@cosmicdrift/kumiko-samples 0.363.0 → 0.365.0

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -4,7 +4,7 @@ import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import { tierAssignmentAggregateId } from "../aggregate-id.js";
-import { TierAssignmentSources } from "../constants.js";
+import { type TierAssignmentSource, TierAssignmentSources } from "../constants.js";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 
 // SystemAdmin setzt das Tier eines BELIEBIGEN Tenants — manueller Grant ohne
@@ -14,7 +14,8 @@ import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 // Cross-tenant mechanics: ctx.forTenant(tenantId) yields a tenant-mode db bound to the target plus
 // the streamTenantId, so the event lands in the target's stream with the operator as actor.
 //
-// `source: TierAssignmentSources.manual` marks the grant so the billing sync skips it.
+// `source` defaults to manual and marks the grant so the billing sync skips it; passing
+// `billing` hands the row back to the sync, which overwrites it on the next webhook.
 // Upsert: one aggregate per tenant (deterministic aggregate id).
 //
 // Effective-set invalidation: the executor write does not fire the
@@ -47,7 +48,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
   return defineWriteHandler({
     name: "set-tenant-tier",
     description:
-      "Assigns a tier to any tenant as a manual grant without a billing purchase, marking it so a later billing sync will not overwrite it, and applies the new feature set immediately.",
+      "Assigns a tier to any tenant as a manual grant without a billing purchase, marking it so a later billing sync will not overwrite it (or, with source billing, handing the row back to the sync), and applies the new feature set immediately.",
     schema: z.object({
       tenantId: z.string().min(1),
       tier: z
@@ -55,6 +56,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         .min(1)
         .max(50)
         .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
+      source: z.enum(TierAssignmentSources).default(TierAssignmentSources.manual),
     }),
     access: { roles: ["SystemAdmin"] },
     agent: { risk: "high" },
@@ -68,6 +70,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
       const tenantId = event.payload.tenantId as TenantId; // @cast-boundary engine-bridge
       const { db: tdb, streamTenantId } = requireForTenant(ctx, tenantId);
       const tier = event.payload.tier;
+      const source: TierAssignmentSource = event.payload.source;
 
       const existing = await fetchOne<TierAssignmentRow>(tdb, tierAssignmentTable, { tenantId });
 
@@ -76,7 +79,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
           {
             id: existing.id,
             version: existing.version,
-            changes: { tier, source: TierAssignmentSources.manual },
+            changes: { tier, source },
           },
           event.user,
           tdb,
@@ -91,7 +94,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         {
           id: tierAssignmentAggregateId(tenantId),
           tier,
-          source: TierAssignmentSources.manual,
+          source,
           tenantId,
         },
         event.user,

package/packages/bundled-features/src/tier-engine/index.ts

@@ -18,7 +18,9 @@ export {
   type TierMap,
 } from "./compose-app.js";
 export {
+  isTierAssignmentSource,
   TIER_ENGINE_FEATURE,
+  type TierAssignmentSource,
   TierAssignmentSources,
   TierEngineHandlers,
   TierEngineQueries,

package/packages/bundled-features/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "resolveUserDisplayNames no longer swallows decrypt errors",
+    "detail": "A misconfigured or unavailable KMS made the delivery log silently show addresses or ids instead of names. Decrypt errors now propagate like in the member directory; users that are missing or have no display name are still left out."
+  },
   {
     "version": "0.361.0",
     "type": "improvement",

package/packages/bundled-features/src/user/constants.ts

@@ -6,6 +6,7 @@ export const USER_FEATURE = "user" as const;
  *  platform operator. Membership roles (TenantAdmin/Admin/User/…) live on
  *  tenant-membership, not here. */
 export const GLOBAL_ROLE_OPTIONS = ["SystemAdmin"] as const;
+export type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 
 // Qualified write handler names. Handlers carry the "user:" entity prefix so
 // field-level access rules (passwordHash system-only etc.) are wired up.

package/packages/bundled-features/src/user/invited-global-roles.ts

@@ -7,7 +7,7 @@ import {
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+import { GLOBAL_ROLE_OPTIONS, type GlobalRole } from "./constants.js";
 import { userEntity, userTable } from "./schema/user.js";
 
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
@@ -18,8 +18,6 @@ type UserRolesRow = {
   readonly roles: readonly string[] | string | null;
 };
 
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
-
 function isGlobalRole(role: string): role is GlobalRole {
   return GLOBAL_ROLE_OPTIONS.some((option) => option === role);
 }
@@ -34,7 +32,7 @@ export function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[] {
 // already holds. Users live on SYSTEM_TENANT_ID (tenancy "global").
 export async function grantInvitedGlobalRoles(
   db: DbRunner,
-  options: { readonly userId: string; readonly globalRoles: readonly string[] },
+  options: { readonly userId: string; readonly globalRoles: readonly GlobalRole[] },
 ) {
   const existing = await fetchOne<UserRolesRow>(db, userTable, { id: options.userId });
   if (!existing) return writeFailure(new NotFoundError("user", options.userId));

package/packages/bundled-features/src/user/resolve-display-names.ts

@@ -6,9 +6,10 @@ import { userTable } from "./schema/user.js";
 // Shares the KMS adapter's small dedicated pool, same as member-directory.
 const KMS_POOL_CONCURRENCY = 4;
 
-// One batched lookup for a page of user ids. Users that are missing, have no
-// display name, or whose name cannot be decrypted (e.g. crypto-shredded) are
-// left out, so callers fall back to the raw id instead of failing the page.
+// One batched lookup for a page of user ids. Users that are missing or have no
+// display name are left out, so callers fall back to the raw id. Decrypt errors
+// propagate (a misconfigured or unavailable KMS fails loudly, like member-directory);
+// crypto-shredding is handled by the KMS layer.
 export async function resolveUserDisplayNames(
   db: TenantDb,
   userIds: readonly string[],
@@ -18,18 +19,10 @@ export async function resolveUserDisplayNames(
   const users = await selectMany(db, userTable, { id: [...userIds] });
   const named = users.filter((user) => typeof user.displayName === "string");
   await mapWithConcurrency(named, KMS_POOL_CONCURRENCY, async (user) => {
-    try {
-      names.set(
-        String(user.id),
-        await decryptStoredPii(
-          String(user.displayName),
-          "displayName",
-          "user:resolve-display-names",
-        ),
-      );
-    } catch {
-      // Unreadable name: the caller's fallback applies.
-    }
+    names.set(
+      String(user.id),
+      await decryptStoredPii(String(user.displayName), "displayName", "user:resolve-display-names"),
+    );
   });
   return names;
 }

package/packages/bundled-features/src/user/seeding.ts

@@ -11,6 +11,7 @@
 // das Event UND schreibt die Projection-Zeile in einer TX.
 
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { computeBlindIndex, configuredBlindIndexKey } from "@cosmicdrift/kumiko-framework/crypto";
 import {
   createEventStoreExecutor,
   createTenantDb,
@@ -139,12 +140,25 @@ export async function rewriteSeededUserEmail(
   if (typeof id !== "string") {
     throw new Error("rewriteSeededUserEmail: existing user row has no string id");
   }
+  const version = existingRow["version"];
+  if (typeof version !== "number") {
+    throw new Error("rewriteSeededUserEmail: existing user row has no numeric version");
+  }
+  // Every executor.update appends a user:updated event; skip when the stored
+  // blind index already matches so repeated boots do not grow the stream.
+  // Queried by the bidx column itself: fetchOne does not return it, and an
+  // `email` condition would also match a plaintext row with a blank index.
+  const blindIndexKey = configuredBlindIndexKey();
+  if (blindIndexKey !== undefined) {
+    const indexed = await fetchOne(db, userTable, {
+      id,
+      emailBidx: computeBlindIndex(blindIndexKey, email),
+    });
+    // skip: the stored blind index already matches, a rewrite would only append a no-op event.
+    if (indexed) return;
+  }
   const tdb = createTenantDb(db, by.tenantId, "system");
-  const result = await userExecutor.update(
-    { id, version: existingRow["version"] as number, changes: { email } },
-    by,
-    tdb,
-  );
+  const result = await userExecutor.update({ id, version, changes: { email } }, by, tdb);
   // version_conflict: a concurrent write already changed the row — fine for a seed helper.
   // unique_violation: a duplicate row already holds the blind index; the repair
   // has to wait for a manual duplicate cleanup.

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "GDPR mails carry designer labels",
+    "detail": "Feature and notify labels for export-ready, export-failed, deletion-requested and deletion-executed name the GDPR mails in the document designer."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Regression tests prove that forget also shreds the previous email in user.updated events",
+    "detail": "No runtime change. Integration tests with a configured subject KMS show that after an email change followed by forget, the old and new email in user.updated changes and previous decrypt only to the erased sentinel and the subject key is gone. Without a configured KMS, event payloads stay plaintext by design."
+  },
   {
     "version": "0.363.0",
     "type": "breaking",

package/packages/bundled-features/src/user-data-rights/email-templates.ts

@@ -36,7 +36,6 @@ export const GDPR_MAIL_EN: Readonly<Record<string, string>> = {
   "gdpr.mail.deletionExecuted.subject": "{app} — Your account has been deleted",
   "gdpr.mail.deletionExecuted.intro":
     "your {app} account and the associated personal data were deleted on {when}. This action is permanent.",
-  "gdpr.mail.fallbackUrl": "If the button doesn't work, copy this link into your browser:",
 };
 
 registerMailTranslations("en", GDPR_MAIL_EN);

package/packages/bundled-features/src/user-data-rights/i18n.ts

@@ -4,6 +4,11 @@
 type LocalizedString = { readonly en: string };
 
 export const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "user-data-rights:feature.label": { en: "Privacy" },
+  "user-data-rights:notify.export-ready.label": { en: "Data export ready" },
+  "user-data-rights:notify.export-failed.label": { en: "Data export failed" },
+  "user-data-rights:notify.deletion-requested.label": { en: "Deletion requested" },
+  "user-data-rights:notify.deletion-executed.label": { en: "Deletion completed" },
   "user-data-rights:nav.exportJobs": { en: "GDPR exports" },
   "screen:export-job-list.title": { en: "GDPR exports" },
   "screen:export-job-detail.title": { en: "Export job" },

package/packages/bundled-features/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -1,6 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type WritePurpose,
+} from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
@@ -27,6 +31,9 @@ export type UpdateUserLifecycleOptions = {
   // executor's `expect:`. Omitted: unconditional overwrite (skipOptimisticLock).
   // Scalars only, see the executor's `expect:` doc.
   readonly expect?: Readonly<Record<string, string | number | boolean | null>>;
+  // Erasure flows run after the subject key is erased; the write then stores the
+  // erased sentinel instead of failing on re-encrypt.
+  readonly writePurpose?: WritePurpose;
 };
 
 // `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
@@ -59,7 +66,11 @@ export async function updateUserLifecycle(
     { id: userId, changes },
     createSystemUser(SYSTEM_TENANT_ID),
     tenantDb,
-    { skipOptimisticLock: true, ...(options?.expect && { expect: options.expect }) },
+    {
+      skipOptimisticLock: true,
+      ...(options?.expect && { expect: options.expect }),
+      ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+    },
   );
 
   if (result.isSuccess) return { applied: true };

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -47,6 +47,7 @@ import {
   entityEventName,
   executeRawQuery,
   nullBlindIndexesForSubject,
+  WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   type EscapeHatchAuditSink,
@@ -531,7 +532,12 @@ async function processUser(args: {
       // geworfen hat, kommen wir hier nicht an — die Tx rollback'd
       // alles, der User bleibt im DeletionRequested-Status, naechster
       // Run retried.
-      await updateUserLifecycle(tx, userId, { status: USER_STATUS.Deleted });
+      await updateUserLifecycle(
+        tx,
+        userId,
+        { status: USER_STATUS.Deleted },
+        { writePurpose: WritePurposes.erasure },
+      );
       txSucceeded = true;
     });
   } catch (e) {

package/packages/bundled-features/src/user-profile/changes.json

@@ -16,7 +16,7 @@
     "type": "breaking",
     "title": "user-profile now registers its own profile screen (id user-profile:screen:profile); app-side profile screen registrations must be removed (fw#2312).",
     "detail": "`profile` is now a declarative `projectionDetail` screen bound to `user:query:user:me` instead of a custom React component: change-password and change-email stay `EditExtensionSection` components (re-auth flows a declarative action can't express), account deletion (request/cancel via `user-data-rights`, grace period) is now fully declarative fields + `actions: RowAction[]`, preserving the original confirm dialog and `visible: {field, eq/ne}` toggle 1:1. `userProfileClient()` now registers the two extension-section components via `extensionSectionComponents` instead of exposing a `ProfileScreen` component for apps to place in a `components` map. `ProfileScreen` is a dead export. New exports: `ChangeEmailSection`, `ChangePasswordSection` (the two surviving extension components, importable for tests but not meant to be placed manually). Known UI regression, accepted for this pass (same trade-off as `privacy-center`): the deletion confirm-dialog title is now always the action's `label`; the dynamically composed grace-period banner sentence is gone, replaced by a plain `gracePeriodEnd` date field; there is no cancel-deletion success toast.",
-    "migration": "The bundled feature now registers the `profile` screen itself (id `user-profile:screen:profile`) — an app's own `profile` custom-screen registration collides on boot with a duplicate short-id error. Delete the app-side registration entirely: `r.screen({ id: \"profile\", type: \"custom\", renderer: { react: { __component: \"UserProfileScreen\" } }, access: { openToAll: true } })` has no replacement to write, just remove the call. If you have an `r.nav({ screen: \"profile\" })` (or any other reference to the app-local `profile` screen id), repoint it at `\"user-profile:screen:profile\"`. Also remove `components: { UserProfileScreen: ProfileScreen }` from your renderer/client setup and the now-unused `ProfileScreen` import — the client no longer exposes that component. Known affected consumers (not modified here, out of this PR's scope): `money-horse` (`src/features/money-horse/feature.ts:286-292`) and `offlot-app` (`src/features/account/feature.ts:24-30`) both currently register their own `profile` custom screen this way."
+    "migration": "The bundled feature now registers the `profile` screen itself (id `user-profile:screen:profile`) — an app's own `profile` custom-screen registration collides on boot with a duplicate short-id error. Delete the app-side registration entirely: `r.screen({ id: \"profile\", type: \"custom\", renderer: { react: { __component: \"UserProfileScreen\" } }, access: { openToAll: true } })` has no replacement to write, just remove the call. If you have an `r.nav({ screen: \"profile\" })` (or any other reference to the app-local `profile` screen id), repoint it at `\"user-profile:screen:profile\"`. Also remove `components: { UserProfileScreen: ProfileScreen }` from your renderer/client setup and the now-unused `ProfileScreen` import — the client no longer exposes that component. Known affected consumers (not modified here, out of this PR's scope): `money-horse` and `offlot-app` both currently register their own `profile` custom screen this way."
   },
   {
     "version": "0.123.2",

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "Waitlist mails carry designer labels",
+    "detail": "Feature and notify labels for confirmation and admin-notice name the waitlist mails in the document designer."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Waitlist invite no longer double-invites, uses the entry locale and refuses members",
+    "detail": "Two parallel invite calls for one entry now queue on a per-entry advisory lock, so exactly one tenant and one invitation are created. The invitation mail is rendered in the entry's locale instead of the caller's. Inviting an email that already is a member of the target tenant fails with 422 waitlist_not_invitable, as reject already did."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Waitlist submit honors emailRateLimits: [], resolves notifyRecipient before the advisory lock and checks only open entries",
+    "detail": "createWaitlistFeature({ emailRateLimits: [] }) no longer fails boot validation; the per-email bucket is dropped as documented. notifyRecipient runs before the per-email advisory lock and the entry insert, so a failing resolver can no longer abort the submit transaction or hold the lock; a throwing resolver only skips the admin notice. The duplicate check queries status pending or invited with limit 1 instead of scanning the first 50 rows of the address. The feature description now states that the response body is identical for known and unknown addresses while response timing can differ."
+  },
   {
     "version": "0.363.0",
     "type": "breaking",

package/packages/bundled-features/src/waitlist/feature.ts

@@ -26,7 +26,7 @@ import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-ho
 export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefinition {
   return defineFeature(WAITLIST_FEATURE, (r) => {
     r.describe(
-      "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response never reveals whether an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
+      "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
     );
     r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
     r.systemScope();

package/packages/bundled-features/src/waitlist/handlers/invite.write.ts

@@ -1,4 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,
@@ -18,7 +19,13 @@ import { AuthErrors, AuthHandlers } from "../../auth-email-password/index.js";
 import { TenantHandlers, tenantTable } from "../../tenant/index.js";
 import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
-import { adminAccess, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
+import {
+  adminAccess,
+  isTenantMember,
+  platformActor,
+  waitlistDb,
+  waitlistExecutor,
+} from "../lib.js";
 import type { WaitlistInviteOptions } from "../options.js";
 import { WaitlistIdSchema } from "../payloads.js";
 
@@ -30,6 +37,11 @@ export type WaitlistInviteData = {
 
 type InviteTarget = { readonly tenantId: TenantId; readonly role: string };
 
+// pg_advisory_xact_lock namespace (int4): 'wlin' as ASCII, disjoint from the submit lock.
+const INVITE_LOCK_NAMESPACE = 0x776c696e;
+const INVITE_LOCK_REASON =
+  "takes the per-entry advisory lock so parallel invites cannot both create a tenant and invitation; TenantDb has no lock API";
+
 const DEFAULT_INVITE: WaitlistInviteOptions = {
   mode: "own-tenant",
   role: DEFAULT_OWN_TENANT_INVITE_ROLE,
@@ -48,10 +60,11 @@ type EntryRow = {
   readonly name: string;
   readonly company: string | null;
   readonly linkedTenantId: string | null;
+  readonly locale: string | undefined;
 };
 
 function readEntryRow(row: Record<string, unknown>): EntryRow {
-  const { id, version, email, name, company, linkedTenantId } = row;
+  const { id, version, email, name, company, linkedTenantId, locale } = row;
   if (
     typeof id !== "string" ||
     typeof version !== "number" ||
@@ -68,6 +81,7 @@ function readEntryRow(row: Record<string, unknown>): EntryRow {
     name,
     company: typeof company === "string" && company !== "" ? company : null,
     linkedTenantId: typeof linkedTenantId === "string" ? linkedTenantId : null,
+    locale: typeof locale === "string" && locale !== "" ? locale : undefined,
   };
 }
 
@@ -122,8 +136,17 @@ export function createInviteHandler(invite: WaitlistInviteOptions = DEFAULT_INVI
       "Invites a pending or already-invited waitlist entry: creates its tenant (or uses the configured shared tenant), mails the entrant a fresh accept link with the configured role and marks the entry invited; rejected entries cannot be invited. The invitee never receives a global role.",
     // Sends an invite link by email, which cannot be recalled.
     agent: { risk: "high" },
+    escapeHatch: { grants: ["unsafeRaw"], reason: INVITE_LOCK_REASON },
     handler: async (event, ctx) => {
       const db = waitlistDb(ctx);
+      if (!ctx.systemDb) {
+        throw new InternalError({ message: "waitlist:invite requires ctx.systemDb" });
+      }
+      await acquireNamespacedAdvisoryLock(
+        ctx.systemDb.unsafeRaw(INVITE_LOCK_REASON),
+        INVITE_LOCK_NAMESPACE,
+        event.payload.id,
+      );
       const row = await waitlistExecutor.detail({ id: event.payload.id }, platformActor(), db);
       if (!row) return writeFailure(new NotFoundError("waitlistEntry", event.payload.id));
       const entry = readEntryRow(row);
@@ -134,13 +157,22 @@ export function createInviteHandler(invite: WaitlistInviteOptions = DEFAULT_INVI
       const target = await resolveInviteTarget(invite, entry, ctx);
       if ("isSuccess" in target) return target;
 
+      if (await isTenantMember(db, entry.email, target.tenantId)) {
+        return writeFailure(new UnprocessableError(WaitlistErrors.notInvitable));
+      }
+
       // inviteCreate is admin-only (no system role); the system variant with an
       // empty globalRoles list is the only in-process path, and a waitlist
       // invite must never grant a global role.
       const invited = await ctx.writeAs(
         createSystemUser(target.tenantId),
         AuthHandlers.systemInviteCreate,
-        { email: entry.email.toLowerCase(), role: target.role, globalRoles: [] },
+        {
+          email: entry.email.toLowerCase(),
+          role: target.role,
+          globalRoles: [],
+          ...(entry.locale !== undefined && { locale: entry.locale }),
+        },
       );
       if (!invited.isSuccess) {
         // Re-inviting a person who already accepted would reset their live invitation.

package/packages/bundled-features/src/waitlist/handlers/reject.write.ts

@@ -1,11 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createSystemUser,
   defineWriteHandler,
   type HandlerContext,
   parseTenantId,
-  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   InternalError,
@@ -18,13 +16,12 @@ import {
   cancelPendingInvitation,
   INVITATION_STATUS,
   tenantInvitationsTable,
-  tenantMembershipsTable,
 } from "../../tenant/index.js";
-import { userTable } from "../../user/index.js";
 import { WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
 import {
   adminAccess,
+  isTenantMember,
   normalizeEmail,
   platformActor,
   waitlistDb,
@@ -34,18 +31,6 @@ import { WaitlistIdSchema } from "../payloads.js";
 
 export type WaitlistRejectData = { readonly kind: "rejected"; readonly id: string };
 
-// An admin re-invite can flip an accepted invitation back to pending, so the
-// invitation status alone cannot prove the person holds no access.
-async function isTenantMember(db: TenantDb, email: string, tenantId: TenantId): Promise<boolean> {
-  const user = await fetchOne<{ id: string }>(db, userTable, {
-    email: normalizeEmail(email),
-    isDeleted: false,
-  });
-  if (!user) return false;
-  const membership = await fetchOne(db, tenantMembershipsTable, { userId: user.id, tenantId });
-  return membership !== undefined && membership !== null;
-}
-
 // An invited entry already has a live invitation link; rejecting must kill it,
 // otherwise the rejected person can still sign up. Once accepted they hold
 // access, which only tenant member removal may revoke.

package/packages/bundled-features/src/waitlist/handlers/submit.write.ts

@@ -36,10 +36,13 @@ const SUBMIT_ROLES = access.roles(
   "TenantAdmin",
 );
 
+const OPEN_STATUSES = [WAITLIST_STATUS.Pending, WAITLIST_STATUS.Invited];
+
 export type WaitlistSubmitData = { readonly kind: "submitted" };
 
-// Identical for new, duplicate and honeypot submits: the response must not
-// reveal whether the email is already on the list.
+// Identical body for new, duplicate and honeypot submits so the response does not
+// state whether the email is already on the list. Timing still differs: only the
+// new-entry path writes and sends mail.
 const SUBMITTED: WriteResult<WaitlistSubmitData> = {
   isSuccess: true,
   data: { kind: "submitted" },
@@ -60,13 +63,32 @@ function isHoneypotFilled(payload: WaitlistSubmitInput): boolean {
 
 async function hasOpenEntryForEmail(email: string, ctx: HandlerContext): Promise<boolean> {
   const found = await waitlistExecutor.list(
-    { filter: { field: "email", op: "eq", value: email }, limit: 50 },
+    {
+      filter: { field: "email", op: "eq", value: email },
+      filters: [{ field: "status", op: "in", value: OPEN_STATUSES }],
+      limit: 1,
+    },
     platformActor(),
     waitlistDb(ctx),
   );
-  return found.rows.some(
-    (row) => row["status"] === WAITLIST_STATUS.Pending || row["status"] === WAITLIST_STATUS.Invited,
-  );
+  return found.rows.length > 0;
+}
+
+// The resolver usually reads config; run it outside the handler transaction's
+// critical section so a failing statement cannot abort the transaction that holds
+// the entry, and a slow resolver does not extend the per-email advisory lock.
+async function resolveAdminRecipient(
+  opts: WaitlistOptions,
+  ctx: HandlerContext,
+): Promise<string | null> {
+  try {
+    return (await opts.notifyRecipient?.(ctx)) || null;
+  } catch (err) {
+    ctx.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
+      error: err instanceof Error ? err.message : String(err),
+    });
+    return null;
+  }
 }
 
 async function sendBestEffort(
@@ -87,14 +109,16 @@ async function sendBestEffort(
 }
 
 export function createSubmitHandler(opts: WaitlistOptions) {
+  const emailRateLimits = opts.emailRateLimits ?? DEFAULT_SUBMIT_EMAIL_RATE_LIMITS;
   return defineWriteHandler<"submit", typeof WaitlistSubmitSchema, WaitlistSubmitData>({
     name: "submit",
     schema: WaitlistSubmitSchema,
     access: { roles: SUBMIT_ROLES, personalData: "public-intake" },
     rateLimit: opts.rateLimit ?? DEFAULT_SUBMIT_RATE_LIMIT,
-    additionalRateLimits: opts.emailRateLimits ?? DEFAULT_SUBMIT_EMAIL_RATE_LIMITS,
+    // An empty array means "disabled"; boot validation rejects an empty additionalRateLimits.
+    ...(emailRateLimits.length > 0 && { additionalRateLimits: emailRateLimits }),
     description:
-      "Public waitlist sign-up: registers an interest entry and sends the submitter a confirmation mail. Always reports success, whether the address is new or already on the list.",
+      "Public waitlist sign-up: registers an interest entry and sends the submitter a confirmation mail. Reports success whether the address is new or already on the list; the response body is identical, response timing can still differ.",
     escapeHatch: { grants: ["unsafeRaw"], reason: SUBMIT_LOCK_REASON },
     handler: async (event, ctx) => {
       const payload = event.payload;
@@ -106,6 +130,7 @@ export function createSubmitHandler(opts: WaitlistOptions) {
           message: "waitlist:submit requires ctx.systemDb — is r.systemScope() set?",
         });
       }
+      const adminRecipient = await resolveAdminRecipient(opts, ctx);
       await acquireNamespacedAdvisoryLock(
         ctx.systemDb.unsafeRaw(SUBMIT_LOCK_REASON),
         SUBMIT_LOCK_NAMESPACE,
@@ -140,7 +165,6 @@ export function createSubmitHandler(opts: WaitlistOptions) {
       );
 
       await sendBestEffort(ctx, "admin notice", async (notify) => {
-        const adminRecipient = await opts.notifyRecipient?.(ctx);
         // skip: no admin recipient configured
         if (!adminRecipient) return;
         await notify(WAITLIST_NOTIFICATION_TYPES.adminNotice, {

package/packages/bundled-features/src/waitlist/i18n.ts

@@ -1,6 +1,15 @@
 type LocalizedString = { readonly en: string; readonly de: string };
 
 export const WAITLIST_I18N: Readonly<Record<string, LocalizedString>> = {
+  "waitlist:feature.label": { en: "Waitlist", de: "Warteliste" },
+  "waitlist:notify.confirmation.label": {
+    en: "Waitlist confirmation",
+    de: "Bestätigung der Warteliste",
+  },
+  "waitlist:notify.admin-notice.label": {
+    en: "New waitlist entry",
+    de: "Neuer Eintrag auf der Warteliste",
+  },
   "screen:waitlist-list.title": { en: "Waitlist", de: "Warteliste" },
   "waitlist.nav.waitlist": { en: "Waitlist", de: "Warteliste" },
   "waitlist:entity:waitlistEntry:field:name": { en: "Name", de: "Name" },

package/packages/bundled-features/src/waitlist/lib.ts

@@ -1,3 +1,4 @@
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor, type TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
@@ -5,8 +6,11 @@ import {
   type HandlerContext,
   type SessionUser,
   SYSTEM_TENANT_ID,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { tenantMembershipsTable } from "../tenant/index.js";
+import { userTable } from "../user/index.js";
 import { waitlistEntryEntity, waitlistEntryTable } from "./entity.js";
 
 export const WAITLIST_CROSS_TENANT_REASON = "waitlist is platform-wide (systemScope)";
@@ -34,3 +38,19 @@ export function waitlistDb(ctx: HandlerContext): TenantDb {
 export function platformActor(): SessionUser {
   return createSystemUser(SYSTEM_TENANT_ID);
 }
+
+// An admin re-invite can flip an accepted invitation back to pending, so the
+// invitation status alone cannot prove the person holds no access.
+export async function isTenantMember(
+  db: TenantDb,
+  email: string,
+  tenantId: TenantId,
+): Promise<boolean> {
+  const user = await fetchOne<{ id: string }>(db, userTable, {
+    email: normalizeEmail(email),
+    isDeleted: false,
+  });
+  if (!user) return false;
+  const membership = await fetchOne(db, tenantMembershipsTable, { userId: user.id, tenantId });
+  return membership !== undefined && membership !== null;
+}

package/packages/bundled-features/src/waitlist/options.ts

@@ -38,5 +38,5 @@ export const DEFAULT_SUBMIT_RATE_LIMIT: RateLimitOption = {
 };
 
 export const DEFAULT_SUBMIT_EMAIL_RATE_LIMITS: readonly PayloadRateLimitOption[] = [
-  { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60 },
+  { per: { payloadField: "email" }, limit: 3, windowSeconds: 24 * 60 * 60, normalize: "email" },
 ];