@cosmicdrift/kumiko-samples 0.364.0 → 0.365.0

package/packages/bundled-features/src/tenant/seeding.ts

@@ -101,26 +101,6 @@ export type SeedTenantHooks = {
   readonly context: AppContext;
 };
 
-// Shared by seedTenant/seedTenantMembership/auth-email-password's
-// seedUserWithPassword: fires the same entity-scoped postSave hooks the
-// real dispatcher would (registry.getEntityPostSaveHooks by entityName),
-// just without the full HTTP/JWT roundtrip a fixture doesn't need. Fresh
-// lifecycle-hooks instance per call, no systemHooks — only feature-
-// registered entity/handler hooks fire (search-index/SSE system hooks are
-// wired at server-boot and out of reach here).
-//
-// Tenant re-scope (#1566): when `targetTenantId` is set we rebuild the
-// tenant-bound pieces of the context (`_tenantId`, `db`, `notify`,
-// `hasFeature`, `user.tenantId`) — a shallow `{ ...ctx, _tenantId }` left
-// closures over the caller's tenant (self-signup is anonymous/system).
-// `query`/`write` bridges still share the caller's identity; hooks that
-// need a full identity switch use `writeAs`/`queryAs`.
-//
-// afterCommit (#1566): when `hooks.context.scheduleAfterCommit` is present
-// (HandlerContext from a live write), afterCommit hooks are queued onto the
-// dispatcher's sink and flush post-commit. Without a sink (fixture / plain
-// Connection) they still fire immediately — there is no outer TX to wait for.
-//
 function buildSeedHookNotify(
   context: AppContext,
   scopedUser: SessionUser,
@@ -129,7 +109,11 @@ function buildSeedHookNotify(
 ): AppContext["notify"] {
   const notifyFactory = context._notifyFactory;
   if (!notifyFactory) return context.notify;
-  if (notifyTiming === "inline") return notifyFactory(scopedUser, targetTenantId);
+  const notifyAfterCommit = (context._notifyAfterCommitFactory ?? notifyFactory)(
+    scopedUser,
+    targetTenantId,
+  );
+  if (notifyTiming === "inline") return notifyAfterCommit;
   // Still inside the caller's write tx: delivery DB work must not wait for an app-pool slot.
   const notifyInsideTransaction = (context._notifyInTransactionFactory ?? notifyFactory)(
     scopedUser,
@@ -140,12 +124,31 @@ function buildSeedHookNotify(
   return createDeferringNotify({
     registry: context.registry,
     tenantId: targetTenantId,
-    notifyAfterCommit: notifyFactory(scopedUser, targetTenantId),
+    notifyAfterCommit,
     notifyNow: notifyInsideTransaction,
     scheduleAfterCommit,
   });
 }
 
+// Shared by seedTenant/seedTenantMembership/auth-email-password's
+// seedUserWithPassword: fires the same entity-scoped postSave hooks the
+// real dispatcher would (registry.getEntityPostSaveHooks by entityName),
+// just without the full HTTP/JWT roundtrip a fixture doesn't need. Fresh
+// lifecycle-hooks instance per call, no systemHooks — only feature-
+// registered entity/handler hooks fire (search-index/SSE system hooks are
+// wired at server-boot and out of reach here).
+//
+// Tenant re-scope (#1566): when `targetTenantId` is set we rebuild the
+// tenant-bound pieces of the context (`_tenantId`, `db`, `notify`,
+// `hasFeature`, `user.tenantId`) — a shallow `{ ...ctx, _tenantId }` left
+// closures over the caller's tenant (self-signup is anonymous/system).
+// `query`/`write` bridges still share the caller's identity; hooks that
+// need a full identity switch use `writeAs`/`queryAs`.
+//
+// afterCommit (#1566): when `hooks.context.scheduleAfterCommit` is present
+// (HandlerContext from a live write), afterCommit hooks are queued onto the
+// dispatcher's sink and flush post-commit. Without a sink (fixture / plain
+// Connection) they still fire immediately — there is no outer TX to wait for.
 // `runner` comes from the caller, which already holds a declared DbRunner —
 // a TenantDb exposes no runner back out to feature code.
 function scopeSeedHookContext(
@@ -219,13 +222,16 @@ export async function fireEntityPostSave(
     target === undefined
       ? hooks.context
       : scopeSeedHookContext(hooks.context, target.tenantId, target.db, "deferUntilCommit");
-  const afterCommitContext =
-    target === undefined
-      ? hooks.context
-      : scopeSeedHookContext(hooks.context, target.tenantId, target.db, "inline");
   await lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.inTransaction);
   const runAfterCommit = () =>
-    lifecycle.runPostSave(pseudoType, entityData, afterCommitContext, HookPhases.afterCommit);
+    lifecycle.runPostSave(
+      pseudoType,
+      entityData,
+      target === undefined
+        ? hooks.context
+        : scopeSeedHookContext(hooks.context, target.tenantId, target.db, "inline"),
+      HookPhases.afterCommit,
+    );
   if (scopedContext.scheduleAfterCommit) {
     scopedContext.scheduleAfterCommit(runAfterCommit);
   } else {

package/packages/bundled-features/src/tenant-handover/move-entity-graph.ts

@@ -28,6 +28,7 @@ import {
   executeRawQuery,
   extractTableName,
   physicalColumnName,
+  toPostgresArrayLiteral,
 } from "@cosmicdrift/kumiko-framework/db";
 import { MAX_TRANSFER_DEPTH, type Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
@@ -79,7 +80,12 @@ async function moveFileRefs(args: {
     args.db,
     `UPDATE ${FILE_REFS_TABLE} SET tenant_id = $1 ` +
       `WHERE tenant_id = $2 AND entity_type = $3 AND entity_id = ANY($4) RETURNING id`,
-    [args.destinationTenantId, args.sourceTenantId, args.entityType, args.entityIds],
+    [
+      args.destinationTenantId,
+      args.sourceTenantId,
+      args.entityType,
+      toPostgresArrayLiteral(args.entityIds),
+    ],
   );
   const movedIds = rows.map((row) => row.id);
   if (movedIds.length === 0) return 0;
@@ -126,7 +132,12 @@ async function moveChildRows(args: {
     `UPDATE "${args.tableName}" SET "${args.tenantCol}" = $1 ` +
       `WHERE "${args.typeCol}" = $2 AND "${args.idCol}" = ANY($3) AND "${args.tenantCol}" = $4 ` +
       `RETURNING "${args.pkCol}" AS id`,
-    [args.destinationTenantId, args.parentEntityType, args.parentRowIds, args.sourceTenantId],
+    [
+      args.destinationTenantId,
+      args.parentEntityType,
+      toPostgresArrayLiteral(args.parentRowIds),
+      args.sourceTenantId,
+    ],
   );
   return rows.map((row) => row.id);
 }
@@ -149,7 +160,7 @@ async function moveReferencedChildRows(args: {
     `UPDATE "${args.tableName}" SET "${args.tenantCol}" = $1 ` +
       `WHERE "${args.refCol}" = ANY($2) AND "${args.tenantCol}" = $3 ` +
       `RETURNING "${args.pkCol}" AS id`,
-    [args.destinationTenantId, args.parentRowIds, args.sourceTenantId],
+    [args.destinationTenantId, toPostgresArrayLiteral(args.parentRowIds), args.sourceTenantId],
   );
   return rows.map((row) => row.id);
 }

package/packages/bundled-features/src/tenant-lifecycle/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "One sweep tick shares a single stage budget between all destroying tenants",
+    "detail": "The destruction sweep used to give every destroying tenant its own full stage budget, so a few large tenants stretched one tick far beyond the minute cron window and the following ticks were skipped. The tick budget is now divided evenly over the destroying tenants. Each tenant's slice starts when that tenant's turn begins, so an overrun by one tenant never leaves the next ones with a zero slice. runNextDestructionStage accepts an optional deadlineAt."
+  },
   {
     "version": "0.354.0",
     "type": "improvement",

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -290,6 +290,7 @@ export async function runNextDestructionStage(args: {
   readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
   readonly escapeHatchAuditLog?: Logger;
   readonly actor?: string;
+  readonly deadlineAt?: number;
 }): Promise<StageTickResult> {
   const events = await loadAggregate(args.db, args.tenantId, args.tenantId);
   const { completed, abandoned, attemptsByStage } = replayStageState(events);
@@ -316,7 +317,7 @@ export async function runNextDestructionStage(args: {
     escapeHatchAuditSink: args.escapeHatchAuditSink,
     escapeHatchAuditLog: args.escapeHatchAuditLog,
     actor: args.actor,
-    deadlineAt: Date.now() + DESTRUCTION_STAGE_TICK_BUDGET_MS,
+    deadlineAt: args.deadlineAt ?? Date.now() + DESTRUCTION_STAGE_TICK_BUDGET_MS,
   };
 
   let version = lastEventVersion(events);
@@ -456,9 +457,16 @@ export async function runTenantDestructionSweep(args: {
 
   let advanced = 0;
   const destroying = await selectMany<{ id: string }>(args.db, tenantTable, destroyingWhere);
+  // One budget per sweep tick, split evenly so a large tenant cannot eat the
+  // window and starve the ones behind it. Each slice starts when its tenant
+  // starts: anchoring to a shared tick deadline would hand tenants after an
+  // overrun a zero slice, and a no-progress stage counts as a failed attempt.
+  const sliceMs = DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length);
   for (const row of destroying) {
+    const tenantDeadlineAt = Date.now() + sliceMs;
     try {
       const result = await runNextDestructionStage({
+        deadlineAt: tenantDeadlineAt,
         db: args.db,
         registry: args.registry,
         tenantId: row.id as TenantId,

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -88,8 +88,9 @@ const tenantMembershipCrud = createEventStoreExecutor(
   },
 );
 
-// Every hook still runs each tick (they are idempotent), so a later hook is not
-// starved by an earlier one that keeps reporting done:false.
+// Every hook runs each tick (they are idempotent) but all share one ctx.deadlineAt: an
+// earlier hook that keeps reporting done:false can use up the budget, so later chunking
+// hooks time out with nothing processed until it finishes.
 function newOutcomeAccumulator(): {
   add: (result: TenantDestroyHookResult | void) => void;
   outcome: () => StageRunOutcome;

package/packages/bundled-features/src/tier-engine/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "set-tenant-tier accepts an optional source so a manual grant can return to billing control",
+    "detail": "The handler payload takes source (manual, billing or default, default manual). Writing the row with source billing makes the subscription tier sync treat it as billing-driven again, so the next webhook overwrites the tier. The handler stays SystemAdmin only."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "tier-assignment source is a select field of TierAssignmentSources",
+    "detail": "The source column keeps its text storage, but the entity now validates it against manual, billing and default, so a typo can no longer bypass the manual-grant protection of the billing sync. TierAssignmentSource and isTierAssignmentSource are exported; the billing sync narrows the stored value with the guard."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/tier-engine/constants.ts

@@ -22,6 +22,15 @@ export const TierAssignmentSources = {
   default: "default",
 } as const;
 
+export type TierAssignmentSource =
+  (typeof TierAssignmentSources)[keyof typeof TierAssignmentSources];
+
+const TIER_ASSIGNMENT_SOURCE_VALUES: readonly string[] = Object.values(TierAssignmentSources);
+
+export function isTierAssignmentSource(value: unknown): value is TierAssignmentSource {
+  return typeof value === "string" && TIER_ASSIGNMENT_SOURCE_VALUES.includes(value);
+}
+
 // Qualified query handler names.
 export const TierEngineQueries = {
   list: "tier-engine:query:tier-assignment:list",

package/packages/bundled-features/src/tier-engine/entity.ts

@@ -1,4 +1,9 @@
-import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createEntity,
+  createSelectField,
+  createTextField,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { type TierAssignmentSource, TierAssignmentSources } from "./constants.js";
 
 // tier-assignment — pro Plattform-Tenant genau ein Aggregat. Aggregate-ID
 // wird deterministisch aus tenantId abgeleitet (uuidv5, siehe aggregate-id.ts).
@@ -35,9 +40,9 @@ export const tierAssignmentEntity = createEntity({
     }),
     // Origin of the assignment, see TierAssignmentSources. Optional for back-compat with
     // rows without source. Protects manual grants from being overwritten by the billing sync.
-    source: createTextField({
+    source: createSelectField({
+      options: Object.values(TierAssignmentSources),
       required: false,
-      maxLength: 20,
       personal: false,
       reason: "technical_reference",
     }),
@@ -48,6 +53,6 @@ export type TierAssignmentRow = {
   readonly id: string;
   readonly version: number;
   readonly tier: string;
-  readonly source: string | null;
+  readonly source: TierAssignmentSource | null;
   readonly tenantId: string;
 };

package/packages/bundled-features/src/tier-engine/handlers/set-tenant-tier.write.ts

@@ -4,7 +4,7 @@ import { defineWriteHandler, type TenantId } from "@cosmicdrift/kumiko-framework
 import * as z from "zod";
 import { requireForTenant } from "../../shared/index.js";
 import { tierAssignmentAggregateId } from "../aggregate-id.js";
-import { TierAssignmentSources } from "../constants.js";
+import { type TierAssignmentSource, TierAssignmentSources } from "../constants.js";
 import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 
 // SystemAdmin setzt das Tier eines BELIEBIGEN Tenants — manueller Grant ohne
@@ -14,7 +14,8 @@ import { type TierAssignmentRow, tierAssignmentEntity } from "../entity.js";
 // Cross-tenant mechanics: ctx.forTenant(tenantId) yields a tenant-mode db bound to the target plus
 // the streamTenantId, so the event lands in the target's stream with the operator as actor.
 //
-// `source: TierAssignmentSources.manual` marks the grant so the billing sync skips it.
+// `source` defaults to manual and marks the grant so the billing sync skips it; passing
+// `billing` hands the row back to the sync, which overwrites it on the next webhook.
 // Upsert: one aggregate per tenant (deterministic aggregate id).
 //
 // Effective-set invalidation: the executor write does not fire the
@@ -47,7 +48,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
   return defineWriteHandler({
     name: "set-tenant-tier",
     description:
-      "Assigns a tier to any tenant as a manual grant without a billing purchase, marking it so a later billing sync will not overwrite it, and applies the new feature set immediately.",
+      "Assigns a tier to any tenant as a manual grant without a billing purchase, marking it so a later billing sync will not overwrite it (or, with source billing, handing the row back to the sync), and applies the new feature set immediately.",
     schema: z.object({
       tenantId: z.string().min(1),
       tier: z
@@ -55,6 +56,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         .min(1)
         .max(50)
         .refine((t) => !opts.validTiers || opts.validTiers.has(t), { message: "unknown tier" }),
+      source: z.enum(TierAssignmentSources).default(TierAssignmentSources.manual),
     }),
     access: { roles: ["SystemAdmin"] },
     agent: { risk: "high" },
@@ -68,6 +70,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
       const tenantId = event.payload.tenantId as TenantId; // @cast-boundary engine-bridge
       const { db: tdb, streamTenantId } = requireForTenant(ctx, tenantId);
       const tier = event.payload.tier;
+      const source: TierAssignmentSource = event.payload.source;
 
       const existing = await fetchOne<TierAssignmentRow>(tdb, tierAssignmentTable, { tenantId });
 
@@ -76,7 +79,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
           {
             id: existing.id,
             version: existing.version,
-            changes: { tier, source: TierAssignmentSources.manual },
+            changes: { tier, source },
           },
           event.user,
           tdb,
@@ -91,7 +94,7 @@ export function createSetTenantTierWrite(opts: SetTenantTierOptions = {}) {
         {
           id: tierAssignmentAggregateId(tenantId),
           tier,
-          source: TierAssignmentSources.manual,
+          source,
           tenantId,
         },
         event.user,

package/packages/bundled-features/src/tier-engine/index.ts

@@ -18,7 +18,9 @@ export {
   type TierMap,
 } from "./compose-app.js";
 export {
+  isTierAssignmentSource,
   TIER_ENGINE_FEATURE,
+  type TierAssignmentSource,
   TierAssignmentSources,
   TierEngineHandlers,
   TierEngineQueries,

package/packages/bundled-features/src/user/constants.ts

@@ -6,6 +6,7 @@ export const USER_FEATURE = "user" as const;
  *  platform operator. Membership roles (TenantAdmin/Admin/User/…) live on
  *  tenant-membership, not here. */
 export const GLOBAL_ROLE_OPTIONS = ["SystemAdmin"] as const;
+export type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
 
 // Qualified write handler names. Handlers carry the "user:" entity prefix so
 // field-level access rules (passwordHash system-only etc.) are wired up.

package/packages/bundled-features/src/user/invited-global-roles.ts

@@ -7,7 +7,7 @@ import {
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
-import { GLOBAL_ROLE_OPTIONS } from "./constants.js";
+import { GLOBAL_ROLE_OPTIONS, type GlobalRole } from "./constants.js";
 import { userEntity, userTable } from "./schema/user.js";
 
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
@@ -18,8 +18,6 @@ type UserRolesRow = {
   readonly roles: readonly string[] | string | null;
 };
 
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
-
 function isGlobalRole(role: string): role is GlobalRole {
   return GLOBAL_ROLE_OPTIONS.some((option) => option === role);
 }
@@ -34,7 +32,7 @@ export function parseInvitedGlobalRoles(raw: unknown): readonly GlobalRole[] {
 // already holds. Users live on SYSTEM_TENANT_ID (tenancy "global").
 export async function grantInvitedGlobalRoles(
   db: DbRunner,
-  options: { readonly userId: string; readonly globalRoles: readonly string[] },
+  options: { readonly userId: string; readonly globalRoles: readonly GlobalRole[] },
 ) {
   const existing = await fetchOne<UserRolesRow>(db, userTable, { id: options.userId });
   if (!existing) return writeFailure(new NotFoundError("user", options.userId));

package/packages/bundled-features/src/user-data-rights/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "GDPR mails carry designer labels",
+    "detail": "Feature and notify labels for export-ready, export-failed, deletion-requested and deletion-executed name the GDPR mails in the document designer."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/user-data-rights/email-templates.ts

@@ -36,7 +36,6 @@ export const GDPR_MAIL_EN: Readonly<Record<string, string>> = {
   "gdpr.mail.deletionExecuted.subject": "{app} — Your account has been deleted",
   "gdpr.mail.deletionExecuted.intro":
     "your {app} account and the associated personal data were deleted on {when}. This action is permanent.",
-  "gdpr.mail.fallbackUrl": "If the button doesn't work, copy this link into your browser:",
 };
 
 registerMailTranslations("en", GDPR_MAIL_EN);

package/packages/bundled-features/src/user-data-rights/i18n.ts

@@ -4,6 +4,11 @@
 type LocalizedString = { readonly en: string };
 
 export const USER_DATA_RIGHTS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "user-data-rights:feature.label": { en: "Privacy" },
+  "user-data-rights:notify.export-ready.label": { en: "Data export ready" },
+  "user-data-rights:notify.export-failed.label": { en: "Data export failed" },
+  "user-data-rights:notify.deletion-requested.label": { en: "Deletion requested" },
+  "user-data-rights:notify.deletion-executed.label": { en: "Deletion completed" },
   "user-data-rights:nav.exportJobs": { en: "GDPR exports" },
   "screen:export-job-list.title": { en: "GDPR exports" },
   "screen:export-job-detail.title": { en: "Export job" },

package/packages/bundled-features/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -1,6 +1,10 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type WritePurpose,
+} from "@cosmicdrift/kumiko-framework/db";
 import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user/index.js";
@@ -27,6 +31,9 @@ export type UpdateUserLifecycleOptions = {
   // executor's `expect:`. Omitted: unconditional overwrite (skipOptimisticLock).
   // Scalars only, see the executor's `expect:` doc.
   readonly expect?: Readonly<Record<string, string | number | boolean | null>>;
+  // Erasure flows run after the subject key is erased; the write then stores the
+  // erased sentinel instead of failing on re-encrypt.
+  readonly writePurpose?: WritePurpose;
 };
 
 // `conn` is ctx.db.unsafeRaw() (regular handlers) or the open tx
@@ -59,7 +66,11 @@ export async function updateUserLifecycle(
     { id: userId, changes },
     createSystemUser(SYSTEM_TENANT_ID),
     tenantDb,
-    { skipOptimisticLock: true, ...(options?.expect && { expect: options.expect }) },
+    {
+      skipOptimisticLock: true,
+      ...(options?.expect && { expect: options.expect }),
+      ...(options?.writePurpose && { writePurpose: options.writePurpose }),
+    },
   );
 
   if (result.isSuccess) return { applied: true };

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -47,6 +47,7 @@ import {
   entityEventName,
   executeRawQuery,
   nullBlindIndexesForSubject,
+  WritePurposes,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   type EscapeHatchAuditSink,
@@ -531,7 +532,12 @@ async function processUser(args: {
       // geworfen hat, kommen wir hier nicht an — die Tx rollback'd
       // alles, der User bleibt im DeletionRequested-Status, naechster
       // Run retried.
-      await updateUserLifecycle(tx, userId, { status: USER_STATUS.Deleted });
+      await updateUserLifecycle(
+        tx,
+        userId,
+        { status: USER_STATUS.Deleted },
+        { writePurpose: WritePurposes.erasure },
+      );
       txSucceeded = true;
     });
   } catch (e) {

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "Waitlist mails carry designer labels",
+    "detail": "Feature and notify labels for confirmation and admin-notice name the waitlist mails in the document designer."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Waitlist invite no longer double-invites, uses the entry locale and refuses members",
+    "detail": "Two parallel invite calls for one entry now queue on a per-entry advisory lock, so exactly one tenant and one invitation are created. The invitation mail is rendered in the entry's locale instead of the caller's. Inviting an email that already is a member of the target tenant fails with 422 waitlist_not_invitable, as reject already did."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Waitlist submit honors emailRateLimits: [], resolves notifyRecipient before the advisory lock and checks only open entries",
+    "detail": "createWaitlistFeature({ emailRateLimits: [] }) no longer fails boot validation; the per-email bucket is dropped as documented. notifyRecipient runs before the per-email advisory lock and the entry insert, so a failing resolver can no longer abort the submit transaction or hold the lock; a throwing resolver only skips the admin notice. The duplicate check queries status pending or invited with limit 1 instead of scanning the first 50 rows of the address. The feature description now states that the response body is identical for known and unknown addresses while response timing can differ."
+  },
   {
     "version": "0.363.0",
     "type": "breaking",

package/packages/bundled-features/src/waitlist/feature.ts

@@ -26,7 +26,7 @@ import { waitlistEntryDeleteHook, waitlistEntryExportHook } from "./user-data-ho
 export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefinition {
   return defineFeature(WAITLIST_FEATURE, (r) => {
     r.describe(
-      "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response never reveals whether an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
+      "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
     );
     r.uiHints({ displayLabel: "Waitlist", category: "data", recommended: false });
     r.systemScope();

package/packages/bundled-features/src/waitlist/handlers/invite.write.ts

@@ -1,4 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
   defineWriteHandler,
@@ -18,7 +19,13 @@ import { AuthErrors, AuthHandlers } from "../../auth-email-password/index.js";
 import { TenantHandlers, tenantTable } from "../../tenant/index.js";
 import { DEFAULT_OWN_TENANT_INVITE_ROLE, WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
-import { adminAccess, platformActor, waitlistDb, waitlistExecutor } from "../lib.js";
+import {
+  adminAccess,
+  isTenantMember,
+  platformActor,
+  waitlistDb,
+  waitlistExecutor,
+} from "../lib.js";
 import type { WaitlistInviteOptions } from "../options.js";
 import { WaitlistIdSchema } from "../payloads.js";
 
@@ -30,6 +37,11 @@ export type WaitlistInviteData = {
 
 type InviteTarget = { readonly tenantId: TenantId; readonly role: string };
 
+// pg_advisory_xact_lock namespace (int4): 'wlin' as ASCII, disjoint from the submit lock.
+const INVITE_LOCK_NAMESPACE = 0x776c696e;
+const INVITE_LOCK_REASON =
+  "takes the per-entry advisory lock so parallel invites cannot both create a tenant and invitation; TenantDb has no lock API";
+
 const DEFAULT_INVITE: WaitlistInviteOptions = {
   mode: "own-tenant",
   role: DEFAULT_OWN_TENANT_INVITE_ROLE,
@@ -48,10 +60,11 @@ type EntryRow = {
   readonly name: string;
   readonly company: string | null;
   readonly linkedTenantId: string | null;
+  readonly locale: string | undefined;
 };
 
 function readEntryRow(row: Record<string, unknown>): EntryRow {
-  const { id, version, email, name, company, linkedTenantId } = row;
+  const { id, version, email, name, company, linkedTenantId, locale } = row;
   if (
     typeof id !== "string" ||
     typeof version !== "number" ||
@@ -68,6 +81,7 @@ function readEntryRow(row: Record<string, unknown>): EntryRow {
     name,
     company: typeof company === "string" && company !== "" ? company : null,
     linkedTenantId: typeof linkedTenantId === "string" ? linkedTenantId : null,
+    locale: typeof locale === "string" && locale !== "" ? locale : undefined,
   };
 }
 
@@ -122,8 +136,17 @@ export function createInviteHandler(invite: WaitlistInviteOptions = DEFAULT_INVI
       "Invites a pending or already-invited waitlist entry: creates its tenant (or uses the configured shared tenant), mails the entrant a fresh accept link with the configured role and marks the entry invited; rejected entries cannot be invited. The invitee never receives a global role.",
     // Sends an invite link by email, which cannot be recalled.
     agent: { risk: "high" },
+    escapeHatch: { grants: ["unsafeRaw"], reason: INVITE_LOCK_REASON },
     handler: async (event, ctx) => {
       const db = waitlistDb(ctx);
+      if (!ctx.systemDb) {
+        throw new InternalError({ message: "waitlist:invite requires ctx.systemDb" });
+      }
+      await acquireNamespacedAdvisoryLock(
+        ctx.systemDb.unsafeRaw(INVITE_LOCK_REASON),
+        INVITE_LOCK_NAMESPACE,
+        event.payload.id,
+      );
       const row = await waitlistExecutor.detail({ id: event.payload.id }, platformActor(), db);
       if (!row) return writeFailure(new NotFoundError("waitlistEntry", event.payload.id));
       const entry = readEntryRow(row);
@@ -134,13 +157,22 @@ export function createInviteHandler(invite: WaitlistInviteOptions = DEFAULT_INVI
       const target = await resolveInviteTarget(invite, entry, ctx);
       if ("isSuccess" in target) return target;
 
+      if (await isTenantMember(db, entry.email, target.tenantId)) {
+        return writeFailure(new UnprocessableError(WaitlistErrors.notInvitable));
+      }
+
       // inviteCreate is admin-only (no system role); the system variant with an
       // empty globalRoles list is the only in-process path, and a waitlist
       // invite must never grant a global role.
       const invited = await ctx.writeAs(
         createSystemUser(target.tenantId),
         AuthHandlers.systemInviteCreate,
-        { email: entry.email.toLowerCase(), role: target.role, globalRoles: [] },
+        {
+          email: entry.email.toLowerCase(),
+          role: target.role,
+          globalRoles: [],
+          ...(entry.locale !== undefined && { locale: entry.locale }),
+        },
       );
       if (!invited.isSuccess) {
         // Re-inviting a person who already accepted would reset their live invitation.

package/packages/bundled-features/src/waitlist/handlers/reject.write.ts

@@ -1,11 +1,9 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   createSystemUser,
   defineWriteHandler,
   type HandlerContext,
   parseTenantId,
-  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
   InternalError,
@@ -18,13 +16,12 @@ import {
   cancelPendingInvitation,
   INVITATION_STATUS,
   tenantInvitationsTable,
-  tenantMembershipsTable,
 } from "../../tenant/index.js";
-import { userTable } from "../../user/index.js";
 import { WAITLIST_STATUS, WaitlistErrors } from "../constants.js";
 import { isOpenWaitlistStatus } from "../entity.js";
 import {
   adminAccess,
+  isTenantMember,
   normalizeEmail,
   platformActor,
   waitlistDb,
@@ -34,18 +31,6 @@ import { WaitlistIdSchema } from "../payloads.js";
 
 export type WaitlistRejectData = { readonly kind: "rejected"; readonly id: string };
 
-// An admin re-invite can flip an accepted invitation back to pending, so the
-// invitation status alone cannot prove the person holds no access.
-async function isTenantMember(db: TenantDb, email: string, tenantId: TenantId): Promise<boolean> {
-  const user = await fetchOne<{ id: string }>(db, userTable, {
-    email: normalizeEmail(email),
-    isDeleted: false,
-  });
-  if (!user) return false;
-  const membership = await fetchOne(db, tenantMembershipsTable, { userId: user.id, tenantId });
-  return membership !== undefined && membership !== null;
-}
-
 // An invited entry already has a live invitation link; rejecting must kill it,
 // otherwise the rejected person can still sign up. Once accepted they hold
 // access, which only tenant member removal may revoke.