@cosmicdrift/kumiko-samples 0.363.0 → 0.365.0

package/packages/bundled-features/src/billing-foundation/handlers/create-checkout-session.write.ts

@@ -23,7 +23,7 @@
 // hand-picked priceId.
 
 import type { HandlerContext, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
-import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
+import { InternalError, UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
 import {
   assertCheckoutAllowed,
@@ -32,6 +32,7 @@ import {
   startProviderCheckout,
 } from "../checkout-core.js";
 import {
+  assertValidOrderItem,
   type ConsentPayload,
   consentCheckoutFields,
   consentPayloadSchema,
@@ -104,11 +105,12 @@ export function createCheckoutSessionHandler(
 
       const mode = payload.mode ?? "subscription";
       const plugin = await assertCheckoutAllowed(ctx, openOptions, checkoutInput);
-      const price = await lookupPrice(ctx, plugin, payload.priceId);
+      const price = await lookupPrice(ctx, plugin, payload.providerName, payload.priceId);
       const orderItem =
         mode === "payment"
           ? await consumerProtection.oneOffItemLabel?.(ctx, payload.priceId)
           : undefined;
+      assertValidOrderItem(orderItem, payload.priceId);
       const consent = await prepareConsent(ctx, consumerProtection, payload.consent, mode);
       const result = await startProviderCheckout(ctx, plugin, {
         ...checkoutInput,
@@ -134,11 +136,17 @@ export function createCheckoutSessionHandler(
 async function lookupPrice(
   ctx: HandlerContext,
   plugin: SubscriptionProviderPlugin,
+  providerName: string,
   priceId: string,
 ): Promise<ProviderPrice> {
+  if (!plugin.retrievePrices) {
+    throw new InternalError({
+      message: `billing-foundation: provider "${providerName}" lacks retrievePrices, required by consumerProtection`,
+    });
+  }
   let price: ProviderPrice | undefined;
   try {
-    const prices = (await plugin.retrievePrices?.(ctx, [priceId])) ?? [];
+    const prices = await plugin.retrievePrices(ctx, [priceId]);
     price = prices.find((p) => p.priceId === priceId);
   } catch (cause) {
     throw priceUnavailable(priceId, cause);

package/packages/bundled-features/src/billing-foundation/handlers/process-event.write.ts

@@ -21,6 +21,7 @@ import * as z from "zod";
 import { subscriptionAggregateId } from "../aggregate-id.js";
 import {
   isSubscriptionBlockingCheckout,
+  isSwitchableSubscriptionStatus,
   SubscriptionEventTypes,
   SubscriptionStatuses,
 } from "../constants.js";
@@ -199,19 +200,24 @@ export async function appendSubscriptionEvent(
 // Tenant-Admin direkt.
 // One subscription aggregate exists per tenant, but a tenant can legitimately hold two provider
 // subscriptions over time (a stale `incomplete` one superseded by a fresh checkout). A late or
-// retried event of the old subscription must not overwrite the row of the live one, so only a
-// `created` event may replace a blocking row that belongs to a different provider subscription.
+// retried event of the old subscription must not overwrite the row of the live one, so an event of a
+// different provider subscription only replaces a row that no longer blocks a checkout. The exception
+// is a `created` of a subscription that is itself live (a provider switch); a late `created` of a
+// never-completed `incomplete` one stays stale, since delivery order is not guaranteed.
 function isStaleSubscriptionEvent(
   current: SubscriptionView | null,
   payload: ProcessEventPayload,
   now: Temporal.Instant,
 ): boolean {
   if (current === null) return false;
-  if (payload.type === SubscriptionEventTypes.created) return false;
   const sameSubscription =
     current.providerName === payload.providerName &&
     current.providerSubscriptionId === payload.providerSubscriptionId;
-  return !sameSubscription && isSubscriptionBlockingCheckout(current, now);
+  if (sameSubscription || !isSubscriptionBlockingCheckout(current, now)) return false;
+  const supersedesCurrent =
+    payload.type === SubscriptionEventTypes.created &&
+    isSwitchableSubscriptionStatus(payload.status);
+  return !supersedesCurrent;
 }
 
 export function createProcessEventHandler(now: () => Temporal.Instant): WriteHandlerDef {

package/packages/bundled-features/src/billing-foundation/i18n.ts

@@ -4,6 +4,12 @@
 type LocalizedString = { readonly en: string };
 
 export const BILLING_FOUNDATION_I18N: Readonly<Record<string, LocalizedString>> = {
+  "billing-foundation:feature.label": { en: "Billing" },
+  "billing-foundation:notify.contract-confirmation.label": { en: "Contract confirmation" },
+  "billing-foundation:notify.contract-termination-receipt.label": { en: "Termination receipt" },
+  "billing-foundation:notify.contract-termination-operator-notice.label": {
+    en: "Termination notice to operator",
+  },
   "screen:billing-plans.title": { en: "Billing" },
   "billing-foundation.plans.billingDisabled": {
     en: "Billing is not active yet. Your current plan stays in place.",
@@ -95,6 +101,9 @@ export const BILLING_FOUNDATION_I18N: Readonly<Record<string, LocalizedString>>
   "billing-foundation.errors.redirectOriginNotAllowed": {
     en: "This redirect URL is not allowed for this app.",
   },
+  "billing-foundation.errors.providerCustomerUnknown": {
+    en: "The billing account for this subscription no longer exists. Subscribe again to continue.",
+  },
   "billing-foundation.errors.providerHasNoPriceCatalog": {
     en: "This provider has no known prices configured.",
   },

package/packages/bundled-features/src/billing-foundation/subscription-tier-sync.ts

@@ -4,6 +4,8 @@
 // so it is now a factory parameter.
 
 import {
+  isTierAssignmentSource,
+  type TierAssignmentSource,
   TierAssignmentSources,
   TierEngineHandlers,
   TierEngineQueries,
@@ -38,6 +40,10 @@ export type SubscriptionTierSyncDeps<TTier extends string> = {
   readonly onSyncError?: "log" | "fail-webhook";
 };
 
+// A manual grant that differs from what billing would assign is reported with this
+// code but never fails the webhook: a provider retry cannot resolve it.
+export const TIER_SYNC_MANUAL_GRANT_SKIPPED = "tier_sync_manual_grant_skipped";
+
 export function effectiveTierFromSubscription<TTier extends string>(
   status: string | undefined,
   tier: string | undefined,
@@ -63,7 +69,7 @@ type ExistingTierAssignment = {
   readonly id: string;
   readonly version: number;
   readonly tier: unknown;
-  readonly source: unknown;
+  readonly source: TierAssignmentSource | null;
 };
 
 function findTierAssignment(
@@ -74,7 +80,13 @@ function findTierAssignment(
   if (!row || typeof row["id"] !== "string" || typeof row["version"] !== "number") {
     return undefined;
   }
-  return { id: row["id"], version: row["version"], tier: row["tier"], source: row["source"] };
+  const source = row["source"];
+  return {
+    id: row["id"],
+    version: row["version"],
+    tier: row["tier"],
+    source: isTierAssignmentSource(source) ? source : null,
+  };
 }
 
 export function createSubscriptionTierSync<TTier extends string>(
@@ -82,7 +94,7 @@ export function createSubscriptionTierSync<TTier extends string>(
 ) {
   async function syncTierFromSubscription(
     tenantId: TenantId,
-    routeDeps: SignatureExtraRouteDeps,
+    routeDeps: Pick<SignatureExtraRouteDeps, "dispatchSystemQuery" | "dispatchSystemWrite">,
   ): Promise<{ code: string; message: string } | null> {
     try {
       const subscriptionId = subscriptionAggregateId(tenantId);
@@ -129,8 +141,13 @@ export function createSubscriptionTierSync<TTier extends string>(
         }
         return null;
       }
-      if (assignment.source === TierAssignmentSources.manual) return null;
       if (assignment.tier === effective) return null;
+      if (assignment.source === TierAssignmentSources.manual) {
+        return {
+          code: TIER_SYNC_MANUAL_GRANT_SKIPPED,
+          message: `manual tier grant "${String(assignment.tier)}" kept although the subscription yields "${effective}"`,
+        };
+      }
 
       const result = await routeDeps.dispatchSystemWrite({
         handlerQn: TierEngineHandlers.update,
@@ -169,9 +186,12 @@ export function createSubscriptionTierSync<TTier extends string>(
         if (syncError) {
           // biome-ignore lint/suspicious/noConsole: operator visibility for a post-commit sync failure
           console.warn(
-            `[subscription-tier-sync] tier sync failed for tenant ${tenantId} after successful webhook write: ${syncError.code} ${syncError.message}`,
+            `[subscription-tier-sync] tier sync for tenant ${tenantId} after successful webhook write: ${syncError.code} ${syncError.message}`,
           );
-          if (deps.onSyncError === "fail-webhook") {
+          if (
+            deps.onSyncError === "fail-webhook" &&
+            syncError.code !== TIER_SYNC_MANUAL_GRANT_SKIPPED
+          ) {
             return {
               isSuccess: false,
               error: {
@@ -188,5 +208,5 @@ export function createSubscriptionTierSync<TTier extends string>(
     });
   }
 
-  return { createWebhookRoute };
+  return { createWebhookRoute, syncTierFromSubscription };
 }

package/packages/bundled-features/src/billing-foundation/types.ts

@@ -396,7 +396,10 @@ export function isLegalLinkSet(
 
 /** Consumer-protection consent gate (§ 312j / § 356 BGB style). When set,
  *  `start-plan-checkout` and `create-checkout-session` require a `consent`
- *  payload and record it as an event before the buyer reaches the provider. */
+ *  payload and record it as an event before the buyer reaches the provider.
+ *  Every provider used with `create-checkout-session` must implement
+ *  `retrievePrices`: the live price is part of the consent record, and a
+ *  provider without it fails the checkout with an InternalError. */
 export type ConsumerProtectionOptions = {
   /** Slug of the template-resolver `text-block` holding the terms text; its
    *  content hash is stored with every recorded consent. */
@@ -411,7 +414,9 @@ export type ConsumerProtectionOptions = {
   readonly terminationScope?: TerminationScope;
   /** Names the item of a one-off payment (mode "payment") for the consent record
    *  and the confirmation mail; the label key is resolved through the registry
-   *  i18n, so it must be qualified with the registering feature. */
+   *  i18n, so it must be qualified with the registering feature. The label key
+   *  is 1-200 characters, string params at most 100; a violation fails the
+   *  checkout with an InternalError before the provider session is created. */
   readonly oneOffItemLabel?: (
     ctx: HandlerContext,
     priceId: string,

package/packages/bundled-features/src/cap-counter/book-cap-usage.ts

@@ -280,6 +280,12 @@ export type ReadRollingCapUsageOptions = {
   readonly windowDays: number;
 };
 
+// A release is written up to a reservation TTL after its increment; once the increment left the
+// window the release must not subtract from other increments still inside it.
+function isBefore(isoInstant: string, cutoff: Temporal.Instant): boolean {
+  return Temporal.Instant.compare(Temporal.Instant.from(isoInstant), cutoff) < 0;
+}
+
 async function sumRollingEventAmounts(
   db: TenantDb,
   tenantId: TenantId,
@@ -289,20 +295,26 @@ async function sumRollingEventAmounts(
   const aggregateId = rollingCapAggregateId(tenantId, options.capName);
   const cutoff = Temporal.Now.instant().subtract({ hours: options.windowDays * 24 });
 
-  const rows = await db.selectMany<{ payload: { amount?: number } }>(eventsTable, {
-    tenantId,
-    aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
-    aggregateId,
-    type,
-    createdAt: { gte: cutoff },
-  });
+  const rows = await db.selectMany<{ payload: { amount?: number; incrementedAt?: string } }>(
+    eventsTable,
+    {
+      tenantId,
+      aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
+      aggregateId,
+      type,
+      createdAt: { gte: cutoff },
+    },
+  );
 
   let total = 0;
   for (const row of rows) {
     // @cast-boundary engine-payload — events.payload is jsonb (typed as
     // unknown by drizzle's $type<Record<string,unknown>>); narrowing the
     // shape here mirrors enforceRollingCap's own read-side contract.
-    const payload = row["payload"] as { amount?: number };
+    const payload = row["payload"] as { amount?: number; incrementedAt?: string };
+    if (typeof payload.incrementedAt === "string" && isBefore(payload.incrementedAt, cutoff)) {
+      continue;
+    }
     if (typeof payload.amount === "number") {
       total += payload.amount;
     }

package/packages/bundled-features/src/cap-counter/calendar-cap-usage-reservation.ts

@@ -44,6 +44,8 @@ export async function reserveEnforcedCalendarCap(
       profile: cap.profile,
       notify: cap.notify,
       amount: cap.amount,
+      ...(cap.periodEndIso !== undefined && { periodEndIso: cap.periodEndIso }),
+      ...(cap.i18nKey !== undefined && { i18nKey: cap.i18nKey }),
       markSoftWarnedOutsideTransaction: outsideTransaction,
     });
   }

package/packages/bundled-features/src/cap-counter/cap-reservation.ts

@@ -37,6 +37,7 @@ type CapReservationRow = {
   readonly periodStartIso: string | null;
   readonly amount: number;
   readonly expiresAt: Temporal.Instant;
+  readonly createdAt: Temporal.Instant;
 };
 
 const NOTHING_TO_RELEASE: WriteResult = { isSuccess: true, data: {} };
@@ -136,13 +137,14 @@ function rollingEvent(
   amount: number,
   expectedVersion: number,
   type: string,
+  extraPayload: { readonly incrementedAt?: string } = {},
 ) {
   return {
     aggregateId: rollingCapAggregateId(user.tenantId, capName),
     aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
     expectedVersion,
     type,
-    payload: { capName, amount },
+    payload: { capName, amount, ...extraPayload },
     metadata: { userId: user.id },
   };
 }
@@ -213,7 +215,10 @@ async function giveBackRolling(
   );
   await appendEventInTenantDb(
     txDb,
-    rollingEvent(user, row.capName, row.amount, version, ROLLING_RELEASED_EVENT_QN),
+    // The window filter must use the increment's time: a sweep releases up to a TTL later.
+    rollingEvent(user, row.capName, row.amount, version, ROLLING_RELEASED_EVENT_QN, {
+      incrementedAt: row.createdAt.toString(),
+    }),
   );
   return NOTHING_TO_RELEASE;
 }

package/packages/bundled-features/src/cap-counter/changes.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "breaking",
+    "title": "Handlers wrapped with withCapEnforcement or withRollingCapEnforcement are rejected when called through a nested ctx.write",
+    "detail": "Since the wrappers reserve through reserveBeforeTransaction, the dispatcher rejects a nested ctx.write, ctx.writeAs or handler-to-handler call of such a handler with an internal error (\"has a pre-transaction phase ... cannot run as a nested write\") instead of running it. Before the reservation lifecycle change the wrapped handler ran normally when called nested.",
+    "migration": "Dispatch rolling- and calendar-capped handlers only as top-level commands (HTTP write or batch). A handler that calls one through ctx.write declares the cap on itself instead, or the call moves out of the handler into a client or job that dispatches a top-level command."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Rolling cap release remembers the original booking time",
+    "detail": "rolling-released events now carry the incrementedAt of the booking they return, so readRollingCapUsage no longer subtracts a release whose increment already left the rolling window."
+  },
+  {
+    "version": "0.364.0",
+    "type": "breaking",
+    "title": "CapExceededError carries resetAt and retryAfterSeconds, API sets Retry-After",
+    "migration": "Periodic caps no longer need RateLimitError({ windowSeconds: 0, ... }). Where you catch CapExceededError from enforceCap and rethrow it as RateLimitError, drop the catch and let CapExceededError pass: the response stays 429 with a correct Retry-After, error.code becomes cap_exceeded instead of rate_limited, and error.details carries resetAt and retryAfterSeconds. Keep a feature-specific message with enforceCap({ ..., i18nKey }) and pass a period end other than the calendar month with periodEndIso (e.g. a budget's resetsAtIso). Clients matching on rate_limited for these caps must also accept cap_exceeded. Any KumikoError with retryAfterSeconds (including RateLimitError thrown in a handler) now gets a Retry-After header from /api/write, /api/batch and /api/query."
+  },
   {
     "version": "0.361.0",
     "type": "improvement",

package/packages/bundled-features/src/cap-counter/enforce-cap.ts

@@ -66,14 +66,38 @@ export function assertBelowHardCap(
     readonly capName: string;
     readonly limit: number;
     readonly profile: CapToleranceProfileName;
+    // Rolling caps have no fixed period, so they pass neither period field.
+    readonly periodStartIso?: string;
+    readonly periodEndIso?: string;
+    readonly i18nKey?: string;
   },
 ): void {
   const tolerance = CAP_TOLERANCES[cap.profile];
   if (valueSeenByLastUnit >= cap.limit * tolerance.hard) {
-    throw new CapExceededError(cap.capName, cap.limit, valueSeenByLastUnit, tolerance);
+    const resetAt = resolvePeriodEndIso(cap.periodStartIso, cap.periodEndIso);
+    throw new CapExceededError(cap.capName, cap.limit, valueSeenByLastUnit, tolerance, {
+      ...(resetAt !== undefined && { resetAt }),
+      ...(cap.i18nKey !== undefined && { i18nKey: cap.i18nKey }),
+    });
   }
 }
 
+function resolvePeriodEndIso(
+  periodStartIso: string | undefined,
+  periodEndIso: string | undefined,
+): string | undefined {
+  if (periodStartIso === undefined) return periodEndIso;
+  if (periodEndIso === undefined) return calendarMonthPeriodEndIso(periodStartIso);
+  const start = Temporal.Instant.from(periodStartIso);
+  const end = Temporal.Instant.from(periodEndIso);
+  if (Temporal.Instant.compare(end, start) <= 0) {
+    throw new Error(
+      `cap-counter: periodEndIso (${periodEndIso}) must be after periodStartIso (${periodStartIso})`,
+    );
+  }
+  return end.toString();
+}
+
 // =============================================================================
 // Enforce-Cap helper
 // =============================================================================
@@ -109,6 +133,9 @@ export async function enforceCap(
     // Units the caller is about to book in one go (default 1), checked with
     // the same outcome as booking them one by one.
     readonly amount?: number;
+    // Default: end of the calendar month that starts at periodStartIso.
+    readonly periodEndIso?: string;
+    readonly i18nKey?: string;
   },
 ): Promise<EnforceCapResult> {
   const { user, readDb } = resolveCapCounterScope(ctx, false);
@@ -211,23 +238,54 @@ export async function enforceRollingCap(
  * Thrown by enforceCap/enforceRollingCap when value ≥ hard-threshold.
  * Extends `KumikoError` — the dispatcher auto-maps this to HTTP 429
  * with `code: "cap_exceeded"`, no caller-side catch needed.
+ *
+ * Calendar caps carry `resetAt` (end of the period) and `retryAfterSeconds`, which the API
+ * answers as Retry-After. Rolling caps have no fixed reset instant, so both stay undefined.
  */
 export class CapExceededError extends KumikoError {
   readonly code = "cap_exceeded" as const;
   readonly httpStatus = 429;
+  readonly resetAt: string | undefined;
 
   constructor(
     readonly capName: string,
     readonly limit: number,
     readonly currentValue: number,
     readonly tolerance: CapToleranceProfile,
+    options?: {
+      readonly resetAt?: string;
+      readonly i18nKey?: string;
+      readonly cause?: Error;
+      // Deterministic tests only.
+      readonly now?: Temporal.Instant;
+    },
   ) {
+    const resetAt = options?.resetAt;
+    const retryAfterSeconds =
+      resetAt === undefined
+        ? undefined
+        : Math.max(
+            0,
+            Math.ceil(
+              Temporal.Instant.from(resetAt).epochMilliseconds / 1000 -
+                (options?.now ?? Temporal.Now.instant()).epochMilliseconds / 1000,
+            ),
+          );
     super({
-      message: `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.`,
-      i18nKey: "errors.cap.exceeded",
-      i18nParams: { capName, limit, currentValue },
-      details: { capName, limit, currentValue, tolerance },
+      message: `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.${resetAt === undefined ? "" : ` Resets at ${resetAt}.`}`,
+      i18nKey: options?.i18nKey ?? "errors.cap.exceeded",
+      i18nParams: { capName, limit, currentValue, ...(resetAt !== undefined && { resetAt }) },
+      details: {
+        capName,
+        limit,
+        currentValue,
+        tolerance,
+        ...(resetAt !== undefined && { resetAt, retryAfterSeconds }),
+      },
+      ...(retryAfterSeconds !== undefined && { retryAfterSeconds }),
+      ...(options?.cause && { cause: options.cause }),
     });
+    this.resetAt = resetAt;
   }
 }
 
@@ -257,6 +315,14 @@ export function currentCalendarMonthStartIso(
   return start.toInstant().toString();
 }
 
+export function calendarMonthPeriodEndIso(periodStartIso: string): string {
+  return Temporal.Instant.from(periodStartIso)
+    .toZonedDateTimeISO("UTC")
+    .add({ months: 1 })
+    .toInstant()
+    .toString();
+}
+
 // =============================================================================
 // Notification-Wiring helpers — convenience-wrapper für enforceCap +
 // enforceRollingCap, die einen Caller-supplied delivery-emit beim
@@ -299,6 +365,8 @@ export async function enforceCapAndMaybeNotify(
     readonly profile: CapToleranceProfileName;
     readonly notify: SoftHitNotifier;
     readonly amount?: number;
+    readonly periodEndIso?: string;
+    readonly i18nKey?: string;
     readonly markSoftWarnedOutsideTransaction?: boolean;
   },
 ): Promise<EnforceCapResult> {
@@ -308,6 +376,8 @@ export async function enforceCapAndMaybeNotify(
     limit: options.limit,
     profile: options.profile,
     ...(options.amount !== undefined && { amount: options.amount }),
+    ...(options.periodEndIso !== undefined && { periodEndIso: options.periodEndIso }),
+    ...(options.i18nKey !== undefined && { i18nKey: options.i18nKey }),
   });
 
   if (result.state === "soft-hit" && result.crossed) {

package/packages/bundled-features/src/cap-counter/handlers/increment-rolling.write.ts

@@ -40,6 +40,8 @@ export const rollingIncrementedSchema = incrementRollingSchema;
 /** Payload of the event that gives a reserved rolling amount back. */
 export const rollingReleasedSchema = incrementRollingSchema.extend({
   amount: z.number().int().positive(),
+  /** When the released increment was booked; absent on events written before it was recorded. */
+  incrementedAt: z.string().optional(),
 });
 
 // Rolling-Increment-Handler — append-only. Race-frei: zwei parallele

package/packages/bundled-features/src/cap-counter/index.ts

@@ -29,6 +29,7 @@ export {
   CapExceededError,
   type CapToleranceProfile,
   type CapToleranceProfileName,
+  calendarMonthPeriodEndIso,
   currentCalendarMonthStartIso,
   type EnforceCapResult,
   enforceCap,

package/packages/bundled-features/src/cap-counter/with-cap-enforcement.ts

@@ -53,6 +53,9 @@ import { chainReservations } from "./reservation-chain.js";
 export type CalendarCapDef = {
   readonly capName: string;
   readonly periodStartIso: string;
+  // Default: end of the calendar month that starts at periodStartIso.
+  readonly periodEndIso?: string;
+  readonly i18nKey?: string;
   readonly limit: number;
   readonly profile: CapToleranceProfileName;
   /** Increment-amount post-success. Default 1. */

package/packages/bundled-features/src/cap-overview/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Cap overview lists no destroyed tenants",
+    "detail": "tenant-options and tenant-caps-list now filter destroyed tenants and keep reading tenant names through the PII-aware path."
+  },
   {
     "version": "0.338.0",
     "type": "breaking",

package/packages/bundled-features/src/cap-overview/handlers/tenant-caps-list.query.ts

@@ -176,7 +176,8 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
       );
 
       const tenants = await decryptTenantNames(
-        await selectMany<TenantRow>(db, tenantTable, {}),
+        // Destroyed tenants decrypt to the erased sentinel, which a picker or list would show verbatim.
+        await selectMany<TenantRow>(db, tenantTable, { destroyedAt: null }),
         "cap-overview:tenant-caps:list",
       );
       const assignments = await selectMany<TierAssignmentRow>(db, tierAssignmentTable, {});

package/packages/bundled-features/src/cap-overview/handlers/tenant-options.query.ts

@@ -23,7 +23,8 @@ export const tenantOptionsQuery = defineQueryHandler({
       "cap-overview:tenant-options — SystemAdmin dashboard tenant-filter options",
     );
     const tenants = await decryptTenantNames(
-      await selectMany<TenantRow>(db, tenantTable, {}),
+      // Destroyed tenants decrypt to the erased sentinel, which the picker would show verbatim.
+      await selectMany<TenantRow>(db, tenantTable, { destroyedAt: null }),
       "cap-overview:tenant-options",
     );
     const sorted = [...tenants].sort((a, b) => a.name.localeCompare(b.name));

package/packages/bundled-features/src/channel-discord/discord-channel.ts

@@ -8,9 +8,11 @@ import {
 
 export type DiscordChannelOptions = ChatWebhookChannelOptions;
 
+const DISCORD_WEBHOOK_PREFIX = "channel-discord:webhooks.";
+
 export const DISCORD_SECRET_KEYS = {
-  webhookPrefix: "channel-discord:webhooks.",
-  webhookKeyFor: (connection: string) => `channel-discord:webhooks.${connection}`,
+  webhookPrefix: DISCORD_WEBHOOK_PREFIX,
+  webhookKeyFor: (connection: string) => `${DISCORD_WEBHOOK_PREFIX}${connection}`,
 } as const;
 
 export const DISCORD_DEFAULT_ALLOWED_HOSTS = ["discord.com", "discordapp.com"] as const;

package/packages/bundled-features/src/channel-email/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "SMTP display names drop address-like characters, inline images get matching extensions",
+    "detail": "Control characters, angle brackets and at signs in a From display name are replaced by spaces so it cannot smuggle a second address; inline image file names derive their extension from the shared image format list."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "List-Unsubscribe accepts an app-owned unsubscribe URL",
+    "detail": "When unsubscribeUrl in the mail data points to an http(s) URL outside the framework unsubscribe route, the email channel sets List-Unsubscribe to that URL without the one-click List-Unsubscribe-Post header, because the framework cannot vouch for a foreign endpoint accepting POST. Other schemes set no header."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "A mail whose file attachment is missing fails at once instead of retrying",
+    "detail": "A missing or foreign-tenant file ref ends the delivery attempt as failed (send_failed) without a retry. The send job no longer throws, so the idempotency key is released and the caller can resend. A template test mail whose template file is missing now answers not_sent instead of channel_error."
+  },
   {
     "version": "0.363.0",
     "type": "breaking",