@cosmicdrift/kumiko-samples 0.351.0 → 0.352.0

package/packages/bundled-features/src/delivery/mask-recipient-address.ts

@@ -0,0 +1,40 @@
+import { isPiiCiphertext } from "@cosmicdrift/kumiko-framework/crypto";
+
+const MASK = "***";
+const VISIBLE_TAIL_LENGTH = 4;
+const MIN_LENGTH_FOR_VISIBLE_TAIL = 8;
+
+function maskedUrl(address: string): string | undefined {
+  if (!URL.canParse(address)) return undefined;
+  const url = new URL(address);
+  if (url.protocol !== "http:" && url.protocol !== "https:") return undefined;
+  return `${url.origin}/${MASK}`;
+}
+
+function maskedEmail(address: string): string | undefined {
+  const parts = address.split("@");
+  const [local, domain] = parts;
+  if (parts.length !== 2 || !local || domain === undefined) return undefined;
+  return `${local.charAt(0)}${MASK}@${domain}`;
+}
+
+// The attempt log is an audit trail, not a contact list: it keeps enough of the address to
+// recognise where a message went, never the full value. URLs go first because webhook URLs can
+// contain an "@" and their path carries the secret.
+export function maskRecipientAddress(address: string | null): string | null {
+  if (address === null) return null;
+  return maskPlainAddress(address);
+}
+
+function maskPlainAddress(address: string): string {
+  // isPiiCiphertext is a type predicate; its false branch would narrow `string` to `never`.
+  if (isPiiCiphertext(address)) return MASK;
+  return maskStructuredOrTail(address);
+}
+
+function maskStructuredOrTail(address: string): string {
+  const structured = maskedUrl(address) ?? maskedEmail(address);
+  if (structured !== undefined) return structured;
+  if (address.length < MIN_LENGTH_FOR_VISIBLE_TAIL) return MASK;
+  return `${MASK}${address.slice(-VISIBLE_TAIL_LENGTH)}`;
+}

package/packages/bundled-features/src/delivery/public-names.ts

@@ -61,4 +61,9 @@ export const DELIVERY_ATTEMPT_EVENT = "delivery:event:attempt" as const;
 export const DeliveryJobNames = {
   render: "render",
   send: "send",
+  attemptLogRetention: "attempt-log-retention",
 } as const;
+
+// Clears recipientAddress on an attempt row after its recipient was forgotten.
+export const DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT =
+  "delivery:event:attempt-address-erased" as const;

package/packages/bundled-features/src/delivery/types.ts

@@ -64,6 +64,9 @@ export type DeliveryChannel = {
   // Absent for channels addressed only through `route` (tenant-owned chat
   // targets): deliverToUser skips them without writing a no_address row.
   resolve?(userId: string, ctx: ChannelContext): Promise<string | null>;
+  // "connection-name": the address is a tenant-chosen connection name (chat webhooks), not
+  // personal data, so the attempt log keeps it unmasked. Absent = personal, masked.
+  readonly addressKind?: "connection-name";
   render?(message: ChannelMessage, ctx: ChannelContext): Promise<RenderedMessage>;
   send(
     address: string,
@@ -118,14 +121,21 @@ export type DeliveryService = {
 // payload — collectChannels derives it from the usage's entityName instead.
 export type DeliveryChannelPlugin = Omit<DeliveryChannel, "name">;
 
+function hasOptionalHooks(o: object): boolean {
+  return (
+    (!("render" in o) || o.render === undefined || typeof o.render === "function") &&
+    (!("resolve" in o) || o.resolve === undefined || typeof o.resolve === "function") &&
+    (!("addressKind" in o) || o.addressKind === undefined || o.addressKind === "connection-name")
+  );
+}
+
 export function isDeliveryChannelPlugin(o: unknown): o is DeliveryChannelPlugin {
   return (
     typeof o === "object" &&
     o !== null &&
     "mode" in o &&
     DELIVERY_CHANNEL_MODES.some((mode) => mode === o.mode) &&
-    (!("render" in o) || o.render === undefined || typeof o.render === "function") &&
-    (!("resolve" in o) || o.resolve === undefined || typeof o.resolve === "function") &&
+    hasOptionalHooks(o) &&
     "send" in o &&
     typeof o.send === "function"
   );

package/packages/bundled-features/src/derivatives-sharp/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "sharp is bumped to 0.35.5 to pick up the librsvg security fix",
+    "detail": "Bump sharp to 0.35.5 (librsvg advisory GHSA-WQ5F-XC86-PV6W)"
+  },
   {
     "version": "0.335.0",
     "type": "fix",

package/packages/bundled-features/src/legal-pages/README.md

@@ -201,10 +201,10 @@ await seedTextBlock(db, {
   title: "Impressum",
   content: `## Angaben gemäß § 5 TMG
 
-**Marc Frost**
+**Alex Morgan**
 
-Slevogtstr. 10
-04159 Leipzig
+Musterstraße 1
+12345 Musterstadt
 
 ## Kontakt
 

package/packages/bundled-features/src/legal-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "fix",
+    "title": "The legal-pages README imprint example uses a fictional demo identity",
+    "detail": "The legal-pages README seeds its imprint example with a fictional demo identity and address instead of a real person's details."
+  },
   {
     "version": "0.344.0",
     "type": "improvement",

package/packages/bundled-features/src/renderer-foundation/types.ts

@@ -12,7 +12,7 @@ export type RenderRequest =
   | { kind: "image-snapshot"; payload: DocumentPayload; options?: ImageOptions };
 
 export type RenderResponse =
-  | { kind: "notification"; html: string }
+  | { kind: "notification"; html: string; text?: string }
   | { kind: "mail-html"; html: string; text: string }
   | { kind: "document-pdf"; pdfBytes: Uint8Array; pageCount: number; sizeBytes: number }
   | {

package/packages/bundled-features/src/renderer-simple/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "Badge, stages track and chips for the simple mail renderer",
+    "detail": "Use badge, { stages } and { chips } in the template variables; the notification RenderResponse carries the matching plain text in text."
+  },
   {
     "version": "0.344.0",
     "type": "improvement",

package/packages/bundled-features/src/renderer-simple/feature.ts

@@ -31,12 +31,10 @@ export async function adaptToFoundation(
     );
   }
   const variables = await resolveNotificationVariables(req, ctx);
-  const html = await renderer.render({
-    template: req.payload.template ?? "",
-    variables,
-    locale: req.payload.locale,
-  });
-  return { kind: "notification", html };
+  const input = { template: req.payload.template ?? "", variables, locale: req.payload.locale };
+  const html = await renderer.render(input);
+  const text = renderer.renderText ? await renderer.renderText(input) : undefined;
+  return text === undefined ? { kind: "notification", html } : { kind: "notification", html, text };
 }
 
 export type RendererSimpleOptions = {

package/packages/bundled-features/src/renderer-simple/index.ts

@@ -1,4 +1,5 @@
 export { createRendererSimpleFeature, type RendererSimpleOptions } from "./feature.js";
+export type { MailBadge, MailChip, MailStage, MailStageState, MailTone } from "./mail-blocks.js";
 export {
   createSimpleRenderer,
   type LocalizedText,

package/packages/bundled-features/src/renderer-simple/mail-blocks.ts

@@ -0,0 +1,138 @@
+import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
+
+export type MailTone = "neutral" | "info" | "success" | "warning" | "danger";
+export type MailStageState = "done" | "current" | "upcoming";
+
+export type MailBadge = { readonly label: string; readonly tone?: MailTone };
+export type MailStage = { readonly label: string; readonly state: MailStageState };
+export type MailChip = { readonly label: string; readonly tone?: MailTone };
+
+// Literal types (as const) keep the colors compile-time known, so they can go into style
+// attributes without escaping.
+const TONE_COLORS = {
+  neutral: { bg: "#f3f4f6", fg: "#374151" },
+  info: { bg: "#dbeafe", fg: "#1e40af" },
+  success: { bg: "#dcfce7", fg: "#166534" },
+  warning: { bg: "#fef3c7", fg: "#92400e" },
+  danger: { bg: "#fee2e2", fg: "#991b1b" },
+} as const satisfies Readonly<Record<MailTone, { readonly bg: string; readonly fg: string }>>;
+
+type ToneColors = (typeof TONE_COLORS)[MailTone];
+type PillMargin = "0" | "0 6px 6px 0";
+
+const STAGE_STATES: readonly MailStageState[] = ["done", "current", "upcoming"];
+const STAGE_DONE_COLOR = "#16a34a";
+const STAGE_UPCOMING_BG = "#e5e7eb";
+const STAGE_UPCOMING_FG = "#9ca3af";
+
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+  return typeof value === "object" && value !== null;
+}
+
+function isMailTone(value: unknown): value is MailTone {
+  return typeof value === "string" && Object.hasOwn(TONE_COLORS, value);
+}
+
+function toneColors(tone: unknown): ToneColors {
+  return TONE_COLORS[isMailTone(tone) ? tone : "neutral"];
+}
+
+function isStageState(value: unknown): value is MailStageState {
+  return STAGE_STATES.some((state) => state === value);
+}
+
+// Template data is runtime data (variables of a stored template): entries that do not match are
+// skipped instead of failing the whole mail.
+function isStage(value: unknown): value is MailStage {
+  return isRecord(value) && typeof value["label"] === "string" && isStageState(value["state"]);
+}
+
+function isChip(value: unknown): value is MailChip {
+  return isRecord(value) && typeof value["label"] === "string";
+}
+
+export function parseBadge(value: unknown): MailBadge | undefined {
+  return isChip(value) && value.label !== "" ? value : undefined;
+}
+
+function validStages(value: unknown): readonly MailStage[] {
+  return Array.isArray(value) ? value.filter(isStage) : [];
+}
+
+function validChips(value: unknown): readonly MailChip[] {
+  return Array.isArray(value) ? value.filter(isChip) : [];
+}
+
+function pill(chip: MailChip, margin: PillMargin): string {
+  const { bg, fg } = toneColors(chip.tone);
+  return `<span style="display:inline-block;margin:${margin};padding:2px 10px;border-radius:999px;background:${bg};color:${fg};font-size:12px;font-weight:600;line-height:18px">${escapeHtml(chip.label)}</span>`;
+}
+
+export function renderBadge(badge: MailBadge): string {
+  return `<p style="margin:0 0 12px">${pill(badge, "0")}</p>`;
+}
+
+export function renderChips(chips: unknown): string {
+  const valid = validChips(chips);
+  if (valid.length === 0) return "";
+  return `<p style="margin:0 0 16px">${valid.map((chip) => pill(chip, "0 6px 6px 0")).join("")}</p>`;
+}
+
+function stageMarker(stage: MailStage, position: number, primaryColor: string): string {
+  const base =
+    "display:inline-block;width:24px;height:24px;line-height:24px;border-radius:12px;text-align:center;font-size:12px;font-weight:700";
+  const primary = escapeHtmlAttr(primaryColor);
+  if (stage.state === "done") {
+    return `<span style="${base};background:${STAGE_DONE_COLOR};color:#fff">&#10003;</span>`;
+  }
+  if (stage.state === "current") {
+    return `<span style="${base};background:#fff;border:2px solid ${primary};line-height:20px;width:20px;height:20px;color:${primary}">${position}</span>`;
+  }
+  return `<span style="${base};background:${STAGE_UPCOMING_BG};color:${STAGE_UPCOMING_FG}">${position}</span>`;
+}
+
+function stageCell(stage: MailStage, position: number, primaryColor: string): string {
+  const labelColor = stage.state === "upcoming" ? STAGE_UPCOMING_FG : "#111";
+  const weight = stage.state === "current" ? 700 : 400;
+  return `<td align="center" valign="top" style="padding:0 4px;font-family:sans-serif">${stageMarker(stage, position, primaryColor)}<div style="margin:4px 0 0;font-size:12px;font-weight:${weight};color:${labelColor}">${escapeHtml(stage.label)}</div></td>`;
+}
+
+function stageConnector(previous: MailStage): string {
+  const color = previous.state === "done" ? STAGE_DONE_COLOR : STAGE_UPCOMING_BG;
+  return `<td valign="top" style="padding:11px 0 0"><div style="width:24px;height:2px;line-height:2px;font-size:2px;background:${color}">&nbsp;</div></td>`;
+}
+
+export function renderStages(stages: unknown, primaryColor: string): string {
+  const valid = validStages(stages);
+  if (valid.length === 0) return "";
+  const cellsHtml = valid
+    .map((stage, index) => {
+      const previous = valid[index - 1];
+      const connector = previous ? stageConnector(previous) : "";
+      return `${connector}${stageCell(stage, index + 1, primaryColor)}`;
+    })
+    .join("");
+  return `<table role="presentation" cellpadding="0" cellspacing="0" border="0" style="margin:0 0 16px"><tr>${cellsHtml}</tr></table>`;
+}
+
+const STAGE_TEXT_MARKER: Readonly<Record<MailStageState, string>> = {
+  done: "✓",
+  current: "▶",
+  upcoming: "○",
+};
+
+export function badgeText(badge: MailBadge): string {
+  return `[${badge.label}]`;
+}
+
+export function stagesText(stages: unknown): string {
+  return validStages(stages)
+    .map((stage) => `${STAGE_TEXT_MARKER[stage.state]} ${stage.label}`)
+    .join(" → ");
+}
+
+export function chipsText(chips: unknown): string {
+  return validChips(chips)
+    .map((chip) => chip.label)
+    .join(" · ");
+}

package/packages/bundled-features/src/renderer-simple/simple-renderer.ts

@@ -1,6 +1,18 @@
 import { escapeHtml, escapeHtmlAttr } from "@cosmicdrift/kumiko-headless";
 import type { NotificationRenderer } from "../delivery/index.js";
 import { renderSafeMarkdown } from "../page-render/index.js";
+import {
+  badgeText,
+  chipsText,
+  type MailBadge,
+  type MailChip,
+  type MailStage,
+  parseBadge,
+  renderBadge,
+  renderChips,
+  renderStages,
+  stagesText,
+} from "./mail-blocks.js";
 
 export type MailBranding = {
   /** Shown as text when there is no logo, and as the logo alt text. */
@@ -170,10 +182,13 @@ type Section =
   | { readonly text: string }
   | { readonly heading: string }
   | { readonly markdown: string }
-  | { readonly button: { readonly label: string; readonly url: string } };
+  | { readonly button: { readonly label: string; readonly url: string } }
+  | { readonly stages: readonly MailStage[] }
+  | { readonly chips: readonly MailChip[] };
 
 type EmailTemplateData = {
   // Preferred: structured email data
+  readonly badge?: MailBadge;
   readonly header?: string;
   readonly sections?: readonly Section[];
   readonly footer?: string;
@@ -183,6 +198,7 @@ type EmailTemplateData = {
 };
 
 function templateContent(variables: Readonly<Record<string, unknown>>): {
+  readonly badge: MailBadge | undefined;
   readonly header: string | undefined;
   readonly sections: readonly Section[] | undefined;
   readonly footer: string | undefined;
@@ -190,6 +206,7 @@ function templateContent(variables: Readonly<Record<string, unknown>>): {
   const data = variables as EmailTemplateData; // @cast-boundary render-helper
   // Without structured fields, title + body become the header and a single text section.
   return {
+    badge: parseBadge(data.badge),
     header: data.header ?? data.title,
     sections: data.sections ?? (data.body ? [{ text: data.body }] : undefined),
     footer: data.footer,
@@ -202,6 +219,8 @@ function sectionText(section: Section): string {
   if ("heading" in section) return section.heading;
   if ("markdown" in section) return section.markdown;
   if ("button" in section) return `${section.button.label}: ${section.button.url}`;
+  if ("stages" in section) return stagesText(section.stages);
+  if ("chips" in section) return chipsText(section.chips);
   return "";
 }
 
@@ -219,6 +238,8 @@ function renderSection(section: Section, primaryColor: string): string {
   if ("button" in section) {
     return `<p style="margin:0 0 16px"><a href="${escapeHtml(section.button.url)}" style="display:inline-block;padding:10px 24px;background:${escapeHtmlAttr(primaryColor)};color:#fff;text-decoration:none;border-radius:4px;font-size:14px">${escapeHtml(section.button.label)}</a></p>`;
   }
+  if ("stages" in section) return renderStages(section.stages, primaryColor);
+  if ("chips" in section) return renderChips(section.chips);
   return "";
 }
 
@@ -232,13 +253,15 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
     name: "simple",
 
     async render(input) {
-      const { header, sections, footer } = templateContent(input.variables);
+      const { badge, header, sections, footer } = templateContent(input.variables);
 
       const parts: string[] = [];
       parts.push('<!DOCTYPE html><html><body style="margin:0;padding:0;font-family:sans-serif">');
       parts.push('<div style="max-width:600px;margin:0 auto;padding:24px">');
       parts.push(renderBrandingHeader(branding, primaryColor, logoUrl));
 
+      if (badge) parts.push(renderBadge(badge));
+
       if (header) {
         parts.push(
           `<h1 style="margin:0 0 24px;color:#111;font-size:20px;font-weight:600">${escapeHtml(header)}</h1>`,
@@ -263,9 +286,15 @@ export function createSimpleRenderer(branding?: MailBranding): NotificationRende
     },
 
     async renderText(input) {
-      const { header, sections, footer } = templateContent(input.variables);
+      const { badge, header, sections, footer } = templateContent(input.variables);
       const brandingFooter = brandingFooterLines(branding, input.locale).join("\n");
-      return [header, ...(sections ?? []).map(sectionText), footer, brandingFooter]
+      return [
+        badge ? badgeText(badge) : undefined,
+        header,
+        ...(sections ?? []).map(sectionText),
+        footer,
+        brandingFooter,
+      ]
         .filter((block): block is string => block !== undefined && block !== "")
         .join("\n\n");
     },

package/packages/bundled-features/src/tier-engine/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.352.0",
+    "type": "improvement",
+    "title": "createTierOptionGate builds the availability rows and gates select options by tier on write",
+    "detail": "withTierOptionGate rejects a disallowed option with the lowest tier that allows it and lets an unchanged stored value pass on update."
+  },
   {
     "version": "0.278.0",
     "type": "breaking",

package/packages/bundled-features/src/tier-engine/index.ts

@@ -29,6 +29,13 @@ export {
   createTierEngineFeature,
   tierEngineFeature,
 } from "./feature.js";
+export {
+  createTierOptionGate,
+  type TierOptionAvailability,
+  type TierOptionGate,
+  type TierOptionGateDeps,
+  type TierOptionSpec,
+} from "./tier-option-gate.js";
 export {
   createTierResolver,
   type TierResolver,

package/packages/bundled-features/src/tier-engine/tier-option-gate.ts

@@ -0,0 +1,148 @@
+// Tier-gated options of a select field: one spec drives the availability query the
+// renderer shows (disabled option + "from <tier>" hint) and the write-path check that
+// actually enforces it, so the two cannot drift apart.
+
+import type { EntityTableMeta, SchemaTable, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  UnprocessableError,
+  type WriteFailure,
+  writeFailure,
+} from "@cosmicdrift/kumiko-framework/errors";
+import { isPlainObject } from "@cosmicdrift/kumiko-framework/utils";
+import {
+  type CapGuardContext,
+  type CapLimitContext,
+  readPayloadField,
+} from "../cap-counter/index.js";
+
+export type TierOptionSpec<TCaps> = {
+  readonly field: string;
+  readonly options: readonly string[];
+  readonly isOptionAllowed: (option: string, caps: TCaps) => boolean;
+  readonly code: string;
+  readonly i18nKey: string;
+  /** Lets an update that resends the unchanged stored value of a no longer allowed
+   *  option pass (edit forms submit the whole row). Without it the stored value is not looked up. */
+  readonly table?: SchemaTable | EntityTableMeta;
+};
+
+export type TierOptionAvailability = {
+  readonly value: string;
+  readonly disabled: boolean;
+  readonly hint?: string;
+};
+
+export type TierOptionGateDeps<TTier extends string, TCaps> = {
+  /** Ascending: the first tier that allows an option is the one named as required. */
+  readonly tierOrder: readonly TTier[];
+  readonly capsForTier: (tier: TTier, context: CapLimitContext) => TCaps | Promise<TCaps>;
+  readonly resolveTier: (db: TenantDb) => Promise<TTier>;
+};
+
+export type TierOptionGate<TTier extends string, TCaps> = {
+  readonly optionAvailability: (
+    db: TenantDb,
+    context: CapLimitContext,
+    spec: Pick<TierOptionSpec<TCaps>, "options" | "isOptionAllowed">,
+    hintFor: (requiredTier: TTier) => string,
+  ) => Promise<readonly TierOptionAvailability[]>;
+  /** `recordId` is the id of the edited row; with `spec.table` it enables the unchanged-value pass. */
+  readonly checkTierOption: (
+    ctx: CapGuardContext,
+    value: unknown,
+    spec: TierOptionSpec<TCaps>,
+    recordId?: string,
+  ) => Promise<WriteFailure | null>;
+  readonly withTierOptionGate: (
+    handler: WriteHandlerDef,
+    spec: TierOptionSpec<TCaps>,
+  ) => WriteHandlerDef;
+};
+
+function limitContextOf(ctx: CapGuardContext): CapLimitContext {
+  return ctx.config ? { config: ctx.config } : {};
+}
+
+function recordIdOf(payload: unknown): string | undefined {
+  return isPlainObject(payload) && typeof payload["id"] === "string" ? payload["id"] : undefined;
+}
+
+export function createTierOptionGate<TTier extends string, TCaps>(
+  deps: TierOptionGateDeps<TTier, TCaps>,
+): TierOptionGate<TTier, TCaps> {
+  async function capsPerTier(
+    context: CapLimitContext,
+  ): Promise<readonly { readonly tier: TTier; readonly caps: TCaps }[]> {
+    return Promise.all(
+      deps.tierOrder.map(async (tier) => ({ tier, caps: await deps.capsForTier(tier, context) })),
+    );
+  }
+
+  async function optionAvailability(
+    db: TenantDb,
+    context: CapLimitContext,
+    spec: Pick<TierOptionSpec<TCaps>, "options" | "isOptionAllowed">,
+    hintFor: (requiredTier: TTier) => string,
+  ): Promise<readonly TierOptionAvailability[]> {
+    const currentCaps = await deps.capsForTier(await deps.resolveTier(db), context);
+    const tiers = await capsPerTier(context);
+    return spec.options.map((value) => {
+      if (spec.isOptionAllowed(value, currentCaps)) return { value, disabled: false };
+      const required = tiers.find(({ caps }) => spec.isOptionAllowed(value, caps));
+      return required === undefined
+        ? { value, disabled: true }
+        : { value, disabled: true, hint: hintFor(required.tier) };
+    });
+  }
+
+  async function storedValueMatches(
+    ctx: CapGuardContext,
+    spec: TierOptionSpec<TCaps>,
+    value: string,
+    recordId: string | undefined,
+  ): Promise<boolean> {
+    if (spec.table === undefined || recordId === undefined) return false;
+    const stored = await ctx.db.fetchOne<Record<string, unknown>>(spec.table, { id: recordId });
+    return stored?.[spec.field] === value;
+  }
+
+  async function checkTierOption(
+    ctx: CapGuardContext,
+    value: unknown,
+    spec: TierOptionSpec<TCaps>,
+    recordId?: string,
+  ): Promise<WriteFailure | null> {
+    // skip: an absent or non-string value is the schema's business, not a tier violation.
+    if (typeof value !== "string") return null;
+    const context = limitContextOf(ctx);
+    const currentCaps = await deps.capsForTier(await deps.resolveTier(ctx.db), context);
+    if (spec.isOptionAllowed(value, currentCaps)) return null;
+    if (await storedValueMatches(ctx, spec, value, recordId)) return null;
+    const required = (await capsPerTier(context)).find(({ caps }) =>
+      spec.isOptionAllowed(value, caps),
+    );
+    return writeFailure(
+      new UnprocessableError(spec.code, {
+        i18nKey: spec.i18nKey,
+        details: { field: spec.field, value, requiredTier: required?.tier },
+      }),
+    );
+  }
+
+  function withTierOptionGate(
+    handler: WriteHandlerDef,
+    spec: TierOptionSpec<TCaps>,
+  ): WriteHandlerDef {
+    return {
+      ...handler,
+      handler: async (event, ctx) => {
+        const value = readPayloadField(event.payload, spec.field);
+        const failure = await checkTierOption(ctx, value, spec, recordIdOf(event.payload));
+        return failure ?? handler.handler(event, ctx);
+      },
+    };
+  }
+
+  return { optionAvailability, checkTierOption, withTierOptionGate };
+}

package/packages/bundled-features/src/user-data-rights-defaults/hooks/delivery-attempt.userdata-hook.ts

@@ -1,5 +1,12 @@
 import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import { deliveryAttemptsTable } from "../../delivery/index.js";
+import {
+  appendEventInTenantDb,
+  getStreamVersionInTenantDb,
+} from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT,
+  deliveryAttemptsTable,
+} from "../../delivery/index.js";
 import { featureMounted } from "./feature-mounted.js";
 
 // userData-Hooks for delivery's attempt log (deferred from #797, closed by
@@ -28,9 +35,32 @@ export const deliveryAttemptExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-export const deliveryAttemptDeleteHook: UserDataDeleteHook = async () => {
-  // Deliberate no-op: erasure runs via crypto-shredding — the forget pipeline
-  // erases the recipient's DEK, which makes recipientAddress unreadable in
-  // BOTH the append-only events and the projected rows (#799). A read-side
-  // UPDATE here would be wiped on the next projection rebuild anyway.
+// Both strategies erase the address. The DEK shredding of a forget covers KMS deployments; the
+// erase event also covers plaintext mode, and unlike a read-side UPDATE it survives a projection
+// rebuild. Rows without an address are skipped, which makes a second run a no-op.
+export const deliveryAttemptDeleteHook: UserDataDeleteHook = async (ctx) => {
+  // skip: delivery not mounted — its table doesn't exist, nothing to erase.
+  if (!featureMounted(ctx, "delivery")) return;
+  const rows = await ctx.db.selectMany<{ id: string; recipientAddress: string | null }>(
+    deliveryAttemptsTable,
+    {
+      tenantId: ctx.tenantId,
+      recipientId: ctx.userId,
+    },
+  );
+  for (const row of rows) {
+    if (row.recipientAddress === null) continue;
+    await appendEventInTenantDb(
+      ctx.db,
+      {
+        aggregateType: "deliveryAttempt",
+        aggregateId: row.id,
+        expectedVersion: await getStreamVersionInTenantDb(ctx.db, row.id),
+        type: DELIVERY_ATTEMPT_ADDRESS_ERASED_EVENT,
+        payload: {},
+        metadata: { userId: "system" },
+      },
+      { registry: ctx.registry },
+    );
+  }
 };

package/samples/apps/marketing-demo/src/app/seed-data.ts

@@ -306,7 +306,7 @@ export const ASSET_TEMPLATES: ReadonlyArray<AssetTemplate> = [
 // treffen ohne Sonderfall. Wird nur für status==="lent" konsultiert.
 export const OWNERS: ReadonlyArray<string> = [
   "",
-  "Marc Frost",
+  "Alex Morgan",
   "Anna Weber",
   "Lars Bergmann",
   "Sina Klein",
@@ -435,7 +435,7 @@ export const REPORTERS: ReadonlyArray<string> = [
 // unzugewiesen damit die Liste nicht zu uniform aussieht.
 export const ASSIGNEES: ReadonlyArray<string> = [
   "",
-  "Marc Frost",
+  "Alex Morgan",
   "IT-Team",
   "Sysadmin",
   "Helpdesk-L1",

package/samples/apps/styleguide/src/app/shell.tsx

@@ -58,7 +58,7 @@ export function AppShell({
           ],
         ])
       }
-      sidebarFooter={<SidebarUser name="Marc Frost" email="marc@cosmicdrift.dev" />}
+      sidebarFooter={<SidebarUser name="Alex Morgan" email="alex@example.com" />}
     >
       {activeTarget !== undefined ? <EditorPanel resolvers={resolvers} /> : children}
     </DefaultAppShell>