@cosmicdrift/kumiko-samples 0.353.0 → 0.354.0

package/packages/bundled-features/src/auth-mfa/web/mfa-setup-preauth-screen.tsx

@@ -67,7 +67,7 @@ export type MfaSetupPreauthScreenProps = {
   readonly subtitle?: ReactNode;
   /** Fired once confirm succeeds — the caller owns session refresh, see the
    *  file-level comment above. */
-  readonly onSuccess?: () => void;
+  readonly onSuccess?: (landingPath?: string) => void;
   readonly onCancel?: () => void;
 };
 
@@ -146,7 +146,7 @@ export function MfaSetupPreauthScreen({
         }
         return;
       }
-      onSuccess?.();
+      onSuccess?.(res.data.landingPath);
     } catch {
       setError("setup_failed");
     } finally {
@@ -173,9 +173,9 @@ export function MfaSetupPreauthScreen({
       ) : null}
 
       {!setup && (
-        <Section
-          testId="mfa-setup-preauth-intro"
-          actions={
+        <Section testId="mfa-setup-preauth-intro">
+          <span className="text-sm text-muted-foreground">{t("auth.mfa.setup.intro")}</span>
+          <div className="flex justify-end">
             <Button
               variant="primary"
               onClick={() => void startSetup()}
@@ -184,27 +184,13 @@ export function MfaSetupPreauthScreen({
             >
               {t("auth.mfa.setup.start")}
             </Button>
-          }
-        >
-          <span className="text-sm text-muted-foreground">{t("auth.mfa.setup.intro")}</span>
+          </div>
         </Section>
       )}
 
       {setup && (
         <Form onSubmit={onSubmit}>
-          <Section
-            testId="mfa-setup-preauth-setup"
-            actions={
-              <Button
-                type="submit"
-                variant="primary"
-                loading={busy}
-                disabled={busy || !acknowledged || code.length !== 6}
-              >
-                {t("auth.mfa.setup.confirm")}
-              </Button>
-            }
-          >
+          <Section testId="mfa-setup-preauth-setup">
             <div className="flex flex-col items-center gap-2 text-center">
               <span className="text-sm font-semibold">{t("auth.mfa.enable.scanTitle")}</span>
               {/* qrcode's own SVG string output, not user input — safe to inline */}
@@ -251,6 +237,17 @@ export function MfaSetupPreauthScreen({
                 autoComplete="one-time-code"
               />
             </Field>
+
+            <div className="flex justify-end">
+              <Button
+                type="submit"
+                variant="primary"
+                loading={busy}
+                disabled={busy || !acknowledged || code.length !== 6}
+              >
+                {t("auth.mfa.setup.confirm")}
+              </Button>
+            </div>
           </Section>
         </Form>
       )}

package/packages/bundled-features/src/auth-mfa/web/mfa-verify-screen.tsx

@@ -20,7 +20,7 @@ export type MfaVerifyScreenProps = {
   /** Called after the server confirms the code and the session state has
    *  refreshed. Optional — apps that swap this screen back out purely on
    *  session.status changing to "authenticated" don't need it. */
-  readonly onSuccess?: () => void;
+  readonly onSuccess?: (landingPath?: string) => void;
   // Some failures (challenge_expired, too_many_attempts) have no retry path —
   // the challengeToken is dead. Without this, the host has no way back to
   // login short of a full page reload. Optional: apps that always mount
@@ -68,7 +68,7 @@ export function MfaVerifyScreen({
     if (res.kind === "success") {
       await session.refresh();
       setSubmitting(false);
-      onSuccess?.();
+      onSuccess?.(res.data.landingPath);
       return;
     }
     setSubmitting(false);

package/packages/bundled-features/src/billing-foundation/billing-info-query.ts

@@ -39,18 +39,18 @@ export type BillingInfo<TTier extends string> = {
     readonly tier: string;
     readonly providerName: string;
   } | null;
-  readonly prices: Readonly<Partial<Record<string, string>>>;
+  readonly prices: TierPrices<TTier>;
 };
 
+export type TierPrices<TTier extends string> = { readonly [K in TTier]?: string };
+
 export type BillingInfoQueryDeps<TTier extends string> = {
   readonly roles: readonly string[];
   readonly resolveTier: (db: TenantDb, tenantId: TenantId) => Promise<TTier>;
   // ctx is the same HandlerContext the returned handler receives — apps read
   // their extraContext fields (e.g. `billingPrices`) off it and validate them
   // at that boundary.
-  readonly getBillingPrices: (
-    ctx: HandlerContext,
-  ) => Readonly<Partial<Record<string, string>>> | null;
+  readonly getBillingPrices: (ctx: HandlerContext) => TierPrices<TTier> | null;
 };
 
 export function createBillingInfoQueryConfig<TTier extends string>(

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "BillingInfo.prices and getBillingPrices are keyed by the tier union",
+    "migration": "A getBillingPrices that returns keys outside your tier union no longer compiles; remove or rename those keys."
+  },
   {
     "version": "0.346.0",
     "type": "fix",

package/packages/bundled-features/src/channel-in-app/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "in_app_messages gets a tenant, user, created_at index",
+    "migration": "Run `kumiko schema generate`; it emits an in-place CREATE INDEX with no DROP and no rebuild."
+  }
+]

package/packages/bundled-features/src/channel-in-app/in-app-channel.ts

@@ -24,7 +24,7 @@ export const inAppChannel: DeliveryChannel = {
     });
 
     if (ctx.sseBroker) {
-      ctx.sseBroker.pushToChannel(tenantChannel(ctx.tenantId), {
+      await ctx.sseBroker.pushToChannel(tenantChannel(ctx.tenantId), {
         type: "channel-in-app:event:delivered",
         data: {
           id: row?.id,

package/packages/bundled-features/src/channel-in-app/tables.ts

@@ -2,6 +2,7 @@ import { requireEntityTableMeta } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   boolean,
   type EntityTableMeta,
+  index,
   instant,
   table as pgTable,
   serial,
@@ -10,18 +11,23 @@ import {
   uuid,
 } from "@cosmicdrift/kumiko-framework/db";
 
-export const inAppMessagesTable = pgTable("in_app_messages", {
-  id: serial("id").primaryKey(),
-  tenantId: uuid("tenant_id").notNull(),
-  userId: text("user_id").notNull(),
-  notificationType: text("notification_type").notNull(),
-  title: text("title").notNull(),
-  body: text("body"),
-  data: text("data"), // JSON string for action, screen, etc.
-  isRead: boolean("is_read").default(false).notNull(),
-  readAt: instant("read_at"),
-  createdAt: instant("created_at").default(sql`now()`).notNull(),
-});
+export const inAppMessagesTable = pgTable(
+  "in_app_messages",
+  {
+    id: serial("id").primaryKey(),
+    tenantId: uuid("tenant_id").notNull(),
+    userId: text("user_id").notNull(),
+    notificationType: text("notification_type").notNull(),
+    title: text("title").notNull(),
+    body: text("body"),
+    data: text("data"), // JSON string for action, screen, etc.
+    isRead: boolean("is_read").default(false).notNull(),
+    readAt: instant("read_at"),
+    createdAt: instant("created_at").default(sql`now()`).notNull(),
+  },
+  // Every inbox, unread-count, mark-all-read and userData export/delete read filters by tenant + user.
+  (t) => [index("in_app_messages_tenant_user_created_idx").on(t.tenantId, t.userId, t.createdAt)],
+);
 
 // Derived from inAppMessagesTable (table() attaches the meta as a Symbol) so
 // the two can't drift, instead of hand-duplicating the column list.

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "forget-subject: the SUBJECT_FORGOTTEN audit now commits before the handler tx does and records cleanupError when a derived-data sweep fails",
+    "detail": "The SUBJECT_FORGOTTEN audit event is appended through the outside-transaction db, so it commits before the handler transaction does and survives a later rollback. If the blind-index sweep or search purge fails, the event carries cleanupError (error code or name, never the message) and the handler then fails; retry to finish the cleanup. The user-lifecycle step runs in a savepoint and no longer aborts the handler transaction."
+  },
+  {
+    "version": "0.354.0",
+    "type": "fix",
+    "title": "Writing a personal field of an erased data subject answers 409 subject_erased instead of 500",
+    "detail": "Writing PII to an erased data subject answers 409 `subject_erased`, rebinding a hook's unsafeRaw grant no longer inherits db.global() writes, jobs wait for boot gates before consuming\nA write that has to encrypt a personal field for a subject whose key was erased (crypto-shredding) now fails with a `ConflictError` (409, reason `subject_erased`, i18n in en and de) instead of a 500, on the executor write path and in `encryptForDirectWrite`. A hook's own `unsafeRaw` grant (`withUnsafeRawGrant`) no longer carries the handler's `globalWrites` grant. The job runner starts its BullMQ worker only after the boot gates passed, so a job queued by a previous run cannot execute against an unmet boot precondition. `buildServer` warns at boot when `r.systemScope()` features exist but no RateLimitResolver is configured. The auth, MFA, PAT, change-email and request-deletion handlers declare only the escape-hatch grants they use."
+  },
   {
     "version": "0.338.0",
     "type": "improvement",

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -1,5 +1,6 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
+import { runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   computeBlindIndex,
   configuredBlindIndexKey,
@@ -31,8 +32,10 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
-import { append } from "@cosmicdrift/kumiko-framework/event-store";
-import { assertIrreversibleOperationAllowed } from "@cosmicdrift/kumiko-framework/pipeline";
+import {
+  appendDomainEventCore,
+  assertIrreversibleOperationAllowed,
+} from "@cosmicdrift/kumiko-framework/pipeline";
 import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/search";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
@@ -46,6 +49,7 @@ import {
 } from "../../user-data-rights/index.js";
 import {
   CRYPTO_SHREDDING_AGGREGATE_TYPE,
+  CRYPTO_SHREDDING_FEATURE_NAME,
   RECORD_ENTITY_NOT_REGISTERED,
   SUBJECT_FORGET_DENIED_EVENT_NAME,
   SUBJECT_FORGOTTEN_EVENT_NAME,
@@ -65,6 +69,9 @@ export const subjectForgottenSchema = z.object({
   subjectKey: z.string().min(1),
   reason: z.string().min(10),
   forgottenBy: z.string().min(1),
+  // Error code or name of a failed derived-data sweep, never its message (which
+  // can name the subject). Present only when the handler failed after the erase.
+  cleanupError: z.string().min(1).optional(),
 });
 
 export const subjectForgetDeniedSchema = z.object({
@@ -234,16 +241,8 @@ async function appendDenialAuditEvent(
       }),
     );
   }
-  const eventDef = ctx.registry.getEvent(SUBJECT_FORGET_DENIED_EVENT_NAME);
-  if (!eventDef) {
-    return writeFailure(
-      new InternalError({
-        message: `[crypto-shredding] event "${SUBJECT_FORGET_DENIED_EVENT_NAME}" is not registered.`,
-      }),
-    );
-  }
   const blindIndexKey = configuredBlindIndexKey();
-  const payload = subjectForgetDeniedSchema.parse({
+  const payload: z.infer<typeof subjectForgetDeniedSchema> = {
     // The denial lands in the REQUESTING actor's own tenant-scoped stream —
     // it must never materialise the foreign subject's identifiers there. A
     // plaintext subjectKey/aggregateId would survive as a permanent record
@@ -260,31 +259,132 @@ async function appendDenialAuditEvent(
     forgottenBy: event.user.id,
     actorTenantId: event.user.tenantId,
     denial: denialCode,
-  });
-  const reqCtx = requestContext.get();
-  // This event is the only proof the denial happened. Skipping
-  // runProjectionsForEvent here is fine — nothing projects
-  // crypto-shredding:event:forget-denied.
-  await append(denialAuditRunner, {
-    aggregateId: generateId(),
-    aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
-    // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw
-    // bypasses TenantDb's scoping, so this is the only guard against a cross-tenant denial event (fw#2452).
-    tenantId: event.user.tenantId,
-    expectedVersion: 0,
-    type: SUBJECT_FORGET_DENIED_EVENT_NAME,
-    eventVersion: eventDef.version,
-    payload,
-    metadata: {
-      userId: event.user.id,
-      ...(reqCtx?.requestId ? { requestId: reqCtx.requestId } : {}),
-      ...(reqCtx?.correlationId ? { correlationId: reqCtx.correlationId } : {}),
-      ...(reqCtx?.causationId ? { causationId: reqCtx.causationId } : {}),
+  };
+  await appendDomainEventCore(
+    {
+      registry: ctx.registry,
+      db: denialAuditRunner,
+      // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw
+      // bypasses TenantDb's scoping, so this is the only guard against a cross-tenant denial event (fw#2452).
+      tenantId: event.user.tenantId,
+      userId: String(event.user.id),
+      callSiteLabel: "forget-subject denial audit",
+      callerFeature: CRYPTO_SHREDDING_FEATURE_NAME,
     },
-  });
+    {
+      // Fresh stream per denial: no version to read, nothing to conflict with.
+      aggregateId: generateId(),
+      aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+      type: SUBJECT_FORGET_DENIED_EVENT_NAME,
+      payload,
+    },
+  );
   return null;
 }
 
+// Name or driver code of the error, never its message: a message can carry the
+// subject key or row values and would land in a permanent audit event.
+function sweepErrorLabel(err: unknown): string {
+  if (typeof err === "object" && err !== null && "code" in err) {
+    const code = err.code;
+    if (typeof code === "string" && code.length > 0) return code;
+  }
+  return err instanceof Error && err.name.length > 0 ? err.name : "UnknownError";
+}
+
+// The key is already erased when this runs, so a failing sweep must not skip the
+// audit event: the failure is returned as a label for the event instead of thrown.
+// The savepoint keeps a database error from aborting the handler transaction.
+async function sweepDerivedSubjectData(
+  ctx: HandlerContext,
+  subject: SubjectId,
+  subjectKey: string,
+  crossTenantRunner: DbRunner,
+): Promise<string | undefined> {
+  try {
+    await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
+      // Blind-index sweep (#818): nulls bidx columns now so the deterministic
+      // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
+      await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
+
+      // Derived search index still holds plaintext (#1610) — purge next to the
+      // blind-index sweep. No adapter → no-op (apps without search).
+      if (ctx.searchAdapter) {
+        await purgeSearchDocumentsForSubject(
+          crossTenantSubjectRunner,
+          ctx.registry.features,
+          ctx.searchAdapter,
+          subjectKey,
+          subject,
+        );
+      }
+    });
+    return undefined;
+  } catch (err) {
+    return sweepErrorLabel(err);
+  }
+}
+
+// Graceful fail: email-subscribers and other non-user entities may use
+// user-style subject keys without having an actual user row — the key erase is
+// the important part for GDPR compliance; the lifecycle update is best-effort for
+// real users. The savepoint confines the failure so the handler transaction
+// stays usable for the audit event.
+async function closeUserLoginDoorBestEffort(
+  ctx: HandlerContext,
+  userId: string,
+  lifecycleRunner: DbRunner,
+): Promise<void> {
+  try {
+    await runInSavepointIfSupported(lifecycleRunner, async (userLifecycleRunner) => {
+      await updateUserLifecycle(userLifecycleRunner, userId, { status: USER_STATUS.Deleted });
+      if (ctx.registry.features.has("personal-access-tokens")) {
+        await revokeAllPatTokensForUser(userLifecycleRunner, userId);
+      }
+    });
+  } catch {
+    // skip: no user row for this subject key (e.g. email subscribers); key erase and sweeps already ran.
+  }
+}
+
+// Through the outside-transaction db when available, so the audit event commits
+// even though the handler may fail afterwards (sweep error) and roll back its own
+// transaction. Without that source the event stays in the handler transaction.
+async function appendSubjectForgotten(
+  ctx: HandlerContext,
+  event: WriteEvent<z.infer<typeof forgetSubjectSchema>>,
+  aggregateId: string,
+  payload: z.infer<typeof subjectForgottenSchema>,
+  outsideRunner: DbRunner | undefined,
+): Promise<void> {
+  if (!outsideRunner) {
+    await ctx.unsafeAppendEvent({
+      aggregateId,
+      aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+      type: SUBJECT_FORGOTTEN_EVENT_NAME,
+      payload,
+    });
+  } else {
+    await appendDomainEventCore(
+      {
+        registry: ctx.registry,
+        db: outsideRunner,
+        // MUST be event.user.tenantId, never SYSTEM_TENANT_ID — unsafeRaw bypasses TenantDb's scoping (fw#2452).
+        tenantId: event.user.tenantId,
+        userId: String(event.user.id),
+        callSiteLabel: "forget-subject audit",
+        callerFeature: CRYPTO_SHREDDING_FEATURE_NAME,
+      },
+      {
+        aggregateId,
+        aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
+        type: SUBJECT_FORGOTTEN_EVENT_NAME,
+        payload,
+      },
+    );
+  }
+}
+
 // Manual crypto-shred for a DPO / platform operator: erases the subject's
 // DEK immediately (all its PII ciphertext becomes unreadable, reads render
 // "[[erased]]") and appends the audit event. Forget is final — the adapter
@@ -306,7 +406,7 @@ export const forgetSubjectWrite = defineWriteHandler({
   escapeHatch: {
     grants: ["unsafeRaw"],
     reason:
-      "denial audit append names the prober's own tenant stream on the outside-transaction db; " +
+      "the denial and SUBJECT_FORGOTTEN audit appends name the caller's own tenant stream on the outside-transaction db; " +
       "the tenant-scope and retention checks run against the subject's tenant, not necessarily the caller's; " +
       "the blind-index sweep and search purge address the subject across tenants; the user " +
       "lifecycle update and PAT revoke run on the SYSTEM user stream.",
@@ -377,22 +477,12 @@ export const forgetSubjectWrite = defineWriteHandler({
       eraseReason: event.payload.reason,
     });
 
-    // Blind-index sweep (#818): nulls bidx columns now so the deterministic
-    // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
-    const crossTenantSubjectRunner = ctx.db.unsafeRaw();
-    await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
-
-    // Derived search index still holds plaintext (#1610) — purge next to the
-    // blind-index sweep. No adapter → no-op (apps without search).
-    if (ctx.searchAdapter) {
-      await purgeSearchDocumentsForSubject(
-        crossTenantSubjectRunner,
-        ctx.registry.features,
-        ctx.searchAdapter,
-        subjectKey,
-        subject,
-      );
-    }
+    const cleanupError = await sweepDerivedSubjectData(
+      ctx,
+      subject,
+      subjectKey,
+      ctx.db.unsafeRaw(),
+    );
 
     // User subject: close the login door. DEK-erase makes the passwordHash
     // ciphertext unreadable, but status + PATs are standalone credentials —
@@ -409,33 +499,28 @@ export const forgetSubjectWrite = defineWriteHandler({
     // crash recovery is safe. User-feature guard: without the user feature
     // read_users doesn't exist (crypto-only stack). Tenant subjects have no
     // credentials.
-    // Graceful fail: email-subscribers and other non-user entities may use
-    // user-style subject keys without having an actual user row — the key
-    // erase above is the important part for GDPR compliance; the lifecycle
-    // update is best-effort for real users.
     if (raw.kind === "user" && ctx.registry.features.has("user")) {
-      try {
-        const userLifecycleRunner = ctx.db.unsafeRaw();
-        await updateUserLifecycle(userLifecycleRunner, raw.userId, { status: USER_STATUS.Deleted });
-        if (ctx.registry.features.has("personal-access-tokens")) {
-          await revokeAllPatTokensForUser(userLifecycleRunner, raw.userId);
-        }
-      } catch {
-        // User row may not exist (e.g. email subscribers with user-style
-        // subject keys). Key erase + blind-index sweep above already ran.
-      }
+      await closeUserLoginDoorBestEffort(ctx, raw.userId, ctx.db.unsafeRaw());
     }
 
-    await ctx.unsafeAppendEvent({
-      aggregateId: subjectAggregateId(raw),
-      aggregateType: CRYPTO_SHREDDING_AGGREGATE_TYPE,
-      type: SUBJECT_FORGOTTEN_EVENT_NAME,
-      payload: {
+    await appendSubjectForgotten(
+      ctx,
+      event,
+      subjectAggregateId(raw),
+      {
         subjectKey,
         reason: event.payload.reason,
         forgottenBy: event.user.id,
+        ...(cleanupError !== undefined && { cleanupError }),
       },
-    });
+      ctx.dbOutsideTransaction?.unsafeRaw(),
+    );
+
+    if (cleanupError !== undefined) {
+      throw new InternalError({
+        message: `[crypto-shredding] forget-subject erased the key but a derived-data sweep failed (${cleanupError}); retry to finish the cleanup.`,
+      });
+    }
 
     return { isSuccess: true as const, data: { subjectKey } };
   },

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.354.0",
+    "type": "breaking",
+    "title": "POST /resubscribe requires the undo token from the POST /unsubscribe response",
+    "migration": "Clients that called the resubscribe route with the unsubscribe token must send the undo token instead: read it from the hidden token field of the page POST /unsubscribe returns (aud kumiko:resubscribe, valid for 1 hour). The unsubscribe token is rejected on /resubscribe with 400, and the undo token is rejected on /unsubscribe."
+  },
   {
     "version": "0.352.0",
     "type": "breaking",

package/packages/bundled-features/src/delivery/db/queries/address-opt-outs.ts

@@ -1,23 +1,29 @@
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { notificationAddressOptOutsTable } from "../../tables.js";
+
+export type AddressOptOutKey = string;
+
+export function addressOptOutKey(addressHash: string, channel: string): AddressOptOutKey {
+  return `${addressHash}|${channel}`;
+}
 
 // Exact match only — unlike notification-preferences there is no wildcard
 // ("*") semantics for address opt-outs, the token that creates a row always
-// carries one concrete notificationType/channel pair.
-export async function isAddressOptedOut(
+// carries one concrete notificationType/channel pair. One query covers every
+// recipient of a notify() call.
+export async function selectOptedOutAddresses(
   db: DbConnection,
   tenantId: TenantId,
-  addressHash: string,
   notificationType: string,
-  channel: string,
-): Promise<boolean> {
-  const rows = await unsafeReadRetrying<{ readonly id: string }>(
+  addressHashes: readonly string[],
+): Promise<ReadonlySet<AddressOptOutKey>> {
+  if (addressHashes.length === 0) return new Set();
+  const rows = await selectMany<{ readonly addressHash: string; readonly channel: string }>(
     db,
-    `SELECT id FROM read_notification_address_opt_outs
-     WHERE tenant_id = $1 AND address_hash = $2 AND notification_type = $3 AND channel = $4
-     LIMIT 1`,
-    [tenantId, addressHash, notificationType, channel],
+    notificationAddressOptOutsTable,
+    { tenantId, notificationType, addressHash: { in: addressHashes } },
   );
-  return rows.length > 0;
+  return new Set(rows.map((row) => addressOptOutKey(row.addressHash, row.channel)));
 }