@cosmicdrift/kumiko-samples 0.340.0 → 0.341.0

package/packages/bundled-features/src/secrets/write-gate.ts

@@ -6,6 +6,7 @@ import type {
 import {
   AccessDeniedError,
   NotFoundError,
+  ValidationError,
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
@@ -60,3 +61,43 @@ export function checkSecretKeyWrite(
   }
   return { ok: true, keyDef };
 }
+
+// The registry surface the value check needs; lets ctx.secrets validate without a full Registry.
+export type SecretValueSchemaSource = Pick<Registry, "getSecretKey" | "findSecretNamespace">;
+
+// Carries neither the value nor the schema's issues.
+export function invalidSecretValueError(): ValidationError {
+  return new ValidationError(
+    {
+      fields: [
+        {
+          path: "value",
+          code: "invalid_secret_value",
+          i18nKey: "secrets.errors.invalidValue",
+        },
+      ],
+    },
+    { i18nKey: "secrets.errors.invalidValue" },
+  );
+}
+
+export function isSecretValueValid(
+  schemas: SecretValueSchemaSource,
+  key: string,
+  value: string,
+): boolean {
+  const valueSchema =
+    schemas.getSecretKey(key)?.valueSchema ?? schemas.findSecretNamespace(key)?.valueSchema;
+  return valueSchema === undefined || valueSchema.safeParse(value).success;
+}
+
+// Runs after checkSecretKeyWrite, so a caller without the write role never learns
+// whether a value would have passed.
+export function checkSecretValue(
+  registry: SecretValueSchemaSource,
+  key: string,
+  value: string,
+): WriteFailure | undefined {
+  if (isSecretValueValid(registry, key, value)) return undefined;
+  return writeFailure(invalidSecretValueError());
+}

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Harden system role, invitations query, tenant teardown and addMember",
+    "detail": "The system role can no longer be minted into a session through a user's global roles. invitations.query returns an explicit field allowlist and exposes globalRoles only to a SystemAdmin. The tenant destruction sweep waits 60 seconds after the grace period ends so the teardown gate can settle. Behaviour change: tenant:write:addMember now adds members to a foreign tenant only from the framework system context; a SystemAdmin request user is limited to their own tenant and gets 403 otherwise."
+  },
   {
     "version": "0.336.1",
     "type": "fix",

package/packages/bundled-features/src/tenant/constants.ts

@@ -75,4 +75,5 @@ export const TenantErrors = {
   membershipAlreadyExists: "membership_already_exists",
   lastTenantAdmin: "last_tenant_admin",
   invitationSuperseded: "invitation_superseded",
+  crossTenantMembershipDenied: "cross_tenant_membership_denied",
 } as const;

package/packages/bundled-features/src/tenant/handlers/add-member.write.ts

@@ -1,7 +1,17 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
-import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
-import { ConflictError, InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import {
+  defineWriteHandler,
+  type SessionUser,
+  SYSTEM_ROLE,
+  SYSTEM_USER_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
+import {
+  AccessDeniedError,
+  ConflictError,
+  InternalError,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { TenantErrors } from "../constants.js";
 import { findForbiddenMembershipRole, reservedMembershipRoleError } from "../membership-roles.js";
@@ -11,6 +21,12 @@ const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembersh
   entityName: "tenant-membership",
 });
 
+// Both halves: test stacks can mint JWTs with the "system" role, but only the
+// framework operator carries SYSTEM_USER_ID.
+function isFrameworkSystemUser(user: SessionUser): boolean {
+  return user.id === SYSTEM_USER_ID && user.roles.includes(SYSTEM_ROLE);
+}
+
 export const addMemberWrite = defineWriteHandler({
   name: "addMember",
   schema: z.object({
@@ -18,7 +34,7 @@ export const addMemberWrite = defineWriteHandler({
     tenantId: z.string(),
     roles: z.array(z.string()).min(1),
   }),
-  access: { roles: ["SystemAdmin"] },
+  access: { roles: [SYSTEM_ROLE, "SystemAdmin"] },
   description:
     "Grants an existing user membership in a tenant with the given roles, refusing reserved role names and a user who is already a member; use it to add someone to a workspace without going through an invitation.",
   handler: async (event, ctx) => {
@@ -31,6 +47,14 @@ export const addMemberWrite = defineWriteHandler({
     const db = ctx.systemDb.acknowledgeCrossTenant(
       "SystemAdmin manages memberships across tenants",
     );
+    if (!isFrameworkSystemUser(event.user) && event.payload.tenantId !== event.user.tenantId) {
+      return writeFailure(
+        new AccessDeniedError({
+          message: "only the system context may add members to another tenant",
+          details: { reason: TenantErrors.crossTenantMembershipDenied },
+        }),
+      );
+    }
     const forbidden = findForbiddenMembershipRole(event.payload.roles);
     if (forbidden !== undefined) return writeFailure(reservedMembershipRoleError(forbidden));
     const existing = await fetchOne(db, tenantMembershipsTable, {

package/packages/bundled-features/src/tenant/handlers/invitations.query.ts

@@ -4,6 +4,7 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { decryptStoredPii, mapWithConcurrency } from "../../shared/index.js";
 import { INVITATION_STATUS, tenantInvitationsTable } from "../invitation-table.js";
+import { isSystemAdmin } from "./is-system-admin.js";
 
 // Bounded, not Promise.all/sequential: each decrypt hits the KMS adapter's
 // own small dedicated pool (PgKmsAdapter default max: 4). Promise.all fires
@@ -52,7 +53,20 @@ export const invitationsQuery = defineQueryHandler({
         typeof invitedBy === "string"
           ? await decryptStoredPii(invitedBy, "invitedBy", "tenant:invitations")
           : invitedBy;
-      return { ...row, email: decryptedEmail, invitedBy: decryptedInvitedBy };
+      // Explicit allowlist: the raw row also carries blind-index columns and
+      // globalRoles, which only a SystemAdmin may see.
+      return {
+        id: row["id"],
+        tenantId: row["tenantId"],
+        email: decryptedEmail,
+        role: row["role"],
+        status: row["status"],
+        invitedBy: decryptedInvitedBy,
+        expiresAt: row["expiresAt"],
+        insertedAt: row["insertedAt"],
+        version: row["version"],
+        ...(isSystemAdmin(query.user) && { globalRoles: row["globalRoles"] }),
+      };
     });
   },
 });

package/packages/bundled-features/src/tenant/index.ts

@@ -1,3 +1,4 @@
+export { cancelPendingInvitation } from "./cancel-pending-invitation.js";
 export { TenantCommandSchemas } from "./command-schemas.js";
 export {
   OWNER_INVITE_ROLE_OPTIONS,

package/packages/bundled-features/src/tenant/invitation-table.ts

@@ -25,10 +25,13 @@
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
+  createMultiSelectField,
   createSelectField,
   createTextField,
   createTimestampField,
 } from "@cosmicdrift/kumiko-framework/engine";
+// kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
+import { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
 
 // Status-const-Object damit Handler-Code keine Magic-Strings nutzt.
 // Bei rename (z.B. "cancelled" → "revoked") fällt jeder caller auf
@@ -67,6 +70,13 @@ export const tenantInvitationEntity = createEntity({
       personal: false,
       reason: "technical_reference",
     }),
+    // Global (users.roles) roles granted on accept, on top of the membership
+    // role. Only the system-only invite variant sets them; every tenant-admin
+    // re-invite resets them to [] so a resend can never carry them over.
+    globalRoles: createMultiSelectField({
+      options: GLOBAL_ROLE_OPTIONS,
+      default: [],
+    }),
     // Lifecycle-State. Default "pending"; transitions:
     //   pending → accepted | cancelled | expired
     status: createSelectField({

package/packages/bundled-features/src/tenant-lifecycle/lifecycle-gate.ts

@@ -23,6 +23,8 @@ export type TenantLifecycleGate = {
 // (cached as null) must not grow the Map without bound: past the cap, expired
 // entries are swept and, if still full, the oldest-inserted entries are evicted.
 const GATE_TTL_MS = 3000;
+// Covers other pods' GATE_TTL_MS plus requests still in flight when the grace period (0 under a compliance override) ends.
+export const TEARDOWN_GATE_SETTLE_MS = 60_000;
 /** @internal exported for the bounded-cache test */
 export const GATE_CACHE_MAX_ENTRIES = 5000;
 const gateCache = new Map<

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -26,7 +26,7 @@ import {
   TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
   TENANT_DESTRUCTION_STARTED_EVENT_SHORT,
 } from "./constants.js";
-import { invalidateTenantLifecycleGate } from "./lifecycle-gate.js";
+import { invalidateTenantLifecycleGate, TEARDOWN_GATE_SETTLE_MS } from "./lifecycle-gate.js";
 import {
   type DestructionStageCtx,
   isDestructionPipelineComplete,
@@ -321,7 +321,7 @@ export async function runTenantDestructionSweep(args: {
   const now = args.now ?? T.Now.instant();
   const due = await selectMany<{ id: string }>(args.db, tenantTable, {
     status: "destroyRequested",
-    gracePeriodEnd: { lte: now },
+    gracePeriodEnd: { lte: now.subtract({ milliseconds: TEARDOWN_GATE_SETTLE_MS }) },
   });
 
   let triggered = 0;

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -63,6 +63,13 @@ import {
   type TrialGate,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { getUnscopedAggregateStreamMaxVersion } from "@cosmicdrift/kumiko-framework/event-store";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
+import {
+  CACHE_SYNC_TOPICS,
+  type CacheSyncBus,
+  isTierAssignmentSyncMessage,
+  type TierAssignmentSyncMessage,
+} from "@cosmicdrift/kumiko-framework/redis";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { tenantTable } from "../tenant/index.js";
@@ -80,6 +87,7 @@ import { isTrialActive, type TrialPolicy } from "./trial.js";
 // from the entity definition — same shape buildEntityTable would produce
 // in the App's drizzle/schema.generated.ts.
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
+const log = createFallbackLogger("tier-engine");
 
 // Event-store-executor für direct-write aus dem auto-default-tier-hook.
 // Pattern wie tenant/seeding.ts: hook sieht AppContext (kein ctx.write),
@@ -227,10 +235,9 @@ export function createTierEngineFeature<
     // Cross-tenant set + read f\u00fcr den tier-admin-Screen. tier-options liefert
     // dem Client die App-Tier-Namen aus der tierMap-Closure (sonst hartkodiert).
     //
-    // onAssigned h\u00e4lt den Resolver-Cache nach einem direkten Executor-Write
-    // warm (der den postSave-Hook NICHT feuert). Late-bind via Holder: ohne
-    // tierMap bleibt es no-op (kein Resolver), im tierMap-Block unten wird
-    // die echte Cache-Update-Funktion eingeh\u00e4ngt \u2014 analog alwaysOnHolder.
+    // onAssigned runs after commit (the direct executor write fires no postSave
+    // hook). Late-bound: without tierMap it stays a no-op, the tierMap block
+    // below installs the real cache update + publish.
     const onTierAssigned: { fn: (tenantId: TenantId, tier: string) => void } = { fn: () => {} };
     r.writeHandler(
       createSetTenantTierWrite({
@@ -312,6 +319,21 @@ export function createTierEngineFeature<
     // mergeAlwaysOn-calls — Late-bind via mutable holder, gefüllt vor allen
     // Requests (build läuft pre-listen via runDevApp/runProdApp-pickup).
     const alwaysOnHolder: { set: ReadonlySet<string> } = { set: new Set() };
+    // Bus handed to build(); hooks fire outside build and publish through it.
+    const busHolder: { bus: CacheSyncBus | undefined } = { bus: undefined };
+    // Out-of-order guard: every cache mutation or reload start takes a ticket; a
+    // reload result is applied only while its ticket is still the tenant's latest.
+    let ticketCounter = 0;
+    const latestTicket = new Map<TenantId, number>();
+    const takeTicket = (tenantId: TenantId): number => {
+      ticketCounter += 1;
+      latestTicket.set(tenantId, ticketCounter);
+      return ticketCounter;
+    };
+    const publishAssignmentChange = (tenantId: TenantId): void => {
+      const message: TierAssignmentSyncMessage = { tenantId };
+      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message);
+    };
 
     // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
     // Feature-Gate geprüft — NICHT im Resolver-Cache. Der Resolver ist
@@ -330,16 +352,16 @@ export function createTierEngineFeature<
       : new Set();
     const nowMs = (): number => getTemporal().Now.instant().epochMilliseconds;
 
-    // set-tenant-tier schreibt direkt über den Executor → der postSave-Hook
-    // unten feuert dabei NICHT. Diese Funktion repliziert den Cache-Update
-    // des Hooks, damit ein manueller Grant das effektive Feature-Set sofort
-    // ändert (nicht nur die Projektion). Selber Cache, selbe mergeAlwaysOn-
-    // Semantik wie der Hook.
-    onTierAssigned.fn = (tenantId, tier) => {
+    // Immediate local visibility on the writing pod; other pods learn via the
+    // bus and re-read the row.
+    const applyAssignment = (tenantId: TenantId, tier: string): void => {
+      takeTicket(tenantId);
       cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, tier)));
+      publishAssignmentChange(tenantId);
     };
+    onTierAssigned.fn = applyAssignment;
 
-    // Invalidation: tier-assignment events update the cache.
+    // Invalidation: tier-assignment CRUD events (e.g. the billing webhook) update the cache.
     r.hook("postSave", { allOf: "tier-assignment" }, async (result) => {
       // result.data has tenantId + tier (after entity-update merge)
       const data = result.data as { tenantId?: unknown; tier?: unknown }; // @cast-boundary engine-payload
@@ -349,14 +371,16 @@ export function createTierEngineFeature<
       // throwing — der lifecycle-pipeline darf nicht durch hook-fehler
       // blocken (afterCommit-pattern, side-effect-best-effort).
       if (typeof data.tenantId !== "string" || typeof data.tier !== "string") return;
-      const tenantId = data.tenantId as TenantId;
-      cache.set(tenantId, mergeAlwaysOn(alwaysOnHolder.set, featuresForTier(tierMap, data.tier)));
+      applyAssignment(data.tenantId as TenantId, data.tier);
     });
     r.hook("postDelete", { allOf: "tier-assignment" }, async (payload) => {
       const data = payload.data as { tenantId?: unknown }; // @cast-boundary engine-payload
       // skip: gleiche type-guard semantik wie postSave-hook oben.
       if (typeof data.tenantId !== "string") return;
-      cache.delete(data.tenantId as TenantId);
+      const tenantId = data.tenantId as TenantId;
+      takeTicket(tenantId);
+      cache.delete(tenantId);
+      publishAssignmentChange(tenantId);
     });
 
     // Auto-default-tier-on-tenant-signup: hook fires inTransaction (atomic
@@ -473,6 +497,60 @@ export function createTierEngineFeature<
           );
         }
 
+        // Read first, then set — never clear-then-refill: a cache miss falls back
+        // to the default tier, which would lock paying tenants out meanwhile.
+        const reloadTenant = async (tenantId: TenantId): Promise<void> => {
+          const ticket = takeTicket(tenantId);
+          const row = await fetchOne<AssignmentRow>(deps.db, tierAssignmentTable, { tenantId });
+          // skip: a newer write or reload for this tenant started meanwhile and owns the entry
+          if (latestTicket.get(tenantId) !== ticket) return;
+          if (row) {
+            cache.set(
+              tenantId,
+              mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)),
+            );
+          } else {
+            cache.delete(tenantId);
+          }
+        };
+        const reloadAllTenants = async (): Promise<void> => {
+          ticketCounter += 1;
+          const startedAtTicket = ticketCounter;
+          const current = await selectMany<AssignmentRow>(deps.db, tierAssignmentTable);
+          const loaded = new Map<TenantId, ReadonlySet<string>>();
+          for (const row of current) {
+            loaded.set(
+              row.tenantId as TenantId,
+              mergeAlwaysOn(computedAlwaysOn, featuresForTier(tierMap, row.tier)),
+            );
+          }
+          const isNewerThanSnapshot = (tenantId: TenantId): boolean =>
+            (latestTicket.get(tenantId) ?? 0) > startedAtTicket;
+          for (const tenantId of [...cache.keys()]) {
+            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) cache.delete(tenantId);
+          }
+          for (const [tenantId, features] of loaded) {
+            if (!isNewerThanSnapshot(tenantId)) cache.set(tenantId, features);
+          }
+        };
+
+        busHolder.bus = deps.cacheSync;
+        deps.cacheSync?.subscribe(CACHE_SYNC_TOPICS.tierAssignment, (message) => {
+          // skip: malformed message from another process
+          if (!isTierAssignmentSyncMessage(message)) return;
+          reloadTenant(message.tenantId).catch((err: unknown) => {
+            log.error("tier reload failed, keeping cached set", {
+              tenantId: message.tenantId,
+              err,
+            });
+          });
+        });
+        deps.cacheSync?.onResync(() => {
+          reloadAllTenants().catch((err: unknown) => {
+            log.error("tier resync failed, keeping cached sets", { err });
+          });
+        });
+
         // Synchronous resolver-callback for dispatcher hot-path.
         const resolver = (tenantId: TenantId): ReadonlySet<string> => {
           // Operator-tooling + async-event-dispatch convention: SYSTEM_TENANT_ID

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -24,14 +24,13 @@ import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 // `source: "manual"` markiert den Grant, damit ein späterer Stripe→Tier-Sync ihn
 // nicht plättet. Upsert: ein Aggregat pro Tenant (deterministische aggregate-id).
 //
-// **Effective-Set-Invalidation (kritisch):** der Executor-Write feuert NICHT
-// den `tier-assignment:postSave`-entityHook (Hooks laufen nur im Entity-
-// Handler-Pfad, nicht bei direktem executor.create/update). Ohne Cache-Update
-// bliebe das Feature-Gate auf dem alten Tier hängen — die Projektion zeigt
-// "pro", das Gate verhält sich weiter wie "free", bis der Prozess neu startet.
-// Daher ruft der Handler nach erfolgreichem Write `opts.onAssigned(tenantId,
-// tier)`; feature.ts verdrahtet das auf denselben Cache-Update wie der Hook
-// (storage-only ohne tierMap = no-op).
+// Effective-set invalidation: the executor write does not fire the
+// `tier-assignment:postSave` entity hook, and a per-handler postSave would not
+// fire either because this handler returns no lifecycle result (kind "save").
+// Without an explicit update the feature gate would stay on the old tier, so
+// `opts.onAssigned(tenantId, tier)` runs after commit (ctx.scheduleAfterCommit).
+// feature.ts uses it to update its cache and notify the other processes; in
+// storage-only mode without a tierMap it is a no-op.
 
 const tierAssignmentTable = buildEntityTable("tier-assignment", tierAssignmentEntity);
 const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEntity, {
@@ -41,9 +40,9 @@ const executor = createEventStoreExecutor(tierAssignmentTable, tierAssignmentEnt
 const SET_TENANT_TIER_REASON = "SystemAdmin assigns the tier of the tenant named in the payload";
 
 export type SetTenantTierOptions = {
-  /** Nach erfolgreichem Write aufgerufen, damit feature.ts den Resolver-
-   *  Cache aktualisieren kann (der Executor-Write feuert den postSave-Hook
-   *  nicht). Ohne tierMap kein Resolver → no-op. */
+  /** Runs after the write commits so feature.ts can update the resolver cache
+   *  and notify the other processes. Without a tierMap there is no resolver
+   *  and this is a no-op. */
   readonly onAssigned?: (tenantId: TenantId, tier: string) => void;
   /** Tier-Namen aus der tierMap-Closure — ohne sie (storage-only-Mode) bleibt
    *  `tier` unvalidiert außer Length/Non-Empty. Mit ihr rejected der Handler
@@ -72,6 +71,12 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
       reason: SET_TENANT_TIER_REASON,
     },
     handler: async (event, ctx) => {
+      // Without a commit sink (unit harness) there is no transaction to wait for.
+      const afterCommit = (tenantId: TenantId, tier: string): void => {
+        const notify = async (): Promise<void> => opts.onAssigned?.(tenantId, tier);
+        if (ctx.scheduleAfterCommit) ctx.scheduleAfterCommit(notify);
+        else opts.onAssigned?.(tenantId, tier);
+      };
       const tenantId = event.payload.tenantId as TenantId; // @cast-boundary engine-bridge
       const rawDb = ctx.db.unsafeRaw();
       const tdb = createTenantDb(rawDb, tenantId, "system");
@@ -91,7 +96,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
           tdb,
         );
         if (!result.isSuccess) return result;
-        opts.onAssigned?.(tenantId, tier);
+        afterCommit(tenantId, tier);
         return { isSuccess: true as const, data: { tenantId, tier, isNew: false } };
       }
 
@@ -101,7 +106,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         tdb,
       );
       if (!result.isSuccess) return result;
-      opts.onAssigned?.(tenantId, tier);
+      afterCommit(tenantId, tier);
       return { isSuccess: true as const, data: { tenantId, tier, isNew: true } };
     },
   });

package/packages/bundled-features/src/user/invited-global-roles.ts

@@ -0,0 +1,58 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbRunner,
+} from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+import { userEntity, userTable } from "./schema/user.js";
+
+const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+
+type UserRolesRow = {
+  readonly id: string;
+  readonly version: number;
+  readonly roles: readonly string[] | string | null;
+};
+
+type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
+
+function isGlobalRole(role: string): role is GlobalRole {
+  return GLOBAL_ROLE_OPTIONS.some((option) => option === role);
+}
+
+// Reads the invitation's stored globalRoles column, keeping only assignable
+// global roles — a hand-edited row cannot smuggle "system" into users.roles.
+export function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[] {
+  return parseRoles(raw).filter(isGlobalRole);
+}
+
+// Add-only: an accepted invitation never removes a global role the user
+// already holds. Users live on SYSTEM_TENANT_ID (tenancy "global").
+export async function grantInvitedGlobalRoles(
+  db: DbRunner,
+  options: { readonly userId: string; readonly globalRoles: readonly string[] },
+) {
+  const existing = await fetchOne<UserRolesRow>(db, userTable, { id: options.userId });
+  if (!existing) return writeFailure(new NotFoundError("user", options.userId));
+
+  const currentRoles = parseRoles(existing.roles);
+  const missingRoles = options.globalRoles.filter((role) => !currentRoles.includes(role));
+  if (missingRoles.length === 0) return grantedGlobalRoles(currentRoles);
+
+  const roles = [...currentRoles, ...missingRoles];
+  const updateResult = await userExecutor.update(
+    { id: existing.id, version: existing.version, changes: { roles } },
+    createSystemUser(SYSTEM_TENANT_ID),
+    createTenantDb(db, SYSTEM_TENANT_ID, "system"),
+  );
+  if (!updateResult.isSuccess) return updateResult;
+  return grantedGlobalRoles(roles);
+}
+
+function grantedGlobalRoles(roles: readonly string[]) {
+  return { isSuccess: true, data: { roles } } as const;
+}

package/packages/bundled-features/src/user-data-rights/feature.ts

@@ -476,6 +476,9 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
       method: "GET",
       path: "/user-export/by-token",
       anonymous: true,
+      // Entry point of the emailed download link; cheap static page, but
+      // anonymous and token-bearing, so bound per-IP probing.
+      rateLimit: { per: "ip+handler", limit: 30, windowSeconds: 60 },
       handler: async (c) => {
         return c.body(TOKEN_EXCHANGE_PAGE_HTML, 200, {
           "content-type": "text/html; charset=utf-8",

package/packages/bundled-features/src/waitlist/changes.json

@@ -0,0 +1,17 @@
+[
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Waitlist submit is limited per email address"
+  },
+  {
+    "version": "0.341.0",
+    "type": "improvement",
+    "title": "Add waitlist bundled feature: public signup intake with admin invite and reject, GDPR export and erasure"
+  },
+  {
+    "version": "0.341.0",
+    "type": "fix",
+    "title": "Waitlist re-invite and reject no longer touch an invitee who already accepted"
+  }
+]

package/packages/bundled-features/src/waitlist/constants.ts

@@ -0,0 +1,44 @@
+// @runtime client
+// Pure string constants, safe for browser code (see auth-email-password/constants.ts).
+export const WAITLIST_FEATURE = "waitlist" as const;
+
+export const WAITLIST_STATUS = {
+  Pending: "pending",
+  Invited: "invited",
+  Rejected: "rejected",
+} as const;
+
+export type WaitlistStatus = (typeof WAITLIST_STATUS)[keyof typeof WAITLIST_STATUS];
+
+export const WaitlistHandlers = {
+  submit: "waitlist:write:submit",
+  invite: "waitlist:write:invite",
+  reject: "waitlist:write:reject",
+} as const;
+
+// Entity-convention list QN: entityList screens resolve their query by this shape.
+export const WaitlistQueries = {
+  list: "waitlist:query:waitlist-entry:list",
+} as const;
+
+export const WaitlistErrors = {
+  notInvitable: "waitlist_not_invitable",
+  notRejectable: "waitlist_not_rejectable",
+} as const;
+
+export const WAITLIST_NOTIFICATION_TYPES = {
+  confirmation: "waitlist:notify:confirmation",
+  adminNotice: "waitlist:notify:admin-notice",
+} as const;
+
+export const DEFAULT_OWN_TENANT_INVITE_ROLE = "TenantAdmin";
+
+export const WAITLIST_FIELD_LIMITS = {
+  name: 120,
+  email: 254,
+  company: 200,
+  portfolio: 200,
+  message: 2000,
+  locale: 35,
+  honeypot: 500,
+} as const;

package/packages/bundled-features/src/waitlist/entity.ts

@@ -0,0 +1,76 @@
+import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createLongTextField,
+  createSelectField,
+  createTextField,
+  createTimestampField,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { WAITLIST_STATUS, type WaitlistStatus } from "./constants.js";
+
+const WAITLIST_STATUS_OPTIONS = [
+  WAITLIST_STATUS.Pending,
+  WAITLIST_STATUS.Invited,
+  WAITLIST_STATUS.Rejected,
+] as const;
+
+const OPEN_WAITLIST_STATUSES: readonly WaitlistStatus[] = [
+  WAITLIST_STATUS.Pending,
+  WAITLIST_STATUS.Invited,
+];
+
+// Entries still awaiting a decision; rejected is terminal.
+export function isOpenWaitlistStatus(status: unknown): boolean {
+  return OPEN_WAITLIST_STATUSES.some((open) => open === status);
+}
+
+// An entrant has no user account, so name/email/message are personal: "self" —
+// the row's own id is its crypto-shredding subject. find: "fuzzy" keeps the
+// blind-index equality lookup (dedupe, GDPR export by email) and full-text
+// search alive; sortable stays off, the boot validator rejects it on subject fields.
+// tenancy "global" + systemStream: entries are platform-wide and live on
+// SYSTEM_TENANT_ID, which also lets the per-tenant GDPR hooks read them.
+export const waitlistEntryEntity = createEntity({
+  table: "read_waitlist_entries",
+  description:
+    "A prospect's signup on the platform waitlist, tracked through pending, invited and rejected status as admins process it; name, email and message are the entry's own personal data.",
+  systemStream: true,
+  tenancy: "global",
+  fields: {
+    name: createTextField({ required: true, personal: "self", find: "fuzzy", searchable: true }),
+    email: createTextField({ required: true, personal: "self", find: "fuzzy", searchable: true }),
+    company: createTextField({
+      personal: false,
+      reason: "is_business_data",
+      searchable: true,
+      sortable: true,
+    }),
+    portfolio: createTextField({ personal: false, reason: "is_business_data" }),
+    message: createLongTextField({ personal: "self", find: "none" }),
+    locale: createTextField({
+      required: true,
+      personal: false,
+      reason: "is_ui_language_preference",
+      sortable: true,
+    }),
+    status: createSelectField({
+      options: WAITLIST_STATUS_OPTIONS,
+      required: true,
+      default: WAITLIST_STATUS.Pending,
+      filterable: true,
+      sortable: true,
+    }),
+    submittedAt: createTimestampField({
+      personal: false,
+      sortable: true,
+      required: true,
+      reason: "is_submission_timestamp",
+    }),
+    invitedAt: createTimestampField(),
+    invitedBy: createTextField({ personal: false, reason: "is_admin_audit_id" }),
+    // Not named tenantId: that is the framework's physical tenant column.
+    linkedTenantId: createTextField({ personal: false, reason: "is_tenant_reference" }),
+  },
+});
+
+export const waitlistEntryTable = buildEntityTable("waitlistEntry", waitlistEntryEntity);