@cosmicdrift/kumiko-samples 0.339.0 → 0.341.0

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -63,6 +63,13 @@ import {
   type TrialGate,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import {
+  CACHE_SYNC_TOPICS,
+  type CacheSyncBus,
+  isTierAssignmentSyncMessage,
+  type TierAssignmentSyncMessage,
+} from "@cosmicdrift/kumiko-framework/redis";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { tenantTable } from "../tenant/index.js";
@@ -80,6 +87,7 @@ import { isTrialActive, type TrialPolicy } from "./trial.js";
 // from the entity definition — same shape buildEntityTable would produce
 // in the App's drizzle/schema.generated.ts.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+const log = createFallbackLogger("tier-engine");
 
 // Event-store-executor für direct-write aus dem auto-default-tier-hook.
 // Pattern wie tenant/seeding.ts: hook sieht AppContext (kein ctx.write),
@@ -227,10 +235,9 @@ export function createTierEngineFeature<
     // Cross-tenant set + read f\u00fcr den tier-admin-Screen. tier-options liefert
     // dem Client die App-Tier-Namen aus der tierMap-Closure (sonst hartkodiert).
     //
-    // onAssigned h\u00e4lt den Resolver-Cache nach einem direkten Executor-Write
-    // warm (der den postSave-Hook NICHT feuert). Late-bind via Holder: ohne
-    // tierMap bleibt es no-op (kein Resolver), im tierMap-Block unten wird
-    // die echte Cache-Update-Funktion eingeh\u00e4ngt \u2014 analog alwaysOnHolder.
+    // onAssigned runs after commit (the direct executor write fires no postSave
+    // hook). Late-bound: without tierMap it stays a no-op, the tierMap block
+    // below installs the real cache update + publish.
     const onTierAssigned: { fn: (tenantId: TenantId, tier: string) => void } = { fn: () => {} };
     r.writeHandler(
       createSetTenantTierWrite({
@@ -312,6 +319,21 @@ export function createTierEngineFeature<
     // mergeAlwaysOn-calls — Late-bind via mutable holder, gefüllt vor allen
     // Requests (build läuft pre-listen via runDevApp/runProdApp-pickup).
     const alwaysOnHolder: { set: ReadonlySet<string> } = { set: new Set() };
+    // Bus handed to build(); hooks fire outside build and publish through it.
+    const busHolder: { bus: CacheSyncBus | undefined } = { bus: undefined };
+    // Out-of-order guard: every cache mutation or reload start takes a ticket; a
+    // reload result is applied only while its ticket is still the tenant's latest.
+    let ticketCounter = 0;
+    const latestTicket = new Map<TenantId, number>();
+    const takeTicket = (tenantId: TenantId): number => {
+      ticketCounter += 1;
+      latestTicket.set(tenantId, ticketCounter);
+      return ticketCounter;
+    };
+    const publishAssignmentChange = (tenantId: TenantId): void => {
+      const message: TierAssignmentSyncMessage = { tenantId };
+      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message);
+    };
 
     // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
     // Feature-Gate geprüft — NICHT im Resolver-Cache. Der Resolver ist
@@ -330,16 +352,16 @@ export function createTierEngineFeature<
       : new Set();
     const nowMs = (): number => getTemporal().Now.instant().epochMilliseconds;
 
-    // set-tenant-tier schreibt direkt über den Executor → der postSave-Hook
-    // unten feuert dabei NICHT. Diese Funktion repliziert den Cache-Update
-    // des Hooks, damit ein manueller Grant das effektive Feature-Set sofort
-    // ändert (nicht nur die Projektion). Selber Cache, selbe mergeAlwaysOn-
-    // Semantik wie der Hook.
-    onTierAssigned.fn = (tenantId, tier) => {
+    // Immediate local visibility on the writing pod; other pods learn via the
+    // bus and re-read the row.
+    const applyAssignment = (tenantId: TenantId, tier: string): void => {
+      takeTicket(tenantId);
       cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, tier)));
+      publishAssignmentChange(tenantId);
     };
+    onTierAssigned.fn = applyAssignment;
 
-    // Invalidation: tier-assignment events update the cache.
+    // Invalidation: tier-assignment CRUD events (e.g. the billing webhook) update the cache.
     r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
       // result.data has tenantId + tier (after entity-update merge)
       const data = result.data as { tenantId?: unknown; tier?: unknown }; // @cast-boundary engine-payload
@@ -349,14 +371,16 @@ export function createTierEngineFeature<
       // throwing — der lifecycle-pipeline darf nicht durch hook-fehler
       // blocken (afterCommit-pattern, side-effect-best-effort).
       if (typeof data.tenantId !== "string" || typeof data.tier !== "string") return;
-      const tenantId = data.tenantId as TenantId;
-      cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, data.tier)));
+      applyAssignment(data.tenantId as TenantId, data.tier);
     });
     r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
       const data = payload.data as { tenantId?: unknown }; // @cast-boundary engine-payload
       // skip: gleiche type-guard semantik wie postSave-hook oben.
       if (typeof data.tenantId !== "string") return;
-      cache.delete(data.tenantId as TenantId);
+      const tenantId = data.tenantId as TenantId;
+      takeTicket(tenantId);
+      cache.delete(tenantId);
+      publishAssignmentChange(tenantId);
     });
 
     // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
@@ -473,6 +497,60 @@ export function createTierEngineFeature<
           );
         }
 
+        // Read first, then set — never clear-then-refill: a cache miss falls back
+        // to the default tier, which would lock paying tenants out meanwhile.
+        const reloadTenant = async (tenantId: TenantId): Promise<void> => {
+          const ticket = takeTicket(tenantId);
+          const row = await fetchOne<AssignmentRow>(deps.db, tierAssignmentTable, { tenantId });
+          // skip: a newer write or reload for this tenant started meanwhile and owns the entry
+          if (latestTicket.get(tenantId) !== ticket) return;
+          if (row) {
+            cache.set(
+              tenantId,
+              mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)),
+            );
+          } else {
+            cache.delete(tenantId);
+          }
+        };
+        const reloadAllTenants = async (): Promise<void> => {
+          ticketCounter += 1;
+          const startedAtTicket = ticketCounter;
+          const current = await selectMany<AssignmentRow>(deps.db, tierAssignmentTable);
+          const loaded = new Map<TenantId, ReadonlySet<string>>();
+          for (const row of current) {
+            loaded.set(
+              row.tenantId as TenantId,
+              mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)),
+            );
+          }
+          const isNewerThanSnapshot = (tenantId: TenantId): boolean =>
+            (latestTicket.get(tenantId) ?? 0) > startedAtTicket;
+          for (const tenantId of [...cache.keys()]) {
+            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) cache.delete(tenantId);
+          }
+          for (const [tenantId, features] of loaded) {
+            if (!isNewerThanSnapshot(tenantId)) cache.set(tenantId, features);
+          }
+        };
+
+        busHolder.bus = deps.cacheSync;
+        deps.cacheSync?.subscribe(CACHE_SYNC_TOPICS.tierAssignment, (message) => {
+          // skip: malformed message from another process
+          if (!isTierAssignmentSyncMessage(message)) return;
+          reloadTenant(message.tenantId).catch((err: unknown) => {
+            log.error("tier reload failed, keeping cached set", {
+              tenantId: message.tenantId,
+              err,
+            });
+          });
+        });
+        deps.cacheSync?.onResync(() => {
+          reloadAllTenants().catch((err: unknown) => {
+            log.error("tier resync failed, keeping cached sets", { err });
+          });
+        });
+
         // Synchronous resolver-callback for dispatcher hot-path.
         const resolver = (tenantId: TenantId): ReadonlySet<string> => {
           // Operator-tooling + async-event-dispatch convention: SYSTEM_TENANT_ID

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -24,14 +24,13 @@ import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 // `source: "manual"` markiert den Grant, damit ein späterer Stripe→Tier-Sync ihn
 // nicht plättet. Upsert: ein Aggregat pro Tenant (deterministische aggregate-id).
 //
-// **Effective-Set-Invalidation (kritisch):** der Executor-Write feuert NICHT
-// den `tier-assignment:postSave`-entityHook (Hooks laufen nur im Entity-
-// Handler-Pfad, nicht bei direktem executor.create/update). Ohne Cache-Update
-// bliebe das Feature-Gate auf dem alten Tier hängen — die Projektion zeigt
-// "pro", das Gate verhält sich weiter wie "free", bis der Prozess neu startet.
-// Daher ruft der Handler nach erfolgreichem Write `opts.onAssigned(tenantId,
-// tier)`; feature.ts verdrahtet das auf denselben Cache-Update wie der Hook
-// (storage-only ohne tierMap = no-op).
+// Effective-set invalidation: the executor write does not fire the
+// `tier-assignment:postSave` entity hook, and a per-handler postSave would not
+// fire either because this handler returns no lifecycle result (kind "save").
+// Without an explicit update the feature gate would stay on the old tier, so
+// `opts.onAssigned(tenantId, tier)` runs after commit (ctx.scheduleAfterCommit).
+// feature.ts uses it to update its cache and notify the other processes; in
+// storage-only mode without a tierMap it is a no-op.
 
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEntity, {
@@ -41,9 +40,9 @@ const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEnt
 const SET_TENANT_TIER_REASON = "SystemAdmin assigns the tier of the tenant named in the payload";
 
 export type SetTenantTierOptions = {
-  /** Nach erfolgreichem Write aufgerufen, damit feature.ts den Resolver-
-   *  Cache aktualisieren kann (der Executor-Write feuert den postSave-Hook
-   *  nicht). Ohne tierMap kein Resolver → no-op. */
+  /** Runs after the write commits so feature.ts can update the resolver cache
+   *  and notify the other processes. Without a tierMap there is no resolver
+   *  and this is a no-op. */
   readonly onAssigned?: (tenantId: TenantId, tier: string) => void;
   /** Tier-Namen aus der tierMap-Closure — ohne sie (storage-only-Mode) bleibt
    *  `tier` unvalidiert außer Length/Non-Empty. Mit ihr rejected der Handler
@@ -72,6 +71,12 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
       reason: SET_TENANT_TIER_REASON,
     },
     handler: async (event, ctx) => {
+      // Without a commit sink (unit harness) there is no transaction to wait for.
+      const afterCommit = (tenantId: TenantId, tier: string): void => {
+        const notify = async (): Promise<void> => opts.onAssigned?.(tenantId, tier);
+        if (ctx.scheduleAfterCommit) ctx.scheduleAfterCommit(notify);
+        else opts.onAssigned?.(tenantId, tier);
+      };
       const tenantId = event.payload.tenantId as TenantId; // @cast-boundary engine-bridge
       const rawDb = ctx.db.unsafeRaw();
       const tdb = createTenantDb(rawDb, tenantId, "system");
@@ -91,7 +96,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
           tdb,
         );
         if (!result.isSuccess) return result;
-        opts.onAssigned?.(tenantId, tier);
+        afterCommit(tenantId, tier);
         return { isSuccess: true as const, data: { tenantId, tier, isNew: false } };
       }
 
@@ -101,7 +106,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         tdb,
       );
       if (!result.isSuccess) return result;
-      opts.onAssigned?.(tenantId, tier);
+      afterCommit(tenantId, tier);
       return { isSuccess: true as const, data: { tenantId, tier, isNew: true } };
     },
   });

package/packages/bundled-features/src/user/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.340.0",
+    "type": "improvement",
+    "title": "The last-SystemAdmin check uses jsonb containment through selectMany",
+    "detail": "Removing the SystemAdmin role still refuses to drop the last active SystemAdmin; the count now comes from `selectMany` with a roles containment filter instead of raw SQL.",
+    "migration": "keine"
+  },
   {
     "version": "0.271.0",
     "type": "improvement",
@@ -8,7 +15,7 @@
   {
     "version": "0.218.1",
     "type": "improvement",
-    "title": "user.email searchable \u2014 reindex required after upgrade",
+    "title": "user.email searchable — reindex required after upgrade",
     "detail": "email gained searchable for roster lookup. buildSearchDocument only runs on write; existing rows need reindexEntity(\"user\") (or the reindex job) plus Meili configure for the new attribute.",
     "migration": "After deploying, run reindexEntity(\"user\") (or the existing reindex job) so pre-upgrade user rows appear in roster search."
   },
@@ -16,28 +23,28 @@
     "version": "0.218.0",
     "type": "fix",
     "title": "user-list: system-scope search; membership roles on tenants; emailVerified sort",
-    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant \u2192 Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only \u2014 TenantAdmin/Admin live on membership (Team \u2192 Members)."
+    "detail": "systemScope entityList search uses SYSTEM_TENANT_ID (was session tenant → Meili miss/500). Tenants column shows membership roles (Offlot Demo (TenantAdmin)). emailVerified sortable; email also searchable for roster lookup. Global roles stay SystemAdmin-only — TenantAdmin/Admin live on membership (Team → Members)."
   },
   {
     "version": "0.217.0",
     "type": "improvement",
     "title": "user-list: roles multiSelect + tenants column; roles editable as SystemAdmin (fw#2384 follow-up)",
-    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box \u2014 SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
+    "detail": "user.roles is now createMultiSelectField (jsonb string[], options=[SystemAdmin]) so entityEdit shows a real multi-select instead of a raw JSON text box — SystemAdmins can promote another SystemAdmin from the UI. user-list columns gain roles + tenants; tenants is a derived field filled by the list handler from memberships (platform roster was unusable without tenant context). switch-tenant + auth-client parseRoles accept jsonb arrays (string-only deserialize dropped SystemAdmin on tenant switch). Soft-deleted users stay hidden by default.",
+    "migration": "Run `kumiko-schema generate` and apply — migrates read_users.roles from text to jsonb USING roles::jsonb. Existing JSON array strings (`[]`, `[\"SystemAdmin\"]`) convert cleanly. Consumers that wrote roles as a JSON-encoded string via user:create/update should pass string[] instead (parseRoles still accepts both on read)."
   },
   {
     "version": "0.167.1",
     "type": "breaking",
     "title": "user.locale no longer defaults to \"de\" (fw#1637).",
     "detail": "The entity-level default contradicted tenant-settings' own \"en\" default and silently overrode any app or tenant locale configuration for every new user. locale now stays unset until the client or a resolution chain provides one. Consumers that already fall back with `user.locale ?? \"en\"` are unaffected in shape but now see null instead of \"de\".",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain \u2014 the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
+    "migration": "Run `kumiko-schema generate` and apply — the migration emits `ALTER TABLE read_users ALTER COLUMN locale DROP DEFAULT`. Note that DROP DEFAULT only affects future inserts: existing rows keep the \"de\" the old default wrote, which no user ever chose. Your app therefore splits into pre-bump users on \"de\" and post-bump users on null, and each group resolves to a different language. Decide deliberately: either keep the old values (and state that pre-bump users stay German), or run `UPDATE read_users SET locale = NULL WHERE locale = 'de'` once so every user follows the same chain — the latter only if no UI ever let users edit the field, otherwise it erases real choices. If your app relied on the implicit German default, set an explicit fallback instead (fw#1653)."
   },
   {
     "version": "0.167.1",
     "type": "improvement",
     "title": "user.timezone field, wired into ctx.tz (fw#1636).",
     "detail": "The user entity gains a `timezone` field (createTzField, no default). buildHandlerContext passes it to ctx.tz.user; the fallback chain stays tenant.timezone, then \"UTC\". Before this, ctx.tz.tenant and ctx.tz.user both hardcoded \"UTC\" while the plumbing already accepted per-request values.",
-    "migration": "Run `kumiko-schema generate` and apply \u2014 the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
+    "migration": "Run `kumiko-schema generate` and apply — the migration adds `read_users.timezone`. No backfill: an unset timezone falls through to the tenant's, exactly as before the field existed."
   },
   {
     "version": "0.165.3",

package/packages/bundled-features/src/user/handlers/update-roles.ts

@@ -1,4 +1,4 @@
-import { asEntityTableMeta, asRawClient, fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   acquireNamespacedAdvisoryLock,
   createEventStoreExecutor,
@@ -40,10 +40,6 @@ type UserRolesRow = {
   isDeleted?: boolean;
 };
 
-function quoteIdent(name: string): string {
-  return `"${name.replace(/"/g, '""')}"`;
-}
-
 function isActiveUserRow(row: UserRolesRow): boolean {
   if (row.isDeleted === true) return false;
   return row.status === USER_STATUS.Active || !row.status;
@@ -54,21 +50,11 @@ function isActiveSystemAdminRow(row: UserRolesRow): boolean {
 }
 
 async function countOtherActiveSystemAdmins(db: DbRunner, excludeUserId: string): Promise<number> {
-  const tableName = asEntityTableMeta(userTable)?.tableName;
-  if (!tableName) {
-    throw new InternalError({ message: "user read table meta missing" });
-  }
-  // kumiko-lint-ignore raw-sql jsonb @> prefilter for SystemAdmin roster under advisory lock
-  const rows = (await asRawClient(db).unsafe(
-    `SELECT id, roles, status, is_deleted AS "isDeleted"
-     FROM ${quoteIdent(tableName)}
-     WHERE is_deleted = false
-       AND (status = $1 OR status IS NULL)
-       AND roles @> $2::jsonb`,
-    // Pass a JS array — JSON.stringify + $n::jsonb double-encodes to a jsonb string
-    // (postgres.js), so `@>` never matches a roles array.
-    [USER_STATUS.Active, ["SystemAdmin"]],
-  )) as UserRolesRow[];
+  // `roles` is a jsonb multiSelect column: a scalar filter value means `@>` containment.
+  const rows = await selectMany<UserRolesRow>(db, userTable, {
+    isDeleted: false,
+    roles: "SystemAdmin",
+  });
   return rows.filter((u) => u.id !== excludeUserId && isActiveSystemAdminRow(u)).length;
 }
 
@@ -138,9 +124,7 @@ export async function applyUserRolesUpdate(
     // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
     await acquireNamespacedAdvisoryLock(lockRunner, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
     const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(
-      ctx.systemDb.unsafeRaw(
-        "jsonb @> prefilter over the global users table to count remaining active SystemAdmins",
-      ),
+      ctx.systemDb.unsafeRaw("count remaining active SystemAdmins across the global users table"),
       event.payload.id,
     );
     if (otherActiveSystemAdmins === 0) {

package/packages/bundled-features/src/user/invited-global-roles.ts

@@ -0,0 +1,58 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbRunner,
+} from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+import { userEntity, userTable } from "./schema/user.js";
+
+const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+
+type UserRolesRow = {
+  readonly id: string;
+  readonly version: number;
+  readonly roles: readonly string[] | string | null;
+};
+
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+
+function isGlobalRole(role: string): role is GlobalRole {
+  return GLOBAL_ROLE_OPTIONS.some((option) => option === role);
+}
+
+// Reads the invitation's stored globalRoles column, keeping only assignable
+// global roles — a hand-edited row cannot smuggle "system" into users.roles.
+export function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[] {
+  return parseRoles(raw).filter(isGlobalRole);
+}
+
+// Add-only: an accepted invitation never removes a global role the user
+// already holds. Users live on SYSTEM_TENANT_ID (tenancy "global").
+export async function grantInvitedGlobalRoles(
+  db: DbRunner,
+  options: { readonly userId: string; readonly globalRoles: readonly string[] },
+) {
+  const existing = await fetchOne<UserRolesRow>(db, userTable, { id: options.userId });
+  if (!existing) return writeFailure(new NotFoundError("user", options.userId));
+
+  const currentRoles = parseRoles(existing.roles);
+  const missingRoles = options.globalRoles.filter((role) => !currentRoles.includes(role));
+  if (missingRoles.length === 0) return grantedGlobalRoles(currentRoles);
+
+  const roles = [...currentRoles, ...missingRoles];
+  const updateResult = await userExecutor.update(
+    { id: existing.id, version: existing.version, changes: { roles } },
+    createSystemUser(SYSTEM_TENANT_ID),
+    createTenantDb(db, SYSTEM_TENANT_ID, "system"),
+  );
+  if (!updateResult.isSuccess) return updateResult;
+  return grantedGlobalRoles(roles);
+}
+
+function grantedGlobalRoles(roles: readonly string[]) {
+  return { isSuccess: true, data: { roles } } as const;
+}

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -476,6 +476,9 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       method: "GET",
       path: "/user-export/by-token",
       anonymous: true,
+      // Entry point of the emailed download link; cheap static page, but
+      // anonymous and token-bearing, so bound per-IP probing.
+      rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
       handler: async (c) => {
         return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
           "content-type": "text/html; charset=utf-8",

package/packages/bundled-features/src/waitlist/changes.json

@@ -0,0 +1,17 @@
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Waitlist submit is limited per email address"
+  },
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Add waitlist bundled feature: public signup intake with admin invite and reject, GDPR export and erasure"
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Waitlist re-invite and reject no longer touch an invitee who already accepted"
+  }
+]

package/packages/bundled-features/src/waitlist/constants.ts

@@ -0,0 +1,44 @@
+// @runtime client
+// Pure string constants, safe for browser code (see auth-email-password/constants.ts).
+export const WAITLIST_FEATURE = "waitlist" as const;
+
+export const WAITLIST_STATUS = {
+  Pending: "pending",
+  Invited: "invited",
+  Rejected: "rejected",
+} as const;
+
+export type WaitlistStatus = (typeof WAITLIST_STATUS)[keyof typeof WAITLIST_STATUS];
+
+export const WaitlistHandlers = {
+  submit: "waitlist:write:submit",
+  invite: "waitlist:write:invite",
+  reject: "waitlist:write:reject",
+} as const;
+
+// Entity-convention list QN: entityList screens resolve their query by this shape.
+export const WaitlistQueries = {
+  list: "waitlist:query:waitlist-entry:list",
+} as const;
+
+export const WaitlistErrors = {
+  notInvitable: "waitlist_not_invitable",
+  notRejectable: "waitlist_not_rejectable",
+} as const;
+
+export const WAITLIST_NOTIFICATION_TYPES = {
+  confirmation: "waitlist:notify:confirmation",
+  adminNotice: "waitlist:notify:admin-notice",
+} as const;
+
+export const DEFAULT_OWN_TENANT_INVITE_ROLE = "TenantAdmin";
+
+export const WAITLIST_FIELD_LIMITS = {
+  name: 120,
+  email: 254,
+  company: 200,
+  portfolio: 200,
+  message: 2000,
+  locale: 35,
+  honeypot: 500,
+} as const;

package/packages/bundled-features/src/waitlist/entity.ts

@@ -0,0 +1,76 @@
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createLongTextField,
+  createSelectField,
+  createTextField,
+  createTimestampField,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { WAITLIST_STATUS, type WaitlistStatus } from "./constants.js";
+
+const WAITLIST_STATUS_OPTIONS = [
+  WAITLIST_STATUS.Pending,
+  WAITLIST_STATUS.Invited,
+  WAITLIST_STATUS.Rejected,
+] as const;
+
+const OPEN_WAITLIST_STATUSES: readonly WaitlistStatus[] = [
+  WAITLIST_STATUS.Pending,
+  WAITLIST_STATUS.Invited,
+];
+
+// Entries still awaiting a decision; rejected is terminal.
+export function isOpenWaitlistStatus(status: unknown): boolean {
+  return OPEN_WAITLIST_STATUSES.some((open) => open === status);
+}
+
+// An entrant has no user account, so name/email/message are personal: "self" —
+// the row's own id is its crypto-shredding subject. find: "fuzzy" keeps the
+// blind-index equality lookup (dedupe, GDPR export by email) and full-text
+// search alive; sortable stays off, the boot validator rejects it on subject fields.
+// tenancy "global" + systemStream: entries are platform-wide and live on
+// SYSTEM_TENANT_ID, which also lets the per-tenant GDPR hooks read them.
+export const waitlistEntryEntity = createEntity({
+  table: "read_waitlist_entries",
+  description:
+    "A prospect's signup on the platform waitlist, tracked through pending, invited and rejected status as admins process it; name, email and message are the entry's own personal data.",
+  systemStream: true,
+  tenancy: "global",
+  fields: {
+    name: createTextField({ required: true, personal: "self", find: "fuzzy", searchable: true }),
+    email: createTextField({ required: true, personal: "self", find: "fuzzy", searchable: true }),
+    company: createTextField({
+      personal: false,
+      reason: "is_business_data",
+      searchable: true,
+      sortable: true,
+    }),
+    portfolio: createTextField({ personal: false, reason: "is_business_data" }),
+    message: createLongTextField({ personal: "self", find: "none" }),
+    locale: createTextField({
+      required: true,
+      personal: false,
+      reason: "is_ui_language_preference",
+      sortable: true,
+    }),
+    status: createSelectField({
+      options: WAITLIST_STATUS_OPTIONS,
+      required: true,
+      default: WAITLIST_STATUS.Pending,
+      filterable: true,
+      sortable: true,
+    }),
+    submittedAt: createTimestampField({
+      personal: false,
+      sortable: true,
+      required: true,
+      reason: "is_submission_timestamp",
+    }),
+    invitedAt: createTimestampField(),
+    invitedBy: createTextField({ personal: false, reason: "is_admin_audit_id" }),
+    // Not named tenantId: that is the framework's physical tenant column.
+    linkedTenantId: createTextField({ personal: false, reason: "is_tenant_reference" }),
+  },
+});
+
+export const waitlistEntryTable = buildEntityTable("waitlistEntry", waitlistEntryEntity);

package/packages/bundled-features/src/waitlist/feature.ts

@@ -0,0 +1,50 @@
+import {
+  defineFeature,
+  EXT_USER_DATA,
+  type FeatureDefinition,
+  i18nKey,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { WAITLIST_FEATURE } from "./constants.js";
+import { waitlistEntryEntity } from "./entity.js";
+import { createInviteHandler } from "./handlers/invite.write.js";
+import { listQuery } from "./handlers/list.query.js";
+import { rejectHandler } from "./handlers/reject.write.js";
+import { createSubmitHandler } from "./handlers/submit.write.js";
+import { WAITLIST_I18N } from "./i18n.js";
+import { adminAccess } from "./lib.js";
+import type { WaitlistOptions } from "./options.js";
+import { waitlistListScreen } from "./screens.js";
+import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-hooks.js";
+
+export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefinition {
+  return defineFeature(WAITLIST_FEATURE, (r) => {
+    r.describe(
+      "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response never reveals whether an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
+    );
+    r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
+    r.systemScope();
+    r.requires("tenant", "auth-email-password", "user-data-rights");
+    r.translations({ keys: WAITLIST_I18N });
+
+    r.entity("waitlistEntry", waitlistEntryEntity);
+    r.writeHandler(createSubmitHandler(opts));
+    r.writeHandler(createInviteHandler(opts.invite));
+    r.writeHandler(rejectHandler);
+    r.queryHandler(listQuery);
+
+    r.screen(waitlistListScreen);
+    r.nav({
+      id: "waitlist",
+      label: i18nKey("waitlist.nav.waitlist"),
+      screen: "waitlist:screen:waitlist-list",
+      icon: "users",
+      order: 15,
+      access: adminAccess,
+    });
+
+    r.useExtension(EXT_USER_DATA, "waitlistEntry", {
+      export: waitlistEntryExportHook,
+      delete: waitlistEntryDeleteHook,
+    });
+  });
+}