@cosmicdrift/kumiko-samples 0.371.0 → 0.372.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.371.0",
+  "version": "0.372.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.371.0",
+  "version": "0.372.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/auth-mfa/db/queries.ts

@@ -5,6 +5,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/db";
 import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
+import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { userMfaEntity, userMfaTable } from "../schema/user-mfa.ts";
 
 export type UserMfaRow = {
@@ -13,8 +14,8 @@ export type UserMfaRow = {
   readonly userId: string;
   readonly totpSecret: string;
   readonly recoveryCodes: { readonly hashes: readonly string[] };
-  readonly enabledAt: string;
-  readonly lastUsedAt: string | null;
+  readonly enabledAt: Temporal.Instant;
+  readonly lastUsedAt: Temporal.Instant | null;
 };
 
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
@@ -37,12 +38,9 @@ export async function findUserMfaRow(db: TenantDb, user: SessionUser): Promise<U
   if (!idLookup) return null;
   const detail = await executor.detail({ id: idLookup.id }, user, db);
   if (!detail) return null;
-  // @cast-boundary engine-payload — executor.detail returns a decrypted,
-  // untyped Record; the userMfa entity's own field shape narrows it.
-  const row = detail as Omit<UserMfaRow, "recoveryCodes"> & { recoveryCodes: string };
   const recoveryCodes = parseJsonOrThrow<{ hashes: readonly string[] }>(
-    row.recoveryCodes,
+    detail.recoveryCodes,
     "user-mfa.recoveryCodes",
   );
-  return { ...row, recoveryCodes };
+  return { ...detail, recoveryCodes };
 }

package/packages/bundled-features/src/cap-overview/web/cap-cards-panel.tsx

@@ -1,3 +1,4 @@
+import { EMPTY_VALUE_PLACEHOLDER } from "@cosmicdrift/kumiko-headless";
 // @runtime client
 import type { ExtensionSectionProps } from "@cosmicdrift/kumiko-renderer";
 import { usePrimitives, useQuery, useTranslation } from "@cosmicdrift/kumiko-renderer";
@@ -102,7 +103,7 @@ export function CapCardsPanel({ filterParams }: ExtensionSectionProps): ReactNod
             label={t(cap.label)}
             value={
               !isMeasured(cap)
-                ? "—"
+                ? EMPTY_VALUE_PLACEHOLDER
                 : cap.limit === null
                   ? String(cap.used)
                   : `${cap.used} / ${cap.limit}`

package/packages/bundled-features/src/config/web/index.ts

@@ -1,4 +1,6 @@
 // @runtime client
+
+export { ConfigQueries } from "../constants.ts";
 export {
   type ConfigClientFeature,
   type ConfigClientOptions,

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "fix",
+    "title": "forget-subject removes files bound to the forgotten subject",
+    "detail": "Forgetting a record or user subject now deletes the bytes, derivatives and file_refs rows behind that subject's personal file fields (fail closed with missing_file_storage or file_delete_failed in cleanupError), so a retry can finish the job; the entity row stays."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -27,6 +27,7 @@ import {
   type EntityDefinition,
   type FeatureDefinition,
   type HandlerContext,
+  parseTenantId,
   type SessionUser,
   type TenantId,
   type WriteEvent,
@@ -47,6 +48,7 @@ import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.ts";
 import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.ts";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.ts";
+import { purgeFilesReachingSubject } from "../../shared/index.ts";
 import { USER_STATUS, userTable } from "../../user/index.ts";
 import {
   denyIfTargetOutsideAdminTenant,
@@ -63,6 +65,7 @@ import {
   TARGET_RECORD_RETENTION_BLOCK_DELETE,
   TARGET_TENANT_NOT_ADMIN_TENANT,
 } from "../constants.ts";
+import { resolveFileBytesDeleter } from "../resolve-file-bytes-deleter.ts";
 
 export { subjectIdSchema };
 
@@ -216,6 +219,17 @@ async function resolveRetentionDenial(
   return effective.policy?.strategy === "blockDelete" ? deny() : undefined;
 }
 
+// The tenant that owns a record subject's row; the file purge is scoped to it.
+async function owningTenantOfRecordSubject(
+  runner: DbRunner,
+  features: ReadonlyMap<string, FeatureDefinition>,
+  raw: SubjectIdInput,
+): Promise<TenantId | undefined> {
+  if (raw.kind !== "record") return undefined;
+  const owner = await recordRowOwningTenantId(runner, features, raw.entity, raw.id);
+  return parseTenantId(owner) ?? undefined;
+}
+
 // AccessDeniedError.code is the generic "access_denied" for every branch;
 // the specific branch lives in details.reason.
 function denialReasonOf(failure: WriteFailure): string {
@@ -300,46 +314,72 @@ function sweepErrorLabel(err: unknown): string {
 
 // The key is already erased when this runs, so a failing sweep must not skip the
 // audit event: the failure is returned as a label for the event instead of thrown.
-// The savepoint keeps a database error from aborting the handler transaction.
+// Each step runs in its own savepoint: a database error must not abort the handler
+// transaction, and one failing step must not skip or roll back the others.
 async function sweepDerivedSubjectData(
   ctx: HandlerContext,
   subject: SubjectId,
   subjectKey: string,
   crossTenantRunner: DbRunner,
   audit: { readonly requestId: string; readonly erasedBy: string },
+  rawSubject: SubjectIdInput,
 ): Promise<string | undefined> {
-  try {
-    await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
-      // Blind-index sweep (#818): nulls bidx columns now so the deterministic
-      // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
-      await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
-
-      // Derived search index still holds plaintext (#1610) — purge next to the
-      // blind-index sweep. No adapter → no-op (apps without search).
-      if (ctx.searchAdapter) {
-        await purgeSearchDocumentsForSubject(
-          crossTenantSubjectRunner,
-          ctx.registry.features,
-          ctx.searchAdapter,
-          subjectKey,
-          subject,
-        );
-      }
-
-      // Note bodies are keyed per note, so the subject's own key never reaches them.
-      if (ctx.registry.features.has("notes-history")) {
-        await eraseNoteBodiesReachingSubject({
-          db: crossTenantSubjectRunner,
-          subject,
-          erasedBy: audit.erasedBy,
-          requestId: audit.requestId,
-        });
-      }
-    });
-    return undefined;
-  } catch (err) {
-    return sweepErrorLabel(err);
-  }
+  const recordTenantId = await owningTenantOfRecordSubject(
+    crossTenantRunner,
+    ctx.registry.features,
+    rawSubject,
+  );
+  const failureLabels: string[] = [];
+  const runStep = async (step: (runner: DbRunner) => Promise<void>): Promise<void> => {
+    try {
+      await runInSavepointIfSupported(crossTenantRunner, step);
+    } catch (err) {
+      failureLabels.push(sweepErrorLabel(err));
+    }
+  };
+
+  await runStep(async (crossTenantSubjectRunner) => {
+    // Blind-index sweep (#818): nulls bidx columns now so the deterministic
+    // HMAC doesn't stay equality-matchable; raw because the ciphertext prefix addresses the subject across tenants.
+    await nullBlindIndexesForSubject(crossTenantSubjectRunner, ctx.registry.features, subjectKey);
+
+    // Derived search index still holds plaintext (#1610) — purge next to the
+    // blind-index sweep. No adapter → no-op (apps without search).
+    if (ctx.searchAdapter) {
+      await purgeSearchDocumentsForSubject(
+        crossTenantSubjectRunner,
+        ctx.registry.features,
+        ctx.searchAdapter,
+        subjectKey,
+        subject,
+      );
+    }
+
+    // Note bodies are keyed per note, so the subject's own key never reaches them.
+    if (ctx.registry.features.has("notes-history")) {
+      await eraseNoteBodiesReachingSubject({
+        db: crossTenantSubjectRunner,
+        subject,
+        erasedBy: audit.erasedBy,
+        requestId: audit.requestId,
+      });
+    }
+  });
+
+  // File columns hold only the fileRef id, so the key erase never reaches the bytes.
+  await runStep((crossTenantSubjectRunner) =>
+    purgeFilesReachingSubject({
+      registry: ctx.registry,
+      db: crossTenantSubjectRunner,
+      subject,
+      subjectKey,
+      ...(recordTenantId !== undefined && { recordTenantId }),
+      resolveDeleteBytes: resolveFileBytesDeleter(ctx),
+      missingStorage: { mode: "fail" },
+    }),
+  );
+
+  return failureLabels[0];
 }
 
 // Email subscribers and other non-user entities use user-style subject keys
@@ -441,7 +481,7 @@ export const forgetSubjectWrite = defineWriteHandler({
     reason:
       "the denial and SUBJECT_FORGOTTEN audit appends name the caller's own tenant stream on the outside-transaction db; " +
       "the tenant-scope and retention checks run against the subject's tenant, not necessarily the caller's; " +
-      "the blind-index sweep and search purge address the subject across tenants; the user " +
+      "the blind-index sweep, search purge and file purge address the subject across tenants; the user " +
       "lifecycle update and PAT revoke run on the SYSTEM user stream.",
   },
   handler: async (event, ctx) => {
@@ -544,6 +584,7 @@ export const forgetSubjectWrite = defineWriteHandler({
       subjectKey,
       ctx.db.unsafeRaw(),
       { requestId, erasedBy: event.user.id },
+      raw,
     );
 
     await appendSubjectForgotten(

package/packages/bundled-features/src/crypto-shredding/resolve-file-bytes-deleter.ts

@@ -0,0 +1,29 @@
+import { deleteFileRefBytes } from "@cosmicdrift/kumiko-framework/derivatives";
+import type { HandlerContext, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createFileContext } from "@cosmicdrift/kumiko-framework/files";
+import type { DeleteFileBytes } from "../shared/index.ts";
+
+const ERROR_CONTEXT = "crypto-shredding:forget-subject";
+
+// The upload resolver, not ctx.files: ctx.files is bound to the acting user's tenant, while a
+// subject's rows can live in any tenant. Resolved eagerly so a missing provider surfaces as
+// missing_file_storage instead of a failed delete.
+export function resolveFileBytesDeleter(
+  ctx: HandlerContext,
+): (tenantId: TenantId) => Promise<DeleteFileBytes | undefined> {
+  return async (tenantId) => {
+    const resolver = ctx._fileProviderResolver;
+    if (resolver === undefined) {
+      const own = tenantId === ctx.user.tenantId ? ctx.files : undefined;
+      return own && ((key) => deleteFileRefBytes(own, { storageKey: key }, ERROR_CONTEXT));
+    }
+    try {
+      const provider = await resolver(tenantId);
+      const files = createFileContext(() => Promise.resolve(provider), tenantId);
+      return (key) => deleteFileRefBytes(files, { storageKey: key }, ERROR_CONTEXT);
+    } catch {
+      // skip: no provider resolvable for this tenant; surfaces as missing_file_storage when files exist
+      return undefined;
+    }
+  };
+}

package/packages/bundled-features/src/data-retention/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "improvement",
+    "title": "runRetentionCleanup is exported for app tests",
+    "detail": "The data-retention entry point now exports runRetentionCleanup with its argument, result and skip types, so an app test can drive a retention run with its own now and file context and check that bytes, file_refs rows and the entity row are gone. The user-data-rights recipe shows the pattern."
+  },
   {
     "version": "0.363.0",
     "type": "improvement",

package/packages/bundled-features/src/data-retention/index.ts

@@ -19,3 +19,9 @@ export {
   tenantRetentionOverrideTable,
 } from "./feature.ts";
 export { computeCutoff, type Instant } from "./keep-for.ts";
+export {
+  type RetentionCleanupSkip,
+  type RunRetentionCleanupArgs,
+  type RunRetentionCleanupResult,
+  runRetentionCleanup,
+} from "./run-retention-cleanup.ts";

package/packages/bundled-features/src/data-retention/run-retention-cleanup.ts

@@ -74,7 +74,13 @@ import {
   fileRefsTable,
 } from "@cosmicdrift/kumiko-framework/files";
 import { propertyOf } from "@cosmicdrift/kumiko-types/type-guards";
-import { runInSubTransaction } from "../shared/index.ts";
+import {
+  collectSingleFileHolders,
+  planFileFields,
+  purgeRowFileRefs,
+  runInSubTransaction,
+  type SingleFileHolder,
+} from "../shared/index.ts";
 import { computeCutoff, type Instant } from "./keep-for.ts";
 import type { RetentionPresetKey } from "./presets.ts";
 import { resolveRetentionPolicyForTenant } from "./resolve-for-tenant.ts";
@@ -264,130 +270,6 @@ async function forgetRowAndEraseKeys(args: {
 
 // --- hardDelete + file-fields (kumiko-framework#3089) ---
 
-type FileFieldPlan = {
-  /** type file|image — stores the fileRef-id directly in the entity column. */
-  readonly singleFields: readonly string[];
-  /** type files|images — resolved via file_refs (bound by entityType/entityId/fieldName). */
-  readonly multiFields: readonly string[];
-};
-
-const NO_FILE_FIELDS: FileFieldPlan = { singleFields: [], multiFields: [] };
-
-// file/image = single-column fields (fileRef-id lives directly in the entity
-// row); files/images = plural, resolved via file_refs. Same set
-// as boot-validator/entity-handler.ts FILE_FIELD_TYPES and engine's
-// isFileField — inlined here rather than importing across the package
-// barrel since this module already needs the single/multi split, not just
-// membership.
-function planFileFields(fields: Readonly<Record<string, unknown>>): FileFieldPlan {
-  const singleFields: string[] = [];
-  const multiFields: string[] = [];
-  for (const [name, field] of Object.entries(fields)) {
-    const type = (field as { readonly type?: unknown }).type; // @cast-boundary schema-walk
-    if (type === "file" || type === "image") singleFields.push(name);
-    else if (type === "files" || type === "images") multiFields.push(name);
-  }
-  return singleFields.length > 0 || multiFields.length > 0
-    ? { singleFields, multiFields }
-    : NO_FILE_FIELDS;
-}
-
-// Every fileRef-id a row's file/image/files/images-fields reference: single
-// fields hold the id in their own column, plural fields resolve
-// via file_refs (tenantId, entityType, entityId, fieldName).
-async function collectFileRefIds(
-  db: DbRunner,
-  tenantId: TenantId,
-  entityName: string,
-  row: Record<string, unknown>,
-  plan: FileFieldPlan,
-): Promise<readonly string[]> {
-  const ids = new Set<string>();
-  for (const field of plan.singleFields) {
-    const value = row[field];
-    if (typeof value === "string" && value.length > 0) ids.add(value);
-  }
-  if (plan.multiFields.length > 0) {
-    const refRows = await selectMany<{ id: string }>(db, fileRefsTable, {
-      tenantId,
-      entityType: entityName,
-      entityId: String(row["id"]),
-      fieldName: { in: plan.multiFields },
-    });
-    for (const r of refRows) ids.add(r.id);
-  }
-  return Array.from(ids);
-}
-
-// A fileRef is bound to a DIFFERENT entity/record than the row currently
-// being purged — its binding (entityType/entityId), not the row's own
-// single-field column, decides ownership. A single-field value can point at
-// a fileRef uploaded/attached elsewhere; that fileRef's bytes belong to
-// whatever it's actually bound to, not to this row.
-function isFileRefBoundElsewhere(
-  fileRef: Record<string, unknown>,
-  entityName: string,
-  rowId: string,
-): boolean {
-  const entityType = fileRef["entityType"];
-  const entityId = fileRef["entityId"];
-  if (typeof entityType === "string" && entityType !== entityName) return true;
-  if (typeof entityId === "string" && entityId !== rowId) return true;
-  return false;
-}
-
-type SingleFileHolder = {
-  readonly table: Parameters<typeof selectMany>[1];
-  readonly tableHasTenantId: boolean;
-  readonly singleFields: readonly string[];
-};
-
-// Every implicit entity table with file/image fields: an unbound fileRef
-// (POST /files without entityType/entityId) can sit in single fields of
-// several entity types, so the sharing check must look beyond the purged
-// row's own table.
-function collectSingleFileHolders(registry: Registry): readonly SingleFileHolder[] {
-  const holders: SingleFileHolder[] = [];
-  for (const proj of registry.getAllProjections().values()) {
-    if (proj.isImplicit !== true || typeof proj.source !== "string" || !proj.table) continue;
-    const entity = registry.getEntity(proj.source);
-    if (!entity) continue;
-    const { singleFields } = planFileFields(entity.fields);
-    if (singleFields.length === 0) continue;
-    holders.push({
-      table: proj.table,
-      tableHasTenantId: propertyOf(proj.table, "tenantId") !== undefined,
-      singleFields,
-    });
-  }
-  return holders;
-}
-
-// A single-field fileRef-id can be shared by more than one row, in the SAME
-// table (e.g. a stock-photo re-picked across records) or in another entity's
-// table. Purging its bytes would corrupt the row that isn't being deleted.
-// Bounded by batchLimit rows per run and holderFields queries per fileRef —
-// the same per-row event-cost tradeoff as the rest of this cron (see header).
-async function isFileRefSharedByOtherRow(
-  db: DbRunner,
-  holders: readonly SingleFileHolder[],
-  ownTable: Parameters<typeof selectMany>[1],
-  tenantId: TenantId,
-  rowId: string,
-  fileRefId: string,
-): Promise<boolean> {
-  for (const holder of holders) {
-    for (const field of holder.singleFields) {
-      const where: WhereObject = { [field]: fileRefId };
-      if (holder.table === ownTable) where["id"] = { ne: rowId };
-      if (holder.tableHasTenantId) where["tenantId"] = tenantId;
-      const others = await selectMany(db, holder.table, where, { limit: 1 });
-      if (others.length > 0) return true;
-    }
-  }
-  return false;
-}
-
 // Throws (unsafe key, missing list permission) must fail this row closed,
 // not abort the whole tenant run.
 async function deleteFileFailingClosed(
@@ -407,11 +289,8 @@ async function deleteFileFailingClosed(
 }
 
 // hardDelete for ONE row of an entity that has file/image/files/images
-// fields: delete the un-shared fileRefs' bytes (+ derivatives) first, then
-// their fileRef rows, then the entity row itself — bytes before rows so a
-// crash mid-way leaves an orphaned fileRef pointing at already-gone bytes
-// (safe: a later run's provider.delete is idempotent) rather than a gone
-// fileRef whose bytes leak forever.
+// fields: purge the un-shared fileRefs (bytes + derivatives, then the fileRef
+// rows), then the entity row itself.
 async function purgeHardDeleteRowWithFiles(args: {
   readonly db: DbRunner;
   readonly table: Parameters<typeof selectMany>[1];
@@ -420,7 +299,6 @@ async function purgeHardDeleteRowWithFiles(args: {
   readonly entityName: string;
   readonly entity: EntityDefinition;
   readonly row: Record<string, unknown>;
-  readonly plan: FileFieldPlan;
   readonly files: FileContext | undefined;
   readonly entityExecutor: ReturnType<typeof createEventStoreExecutor>;
   readonly fileRefExecutor: ReturnType<typeof createEventStoreExecutor>;
@@ -431,8 +309,32 @@ async function purgeHardDeleteRowWithFiles(args: {
   readonly onSkip: (reason: "missing_file_storage" | "file_delete_failed") => void;
 }): Promise<boolean> {
   const rowId = String(args.row["id"]);
-  const forgetEntityRow = () =>
-    forgetRowAndEraseKeys({
+  const logContext = `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`;
+  const files = args.files;
+  const outcome = await purgeRowFileRefs({
+    db: args.db,
+    tenantId: args.tenantId,
+    entityName: args.entityName,
+    entity: args.entity,
+    table: args.table,
+    fileHolders: args.fileHolders,
+    row: args.row,
+    deleteBytes: files ? (key) => deleteFileFailingClosed(key, files, logContext) : undefined,
+    fileRefForget: async (fileRefId) =>
+      (await args.fileRefExecutor.forget({ id: fileRefId }, args.systemUser, args.tdb)).isSuccess,
+    onBytesDeleteFailed: (failedKeys) => {
+      // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
+      console.warn(
+        `[data-retention:hardDelete] ${logContext} storage delete failed keys=${failedKeys.join(",")}`,
+      );
+    },
+  });
+  if (outcome !== "purged") {
+    args.onSkip(outcome);
+    return false;
+  }
+  return (
+    await forgetRowAndEraseKeys({
       db: args.db,
       executor: args.entityExecutor,
       entity: args.entity,
@@ -442,83 +344,8 @@ async function purgeHardDeleteRowWithFiles(args: {
       row: args.row,
       kms: args.kms,
       registry: args.registry,
-    });
-  const fileRefIds = await collectFileRefIds(
-    args.db,
-    args.tenantId,
-    args.entityName,
-    args.row,
-    args.plan,
-  );
-  if (fileRefIds.length === 0) {
-    return (await forgetEntityRow()).isSuccess;
-  }
-
-  const fileRefRows = await selectMany<Record<string, unknown>>(args.db, fileRefsTable, {
-    id: { in: fileRefIds },
-    tenantId: args.tenantId,
-  });
-
-  const toDelete: Record<string, unknown>[] = [];
-  for (const fileRef of fileRefRows) {
-    if (isFileRefBoundElsewhere(fileRef, args.entityName, rowId)) continue;
-    const shared = await isFileRefSharedByOtherRow(
-      args.db,
-      args.fileHolders,
-      args.table,
-      args.tenantId,
-      rowId,
-      String(fileRef["id"]),
-    );
-    if (shared) continue;
-    toDelete.push(fileRef);
-  }
-
-  if (toDelete.length === 0) {
-    return (await forgetEntityRow()).isSuccess;
-  }
-
-  if (!args.files) {
-    args.onSkip("missing_file_storage");
-    return false;
-  }
-  const files = args.files;
-
-  let anyFailed = false;
-  for (const fileRef of toDelete) {
-    const key = fileRef["storageKey"];
-    if (typeof key !== "string" || key.length === 0) continue;
-    const failedKeys = await deleteFileFailingClosed(
-      key,
-      files,
-      `tenant=${args.tenantId} entity=${args.entityName} row=${rowId}`,
-    );
-    if (failedKeys.length > 0) {
-      anyFailed = true;
-      // biome-ignore lint/suspicious/noConsole: operator-visibility for storage-cleanup failures
-      console.warn(
-        `[data-retention:hardDelete] tenant=${args.tenantId} entity=${args.entityName} row=${rowId} storage delete failed keys=${failedKeys.join(",")}`,
-      );
-    }
-  }
-  if (anyFailed) {
-    args.onSkip("file_delete_failed");
-    return false;
-  }
-
-  for (const fileRef of toDelete) {
-    const res = await args.fileRefExecutor.forget(
-      { id: fileRef["id"] as EntityId },
-      args.systemUser,
-      args.tdb,
-    );
-    if (!res.isSuccess) {
-      args.onSkip("file_delete_failed");
-      return false;
-    }
-  }
-
-  return (await forgetEntityRow()).isSuccess;
+    })
+  ).isSuccess;
 }
 
 // hardDelete page for an entity WITH file/image/files/images fields — loads
@@ -534,7 +361,6 @@ async function purgeHardDeleteRowsWithFiles(args: {
   readonly tenantId: TenantId;
   readonly entityName: string;
   readonly entity: EntityDefinition;
-  readonly plan: FileFieldPlan;
   readonly files: FileContext | undefined;
   readonly entityExecutor: ReturnType<typeof createEventStoreExecutor>;
   readonly fileRefExecutor: ReturnType<typeof createEventStoreExecutor>;
@@ -575,7 +401,6 @@ async function purgeHardDeleteRowsWithFiles(args: {
         entityName: args.entityName,
         entity: args.entity,
         row,
-        plan: args.plan,
         files: args.files,
         entityExecutor: args.entityExecutor,
         fileRefExecutor: args.fileRefExecutor,
@@ -753,7 +578,6 @@ export async function runRetentionCleanup(
           tenantId,
           entityName,
           entity,
-          plan: filePlan,
           files: args.files,
           entityExecutor: executor,
           fileRefExecutor,

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.372.0",
+    "type": "breaking",
+    "title": "Queued delivery jobs carry the recipient address sealed",
+    "detail": "createDeliveryService takes an addressCipher; the boot wiring passes the master-key cipher, so delivery.render and delivery.send payloads hold sealedAddress instead of address. Workers open it through ctx.configEncryption.",
+    "migration": "Roll out worker and web together with the same KUMIKO_SECRETS_MASTER_KEY_V<n>; a worker without the master key fails sealed jobs with send_failed. Code that calls createDeliveryService itself passes addressCipher to get sealed payloads."
+  },
+  {
+    "version": "0.372.0",
+    "type": "improvement",
+    "title": "createUnsubscribePageChromeReader gives app routes the tenant branding for unsubscribe pages",
+    "detail": "The JSDoc of renderUnsubscribeResultPage pointed to a chrome read that only works for SystemAdmin, so app routes for legacy unsubscribe links rendered without branding. The new `createUnsubscribePageChromeReader({ dispatchSystemQuery })` returns `(tenantId, locale) => MailChrome | null`, failing soft to null. Build it once in the `wire` hook, whose deps now also carry `dispatchSystemQuery` (runProdApp, runWorkerApp.wireComponents, createKumikoServer), and call it with a tenant the route resolved itself, for example from the Host, never with a tenantId from the query string or body. The chrome query itself stays SystemAdmin-only; anonymous `/api/query` callers are still rejected for every tenant."
+  },
   {
     "version": "0.371.0",
     "type": "improvement",