView, createTenantDb, runInSavepointIfSupported, } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -10,7 +10,7 @@ import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../web/constants.j
 // pg_advisory_xact_lock namespace (int4): 'wlst' as ASCII, disjoint from the
 // framework's other fixed advisory-lock keys.
 const SUBMIT_LOCK_NAMESPACE = 0x776c7374;
-const SUBMIT_LOCK_REASON = "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check; TenantDb has no lock API";
+const SUBMIT_LOCK_REASON = "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check and wraps the admin-recipient resolver in a savepoint so a failing statement cannot abort the submit transaction; TenantDb has neither API";
 // Logged-in callers carry no anonymous role, so every signed-in role must be listed.
 const SUBMIT_ROLES = access.roles(...access.anonymous, ...access.authenticated, "Member", "TenantAdmin");
 const OPEN_STATUSES = [WAITLIST_STATUS.Pending, WAITLIST_STATUS.Invited];
@@ -40,12 +40,17 @@ async function hasOpenEntryForEmail(email, ctx) {
     }, platformActor(), waitlistDb(ctx));
     return found.rows.length > 0;
 }
-// The resolver usually reads config; run it outside the handler transaction's
-// critical section so a failing statement cannot abort the transaction that holds
-// the entry, and a slow resolver does not extend the per-email advisory lock.
-async function resolveAdminRecipient(opts, ctx) {
+// The resolver usually reads config. It runs before the per-email advisory lock so a slow
+// resolver does not extend the lock. Postgres aborts the whole transaction after a failed
+// statement, even one whose JS error is caught here, so the resolver gets a ctx whose
+// systemDb is bound to its own savepoint: a failing statement rolls back only that.
+// Statements through any other ctx handle (ctx.query, ctx.write) stay in the handler transaction.
+async function resolveAdminRecipient(opts, ctx, systemDb, tenantId) {
     try {
-        return (await opts.notifyRecipient?.(ctx)) || null;
+        return await runInSavepointIfSupported(systemDb.unsafeRaw(SUBMIT_LOCK_REASON), async (sp) => {
+            const savepointSystemDb = createSystemDbView(createTenantDb({ db: sp, tenantId, mode: "system" }));
+            return (await opts.notifyRecipient?.({ ...ctx, systemDb: savepointSystemDb })) || null;
+        });
     }
     catch (err) {
         ctx.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
@@ -88,7 +93,7 @@ export function createSubmitHandler(opts) {
                     message: "waitlist:submit requires ctx.systemDb — is r.systemScope() set?",
                 });
             }
-            const adminRecipient = await resolveAdminRecipient(opts, ctx);
+            const adminRecipient = await resolveAdminRecipient(opts, ctx, ctx.systemDb, event.user.tenantId);
             await acquireNamespacedAdvisoryLock(ctx.systemDb.unsafeRaw(SUBMIT_LOCK_REASON), SUBMIT_LOCK_NAMESPACE, email);
             if (await hasOpenEntryForEmail(email, ctx))
                 return SUBMITTED;
@@ -124,8 +129,7 @@ export function createSubmitHandler(opts) {
                         message: payload.message,
                     }),
                     priority: "normal",
-                    // Operator-facing: the request locale, not the one the entrant picked in the form.
-                    locale: resolveWaitlistMailLocale(ctx.locale),
+                    locale: resolveWaitlistMailLocale(opts.adminLocale),
                 });
             });
             return SUBMITTED;

package/dist/waitlist/import.d.ts

@@ -1,6 +1,6 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import type { WaitlistStatus } from "./web/constants.ts";
+import { type WaitlistStatus } from "./web/constants.ts";
 export type WaitlistImportEntry = {
     /** Stable identity of the source row (e.g. `offlot:<uuid>`); the new entry id derives from it. */
     readonly sourceKey: string;
@@ -19,6 +19,8 @@ export type WaitlistImportEntry = {
 };
 export type WaitlistImportOutcome = "created" | "skipped";
 export declare function waitlistImportId(sourceKey: string): string;
+export declare function isWaitlistImportId(id: string): boolean;
+export declare function waitlistImportEntryWithinLimits(entry: WaitlistImportEntry): boolean;
 export declare function importWaitlistEntry(db: TenantDb, entry: WaitlistImportEntry, options?: {
     readonly dryRun?: boolean;
 }): Promise<WaitlistImportOutcome>;

package/dist/waitlist/import.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.js";
+import { WAITLIST_FIELD_LIMITS } from "./web/constants.js";
 // RFC 4122 name-based UUID (v5 layout, fixed namespace) so a re-run finds the entry
 // it created before without matching on encrypted personal data.
 const IMPORT_NAMESPACE = "kumiko-waitlist-import";
@@ -13,13 +14,36 @@ export function waitlistImportId(sourceKey) {
     const hex = bytes.subarray(0, 16).toString("hex");
     return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
+// The version nibble marks ids minted by waitlistImportId; legacy row ids are random UUIDs.
+export function isWaitlistImportId(id) {
+    return id[14] === "5";
+}
+// The live submit schema caps these fields; an imported value above the cap would be
+// stored but could never pass a later update through the same payload schema.
+export function waitlistImportEntryWithinLimits(entry) {
+    const limited = [
+        [entry.name, WAITLIST_FIELD_LIMITS.name],
+        [entry.email, WAITLIST_FIELD_LIMITS.email],
+        [entry.locale, WAITLIST_FIELD_LIMITS.locale],
+        [entry.company, WAITLIST_FIELD_LIMITS.company],
+        [entry.portfolio, WAITLIST_FIELD_LIMITS.portfolio],
+        [entry.message, WAITLIST_FIELD_LIMITS.message],
+    ];
+    return limited.every(([value, max]) => value === undefined || value.length <= max);
+}
 function presentOnly(fields) {
     return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
 }
-// Writes through the entity executor, so events, projection and subject encryption
-// behave exactly as for a live submit. No mail, no rate limit, no duplicate-by-email
+// Writes through the entity executor, so events and projection match a live submit; subject
+// encryption applies only when the caller configured a PII KMS (the CLI wires it from env
+// and aborts without one). No mail, no rate limit, no duplicate-by-email
 // check: the source row is the truth and the id makes the call idempotent.
 export async function importWaitlistEntry(db, entry, options = {}) {
+    if (!waitlistImportEntryWithinLimits(entry)) {
+        throw new InternalError({
+            message: `waitlist import entry ${entry.sourceKey} exceeds a field length limit`,
+        });
+    }
     const id = waitlistImportId(entry.sourceKey);
     const existing = await waitlistExecutor.detail({ id }, platformActor(), db);
     if (existing)

package/dist/waitlist/legacy-migrate.js

@@ -1,10 +1,11 @@
 import { configuredPiiSubjectKms, decryptPiiFieldValues, isPiiCiphertext, PII_ERASED_SENTINEL, } from "@cosmicdrift/kumiko-framework/crypto";
-import { countWhere, createTenantDb, selectMany, table, text as textColumn, timestamp, transaction, uuid, } from "@cosmicdrift/kumiko-framework/db";
+import { countWhere, createTenantDb, selectMany, table, tableExists, text as textColumn, timestamp, transaction, uuid, } from "@cosmicdrift/kumiko-framework/db";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { archiveStream, createArchivedStreamsTable, eventsTable, isStreamArchived, } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { importWaitlistEntry, waitlistImportId } from "./import.js";
+import { importWaitlistEntry, isWaitlistImportId, waitlistImportEntryWithinLimits, waitlistImportId, } from "./import.js";
 import { WAITLIST_STATUS } from "./web/constants.js";
+const ARCHIVED_STREAMS_TABLE = "public.kumiko_archived_streams";
 export const LEGACY_WAITLIST_SOURCES = ["offlot", "publicstatus"];
 export function isLegacyWaitlistSource(value) {
     return LEGACY_WAITLIST_SOURCES.some((known) => known === value);
@@ -152,10 +153,12 @@ async function readLegacyRows(db, from, sourceTable) {
 // new id, so a rebuild would replay the old stream next to it and bring every migrated entry back
 // twice; archived streams are excluded from replay. The offlot default source table is the entity
 // table itself, so its row ids are live entries by design and no id check can tell a wrong table.
-async function archiveLegacyStream(db, legacyId, importedId) {
+async function archiveLegacyStream(db, legacyId, importedId, dryRun) {
     if (legacyId === importedId)
         return 0;
-    if (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId))
+    // A dry run never creates the archive table, so a missing one means nothing is archived yet.
+    const archiveTableReady = !dryRun || (await tableExists(db, ARCHIVED_STREAMS_TABLE));
+    if (archiveTableReady && (await isStreamArchived(db, SYSTEM_TENANT_ID, legacyId)))
         return 0;
     const legacyEvents = await countWhere(db, eventsTable, {
         tenantId: SYSTEM_TENANT_ID,
@@ -164,6 +167,8 @@ async function archiveLegacyStream(db, legacyId, importedId) {
     });
     if (legacyEvents === 0)
         return 0;
+    if (dryRun)
+        return 1;
     await archiveStream(db, {
         tenantId: SYSTEM_TENANT_ID,
         aggregateId: legacyId,
@@ -185,10 +190,16 @@ export async function migrateLegacyWaitlist(db, options) {
     if (!options.dryRun && options.from === "offlot")
         await createArchivedStreamsTable(db);
     for (const row of rows) {
+        // The offlot default source is the entity table: rows a previous run imported
+        // are already migrated entries and must neither be re-imported nor archived.
+        if (options.from === "offlot" && isWaitlistImportId(String(row["id"]))) {
+            skipped += 1;
+            continue;
+        }
         const entry = options.from === "offlot"
             ? await mapOfflotRow(row)
             : mapPublicstatusRow(row, options.defaultLocale);
-        if (!entry) {
+        if (!entry || !waitlistImportEntryWithinLimits(entry)) {
             unreadable += 1;
             continue;
         }
@@ -200,8 +211,8 @@ export async function migrateLegacyWaitlist(db, options) {
             else
                 skipped += 1;
         });
-        if (!options.dryRun && options.from === "offlot") {
-            archivedStreams += await archiveLegacyStream(db, String(row["id"]), waitlistImportId(entry.sourceKey));
+        if (options.from === "offlot") {
+            archivedStreams += await archiveLegacyStream(db, String(row["id"]), waitlistImportId(entry.sourceKey), options.dryRun);
         }
     }
     return { read: rows.length, created, skipped, unreadable, archivedStreams };

package/dist/waitlist/link-on-signup.js

@@ -59,11 +59,14 @@ export const linkWaitlistOnSignup = async (event, tx) => {
     if (typeof user?.email !== "string")
         return;
     const email = normalizeEmail(await decryptStoredPii(user.email, "email", PII_DECRYPT_REASON));
-    const found = await waitlistExecutor.list({
-        filter: { field: "email", op: "eq", value: email },
-        filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
-    }, platformActor(), db);
-    const invited = [...found.rows].sort(newestSubmittedFirst)[0];
+    const findInvited = async () => {
+        const found = await waitlistExecutor.list({
+            filter: { field: "email", op: "eq", value: email },
+            filters: [{ field: "status", op: "in", value: [WAITLIST_STATUS.Invited] }],
+        }, platformActor(), db);
+        return [...found.rows].sort(newestSubmittedFirst)[0];
+    };
+    const invited = await findInvited();
     // skip: the signup email has no invited waitlist entry (open signup or stale invite).
     if (!invited)
         return;
@@ -71,7 +74,7 @@ export const linkWaitlistOnSignup = async (event, tx) => {
     // skip: defensive guard on the row shape.
     if (typeof id !== "string" || typeof version !== "number")
         return;
-    await waitlistExecutor.update({
+    const updated = await waitlistExecutor.update({
         id,
         version,
         changes: {
@@ -80,4 +83,13 @@ export const linkWaitlistOnSignup = async (event, tx) => {
             provisionedAt: Temporal.Now.instant(),
         },
     }, platformActor(), db);
+    // skip: linked.
+    if (updated.isSuccess)
+        return;
+    // A concurrent admin change that already moved the entry out of `invited` makes the link
+    // moot; otherwise throw so the at-least-once consumer redelivers.
+    // skip: the entry left `invited` concurrently.
+    if ((await findInvited())?.id !== id)
+        return;
+    throw new Error(`waitlist:link-on-signup: could not link waitlist entry ${id}`);
 };