@cosmicdrift/kumiko-samples 0.363.0 → 0.364.0

package/packages/bundled-features/src/config/resolver.ts

@@ -119,6 +119,19 @@ async function decryptPiiEncrypted(raw: string, qualifiedKey: string): Promise<s
   return decryptPiiValueForSubject(kms, raw, kmsCtx, qualifiedKey);
 }
 
+// Plaintext form of a stored config_values.value for every read path (resolver,
+// bootstrap idempotency check).
+export async function decryptStoredValue(
+  raw: string,
+  keyDef: ConfigKeyDefinition,
+  cipher: EnvelopeCipher | undefined,
+  qualifiedKey: string,
+): Promise<string> {
+  if (keyDef.encrypted) return decryptEncrypted(cipher, raw, qualifiedKey);
+  if (keyDef.piiEncrypted) return decryptPiiEncrypted(raw, qualifiedKey);
+  return raw;
+}
+
 // backing="secrets" keys store their value in the secrets store (flat per
 // (tenant,key) at SYSTEM_TENANT_ID), not in config_values. Both read paths
 // (getWithSource + buildCascade) route the system rung here. Missing reader =
@@ -230,12 +243,7 @@ async function buildCascade(
 
     const row = await fetchRow(lookup.tenantId, lookup.userId);
     if (row?.value !== null && row?.value !== undefined) {
-      let raw = row.value;
-      if (keyDef.encrypted) {
-        raw = await decryptEncrypted(cipher, raw, qualifiedKey);
-      } else if (keyDef.piiEncrypted) {
-        raw = await decryptPiiEncrypted(raw, qualifiedKey);
-      }
+      const raw = await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey);
       if (activeIndex === -1) activeIndex = levels.length;
       levels.push({
         label: lookup.label,
@@ -409,12 +417,7 @@ export function createConfigResolver(options: ConfigResolverOptions = {}): Confi
       for (const lookup of lookups) {
         const row = await findRow(qualifiedKey, lookup.tenantId, lookup.userId, db);
         if (row?.value !== null && row?.value !== undefined) {
-          let raw = row.value;
-          if (keyDef.encrypted) {
-            raw = await decryptEncrypted(cipher, raw, qualifiedKey);
-          } else if (keyDef.piiEncrypted) {
-            raw = await decryptPiiEncrypted(raw, qualifiedKey);
-          }
+          const raw = await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey);
           return { value: deserializeValue(raw, keyDef.type), source: lookup.source };
         }
       }

package/packages/bundled-features/src/config/write-helpers.ts

@@ -28,8 +28,10 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
+import type { EnvelopeCipher } from "@cosmicdrift/kumiko-framework/secrets";
 import { assertUnreachable } from "@cosmicdrift/kumiko-framework/utils";
 import { ConfigErrors } from "./constants.js";
+import { decryptStoredValue } from "./resolver.js";
 import { configValuesTable } from "./table.js";
 
 export type ConfigRowLookup = {
@@ -62,6 +64,27 @@ export async function findConfigRow(
   };
 }
 
+// Idempotency check for declarative writers: does the stored row already hold
+// `serializedValue` (JSON of the plaintext)? Encrypted rows are decrypted
+// first, since their ciphertext differs on every encrypt.
+export async function configRowHoldsValue(
+  row: ConfigRowLookup | null,
+  keyDef: ConfigKeyDefinition | undefined,
+  cipher: EnvelopeCipher | undefined,
+  qualifiedKey: string,
+  serializedValue: string,
+): Promise<boolean> {
+  if (row?.value === null || row?.value === undefined) return false;
+  if (!keyDef?.encrypted && !keyDef?.piiEncrypted) return row.value === serializedValue;
+  if (!keyDef) return false;
+  try {
+    return (await decryptStoredValue(row.value, keyDef, cipher, qualifiedKey)) === serializedValue;
+  } catch {
+    // Unreadable (rotated key, missing cipher/KMS): the caller rewrites the row, which is the repair.
+    return false;
+  }
+}
+
 // Three-stage pre-write gate that set + reset both need: resolve the key
 // definition (404 when unknown), check the user's roles can write it (403),
 // and map the target scope to the (tenantId | null, userId | null) pair the

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "forget-subject keeps the user status flip and PAT revocation when the sweep fails",
+    "detail": "The user is set to Deleted and its personal access tokens are revoked right after the key erase, in their own transaction on the outside-transaction db. A failing blind-index or search sweep still makes the handler throw so the cleanup can be retried, but it no longer rolls the login door back. Without an outside-transaction db the previous in-transaction savepoint path is used. A failure while closing the login door of an existing user now fails the forget (retry is safe) instead of passing silently; subjects without a user row are skipped."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -1,6 +1,11 @@
 import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { ROLES } from "@cosmicdrift/kumiko-framework/auth";
-import { runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  fetchOne,
+  runInSavepointIfSupported,
+  runnerCanBeginTransaction,
+  transaction,
+} from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   computeBlindIndex,
   configuredBlindIndexKey,
@@ -42,7 +47,7 @@ import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
 import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
-import { USER_STATUS } from "../../user/index.js";
+import { USER_STATUS, userTable } from "../../user/index.js";
 import {
   denyIfTargetOutsideAdminTenant,
   isSystemAdminActor,
@@ -337,25 +342,33 @@ async function sweepDerivedSubjectData(
   }
 }
 
-// Graceful fail: email-subscribers and other non-user entities may use
-// user-style subject keys without having an actual user row — the key erase is
-// the important part for GDPR compliance; the lifecycle update is best-effort for
-// real users. The savepoint confines the failure so the handler transaction
-// stays usable for the audit event.
-async function closeUserLoginDoorBestEffort(
+// Email subscribers and other non-user entities use user-style subject keys
+// without a read_users row — the key erase is the GDPR-relevant part, so no row
+// means nothing to close. For an existing row, failures propagate: the handler
+// throws and the retry re-runs the (idempotent) erase plus the door close. With
+// an outside-transaction runner that can open its own transaction, the door
+// closes there and stays committed when the handler throws afterwards (sweep
+// error). Otherwise a savepoint confines a failure to the handler transaction.
+async function closeUserLoginDoor(
   ctx: HandlerContext,
   userId: string,
-  lifecycleRunner: DbRunner,
+  outsideRunner: DbRunner | undefined,
+  handlerTxRunner: DbRunner,
 ): Promise<void> {
-  try {
-    await runInSavepointIfSupported(lifecycleRunner, async (userLifecycleRunner) => {
-      await updateUserLifecycle(userLifecycleRunner, userId, { status: USER_STATUS.Deleted });
-      if (ctx.registry.features.has("personal-access-tokens")) {
-        await revokeAllPatTokensForUser(userLifecycleRunner, userId);
-      }
-    });
-  } catch {
-    // skip: no user row for this subject key (e.g. email subscribers); key erase and sweeps already ran.
+  const userRow = await fetchOne(handlerTxRunner, userTable, { id: userId });
+  // skip: no user row for this subject key (e.g. email subscribers); there is no door to close.
+  if (!userRow) return;
+
+  const closeDoor = async (runner: DbRunner): Promise<void> => {
+    await updateUserLifecycle(runner, userId, { status: USER_STATUS.Deleted });
+    if (ctx.registry.features.has("personal-access-tokens")) {
+      await revokeAllPatTokensForUser(runner, userId);
+    }
+  };
+  if (outsideRunner && runnerCanBeginTransaction(outsideRunner)) {
+    await transaction(outsideRunner, closeDoor);
+  } else {
+    await runInSavepointIfSupported(handlerTxRunner, closeDoor);
   }
 }
 
@@ -490,14 +503,6 @@ export const forgetSubjectWrite = defineWriteHandler({
       eraseReason: event.payload.reason,
     });
 
-    const cleanupError = await sweepDerivedSubjectData(
-      ctx,
-      subject,
-      subjectKey,
-      ctx.db.unsafeRaw(),
-      { requestId, erasedBy: event.user.id },
-    );
-
     // User subject: close the login door. DEK-erase makes the passwordHash
     // ciphertext unreadable, but status + PATs are standalone credentials —
     // the PAT resolver only checks revokedAt/expiresAt, NOT user.status
@@ -513,10 +518,26 @@ export const forgetSubjectWrite = defineWriteHandler({
     // crash recovery is safe. User-feature guard: without the user feature
     // read_users doesn't exist (crypto-only stack). Tenant subjects have no
     // credentials.
+    // Runs before the sweep and in its own transaction: a failing sweep rolls the
+    // handler transaction back, and the handler tx holds no lock on this user's
+    // read_users row yet (only read gates ran), so there is no lock conflict.
     if (raw.kind === "user" && ctx.registry.features.has("user")) {
-      await closeUserLoginDoorBestEffort(ctx, raw.userId, ctx.db.unsafeRaw());
+      await closeUserLoginDoor(
+        ctx,
+        raw.userId,
+        ctx.dbOutsideTransaction?.unsafeRaw(),
+        ctx.db.unsafeRaw(),
+      );
     }
 
+    const cleanupError = await sweepDerivedSubjectData(
+      ctx,
+      subject,
+      subjectKey,
+      ctx.db.unsafeRaw(),
+      { requestId, erasedBy: event.user.id },
+    );
+
     await appendSubjectForgotten(
       ctx,
       event,

package/packages/bundled-features/src/custom-fields/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "update-tenant-field no longer hides `type` from the handler schema",
+    "detail": "The `type` field is part of the documented payload; the 422 check against changing the stored type remains the protection."
+  },
   {
     "version": "0.359.0",
     "type": "improvement",

package/packages/bundled-features/src/custom-fields/handlers/update-tenant-field.write.ts

@@ -46,7 +46,6 @@ export function createUpdateTenantFieldHandler(
     access: { roles: opts.roles ?? DEFAULT_FIELD_DEFINITION_WRITE_ROLES },
     description:
       "Replaces a tenant-owned custom-field definition with a complete new spec; serializedField.type may be omitted, in which case the stored type applies, and a different type is refused. Use it to relabel or re-constrain an existing field rather than to create or remove one.",
-    excludedFields: ["type"],
     handler: async (event, ctx) => {
       const payload = event.payload as UpdateFieldPayload; // @cast-boundary engine-payload
       const tenantId = event.user.tenantId;

package/packages/bundled-features/src/delivery/attachment-ref.ts

@@ -14,6 +14,27 @@ export const MAX_EMAIL_ATTACHMENTS = 20;
 
 export const MAX_RENDERED_PDF_VARIABLES_BYTES = 64_000;
 
+// Channel-data keys that steer delivery itself (envelope, headers, attachments);
+// they are not document variables and must not be copied into attached PDF refs.
+export const DELIVERY_ENVELOPE_DATA_KEYS = [
+  "attachments",
+  "from",
+  "fromName",
+  "replyTo",
+  "headers",
+  "unsubscribeUrl",
+] as const;
+
+const DELIVERY_ENVELOPE_DATA_KEY_SET: ReadonlySet<string> = new Set(DELIVERY_ENVELOPE_DATA_KEYS);
+
+export function withoutDeliveryEnvelopeKeys(
+  variables: Readonly<Record<string, unknown>>,
+): Readonly<Record<string, unknown>> {
+  return Object.fromEntries(
+    Object.entries(variables).filter(([key]) => !DELIVERY_ENVELOPE_DATA_KEY_SET.has(key)),
+  );
+}
+
 const MAX_ID_LENGTH = 64;
 
 const fileRefIdSchema = z.string().min(1).max(MAX_ID_LENGTH);

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A failed final delivery attempt frees the idempotency key",
+    "detail": "A soft send failure and any error thrown on the final render or send attempt release the idempotency key, so the caller's retry is not dropped as a duplicate."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "A mail without a readable inline image is sent without it",
+    "detail": "An inline image whose bytes could not be read (for example a system template logo while the job context has no provider resolver) failed the whole mail send. The attachment reader now logs a warning with the fileRef id and skips the image."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Delivery exports the envelope-key filter for mail variables",
+    "detail": "withoutDeliveryEnvelopeKeys strips reserved delivery keys from template variables."
+  },
   {
     "version": "0.363.0",
     "type": "breaking",

package/packages/bundled-features/src/delivery/channel-context.ts

@@ -3,8 +3,9 @@ import { createTenantDb, type DbConnection, type TenantDb } from "@cosmicdrift/k
 import type { ConfigAccessor, Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
+import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { readFileRefContent } from "../file-foundation/index.js";
+import { type FileRefContent, readFileRefContent } from "../file-foundation/index.js";
 import {
   collectRendererPlugins,
   createRendererFoundationApi,
@@ -40,7 +41,10 @@ export function createTemplateMailRenderer(
       html: response.html,
       text: response.text,
       ...(response.previewText !== undefined && { previewText: response.previewText }),
+      ...(response.fromName !== undefined && { fromName: response.fromName }),
+      ...(response.replyTo !== undefined && { replyTo: response.replyTo }),
       ...(response.attachments !== undefined && { attachments: response.attachments }),
+      ...(response.layout !== undefined && { layout: response.layout }),
     };
   };
 }
@@ -82,6 +86,22 @@ function createPdfRenderer(
   };
 }
 
+// A decorative inline image (logo) that cannot be read must not fail the whole mail.
+async function readInlineImageOrNull(
+  fileRefId: string,
+  read: () => Promise<FileRefContent | null>,
+): Promise<FileRefContent | null> {
+  try {
+    return await read();
+  } catch (err) {
+    createFallbackLogger("delivery").warn("inline image could not be read, sending without it", {
+      fileRefId,
+      errorName: err instanceof Error ? err.name : typeof err,
+    });
+    return null;
+  }
+}
+
 // Inline images and file attachments the renderer took from a template may come from the system
 // tenant (system template or tenant override of one). A file ref from notify data stays limited to
 // the job's own tenant, since a caller picks it. Inline content that is not an image is dropped, so
@@ -96,13 +116,16 @@ export function createEmailAttachmentReader(
   const renderPdf = createPdfRenderer(db, registry, tenantId, config, filesForTenant);
   return async (ref: EmailAttachmentRef, origin: AttachmentOrigin = "message") => {
     if (ref.kind === "rendered-pdf") return renderPdf(ref);
-    const found = await readFileRefContent({
-      db,
-      filesForTenant,
-      fileRefId: ref.fileRefId,
-      allowedTenantIds:
-        ref.kind === "file" && origin === "message" ? [tenantId] : [tenantId, SYSTEM_TENANT_ID],
-    });
+    const readRef = () =>
+      readFileRefContent({
+        db,
+        filesForTenant,
+        fileRefId: ref.fileRefId,
+        allowedTenantIds:
+          ref.kind === "file" && origin === "message" ? [tenantId] : [tenantId, SYSTEM_TENANT_ID],
+      });
+    const found =
+      ref.kind === "inline" ? await readInlineImageOrNull(ref.fileRefId, readRef) : await readRef();
     if (found === null) return null;
     if (ref.kind === "inline" && !found.contentType.startsWith(INLINE_IMAGE_CONTENT_TYPE_PREFIX)) {
       return null;

package/packages/bundled-features/src/delivery/index.ts

@@ -1,6 +1,7 @@
 export { sanitizePdfAttachmentFileName } from "../shared/index.js";
 export { hashUnsubscribeAddress } from "./address-opt-out.js";
 export {
+  DELIVERY_ENVELOPE_DATA_KEYS,
   type EmailAttachmentRef,
   emailAttachmentRefSchema,
   type FileAttachmentRef,
@@ -12,6 +13,7 @@ export {
   type RenderedPdfAttachmentRef,
   renderedPdfAttachmentRefSchema,
   toAttachmentRef,
+  withoutDeliveryEnvelopeKeys,
 } from "./attachment-ref.js";
 export {
   type AttemptLogRetentionOptions,

package/packages/bundled-features/src/delivery/jobs.ts

@@ -59,6 +59,8 @@ const sendJobPayloadSchema = renderJobPayloadSchema.extend({
       html: z.string(),
       subject: z.string(),
       text: z.string().optional(),
+      fromName: z.string().optional(),
+      replyTo: z.string().optional(),
       attachments: z.array(emailAttachmentRefSchema).max(MAX_EMAIL_ATTACHMENTS).optional(),
     })
     .optional(),
@@ -96,6 +98,8 @@ function toSendRendered(
     html: rendered.html,
     subject: rendered.subject,
     ...(rendered.text !== undefined && { text: rendered.text }),
+    ...(rendered.fromName !== undefined && { fromName: rendered.fromName }),
+    ...(rendered.replyTo !== undefined && { replyTo: rendered.replyTo }),
     ...(rendered.attachments !== undefined && {
       attachments: rendered.attachments.map(toAttachmentRef),
     }),
@@ -138,15 +142,11 @@ function entryFor(
   };
 }
 
-// Only the final retry frees the key: earlier failures are retried by the runner and
-// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
-// wires the same instance into both.
-async function releaseIdempotencyOnTerminalFailure(
-  ctx: JobContext,
-  p: RenderJobPayload,
-): Promise<void> {
-  // skip: nothing to release before the last attempt or without an idempotency key
-  if (!ctx.finalAttempt || !p.idempotencyKey) return;
+// Assumes ctx.redis is the handle the service claimed on; runProdApp wires the same
+// instance into both.
+async function releaseIdempotencyKey(ctx: JobContext, p: RenderJobPayload): Promise<void> {
+  // skip: no idempotency key was claimed for this notification
+  if (!p.idempotencyKey) return;
   if (!ctx.redis) {
     ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
       notificationType: p.notificationType,
@@ -162,6 +162,33 @@ async function releaseIdempotencyOnTerminalFailure(
   }
 }
 
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup.
+async function releaseIdempotencyOnTerminalFailure(
+  ctx: JobContext,
+  p: RenderJobPayload,
+): Promise<void> {
+  // skip: not the last attempt, the runner retries and the key must keep deduplicating
+  if (!ctx.finalAttempt) return;
+  await releaseIdempotencyKey(ctx, p);
+}
+
+// Covers every throw after the payload parsed, not just the attempt-logged ones: a
+// missing registry or unknown channel on the last attempt would otherwise hold the key
+// until its TTL.
+async function releasingKeyOnTerminalFailure<T>(
+  ctx: JobContext,
+  p: RenderJobPayload,
+  run: () => Promise<T>,
+): Promise<T> {
+  try {
+    return await run();
+  } catch (err) {
+    await releaseIdempotencyOnTerminalFailure(ctx, p);
+    throw err;
+  }
+}
+
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -184,7 +211,6 @@ async function failAttempt(
     p.deliveryAttemptId,
     entryFor(p, "failed", code, p.address),
   );
-  await releaseIdempotencyOnTerminalFailure(ctx, p);
   throw new Error(code);
 }
 
@@ -193,6 +219,10 @@ async function failAttempt(
 // the send step is never reached, so a stuck render can't half-send.
 export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
   const p = renderJobPayloadSchema.parse(payload);
+  return releasingKeyOnTerminalFailure(ctx, p, () => renderStep(p, ctx));
+};
+
+async function renderStep(p: RenderJobPayload, ctx: JobContext): Promise<void> {
   const tenantId = p.tenantId as TenantId; // @cast-boundary engine-payload — stream tenant
   const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
   const channel = resolveChannel(registry, p.channelName);
@@ -203,7 +233,7 @@ export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
     tenantId,
     ctx.secrets,
     ctx.config,
-    (fileTenantId) => fileContextForTenant(ctx, fileTenantId),
+    (fileTenantId) => fileContextForTenant(ctx, ctx.systemUser.tenantId, fileTenantId),
   );
 
   let rendered: RenderedMessage;
@@ -225,13 +255,17 @@ export const deliveryRenderJob: JobHandlerFn = async (payload, ctx) => {
   } catch (err) {
     return failAttempt(ctx, db, registry, p, "channel_error", err);
   }
-};
+}
 
 // Deliver via the channel using the rendered payload (if any). On failure:
 // record the terminal failed event and rethrow so BullMQ retries the send with
 // the same already-rendered HTML — no re-render needed.
 export const deliverySendJob: JobHandlerFn = async (payload, ctx) => {
   const p = sendJobPayloadSchema.parse(payload);
+  return releasingKeyOnTerminalFailure(ctx, p, () => sendStep(p, ctx));
+};
+
+async function sendStep(p: z.infer<typeof sendJobPayloadSchema>, ctx: JobContext): Promise<void> {
   const tenantId = p.tenantId as TenantId; // @cast-boundary engine-payload — stream tenant
   const { db, registry } = requireTenantScopedDeps(ctx, tenantId);
   const channel = resolveChannel(registry, p.channelName);
@@ -242,7 +276,7 @@ export const deliverySendJob: JobHandlerFn = async (payload, ctx) => {
     tenantId,
     ctx.secrets,
     ctx.config,
-    (fileTenantId) => fileContextForTenant(ctx, fileTenantId),
+    (fileTenantId) => fileContextForTenant(ctx, ctx.systemUser.tenantId, fileTenantId),
   );
 
   try {
@@ -259,7 +293,10 @@ export const deliverySendJob: JobHandlerFn = async (payload, ctx) => {
         result.confirmed,
       ),
     );
+    // A soft failure ends the job successfully, so no retry follows and the caller's
+    // retry must not be skipped as a duplicate.
+    if (result.status === "failed") await releaseIdempotencyKey(ctx, p);
   } catch (err) {
     return failAttempt(ctx, db, registry, p, "send_failed", err);
   }
-};
+}

package/packages/bundled-features/src/delivery/types.ts

@@ -13,7 +13,7 @@ import type {
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import type { MailPayload } from "../renderer-foundation/index.js";
+import type { MailPayload, RenderedTemplateRef } from "../renderer-foundation/index.js";
 import type { EmailAttachmentRef } from "./attachment-ref.js";
 import { DELIVERY_CHANNEL_EXTENSION } from "./constants.js";
 
@@ -24,7 +24,11 @@ export type RenderedMail = {
   readonly html: string;
   readonly text: string;
   readonly previewText?: string;
+  readonly fromName?: string;
+  readonly replyTo?: string;
   readonly attachments?: readonly EmailAttachmentRef[];
+  /** The layout version the html was rendered through; the editor preview names it. */
+  readonly layout?: RenderedTemplateRef;
 };
 
 export type ChannelContext = {
@@ -71,6 +75,8 @@ export type RenderedMessage = {
   readonly html: string;
   readonly subject: string;
   readonly text?: string;
+  readonly fromName?: string;
+  readonly replyTo?: string;
   readonly attachments?: readonly EmailAttachmentRef[];
 };
 

package/packages/bundled-features/src/file-derivatives/handlers/public-variant.query.ts

@@ -147,7 +147,7 @@ export const publicVariantQuery = defineQueryHandler({
     const spec = resolveFieldVariant(ctx.registry, entityType, fieldName, query.payload.variant);
     if (!spec) return null;
     const result = await derivatives.variant(query.payload.fileRefId, spec, query.payload.variant);
-    const bytes = await files.ref(result.storageKey).read();
+    const bytes = await files.refFromFileRef(result).read();
 
     // ponytail: fully buffered (no streaming), +33% over the wire from
     // base64 — HttpRouteHandlerDeps only exposes {app, systemQuery} (no

package/packages/bundled-features/src/file-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "readFileRefContent reads handed-over files; fileContextForTenant takes the context tenant",
+    "detail": "readFileRefContent, readTemplateResource and the public variant query read bytes through FileContext.refFromFileRef, so a fileRef moved by a tenant handover is readable again. fileContextForTenant gains a `contextTenantId` argument: without a provider resolver it returns undefined for any other tenant instead of the context's files, which are bound to a different key space."
+  },
   {
     "version": "0.292.0",
     "type": "improvement",

package/packages/bundled-features/src/file-foundation/read-file-ref-content.ts

@@ -22,16 +22,19 @@ type FileRefRow = {
   readonly size: number | bigint | string;
 };
 
-// Tenant-bound on purpose: the FileContext of the current request only reaches its own key space.
+// Tenant-bound on purpose: without a resolver `ctx.files` only reaches the storage of the
+// context's own tenant (`contextTenantId`), so a request for another tenant's files is
+// undefined instead of silently reading through the wrong tenant's storage.
 export function fileContextForTenant(
   ctx: {
     readonly _fileProviderResolver?: FileProviderResolver | undefined;
     readonly files?: FileContext | undefined;
   },
+  contextTenantId: string,
   tenantId: string,
 ): FileContext | undefined {
   const resolver = ctx._fileProviderResolver;
-  if (resolver === undefined) return ctx.files;
+  if (resolver === undefined) return tenantId === contextTenantId ? ctx.files : undefined;
   return fileContextFromResolver(resolver, tenantId);
 }
 
@@ -81,6 +84,6 @@ export async function readFileRefContent(args: {
   if (files === undefined) {
     throw new Error("readFileRefContent: no file storage is available for the file's tenant");
   }
-  const content = await files.ref(row.storageKey).read();
+  const content = await files.refFromFileRef(row).read();
   return { content, contentType: row.mimeType, tenantId: row.tenantId, size };
 }

package/packages/bundled-features/src/files-tenant-data/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tenant destroy hooks make progress even when the deadline already passed",
+    "detail": "The chunked migration takes a minBatches option and the file destroy hooks process one chunk per tick, so a slow list call no longer makes every run time out empty."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/packages/bundled-features/src/files-tenant-data/hooks.ts

@@ -129,6 +129,7 @@ export const fileRefTenantDestroyHook: TenantDataDestroyHook = async (ctx) => {
     },
     maxFailures: 1,
     deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+    minBatches: 1,
     onRowError: (_row, err) => {
       firstFailure = err instanceof Error ? err.message : String(err);
     },
@@ -222,6 +223,9 @@ export const fileRefStorageDestroyHook: StorageProviderDestroyTenantHook = async
       },
       maxFailures: 1,
       deadlineAt: ctx.deadlineAt ?? Number.POSITIVE_INFINITY,
+      // list() and the survivor lookup above can use up the whole budget; one chunk per tick
+      // still deletes, so the stage never reports "no progress".
+      minBatches: 1,
       onRowError: (_key, err) => {
         firstFailure = err instanceof Error ? err.message : String(err);
       },

package/packages/bundled-features/src/inbound-mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Watch supervisor skips and logs accounts whose address does not decrypt",
+    "detail": "Previously a single such account made the whole account snapshot throw."
+  },
   {
     "version": "0.340.0",
     "type": "improvement",