@cosmicdrift/kumiko-samples 0.352.0 → 0.353.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.352.0",
+  "version": "0.353.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.352.0",
+  "version": "0.353.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/agent-tools/agent-manifest.ts

@@ -19,6 +19,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { translationValueOtherText } from "@cosmicdrift/kumiko-framework/ui-types";
 import * as z from "zod";
+import { recordManifestDenyQns } from "./manifest-deny-qns.js";
 import type {
   AgentManifest,
   AgentManifestEntity,
@@ -334,6 +335,16 @@ function detailIdParam(screen: ScreenDefinition): string {
   return screen.type === "projectionDetail" ? (screen.idParam ?? "id") : "id";
 }
 
+function screenTitles(
+  translations: TranslationKeys,
+  screenId: string,
+  shortId: string,
+): AgentManifestScreen["titles"] {
+  return entryAsLabels(
+    translations[`${screenId}.title`] ?? translations[`screen:${shortId}.title`] ?? {},
+  );
+}
+
 function buildScreens(
   screens: ReadonlyMap<string, ScreenDefinition>,
   navs: ReadonlyMap<string, NavDefinition>,
@@ -372,7 +383,7 @@ function buildScreens(
     result.push({
       id: screen.id,
       type: screen.type,
-      titles: labelsForSuffix(translations, `screen:${shortId}.title`),
+      titles: screenTitles(translations, screen.id, shortId),
       // `screen.description` may be a raw i18n key (`registry.getAllTranslations()`
       // double-prefixes it, see build-app-schema.ts:77-81) — match on suffix like
       // `labelsForSuffix` does for entity/field labels, else fall back to the
@@ -444,7 +455,7 @@ export function buildAgentManifest(
   );
   const workspaces = buildWorkspaces(workspaceMap, translations, roles);
 
-  return {
+  const manifest: AgentManifest = {
     builtForRoles: [...roles],
     features: sortedByKey(features, (f) => f.name),
     entities: sortedByKey(entities, (e) => e.name),
@@ -457,4 +468,6 @@ export function buildAgentManifest(
       ...(options.currency && { currency: options.currency }),
     },
   };
+  recordManifestDenyQns(manifest, new Set(options.denyQns ?? []));
+  return manifest;
 }

package/packages/bundled-features/src/agent-tools/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "buildToolCatalog throws when the manifest was built with denyQns the catalog options lack",
+    "migration": "Pass the same denyQns list to buildAgentManifest and buildToolCatalog."
+  },
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Agent manifest screen titles resolve per feature instead of by mount order",
+    "detail": "Agent manifest screen titles no longer depend on feature mount order\nTwo features with a screen of the same short id used to get the title of whichever feature was mounted first. The manifest now looks up the screen's own feature-prefixed title key first and falls back to the unprefixed key."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/packages/bundled-features/src/agent-tools/manifest-deny-qns.ts

@@ -0,0 +1,25 @@
+import type { AgentManifest } from "./types.js";
+
+// The deny list is deliberately not a manifest field (the manifest is prompt
+// payload), so the catalog builder learns it through this side channel to
+// detect a manifest cut that the catalog would silently not mirror.
+const denyQnsByManifest = new WeakMap<AgentManifest, ReadonlySet<string>>();
+
+export function recordManifestDenyQns(manifest: AgentManifest, denyQns: ReadonlySet<string>): void {
+  denyQnsByManifest.set(manifest, denyQns);
+}
+
+export function assertCatalogMirrorsManifestDenyQns(
+  manifest: AgentManifest,
+  catalogDenyQns: ReadonlySet<string>,
+): void {
+  const manifestDenyQns = denyQnsByManifest.get(manifest);
+  // skip: manifest has no registered deny list, nothing to mirror
+  if (!manifestDenyQns) return;
+  const missing = [...manifestDenyQns].filter((qn) => !catalogDenyQns.has(qn));
+  if (missing.length > 0) {
+    throw new Error(
+      `agent denyQns passed to buildAgentManifest but not to buildToolCatalog: ${missing.join(", ")} — the catalog would still expose their entity CRUD tools`,
+    );
+  }
+}

package/packages/bundled-features/src/agent-tools/tool-catalog.ts

@@ -6,6 +6,7 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { hasAccess, normalizeAccessEntry } from "@cosmicdrift/kumiko-framework/engine";
 import { FILTER_OPS, isRecord } from "./filter-ops.js";
+import { assertCatalogMirrorsManifestDenyQns } from "./manifest-deny-qns.js";
 import type {
   AgentManifest,
   AgentManifestEntity,
@@ -628,7 +629,8 @@ function addClientTools(manifest: AgentManifest, mode: AgentToolMode, sink: Cata
  *  to drop an entity CRUD tool, which no `agent.expose` on the manifest side can reach. It is
  *  NOT read off the manifest on purpose — the manifest is prompt payload, and a list of the
  *  handlers the model may not call has no business travelling to the provider. Pass the same
- *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds. */
+ *  list to `buildAgentManifest` so the manifest stops describing what the catalog withholds;
+ *  a manifest built with `denyQns` that the catalog lacks throws. */
 export function buildToolCatalog(
   registry: RegistrySearchView,
   manifest: AgentManifest,
@@ -639,6 +641,7 @@ export function buildToolCatalog(
   const locale = manifest.tenantSettings.locale;
   const entityByName = new Map(manifest.entities.map((entity) => [entity.name, entity]));
   const denyQns = new Set(options.denyQns ?? []);
+  assertCatalogMirrorsManifestDenyQns(manifest, denyQns);
 
   addRegistrySearchTools(registry, roleFilter, denyQns, sink);
   const { detailQnByEntity, listQnByEntity, entityListDetailQns } = collectEntityHandlerQns(

package/packages/bundled-features/src/audit/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "Audit list paging no longer repeats rows with ascending sort",
+    "detail": "Audit list pages forward without repeats when sorted ascending\n`audit:query:list` with `sortDirection: \"asc\"` returned the same rows again on the next page because the cursor always meant \"older than\". The cursor now follows the sort direction, and ties are broken by event id. Sorting by `type` returns a single page without `nextCursor`, since an event id cannot resume a type-ordered listing."
+  },
   {
     "version": "0.346.0",
     "type": "improvement",

package/packages/bundled-features/src/audit/handlers/list.query.ts

@@ -52,6 +52,7 @@ function buildAuditWhere(
     cursor?: string;
     before?: string;
   },
+  direction: "asc" | "desc",
 ): WhereObject {
   const where: WhereObject = { tenantId };
   if (p.aggregateType) where["aggregateType"] = p.aggregateType;
@@ -62,7 +63,9 @@ function buildAuditWhere(
   const range = buildDateRange(p.from, p.to);
   if (range) where["createdAt"] = range;
   const cursor = p.cursor ?? p.before;
-  if (cursor) where["id"] = { lt: BigInt(cursor) };
+  // The cursor is an event id, so it only walks pages in id order: ascending
+  // pages continue past it, descending pages stop before it.
+  if (cursor) where["id"] = direction === "asc" ? { gt: BigInt(cursor) } : { lt: BigInt(cursor) };
   return where;
 }
 
@@ -94,10 +97,15 @@ export const listQuery = defineQueryHandler({
   handler: async (query, ctx) => {
     const p = query.payload;
     const scopeFilter = resolveAuditScopeFilter(query.user, p.scope);
-    const where = buildAuditWhere(scopeFilter.tenantId, {
-      ...p,
-      aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
-    });
+    const direction = p.sortDirection ?? "desc";
+    const where = buildAuditWhere(
+      scopeFilter.tenantId,
+      {
+        ...p,
+        aggregateType: scopeFilter.aggregateType ?? p.aggregateType,
+      },
+      direction,
+    );
 
     const rows = await selectMany<{
       id: bigint;
@@ -110,10 +118,11 @@ export const listQuery = defineQueryHandler({
       createdAt: unknown;
       createdBy: string;
     }>(ctx.db, eventsTable, where, {
-      orderBy: {
-        col: query.payload.sort === "type" ? "type" : "createdAt",
-        direction: query.payload.sortDirection ?? "desc",
-      },
+      // `id` as tie-breaker keeps the order total, so pages never overlap.
+      orderBy: [
+        { col: p.sort === "type" ? "type" : "createdAt", direction },
+        { col: "id", direction },
+      ],
       limit: p.limit,
     });
 
@@ -129,7 +138,8 @@ export const listQuery = defineQueryHandler({
       createdBy: r.createdBy,
     }));
     const last = serialised[serialised.length - 1];
-    const nextId = serialised.length === p.limit && last ? last.id : null;
+    // An id cursor cannot resume a type-ordered listing, so that sort is one page.
+    const nextId = serialised.length === p.limit && last && p.sort !== "type" ? last.id : null;
     return {
       rows: serialised,
       nextCursor: nextId,

package/packages/bundled-features/src/auth-email-password/handlers/signup-confirm.write.ts

@@ -196,9 +196,8 @@ export function createSignupConfirmHandler(opts: SignupConfirmOptions = {}) {
               displayName,
               tenantId,
               tenantKey,
-              // Tenant-Display-Name als Default = Email. User wechselt das im
-              // Settings-Screen. Konzept "Tenant" leakt nicht in die Signup-UI.
-              tenantName: email,
+              // Generated slug as default name: no personal data (the email) in the tenant name.
+              tenantName: tenantKey,
             },
             // #1463: seedTenant's postSave hooks (tier-engine's auto-default-
             // tier, an app's auto-default-compliance) must fire on self-signup

package/packages/bundled-features/src/auth-mfa/screens.ts

@@ -58,7 +58,7 @@ export const mfaEnableScreen: SecretMintScreenDefinition = {
   confirm: {
     handler: AuthMfaHandlers.enableConfirm,
     fields: {
-      code: { type: "text", required: true, maxLength: 6 },
+      code: { type: "text", required: true, minLength: 6, maxLength: 6 },
     },
     layout: { sections: [{ fields: ["code"] }] },
     carry: ["setupToken"],
@@ -69,7 +69,7 @@ export const mfaEnableScreen: SecretMintScreenDefinition = {
 
 // Either a 6-digit TOTP code or a 9-char recovery code proves possession —
 // same bounds as the disable/regenerate-recovery handler schemas.
-const possessionCodeField = { type: "text", required: true, maxLength: 9 } as const;
+const possessionCodeField = { type: "text", required: true, minLength: 6, maxLength: 9 } as const;
 
 export const mfaDisableScreen: ActionFormScreenDefinition = {
   id: MFA_DISABLE_SCREEN_ID,

package/packages/bundled-features/src/billing-foundation/billing-info-query.ts

@@ -45,10 +45,9 @@ export type BillingInfo<TTier extends string> = {
 export type BillingInfoQueryDeps<TTier extends string> = {
   readonly roles: readonly string[];
   readonly resolveTier: (db: TenantDb, tenantId: TenantId) => Promise<TTier>;
-  // ctx is the same HandlerContext the returned handler receives — app
-  // implementations read app-specific extraContext fields off it (e.g.
-  // publicstatus/show-pony's getBillingPrices(ctx) reads `billingPrices`),
-  // so they type their own ctx param as `unknown` and cast internally.
+  // ctx is the same HandlerContext the returned handler receives — apps read
+  // their extraContext fields (e.g. `billingPrices`) off it and validate them
+  // at that boundary.
   readonly getBillingPrices: (
     ctx: HandlerContext,
   ) => Readonly<Partial<Record<string, string>>> | null;

package/packages/bundled-features/src/billing-foundation/checkout-core.ts

@@ -274,6 +274,13 @@ export type OpenCheckoutOptions = {
   readonly baseUrl?: string;
   readonly catalog?: BillingPlanCatalog;
   readonly now: () => Temporal.Instant;
+  /** The caller already ran `assertBillingEnabled` under its own handler name
+   *  (before a costly provider lookup), so the gate is not repeated here. */
+  readonly billingEnabledChecked?: boolean;
+  /** The caller already ran `assertNoActiveSubscription` and passes its result
+   *  (null = tenant has none); mode:"subscription" skips the second read and
+   *  the providerCustomerId check reuses it. */
+  readonly checkedSubscription?: Awaited<ReturnType<typeof getSubscriptionForTenant>>;
 };
 
 export type OpenCheckoutInput = {
@@ -358,7 +365,9 @@ export async function assertCheckoutAllowed(
   // Checked before the redirect-origin hardening for every mode — a
   // disabled provider must reject a mode:"payment" checkout just as much
   // as a mode:"subscription" one.
-  await assertBillingEnabled(ctx, plugin, "create-checkout-session");
+  if (options.billingEnabledChecked !== true) {
+    await assertBillingEnabled(ctx, plugin, "create-checkout-session");
+  }
   assertRedirectOrigins([input.successUrl, input.cancelUrl], options.baseUrl);
 
   const mode = input.mode ?? "subscription";
@@ -368,7 +377,10 @@ export async function assertCheckoutAllowed(
 
   if (mode === "subscription") {
     assertSubscriptionPriceAllowed(plugin, options.catalog, input);
-    ownSubscription = await assertNoActiveSubscription(ctx, options.now());
+    ownSubscription =
+      options.checkedSubscription !== undefined
+        ? options.checkedSubscription
+        : await assertNoActiveSubscription(ctx, options.now());
   } else {
     assertOneOffPriceAllowed(plugin, input);
   }

package/packages/bundled-features/src/billing-foundation/handlers/start-plan-checkout.write.ts

@@ -74,7 +74,13 @@ export function createStartPlanCheckoutHandler(
       const baseUrl = options.baseUrl ?? "";
       const result = await openCheckout(
         ctx,
-        { baseUrl: options.baseUrl, catalog, now: options.now },
+        {
+          baseUrl: options.baseUrl,
+          catalog,
+          now: options.now,
+          billingEnabledChecked: true,
+          checkedSubscription: existing,
+        },
         {
           providerName,
           priceId: resolved.priceId,

package/packages/bundled-features/src/cap-overview/access.ts

@@ -1,4 +1,4 @@
-import { access } from "@cosmicdrift/kumiko-framework/engine";
+import { access, BUILT_IN_MEMBERSHIP_ROLES } from "@cosmicdrift/kumiko-framework/engine";
 
 // Usage numbers are an operator concern by default; wider visibility is an
 // explicit `usageVisibleTo` opt-in on createCapOverviewFeature. The my-caps
@@ -9,14 +9,7 @@ export const DEFAULT_CAP_USAGE_ROLES: readonly string[] = access.roles(...access
 // Roles the engine itself knows (role-assignment.ts ranks). App-declared roles
 // (assignableRole) only exist once the registry is composed, which is after
 // this feature is defined, so they cannot be validated here.
-const BUILT_IN_USAGE_VISIBLE_ROLES: ReadonlySet<string> = new Set([
-  "User",
-  "Member",
-  "Editor",
-  "Admin",
-  "TenantAdmin",
-  "SystemAdmin",
-]);
+const BUILT_IN_USAGE_VISIBLE_ROLES: ReadonlySet<string> = new Set(BUILT_IN_MEMBERSHIP_ROLES);
 
 export function resolveCapUsageRoles(
   usageVisibleTo: readonly string[] | undefined,

package/packages/bundled-features/src/cap-overview/handlers/tenant-caps-list.query.ts

@@ -10,7 +10,7 @@ import { InternalError, ValidationError } from "@cosmicdrift/kumiko-framework/er
 import * as z from "zod";
 import { subscriptionsProjectionTable } from "../../billing-foundation/index.js";
 import type { CapLimitContext } from "../../cap-counter/index.js";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 import { tierAssignmentEntity } from "../../tier-engine/index.js";
 import { capFieldName } from "../constants.js";
 import type { CapSpec, CapUsage } from "../types.js";
@@ -174,7 +174,10 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
         "cap-overview:tenant-caps:list — SystemAdmin platform-wide tenant overview",
       );
 
-      const tenants = await selectMany<TenantRow>(db, tenantTable, {});
+      const tenants = await decryptTenantNames(
+        await selectMany<TenantRow>(db, tenantTable, {}),
+        "cap-overview:tenant-caps:list",
+      );
       const assignments = await selectMany<TierAssignmentRow>(db, tierAssignmentTable, {});
       const subscriptions = await selectMany<SubscriptionRow>(db, subscriptionsProjectionTable, {});
 

package/packages/bundled-features/src/cap-overview/handlers/tenant-options.query.ts

@@ -2,7 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 
 type TenantRow = { readonly id: string; readonly name: string };
 
@@ -22,14 +22,11 @@ export const tenantOptionsQuery = defineQueryHandler({
     const db = ctx.systemDb.acknowledgeCrossTenant(
       "cap-overview:tenant-options — SystemAdmin dashboard tenant-filter options",
     );
-    const tenants = await selectMany<TenantRow>(
-      db,
-      tenantTable,
-      {},
-      {
-        orderBy: { col: "name", direction: "asc" },
-      },
+    const tenants = await decryptTenantNames(
+      await selectMany<TenantRow>(db, tenantTable, {}),
+      "cap-overview:tenant-options",
     );
-    return { rows: tenants.map((tenant) => ({ value: tenant.id, label: tenant.name })) };
+    const sorted = [...tenants].sort((a, b) => a.name.localeCompare(b.name));
+    return { rows: sorted.map((tenant) => ({ value: tenant.id, label: tenant.name })) };
   },
 });

package/packages/bundled-features/src/compliance-profiles-ops/handlers/tenants-missing-profile.query.ts

@@ -3,7 +3,7 @@ import { defineQueryHandler, type TenantId } from "@cosmicdrift/kumiko-framework
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import { tenantComplianceProfileTable } from "../../compliance-profiles/index.js";
-import { tenantTable } from "../../tenant/index.js";
+import { decryptTenantNames, tenantTable } from "../../tenant/index.js";
 
 // SystemAdmin platform-wide counterpart to needs-profile (#2089).
 //
@@ -34,9 +34,10 @@ export const tenantsMissingProfileQuery = defineQueryHandler({
       "platform operator scans every tenant for a missing compliance-profile selection",
     );
 
-    const tenants = await db.selectMany<{ id: TenantId; name: string }>(tenantTable, {
-      isEnabled: true,
-    });
+    const tenants = await decryptTenantNames(
+      await db.selectMany<{ id: TenantId; name: string }>(tenantTable, { isEnabled: true }),
+      "compliance-profiles-ops:tenants-missing-profile",
+    );
     const profileRows = await db.selectMany<{ tenantId: TenantId }>(
       tenantComplianceProfileTable,
       {},

package/packages/bundled-features/src/config/handlers/values.query.ts

@@ -13,8 +13,10 @@ import { hasConfigAccess } from "../write-helpers.js";
 export const valuesQuery = defineQueryHandler({
   name: "values",
   description:
-    "Returns the effective value, scope and winning source for every config key the caller may read, with encrypted and secret-backed values masked; use it to inspect the current settings.",
-  schema: z.object({}),
+    "Returns the effective value, scope and winning source for every config key the caller may read (optionally narrowed to `keys`), with encrypted and secret-backed values masked; use it to inspect the current settings.",
+  schema: z.object({
+    keys: z.array(z.string()).optional(),
+  }),
   // Per-key read access enforced via hasConfigAccess inside the handler.
   access: {
     openToAll: {
@@ -37,7 +39,10 @@ export const valuesQuery = defineQueryHandler({
     const allKeys = registry.getAllConfigKeys();
     const keyDefs = new Map<string, ConfigKeyDefinition>();
     const filteredKeys: string[] = [];
+    const requestedKeys =
+      query.payload.keys === undefined ? undefined : new Set(query.payload.keys);
     for (const [qualifiedKey, keyDef] of allKeys) {
+      if (requestedKeys !== undefined && !requestedKeys.has(qualifiedKey)) continue;
       if (!hasConfigAccess(keyDef.access.read, query.user.roles)) continue;
       keyDefs.set(qualifiedKey, keyDef);
       filteredKeys.push(qualifiedKey);

package/packages/bundled-features/src/delivery/public-names.ts

@@ -11,7 +11,7 @@ export const DeliveryHandlers = {
   resubscribeUser: "delivery:write:resubscribe-user",
 } as const;
 
-// Fixed so links mailed out today keep working — the unsubscribe route is
+// Stable path: links signed against it keep working. The unsubscribe route is
 // mounted at this exact path via `extraRoutes: [...createUnsubscribeRoutes(...)]`.
 export const DELIVERY_UNSUBSCRIBE_PATH = "/api/delivery/unsubscribe" as const;
 

package/packages/bundled-features/src/files-tenant-data/hooks.ts

@@ -170,8 +170,9 @@ export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async
   }
   // Provider resolved — a list()/delete() failure from here IS fail-closed:
   // the "files" stage throws, tenant-lifecycle's retry/abandon handling sees
-  // it, and the next sweep tick retries (list+delete are idempotent, so this
-  // converges rather than double-deleting or erroring on a missing key).
+  // it and retries up to the stage's attempt cap before abandoning the destroy
+  // (list+delete are idempotent, so a retry converges rather than
+  // double-deleting or erroring on a missing key).
   for (const prefix of tenantStoragePrefixes(tenantId)) {
     const keys = await provider.list(prefix);
     const keptStemPrefixes = await survivorStemPrefixes(ctx.db, keys);

package/packages/bundled-features/src/folders/feature.ts

@@ -25,7 +25,7 @@ import {
   type EntityDefinition,
   type FeatureRegistrar,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { hasWhereRule } from "../shared/index.js";
+import { assertNoWhereRuleInOwnershipWrite } from "../shared/index.js";
 import { DEFAULT_FOLDER_ACCESS, FOLDERS_FEATURE_NAME } from "./constants.js";
 import { createFolderAssignmentEntity, folderEntity } from "./entity.js";
 import { createClearFolderHandler } from "./handlers/clear-folder.write.js";
@@ -166,17 +166,7 @@ export function createFoldersFeature(opts: FoldersFeatureOptions = {}): typeof f
   ) {
     return foldersFeature;
   }
-  if (hasWhereRule(opts.ownership?.write)) {
-    throw new Error(
-      "createFoldersFeature({ ownership }): ownership.write must not contain a " +
-        '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
-        "layer (the read path, via buildOwnershipClause). Write paths that " +
-        "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them, so such a rule can only ever deny — boot validation " +
-        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
-        "leave it unset.",
-    );
-  }
+  assertNoWhereRuleInOwnershipWrite("createFoldersFeature", opts.ownership?.write);
   if (opts.parents !== undefined && opts.parents.length === 0) {
     throw new Error(
       "createFoldersFeature({ parents }): parents must not be an empty array — " +

package/packages/bundled-features/src/form-draft/changes.json

@@ -1 +1,7 @@
-[]
+[
+  {
+    "version": "0.353.0",
+    "type": "fix",
+    "title": "The stale-draft cleanup keeps sweeping when a whole batch was re-saved in the meantime"
+  }
+]

package/packages/bundled-features/src/form-draft/db/queries/cleanup.ts

@@ -57,6 +57,7 @@ export async function selectStaleDraftsBatch(
 /** Re-check staleness after the select→release window so a freshly saved draft is not deleted. */
 export async function isDraftStillStale(
   db: DbConnection,
+  tenantId: TenantId,
   id: string,
   olderThanDays: number,
 ): Promise<boolean> {
@@ -64,9 +65,10 @@ export async function isDraftStillStale(
     db,
     `SELECT 1 FROM "read_form_drafts"
      WHERE "id" = $1
-       AND COALESCE("modified_at", "inserted_at") < now() - ($2::int * interval '1 day')
+       AND "tenant_id" = $2
+       AND COALESCE("modified_at", "inserted_at") < now() - ($3::int * interval '1 day')
      LIMIT 1`,
-    [id, olderThanDays],
+    [id, tenantId, olderThanDays],
   )) as readonly unknown[];
   return rows.length > 0;
 }

package/packages/bundled-features/src/form-draft/handlers/cleanup.job.ts

@@ -121,20 +121,24 @@ export function groupStaleDraftIdsByTenant(
 // resurrects, PII included. formDraftExecutor.delete() is the event-sourced
 // path; it needs a tenant-scoped db + a SessionUser, so rows are grouped by
 // tenant first (see groupStaleDraftIdsByTenant above).
-async function deleteStaleDraftsBatch(
+export async function deleteStaleDraftsBatch(
   batch: readonly StaleDraftRow[],
   db: DbConnection,
   retentionDays: number,
   log: AppContext["log"],
-): Promise<readonly StaleDraftRow[]> {
+): Promise<{ readonly deletedRows: readonly StaleDraftRow[]; readonly skippedCount: number }> {
   const deletedRows: StaleDraftRow[] = [];
+  let skippedCount = 0;
   const byId = new Map(batch.map((row) => [row.id, row]));
   for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
     const systemUser = createSystemUser(tenantId);
     const tenantDb = createTenantDb(db, tenantId, "system");
     for (const id of ids) {
       // Race: user may have saved between select and here — skip if no longer stale.
-      if (!(await isDraftStillStale(db, id, retentionDays))) continue;
+      if (!(await isDraftStillStale(db, tenantId, id, retentionDays))) {
+        skippedCount++;
+        continue;
+      }
       const result = await formDraftExecutor.delete({ id }, systemUser, tenantDb);
       if (result.isSuccess) {
         const row = byId.get(id);
@@ -146,7 +150,7 @@ async function deleteStaleDraftsBatch(
       }
     }
   }
-  return deletedRows;
+  return { deletedRows, skippedCount };
 }
 
 export async function cleanupDraftsJob(
@@ -189,12 +193,20 @@ export async function cleanupDraftsJob(
     // entirely for rows with no FileRefs in the blob, the common case.
     // Delete first (with staleness re-check), then release binaries from rows
     // that actually disappeared — never release a draft the user just saved.
-    const deletedRows = await deleteStaleDraftsBatch(batch, db, retentionDays, ctx.log);
+    const { deletedRows, skippedCount } = await deleteStaleDraftsBatch(
+      batch,
+      db,
+      retentionDays,
+      ctx.log,
+    );
     for (const row of deletedRows) {
       await releaseRowFileRefs(row, db, fileProviderResolver, ctx.log);
     }
     deleted += deletedRows.length;
-    if (deletedRows.length === 0 || batch.length < DEFAULT_BATCH_SIZE) break;
+    // A skipped row is no longer stale, so the next select drops it — a fully
+    // skipped batch still makes progress. Only a batch with neither deletes nor
+    // skips (all failed) would reselect the same rows forever.
+    if (deletedRows.length + skippedCount === 0 || batch.length < DEFAULT_BATCH_SIZE) break;
   }
   ctx.log?.info?.(`[form-draft:cleanup] deleted=${deleted} retentionDays=${retentionDays}`);
 }