@cosmicdrift/kumiko-bundled-features 0.388.0 → 0.389.0

package/dist/template-resolver/handlers/send-test-status.query.d.ts

@@ -1,4 +1,5 @@
 import * as z from "zod";
+import { type TemplateEditPolicy } from "../template-edit-policy.ts";
 export type SendTestStatus = {
     readonly canSend: true;
     readonly reason: null;
@@ -6,4 +7,4 @@ export type SendTestStatus = {
     readonly canSend: false;
     readonly reason: "no_channel" | "no_address";
 };
-export declare const sendTestStatusQuery: import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"send-test-status", z.ZodObject<{}, z.core.$strip>, SendTestStatus, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;
+export declare function makeSendTestStatusQuery(policy: TemplateEditPolicy): import("@cosmicdrift/kumiko-types/define-handler").QueryHandlerDefinition<"send-test-status", z.ZodObject<{}, z.core.$strip>, SendTestStatus, import("@cosmicdrift/kumiko-types/event-type-map").KumikoEventTypeMap>;

package/dist/template-resolver/handlers/send-test-status.query.js

@@ -1,18 +1,21 @@
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import * as z from "zod";
+import { templateEditAccess } from "../template-edit-policy.js";
 import { emailChannelOf, resolveTestMailAddress, testMailChannelContext, } from "./send-test-shared.js";
-export const sendTestStatusQuery = defineQueryHandler({
-    name: "send-test-status",
-    schema: z.object({}),
-    access: { roles: ["TenantAdmin", "SystemAdmin"] },
-    description: "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
-    handler: async (query, ctx) => {
-        const channel = emailChannelOf(ctx.registry);
-        if (channel === undefined)
-            return { canSend: false, reason: "no_channel" };
-        const address = await resolveTestMailAddress(channel, testMailChannelContext(ctx, query.user), query.user);
-        return address === null
-            ? { canSend: false, reason: "no_address" }
-            : { canSend: true, reason: null };
-    },
-});
+export function makeSendTestStatusQuery(policy) {
+    return defineQueryHandler({
+        name: "send-test-status",
+        schema: z.object({}),
+        access: templateEditAccess(policy.tenantEditable),
+        description: "Tells whether send-test can reach the calling user: canSend is true when an email channel is mounted and resolves an address for the caller, otherwise reason is no_channel or no_address; the address itself is never returned.",
+        handler: async (query, ctx) => {
+            const channel = emailChannelOf(ctx.registry);
+            if (channel === undefined)
+                return { canSend: false, reason: "no_channel" };
+            const address = await resolveTestMailAddress(channel, testMailChannelContext(ctx, query.user), query.user);
+            return address === null
+                ? { canSend: false, reason: "no_address" }
+                : { canSend: true, reason: null };
+        },
+    });
+}

package/dist/template-resolver/seeding.d.ts

@@ -64,4 +64,5 @@ export type LegalContentBlock = {
 export declare function seedLegalContentFromJson(db: DbConnection, blocks: readonly LegalContentBlock[], opts?: {
     readonly tenantId?: TenantId;
     readonly by?: SessionUser;
+    readonly folder?: string;
 }): Promise<void>;

package/dist/template-resolver/seeding.js

@@ -295,11 +295,13 @@ export async function seedTextBlock(db, opts) {
         status: "active",
     };
     const applyUpdate = async (row, current) => {
+        // No folder option keeps the row's folder, so a re-seed cannot drop it from the content tree.
+        const folder = opts.folder === undefined ? (current?.folder ?? null) : fields.folder;
         // Skip no-op updates so a legal re-seed on every pod boot does not bump
         // version/modifiedAt (ETag, "last changed", event-store growth).
         if (current?.title === fields.title &&
             current?.content === fields.content &&
-            current?.folder === fields.folder) {
+            current?.folder === folder) {
             return { id: String(row.id) };
         }
         const result = await executor.update({
@@ -308,7 +310,7 @@ export async function seedTextBlock(db, opts) {
             changes: {
                 title: fields.title,
                 content: fields.content,
-                folder: fields.folder,
+                folder,
                 // A re-seed must not revive an archived block; only a served one gets a new served version.
                 ...(current?.status === "active" && servedStampChanges(row)),
             },
@@ -369,6 +371,7 @@ export async function seedLegalContentFromJson(db, blocks, opts = {}) {
             locale: block.locale,
             title: block.title,
             content: block.content,
+            ...(opts.folder !== undefined && { folder: opts.folder }),
             ifExists: "update",
             by,
         });

package/dist/template-resolver/store-template-resource.js

@@ -1,14 +1,13 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { NotFoundError, UnprocessableError, writeFailure, } from "@cosmicdrift/kumiko-framework/errors";
 import { createFileRefFromUploadedBytes, uploadFileBytesBeforeTransaction, } from "@cosmicdrift/kumiko-framework/files";
-import { fileContextForTenant } from "../file-foundation/index.js";
+import { fileContextForTenant, readFileRefContent } from "../file-foundation/index.js";
 import { extensionForResourceContentType, requireForTenant } from "../shared/index.js";
 import { DEFAULT_RESOURCE_MAX_BYTES, MAX_FILE_ATTACHMENTS_PER_TEMPLATE, RESOURCE_MAX_BYTES_CONFIG_KEY, } from "./handlers/resource-shared.js";
 import { executor } from "./handlers/shared.js";
-import { attachmentEntriesOf, parseLinkedResourceEntries, templatePdfAttachmentLinkSchema, } from "./linked-resources.js";
+import { attachmentEntriesOf, isFileAttachmentEntry, parseLinkedResourceEntries, templatePdfAttachmentLinkSchema, } from "./linked-resources.js";
 import { normalizeResourceImage } from "./resource-image.js";
 import { templateResourcesTable } from "./table.js";
-import { readTemplateResource } from "./template-resources.js";
 import { ACTIVE_TEMPLATE_STATUS, SYSTEM_TENANT_ID } from "./web/constants.js";
 import { TemplateResolverErrors } from "./web/qualified-names.js";
 export async function readTemplateResourceMaxBytes(config, registry) {
@@ -143,6 +142,38 @@ export async function releaseAfterFailure(ctx, releases) {
         });
     }
 }
+// The source row's own fileName is personal data and may be ciphertext, so the copy is named from
+// the link entry or the key.
+function copiedFileName(key, entry, contentType) {
+    if (typeof entry !== "string" && isFileAttachmentEntry(entry))
+        return entry.fileName;
+    return `${key}.${extensionForResourceContentType(contentType) ?? "bin"}`;
+}
+function sourceUnreadable() {
+    return writeFailure(new UnprocessableError(TemplateResolverErrors.resourceSourceUnreadable, {
+        i18nKey: "templateResolver.errors.resource.sourceUnreadable",
+    }));
+}
+// Undefined: the fileRef row exists but its bytes cannot be read, which must not look like a
+// deleted file. The provider is chosen by the tenant of the fileRef, not by the caller's.
+async function readCopySource(ctx, fileRefId) {
+    try {
+        const found = await readFileRefContent({
+            db: ctx.db,
+            filesForTenant: (tid) => fileContextForTenant(ctx, ctx.user.tenantId, tid),
+            fileRefId,
+            allowedTenantIds: [SYSTEM_TENANT_ID, ctx.user.tenantId],
+        });
+        return found === null ? null : { contentType: found.contentType, bytes: found.content };
+    }
+    catch (cause) {
+        ctx.log?.warn("template copy: source file could not be read", {
+            fileRefId,
+            errorClass: cause instanceof Error ? cause.name : typeof cause,
+        });
+        return undefined;
+    }
+}
 // beforeTransaction half: copies the file behind every entry into the target tenant's storage, so a
 // template copied from the system default keeps working once the tenant exports it or measures its
 // attachments. An entry whose source file is gone is left out: it could not be resolved at render
@@ -157,10 +188,19 @@ export async function prepareLinkedResourceCopiesBeforeTransaction(args) {
                 copies.push({ key, entry });
                 continue;
             }
-            const file = await readTemplateResource(ctx, typeof entry === "string" ? entry : entry.fileRefId);
-            if (file === null)
+            const source = await readCopySource(ctx, typeof entry === "string" ? entry : entry.fileRefId);
+            if (source === undefined) {
+                await releaseAfterFailure(ctx, releases);
+                return sourceUnreadable();
+            }
+            // skip: the source fileRef is deleted or unknown, so there is nothing to copy
+            if (source === null)
                 continue;
-            const uploaded = await uploadToTenant({ ctx, user, tenantId }, { fileName: file.fileName, mimeType: file.contentType, data: file.bytes });
+            const uploaded = await uploadToTenant({ ctx, user, tenantId }, {
+                fileName: copiedFileName(key, entry, source.contentType),
+                mimeType: source.contentType,
+                data: source.bytes,
+            });
             if (!uploaded.isSuccess) {
                 await releaseAfterFailure(ctx, releases);
                 return uploaded;

package/dist/template-resolver/web/i18n.js

@@ -72,6 +72,8 @@ export const defaultTranslations = {
         "templateResolver.errors.patch.blockRemoved": "The block {blockId} was already removed by an earlier step.",
         "templateResolver.errors.patch.textNotFound": "The text {find} was not found in the block.",
         "templateResolver.errors.patch.textAmbiguous": "The text {find} occurs {count} times in the block; use a longer text.",
+        "templateResolver.errors.patch.textSpansFormatting": "The text {find} crosses a formatting change in the block; replace each formatted part on its own.",
+        "templateResolver.errors.patch.placeholderNotReplaceable": "The placeholder {find} cannot be replaced as text; set the text around it with another operation or remove the block.",
         "templateResolver.errors.patch.blockNotAllowed": "The block type {type} is not available in {kind} templates.",
         "templateResolver.errors.patch.blockTypeMismatch": "This step needs a {expected} block, but the block is a {actual}.",
         "templateResolver.errors.patch.invalidResourceKey": "The image key {resource} is not valid.",
@@ -86,6 +88,7 @@ export const defaultTranslations = {
         "templateResolver.errors.testMail.noAddress": "Your account has no email address to send the test mail to.",
         "templateResolver.errors.testMail.failed": "The test mail could not be sent.",
         "templateResolver.errors.resource.tooLarge": "The image is too large.",
+        "templateResolver.errors.resource.sourceUnreadable": "A file of the source template could not be read, so nothing was copied.",
         "templateResolver.errors.resource.unsupportedImage": "This file is not a supported image. Use PNG, JPEG, WebP or GIF.",
         "templateResolver.errors.template.systemResourcesNeedSystemTenant": "Resource files of system templates can only be imported or exported by a user of the system tenant.",
         "templateResolver.errors.template.bundleLocalesDiffer": "The locales of this template differ in content format or variables, so they cannot be exported as one bundle.",

package/dist/template-resolver/web/qualified-names.d.ts

@@ -53,6 +53,7 @@ export declare const TemplateResolverErrors: {
     readonly bundleLocalesDiffer: "bundle_locales_differ";
     readonly resourceTooLarge: "template_resource_too_large";
     readonly resourceUnsupportedImage: "template_resource_unsupported_image";
+    readonly resourceSourceUnreadable: "template_resource_source_unreadable";
     readonly attachmentUnsupportedType: "template_attachment_unsupported_type";
     readonly attachmentLimit: "template_attachment_limit";
     readonly attachmentInvalid: "template_attachment_invalid";

package/dist/template-resolver/web/qualified-names.js

@@ -63,6 +63,7 @@ export const TemplateResolverErrors = {
     bundleLocalesDiffer: "bundle_locales_differ",
     resourceTooLarge: "template_resource_too_large",
     resourceUnsupportedImage: "template_resource_unsupported_image",
+    resourceSourceUnreadable: "template_resource_source_unreadable",
     attachmentUnsupportedType: "template_attachment_unsupported_type",
     attachmentLimit: "template_attachment_limit",
     attachmentInvalid: "template_attachment_invalid",

package/dist/tenant/feature.js

@@ -31,6 +31,7 @@ export function collectAssignableAppRoles(features) {
 // --- Feature ---
 export function createTenantFeature(options) {
     return defineFeature("tenant", (r) => {
+        r.adoptsBundledLists();
         r.describe("Registers the three core multi-tenancy entities \u2014 `tenant`, `tenant-membership`, and `tenant-invitation` (DB tables `read_tenants`, `read_tenant_memberships`, and `read_tenant_invitations`) \u2014 along with write handlers for create/update/disable/enable/addMember/removeMember/updateMemberRoles and the matching queries. It also declares a set of per-tenant config keys (companyName, timezone, locale, SMTP credentials) and system-only keys (priceModel, maxUsers) via `r.config({ keys: { ... } })`. Use this feature in every multi-tenant app; membership resolution and invitation flows depend on it, and `auth-email-password` requires it.");
         r.uiHints({
             displayLabel: "Multi-Tenant Core",

package/dist/tenant/handlers/team-list.query.js

@@ -1,9 +1,9 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/db";
+import { isUndefinedTable, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { access, definePagedQueryHandler, MAX_LIST_LIMIT, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { errorCodeOf, isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
+import { isOneOf } from "@cosmicdrift/kumiko-types/type-guards";
 import * as z from "zod";
 import { userSessionTable } from "../../sessions/index.js";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
@@ -110,7 +110,7 @@ export const teamListQuery = definePagedQueryHandler({
                 // ponytail: lean sample apps (admin-console) mount auth without
                 // sessions — store_user_sessions never gets pushed. Integration tests
                 // may seed the table without mounting the feature; prod mounts both.
-                if (errorCodeOf(err) !== "42P01")
+                if (!isUndefinedTable(err))
                     throw err;
             }
         }

package/dist/tenant-lifecycle/stages.js

@@ -73,6 +73,27 @@ async function runTenantDataHooks(ctx) {
     }
     return total.outcome();
 }
+// A user key outlives the tenant while the user still belongs to another live tenant:
+// erasing it would tombstone the key and break every later PII write for that user.
+async function userIdsWithoutOtherLiveTenant(ctx, userIds) {
+    // skip: no members, nothing to look up.
+    if (userIds.length === 0)
+        return [];
+    const otherMemberships = (await selectMany(ctx.db, tenantMembershipsTable, {
+        userId: { in: [...userIds] },
+    })).filter((membership) => membership.tenantId !== ctx.tenantId);
+    // skip: every member belongs to this tenant only.
+    if (otherMemberships.length === 0)
+        return userIds;
+    const otherTenants = await selectMany(ctx.db, tenantTable, {
+        id: { in: [...new Set(otherMemberships.map((membership) => membership.tenantId))] },
+    });
+    const liveTenantIds = new Set(otherTenants.filter((tenant) => tenant.status !== "destroyed").map((tenant) => tenant.id));
+    const retainedUserIds = new Set(otherMemberships
+        .filter((membership) => liveTenantIds.has(membership.tenantId))
+        .map((membership) => membership.userId));
+    return userIds.filter((userId) => !retainedUserIds.has(userId));
+}
 async function eraseSubjectKeys(ctx) {
     const kms = configuredPiiSubjectKms();
     if (!kms) {
@@ -87,7 +108,7 @@ async function eraseSubjectKeys(ctx) {
     const subjects = [
         { kind: "tenant", tenantId: ctx.tenantId },
         tenantRecordSubject,
-        ...memberships.map((m) => ({ kind: "user", userId: m.userId })),
+        ...(await userIdsWithoutOtherLiveTenant(ctx, memberships.map((m) => m.userId))).map((userId) => ({ kind: "user", userId })),
     ];
     for (const subject of subjects) {
         await kms.eraseKey(subject, {

package/dist/user/feature.js

@@ -14,6 +14,7 @@ import { userEditScreen, userListScreen } from "./screens.js";
 // Membership + tenant-specific roles live in the tenant feature.
 export function createUserFeature() {
     return defineFeature("user", (r) => {
+        r.adoptsBundledLists();
         r.describe("Manages the cross-tenant user identity: the `read_users` table holds each user's email, `displayName`, global `roles`, `emailVerified` flag, and lifecycle `status` (active / restricted / deletionRequested / deleted). Because users exist above any individual tenant, the feature runs with `r.systemScope()` \u2014 membership and tenant-specific roles live in the `tenant` feature instead. Add this feature whenever your app needs a persistent, tenant-agnostic user record that auth and GDPR pipelines can reference.");
         r.uiHints({
             displayLabel: "User Identity",

package/dist/user-data-rights/feature.js

@@ -51,6 +51,7 @@ export function createUserDataRightsFeature(opts = {}) {
     let warnedMissingMailDelivery = false;
     const showDeletion = opts.privacyCenterShowDeletion ?? true;
     return defineFeature("user-data-rights", (r) => {
+        r.adoptsBundledLists();
         r.describe('Implements GDPR Art. 15 (access / `my-audit-log` query), Art. 17 (erasure / `request-deletion` + `cancel-deletion`, plus the anonymous email-verified `request-deletion-by-email` + `confirm-deletion-by-token` flow for lockout-safe self-service, + cron cleanup with grace period), Art. 18 (restriction / `restrict-account` + `lift-restriction`), and Art. 20 (portability / async `request-export` \u2192 ZIP via `file-foundation`, Magic-Link download) as first-class HTTP handlers and cron jobs. Each domain feature opts in by calling `r.useExtension(EXT_USER_DATA, "<entity>", { export, delete })` \u2014 the feature then orchestrates the export and forget pipelines across all registered hooks automatically. When `mail-foundation` and a `mail-transport-*` are mounted, it also sends the four GDPR notifications (export ready/failed, deletion requested/executed) itself with no app callback code, rendered in each recipient’s locale. Requires `user`, `data-retention`, `compliance-profiles`, and `sessions`.');
         r.uiHints({
             displayLabel: "User Data Rights \u00b7 GDPR",

package/dist/user-data-rights/index.d.ts

@@ -11,4 +11,4 @@ export type { UserExportBundle } from "./run-user-export.ts";
 export { runUserExport } from "./run-user-export.ts";
 export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.ts";
 export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, type ExportJobStatus, exportJobEntity, exportJobsTable, } from "./schema/export-job.ts";
-export { TENANT_MODEL_CONFIG_KEY } from "./web/constants.ts";
+export { TENANT_MODEL_CONFIG_KEY, USER_DATA_RIGHTS_FEATURE, UserDataRightsHandlers, UserDataRightsQueries, } from "./web/constants.ts";

package/dist/user-data-rights/index.js

@@ -15,4 +15,4 @@ export { policyToStrategy, runForgetCleanup } from "./run-forget-cleanup.js";
 export { runUserExport } from "./run-user-export.js";
 export { downloadAttemptEntity, downloadAttemptsTable } from "./schema/download-attempt.js";
 export { ACTIVE_JOB_CONSTRAINT, EXPORT_JOB_STATUS, exportJobEntity, exportJobsTable, } from "./schema/export-job.js";
-export { TENANT_MODEL_CONFIG_KEY } from "./web/constants.js";
+export { TENANT_MODEL_CONFIG_KEY, USER_DATA_RIGHTS_FEATURE, UserDataRightsHandlers, UserDataRightsQueries, } from "./web/constants.js";

package/dist/user-data-rights/web/constants.d.ts

@@ -6,13 +6,19 @@ export declare const UserDataRightsQueries: {
     readonly exportStatus: "user-data-rights:query:export-status";
     readonly myAuditLog: "user-data-rights:query:my-audit-log";
     readonly downloadByJob: "user-data-rights:query:download-by-job";
+    readonly downloadByToken: "user-data-rights:query:download-by-token";
+    readonly listDownloadAttempts: "user-data-rights:query:list-download-attempts";
 };
 export declare const TENANT_MODEL_CONFIG_KEY: "user-data-rights:config:tenant-model";
 export declare const UserDataRightsHandlers: {
     readonly requestExport: "user-data-rights:write:request-export";
     readonly requestDeletion: "user-data-rights:write:request-deletion";
+    readonly requestDeletionByEmail: "user-data-rights:write:request-deletion-by-email";
+    readonly confirmDeletionByToken: "user-data-rights:write:confirm-deletion-by-token";
     readonly cancelDeletion: "user-data-rights:write:cancel-deletion";
     readonly restrictAccount: "user-data-rights:write:restrict-account";
+    readonly liftRestriction: "user-data-rights:write:lift-restriction";
+    readonly runForgetCleanup: "user-data-rights:write:run-forget-cleanup";
 };
 export declare const USER_ME_QUERY: "user:query:user:me";
 export declare const EXPORT_JOB_STATUS: {

package/dist/user-data-rights/web/constants.js

@@ -21,6 +21,8 @@ export const UserDataRightsQueries = {
     exportStatus: "user-data-rights:query:export-status",
     myAuditLog: "user-data-rights:query:my-audit-log",
     downloadByJob: "user-data-rights:query:download-by-job",
+    downloadByToken: "user-data-rights:query:download-by-token",
+    listDownloadAttempts: "user-data-rights:query:list-download-attempts",
 };
 // App-level config: tenant-occupancy model. "single-user" tells the forget
 // pipeline that each tenant has exactly one user, so tenant-scoped contributors
@@ -31,8 +33,12 @@ export const TENANT_MODEL_CONFIG_KEY = "user-data-rights:config:tenant-model";
 export const UserDataRightsHandlers = {
     requestExport: "user-data-rights:write:request-export",
     requestDeletion: "user-data-rights:write:request-deletion",
+    requestDeletionByEmail: "user-data-rights:write:request-deletion-by-email",
+    confirmDeletionByToken: "user-data-rights:write:confirm-deletion-by-token",
     cancelDeletion: "user-data-rights:write:cancel-deletion",
     restrictAccount: "user-data-rights:write:restrict-account",
+    liftRestriction: "user-data-rights:write:lift-restriction",
+    runForgetCleanup: "user-data-rights:write:run-forget-cleanup",
 };
 // Foreign QN: the lifecycle status (active / deletionRequested / restricted)
 // comes from the user feature. Pinned locally instead of importing the user

package/dist/user-data-rights/web/index.d.ts

@@ -1,6 +1,7 @@
 export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.tsx";
 export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.tsx";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+export { UserDataRightsHandlers, UserDataRightsQueries } from "./constants.ts";
 export { defaultTranslations } from "./default-translations.ts";
 export { formatDate } from "./privacy-center-screen.tsx";
 export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";

package/dist/user-data-rights/web/index.js

@@ -5,6 +5,7 @@
 // no React/DOM dependencies.
 export { userDataRightsClient } from "./client-plugin.js";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.js";
+export { UserDataRightsHandlers, UserDataRightsQueries } from "./constants.js";
 export { defaultTranslations } from "./default-translations.js";
 export { formatDate } from "./privacy-center-screen.js";
 export { makePublicDeletionGate } from "./public-deletion-gate.js";

package/dist/waitlist/feature.js

@@ -15,6 +15,7 @@ import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-ho
 import { WAITLIST_EXPORTED_EVENT_SHORT, WAITLIST_FEATURE, WAITLIST_PURGED_EVENT_SHORT, } from "./web/constants.js";
 export function createWaitlistFeature(opts = {}) {
     return defineFeature(WAITLIST_FEATURE, (r) => {
+        r.adoptsBundledLists();
         r.describe("Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.");
         r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
         r.systemScope();

package/dist/waitlist/handlers/submit.write.js

@@ -1,4 +1,4 @@
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { acquireNamespacedAdvisoryLock, createSystemDbView, createTenantDb, runInSavepointIfSupported, } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler, } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
@@ -10,7 +10,7 @@ import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../web/constants.j
 // pg_advisory_xact_lock namespace (int4): 'wlst' as ASCII, disjoint from the
 // framework's other fixed advisory-lock keys.
 const SUBMIT_LOCK_NAMESPACE = 0x776c7374;
-const SUBMIT_LOCK_REASON = "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check; TenantDb has no lock API";
+const SUBMIT_LOCK_REASON = "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check and wraps the admin-recipient resolver in a savepoint so a failing statement cannot abort the submit transaction; TenantDb has neither API";
 // Logged-in callers carry no anonymous role, so every signed-in role must be listed.
 const SUBMIT_ROLES = access.roles(...access.anonymous, ...access.authenticated, "Member", "TenantAdmin");
 const OPEN_STATUSES = [WAITLIST_STATUS.Pending, WAITLIST_STATUS.Invited];
@@ -40,13 +40,17 @@ async function hasOpenEntryForEmail(email, ctx) {
     }, platformActor(), waitlistDb(ctx));
     return found.rows.length > 0;
 }
-// The resolver usually reads config. It runs before the per-email advisory lock so a
-// slow resolver does not extend the lock. It still shares the handler transaction: a
-// thrown JS error is swallowed here, but a failed SQL statement inside it would abort
-// the transaction, so resolvers must not issue statements that can fail.
-async function resolveAdminRecipient(opts, ctx) {
+// The resolver usually reads config. It runs before the per-email advisory lock so a slow
+// resolver does not extend the lock. Postgres aborts the whole transaction after a failed
+// statement, even one whose JS error is caught here, so the resolver gets a ctx whose
+// systemDb is bound to its own savepoint: a failing statement rolls back only that.
+// Statements through any other ctx handle (ctx.query, ctx.write) stay in the handler transaction.
+async function resolveAdminRecipient(opts, ctx, systemDb, tenantId) {
     try {
-        return (await opts.notifyRecipient?.(ctx)) || null;
+        return await runInSavepointIfSupported(systemDb.unsafeRaw(SUBMIT_LOCK_REASON), async (sp) => {
+            const savepointSystemDb = createSystemDbView(createTenantDb({ db: sp, tenantId, mode: "system" }));
+            return (await opts.notifyRecipient?.({ ...ctx, systemDb: savepointSystemDb })) || null;
+        });
     }
     catch (err) {
         ctx.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
@@ -89,7 +93,7 @@ export function createSubmitHandler(opts) {
                     message: "waitlist:submit requires ctx.systemDb — is r.systemScope() set?",
                 });
             }
-            const adminRecipient = await resolveAdminRecipient(opts, ctx);
+            const adminRecipient = await resolveAdminRecipient(opts, ctx, ctx.systemDb, event.user.tenantId);
             await acquireNamespacedAdvisoryLock(ctx.systemDb.unsafeRaw(SUBMIT_LOCK_REASON), SUBMIT_LOCK_NAMESPACE, email);
             if (await hasOpenEntryForEmail(email, ctx))
                 return SUBMITTED;

package/dist/waitlist/import.d.ts

@@ -1,6 +1,6 @@
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import type { WaitlistStatus } from "./web/constants.ts";
+import { type WaitlistStatus } from "./web/constants.ts";
 export type WaitlistImportEntry = {
     /** Stable identity of the source row (e.g. `offlot:<uuid>`); the new entry id derives from it. */
     readonly sourceKey: string;
@@ -20,6 +20,7 @@ export type WaitlistImportEntry = {
 export type WaitlistImportOutcome = "created" | "skipped";
 export declare function waitlistImportId(sourceKey: string): string;
 export declare function isWaitlistImportId(id: string): boolean;
+export declare function waitlistImportEntryWithinLimits(entry: WaitlistImportEntry): boolean;
 export declare function importWaitlistEntry(db: TenantDb, entry: WaitlistImportEntry, options?: {
     readonly dryRun?: boolean;
 }): Promise<WaitlistImportOutcome>;

package/dist/waitlist/import.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.js";
+import { WAITLIST_FIELD_LIMITS } from "./web/constants.js";
 // RFC 4122 name-based UUID (v5 layout, fixed namespace) so a re-run finds the entry
 // it created before without matching on encrypted personal data.
 const IMPORT_NAMESPACE = "kumiko-waitlist-import";
@@ -17,13 +18,32 @@ export function waitlistImportId(sourceKey) {
 export function isWaitlistImportId(id) {
     return id[14] === "5";
 }
+// The live submit schema caps these fields; an imported value above the cap would be
+// stored but could never pass a later update through the same payload schema.
+export function waitlistImportEntryWithinLimits(entry) {
+    const limited = [
+        [entry.name, WAITLIST_FIELD_LIMITS.name],
+        [entry.email, WAITLIST_FIELD_LIMITS.email],
+        [entry.locale, WAITLIST_FIELD_LIMITS.locale],
+        [entry.company, WAITLIST_FIELD_LIMITS.company],
+        [entry.portfolio, WAITLIST_FIELD_LIMITS.portfolio],
+        [entry.message, WAITLIST_FIELD_LIMITS.message],
+    ];
+    return limited.every(([value, max]) => value === undefined || value.length <= max);
+}
 function presentOnly(fields) {
     return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
 }
-// Writes through the entity executor, so events, projection and subject encryption
-// behave exactly as for a live submit. No mail, no rate limit, no duplicate-by-email
+// Writes through the entity executor, so events and projection match a live submit; subject
+// encryption applies only when the caller configured a PII KMS (the CLI wires it from env
+// and aborts without one). No mail, no rate limit, no duplicate-by-email
 // check: the source row is the truth and the id makes the call idempotent.
 export async function importWaitlistEntry(db, entry, options = {}) {
+    if (!waitlistImportEntryWithinLimits(entry)) {
+        throw new InternalError({
+            message: `waitlist import entry ${entry.sourceKey} exceeds a field length limit`,
+        });
+    }
     const id = waitlistImportId(entry.sourceKey);
     const existing = await waitlistExecutor.detail({ id }, platformActor(), db);
     if (existing)

package/dist/waitlist/legacy-migrate.js

@@ -3,7 +3,7 @@ import { countWhere, createTenantDb, selectMany, table, tableExists, text as tex
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { archiveStream, createArchivedStreamsTable, eventsTable, isStreamArchived, } from "@cosmicdrift/kumiko-framework/event-store";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
-import { importWaitlistEntry, isWaitlistImportId, waitlistImportId, } from "./import.js";
+import { importWaitlistEntry, isWaitlistImportId, waitlistImportEntryWithinLimits, waitlistImportId, } from "./import.js";
 import { WAITLIST_STATUS } from "./web/constants.js";
 const ARCHIVED_STREAMS_TABLE = "public.kumiko_archived_streams";
 export const LEGACY_WAITLIST_SOURCES = ["offlot", "publicstatus"];
@@ -199,7 +199,7 @@ export async function migrateLegacyWaitlist(db, options) {
         const entry = options.from === "offlot"
             ? await mapOfflotRow(row)
             : mapPublicstatusRow(row, options.defaultLocale);
-        if (!entry) {
+        if (!entry || !waitlistImportEntryWithinLimits(entry)) {
             unreadable += 1;
             continue;
         }

package/dist/waitlist/options.d.ts

@@ -14,7 +14,8 @@ export type WaitlistInviteOptions = {
 export type WaitlistOptions = {
     /** Address for an admin notification mail on each new entry. Null, an empty
      *  string or an absent option sends none. Best effort, never fails the submit,
-     *  also when the resolver throws or rejects. */
+     *  also when the resolver throws or rejects. `ctx.systemDb` is bound to a savepoint, so a
+     *  failing statement through it is rolled back without aborting the submit transaction. */
     readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
     /** Language of the admin notice mail (en, de or es; anything else falls back to en).
      *  Not taken from the request: a submit comes from the entrant, not the operator. */

package/dist/workflow-runner/handlers/resume-run.write.js

@@ -143,7 +143,7 @@ function readTriggerSource(startedPayload) {
     return null;
 }
 async function loadReferencedEvent(ctx, ref) {
-    const events = await ctx.loadAggregate(ref.aggregateId);
+    const events = await ctx.loadAggregate(ref.aggregateId, { atVersion: ref.version });
     return events.find((e) => e.id === ref.eventId);
 }
 async function recoverTriggerEvent(ctx, runEvents, runId, user) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.388.0",
+  "version": "0.389.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "MIT",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -548,9 +548,9 @@
     }
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-framework": "0.388.0",
-    "@cosmicdrift/kumiko-renderer": "0.388.0",
-    "@cosmicdrift/kumiko-types": "0.388.0",
+    "@cosmicdrift/kumiko-framework": "0.389.0",
+    "@cosmicdrift/kumiko-renderer": "0.389.0",
+    "@cosmicdrift/kumiko-types": "0.389.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@tiptap/core": "3.31.3",
@@ -1124,17 +1124,17 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.388.0",
-    "@cosmicdrift/kumiko-locale-es": "0.388.0",
-    "@cosmicdrift/kumiko-locale-fr": "0.388.0",
-    "@cosmicdrift/kumiko-locale-it": "0.388.0",
-    "@cosmicdrift/kumiko-renderer-mail-html": "0.388.0",
+    "@cosmicdrift/kumiko-locale-de": "0.389.0",
+    "@cosmicdrift/kumiko-locale-es": "0.389.0",
+    "@cosmicdrift/kumiko-locale-fr": "0.389.0",
+    "@cosmicdrift/kumiko-locale-it": "0.389.0",
+    "@cosmicdrift/kumiko-renderer-mail-html": "0.389.0",
     "jsqr": "^1.4.0",
     "unpdf": "^1.8.1",
-    "@cosmicdrift/kumiko-testing": "0.388.0"
+    "@cosmicdrift/kumiko-testing": "0.389.0"
   },
   "peerDependencies": {
-    "@cosmicdrift/kumiko-testing": "0.388.0"
+    "@cosmicdrift/kumiko-testing": "0.389.0"
   },
   "peerDependenciesMeta": {
     "@cosmicdrift/kumiko-testing": {

package/src/agent-tools/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Local agent tool errors carry a code",
+    "detail": "dispatchToolCall returns code invalid_tool_call for validation errors and unknown_tool for an unknown tool name, instead of a result without code. TOOL_CALL_ERROR_CODES names both."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/src/auth-email-password/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "Optional returnTo for password reset and signup",
+    "detail": "Password reset and signup accept an optional returnTo path. A safe value (same-origin path, no dot segments) is appended to the mailed link as a query parameter, the reset and signup-complete screens follow it, and the login screen forwards its next to the forgot-password and signup links. Invalid values are dropped silently and never block the mail. isSafeReturnPath and readReturnToFromSearch are exported from the web barrel. isSafeNextPath now uses the same check, so a next with a dot segment such as \"/a/../b\" is no longer followed."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "CurrentUser carries tenantId, logout clears remembered list state",
+    "detail": "The session CurrentUser has an optional tenantId used to scope remembered list state; logout removes all kumiko.list.* storage entries."
+  },
   {
     "version": "0.385.0",
     "type": "improvement",