@cosmicdrift/kumiko-samples 0.387.0 → 0.389.0

package/packages/bundled-features/src/jobs/handlers/tenant-runs.query.ts

@@ -32,63 +32,67 @@ function parseSubject(stored: string | null): Record<string, unknown> | null {
   return Object.fromEntries(parsed.filter(isSubjectEntry));
 }
 
-export const tenantRunsQuery = defineQueryHandler({
-  name: "tenant-runs",
-  description:
-    "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
-  schema: z.object({
-    jobName: z.string().optional(),
-    subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
-    limit: z.number().int().min(1).max(200).optional(),
-  }),
-  // Every membership rank: a run state carries a job name, a status and
-  // times, nothing a team member of the tenant may not see.
-  access: { roles: access.roles("User", "Editor", ...access.admin) },
-  handler: async (query, ctx) => {
-    if (!ctx.systemDb) {
-      throw new InternalError({
-        message:
-          "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+export function createTenantRunsQuery(readRoles: readonly string[]) {
+  return defineQueryHandler({
+    name: "tenant-runs",
+    description:
+      "Lists the calling tenant's own job runs that opted in via tenantVisibleRun — per job and subject every queued or running run plus the latest completed or failed one, active runs first, then newest first; each row carries only status and queuedAt/startedAt/finishedAt, never payloads, error text or logs; the optional subject filter matches exactly: all declared subjectFields with the same JSON types as the job payload; use it to show whether work for a subject is waiting, running or done, and to tell a failed run from a finished one.",
+    schema: z.object({
+      jobName: z.string().optional(),
+      subject: z.record(z.string(), z.union([z.string(), z.number(), z.boolean()])).optional(),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    // Every membership rank: a run state carries a job name, a status and
+    // times, nothing a team member of the tenant may not see.
+    access: {
+      roles: [...new Set([...access.roles("User", "Editor", ...access.admin), ...readRoles])],
+    },
+    handler: async (query, ctx) => {
+      if (!ctx.systemDb) {
+        throw new InternalError({
+          message:
+            "jobs:query:tenant-runs requires ctx.systemDb (feature must declare r.systemScope())",
+        });
+      }
+      // assertTenantMatch returns the same unfiltered system-mode db — the
+      // explicit tenantId below is the filter, assertRowsTenant the second net.
+      const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
+      const where: Record<string, unknown> = { tenantId: [query.user.tenantId] };
+      if (query.payload.jobName) where["jobName"] = query.payload.jobName;
+      if (query.payload.subject) where["subject"] = serializeJobSubject(query.payload.subject);
+      const limit = query.payload.limit ?? DEFAULT_LIMIT;
+      const newestFirst = { col: "updatedAt", direction: "desc" } as const;
+      const activeRows = await selectMany<TenantJobRunRow>(
+        db,
+        tenantJobRunsTable,
+        { ...where, status: { in: ["queued", "running"] } },
+        { orderBy: newestFirst, limit },
+      );
+      const finishedRows = await selectMany<TenantJobRunRow>(
+        db,
+        tenantJobRunsTable,
+        { ...where, status: { in: ["completed", "failed"] } },
+        { orderBy: newestFirst, limit },
+      );
+      const seenFinishedKeys = new Set<string>();
+      const finishedNewestPerKey = finishedRows.filter((row) => {
+        const key = JSON.stringify([row.jobName, row.subject]);
+        if (seenFinishedKeys.has(key)) return false;
+        seenFinishedKeys.add(key);
+        return true;
       });
-    }
-    // assertTenantMatch returns the same unfiltered system-mode db — the
-    // explicit tenantId below is the filter, assertRowsTenant the second net.
-    const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-    const where: Record<string, unknown> = { tenantId: [query.user.tenantId] };
-    if (query.payload.jobName) where["jobName"] = query.payload.jobName;
-    if (query.payload.subject) where["subject"] = serializeJobSubject(query.payload.subject);
-    const limit = query.payload.limit ?? DEFAULT_LIMIT;
-    const newestFirst = { col: "updatedAt", direction: "desc" } as const;
-    const activeRows = await selectMany<TenantJobRunRow>(
-      db,
-      tenantJobRunsTable,
-      { ...where, status: { in: ["queued", "running"] } },
-      { orderBy: newestFirst, limit },
-    );
-    const finishedRows = await selectMany<TenantJobRunRow>(
-      db,
-      tenantJobRunsTable,
-      { ...where, status: { in: ["completed", "failed"] } },
-      { orderBy: newestFirst, limit },
-    );
-    const seenFinishedKeys = new Set<string>();
-    const finishedNewestPerKey = finishedRows.filter((row) => {
-      const key = JSON.stringify([row.jobName, row.subject]);
-      if (seenFinishedKeys.has(key)) return false;
-      seenFinishedKeys.add(key);
-      return true;
-    });
-    const activeFirst = [...activeRows, ...finishedNewestPerKey];
-    return {
-      rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
-        jobName: row.jobName,
-        subject: parseSubject(row.subject),
-        status: row.status,
-        queuedAt: row.queuedAt,
-        startedAt: row.startedAt,
-        finishedAt: row.finishedAt,
-      })),
-      nextCursor: null,
-    };
-  },
-});
+      const activeFirst = [...activeRows, ...finishedNewestPerKey];
+      return {
+        rows: ctx.systemDb.assertRowsTenant(activeFirst.slice(0, limit), "tenantId").map((row) => ({
+          jobName: row.jobName,
+          subject: parseSubject(row.subject),
+          status: row.status,
+          queuedAt: row.queuedAt,
+          startedAt: row.startedAt,
+          finishedAt: row.finishedAt,
+        })),
+        nextCursor: null,
+      };
+    },
+  });
+}

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -262,15 +262,16 @@ async function recordTenantRunQueued(
   const now = Temporal.Now.instant();
   await transaction(db, async (tx) => {
     // A finished row under the same id is left over from before a Redis reset
-    // (ids restart at 1), not this job. Only rows that went through this hook
-    // (queuedAt set) qualify: a fast worker can finish before the hook runs,
-    // and that row is this job's own and must stay.
+    // (ids restart at 1), not this job. Only rows queued before this BullMQ job
+    // was created qualify: a fast worker can finish before the hook runs (no
+    // queuedAt), and a deduplicated add of an already finished job re-announces
+    // it with a creation time older than its own row. Both rows must stay.
     await deleteMany(tx, tenantJobRunsTable, {
       tenantId: key.tenantId,
       jobName,
       bullJobId,
       status: { in: ["completed", "failed"] },
-      queuedAt: { gt: Temporal.Instant.fromEpochMilliseconds(0) },
+      queuedAt: { lt: Temporal.Instant.fromEpochMilliseconds(meta.jobCreatedAtMs) },
     });
     // DO NOTHING: a fast worker can report the start before this enqueue hook
     // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.

package/packages/bundled-features/src/ledger/web/index.ts

@@ -1,7 +1,7 @@
 // Client-safe ledger surface: QN constants, pure recurring helpers
 // (projection + Soll/Ist merge), and Zod payload schemas for client-side
 // pre-validation before dispatch. The full `../ledger` entry also re-exports
-// the feature/handlers/executor, which pull postgres-js; importing it in a
+// the feature/handlers/executor, which pull the DB driver; importing it in a
 // browser bundle fails on Node builtins. Client screens import dispatch QNs and
 // pure forecast/merge helpers from this module, then dispatch via the renderer's
 // useDispatcher.

package/packages/bundled-features/src/legal-pages/README.md

@@ -35,7 +35,7 @@ runProdApp({
   //      decoupling — legal-pages imports no code from template-resolver,
   //      only uses the API via ctx)
   anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
-  extraContext: ({ db }) => ({
+  extraContext: ({ db, registry }) => ({
     templateResolver: createTemplateResolverApi(db, registry),
   }),
 });

package/packages/bundled-features/src/legal-pages/seed.ts

@@ -42,12 +42,15 @@ async function loadBlocksFromJson(path: string): Promise<readonly LegalContentBl
 
 // Boot seed for runProdApp's `seeds: [...]`. The JSON template is authoritative
 // (ifExists "update"), so legally required text changes reach rows seeded once.
-export function legalContentSeed(source: LegalContentSeedSource): LegalContentSeedFn {
+export function legalContentSeed(
+  source: LegalContentSeedSource,
+  options?: { readonly folder?: string },
+): LegalContentSeedFn {
   return async ({ db }) => {
     const blocks =
       "blocks" in source
         ? legalContentBlocksSchema.parse(source.blocks)
         : await loadBlocksFromJson(source.path);
-    await seedLegalContentFromJson(db, blocks);
+    await seedLegalContentFromJson(db, blocks, options);
   };
 }

package/packages/bundled-features/src/mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tenant mail transport falls back to the app transport without tenant config",
+    "detail": "tenantMailTransport returns null when the channel context carries no tenant config, instead of throwing on every send, so the channel uses the app transport as documented."
+  },
   {
     "version": "0.378.0",
     "type": "improvement",

package/packages/bundled-features/src/mail-foundation/feature.ts

@@ -75,9 +75,9 @@ export const MAIL_TRANSPORT_EXTENSION = "mailTransport" as const;
  *   config      — tenant config reads (the plugin's host/port/from/...)
  *   registry    — extension lookup in the factory (not plugin-internal)
  *   secrets     — tenant secret reads (smtp.password)
- *   auditUserId — audit identity for secret reads. Handler path: the
- *                 dispatcher sets the caller's user id; worker path: the
- *                 r.job wrap sets a system identity.
+ *   auditUserId — audit identity for secret reads. Handler path: unset,
+ *                 requireSecretsContext falls back to ctx.user.id; worker path:
+ *                 the r.job wrap sets a system identity.
  */
 export type MailTransportContext = {
   readonly config?: ConfigAccessor;
@@ -276,6 +276,8 @@ export type TenantMailTransportScope = {
 export function tenantMailTransport(
   scope: TenantMailTransportScope,
 ): Promise<EmailTransport | null> {
+  // Without a tenant config the provider cannot be read: use the app transport.
+  if (scope.config === undefined) return Promise.resolve(null);
   return createTransportForTenantIfConfigured(
     {
       config: scope.config,

package/packages/bundled-features/src/mail-transport-smtp/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "SMTP authentication is optional",
+    "detail": "authUser is no longer a required key and the SMTP password secret no longer counts as missing in readiness. With an empty user the transport connects without auth, which suits internal relays; with a user set, a missing password still fails the send."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/mail-transport-smtp/config-keys.ts

@@ -6,6 +6,7 @@ const tenantAdminWrite = access.withSystem(access.roles("TenantAdmin"));
 const tenantAdminRead = access.roles("TenantAdmin", "SystemAdmin");
 
 // required: true ↔ the requireNonEmpty calls in buildSmtpTransport — keep in sync.
+// authUser stays optional: empty means an unauthenticated relay.
 export const SMTP_CONFIG_KEYS = {
   host: createTenantConfig("text", {
     required: true,
@@ -41,7 +42,6 @@ export const SMTP_CONFIG_KEYS = {
     },
   }),
   authUser: createTenantConfig("text", {
-    required: true,
     default: "",
     write: tenantAdminWrite,
     read: tenantAdminRead,

package/packages/bundled-features/src/mail-transport-smtp/feature.ts

@@ -105,8 +105,7 @@ export function createMailTransportSmtpFeature() {
           return `${plaintext.slice(0, 3)}...${plaintext.slice(-2)}`;
         },
         scope: "tenant",
-        // required: true ↔ the missing-secret throw in readPassword — keep in sync.
-        required: true,
+        // Only needed once authUser is set (readPassword throws then), so readiness must not demand it.
       });
 
       const configKeys = r.config({ keys: SMTP_CONFIG_KEYS });
@@ -191,14 +190,13 @@ async function buildSmtpTransport(
     "from",
     SMTP_HINT,
   );
-  const authUser = requireNonEmpty(
-    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser),
-    FEATURE_NAME,
-    "authUser",
-    SMTP_HINT,
-  );
-
-  const password = await readPassword(ctx, tenantId);
+  const authUser = (
+    await ctxConfig(sharedMailTransportSmtpFeature.exports.configKeys.authUser)
+  )?.trim();
+  const auth =
+    authUser === undefined || authUser === ""
+      ? undefined
+      : { user: authUser, pass: await readPassword(ctx, tenantId) };
 
   let target: MailConnectTarget;
   try {
@@ -227,7 +225,7 @@ async function buildSmtpTransport(
     port,
     secure,
     from,
-    auth: { user: authUser, pass: password },
+    ...(auth && { auth }),
     ...(target.servername && { servername: target.servername }),
   });
 }

package/packages/bundled-features/src/managed-pages/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "MANAGED_PAGES_FEATURE names the feature",
+    "detail": "The barrel exports the MANAGED_PAGES_FEATURE constant so other code can refer to the feature name without a string literal."
+  },
   {
     "version": "0.363.0",
     "type": "improvement",

package/packages/bundled-features/src/managed-pages/constants.ts

@@ -0,0 +1 @@
+export const MANAGED_PAGES_FEATURE = "managed-pages" as const;

package/packages/bundled-features/src/managed-pages/feature.ts

@@ -10,6 +10,7 @@ import {
 } from "../page-render/index.ts";
 import { rateLimitedTextResponse, type SystemQueryFn } from "../shared/index.ts";
 import { BRANDING_KEYS, BRANDING_QUERY_QN, CUSTOM_CSS_KEY, coerceBranding } from "./branding.ts";
+import { MANAGED_PAGES_FEATURE } from "./constants.ts";
 import { createBrandingQuery } from "./handlers/branding.query.ts";
 import { bySlugQuery } from "./handlers/by-slug.query.ts";
 import { byTenantPublishedQuery } from "./handlers/by-tenant-published.query.ts";
@@ -153,7 +154,8 @@ export function createManagedPagesFeature(opts: ManagedPagesOptions): FeatureDef
   const defaultLang = opts.defaultLang ?? "en";
   const allowCustomCss = opts.allowCustomCss ?? false;
 
-  return defineFeature("managed-pages", (r) => {
+  return defineFeature(MANAGED_PAGES_FEATURE, (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Tenant-editable, server-rendered public pages with per-tenant branding. Stores one Markdown `page` per `(tenantId, slug, lang)` in the `read_pages` entity table with a `published` gate plus `description`/`ogImage` SEO meta. Registers an anonymous `GET {basePath}/:slug` route that resolves the tenant from the request Host via the app-supplied `resolveApexTenant`, serves only published pages (drafts → 404), renders Markdown through the hardened `page-render` core, and isolates per-tenant content with `Vary: Host`. Ships TenantAdmin/SystemAdmin admin screens (`entityList` + `entityEdit`) backed by convention CRUD handlers (`managed-pages:write:page:{create,update,delete}`, `managed-pages:query:page:{list,detail}`); the app wires nav/workspace onto `managed-pages:screen:page-list`. Also exposes `managed-pages:query:by-tenant-published` (anonymous, SQL-filtered on `published`) for sitemap/discovery consumers such as the `seo` feature. Branding (via `config`, scope tenant): `branding-{title,description,site-url,accent-color,logo-url,layout-preset,custom-css}` keys with write-time validation (hex color, https URLs), a `configEdit` self-service screen (`managed-pages:screen:branding-settings`), and a `managed-pages:query:branding` read that the render path applies as scoped `:root` CSS vars + a logo/title header. Also exposes `managed-pages:write:set` (idempotent slug-keyed upsert, SystemAdmin cross-tenant via `tenantIdOverride`) as a provisioning API. Requires `config` + `anonymousAccess` wired at app bootstrap.",
     );

package/packages/bundled-features/src/managed-pages/index.ts

@@ -21,6 +21,7 @@ export {
 // (`config:write:set`) — single source for the `managed-pages:config:branding-*`
 // strings, so apps + the per-tenant migration never hardcode them.
 export { BRANDING_QN, MANAGED_PAGES_CSS_FEATURE } from "./branding.ts";
+export { MANAGED_PAGES_FEATURE } from "./constants.ts";
 export { createManagedPagesCssFeature } from "./css-gate.ts";
 export {
   createManagedPagesFeature,

package/packages/bundled-features/src/notes-history/handlers/add-note.write.ts

@@ -69,7 +69,7 @@ export function createAddNoteHandler(
       let authorName: string | null = null;
       try {
         // read_users is tenant-agnostic → ctx.db.unsafeRaw, not the tenant-scoped ctx.db.
-        // postgres-js poisons the whole tx after any error inside it, even one that's
+        // Postgres aborts the whole tx after any error inside it, even one that's
         // caught — so the lookup runs in a savepoint where available, otherwise directly
         // (pool statements are their own units).
         authorName = await runInSavepointIfSupported(ctx.db.unsafeRaw(), async (sp) => {

package/packages/bundled-features/src/personal-access-tokens/feature.ts

@@ -36,7 +36,7 @@ const PAT_REVOKE_TRIGGERING_FIELDS = ["passwordHash"] as const;
 
 export type BindPatAutoRevokeOnPasswordChange = (
   revoker: (userId: string) => Promise<number>,
-) => void;
+) => () => void;
 
 // Reads the late-bind setter off a mounted personal-access-tokens feature's
 // exports — run{Prod,Dev}App call this once a concrete db is available,
@@ -101,6 +101,7 @@ export function createPersonalAccessTokensFeature(
 ): FeatureDefinition {
   const { scopes } = options;
   return defineFeature(PAT_FEATURE, (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Long-lived, revocable Personal Access Tokens for headless HTTP-API access. Stores SHA-256 token hashes in the `store_api_tokens` direct-write table; the plaintext is returned once at creation. `create`/`revoke`/`mine` manage a user's own tokens and `available-scopes` lists the app-declared scope catalog. Bearer tokens carrying the PAT prefix are resolved before jwt.verify (roles resolved live, granted scopes enforced fail-closed at the API boundary) — registered as an auth-foundation tokenVerifier provider, resolved generically by the middleware. Pass { toggleable: { default: false } } to tier-gate the whole feature.",
     );
@@ -169,6 +170,9 @@ export function createPersonalAccessTokensFeature(
     });
     const bindAutoRevokeOnPasswordChange: BindPatAutoRevokeOnPasswordChange = (revoker) => {
       boundAutoRevoke = revoker;
+      return () => {
+        if (boundAutoRevoke === revoker) boundAutoRevoke = undefined;
+      };
     };
 
     const handlers = {

package/packages/bundled-features/src/renderer-pdf/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "renderTablePdf validates the document for direct callers",
+    "detail": "renderTablePdf parses the document against pdfTableDocumentSchema and throws RendererError invalid_payload above the row, column and cell caps. Title, subtitle, meta entries, headers, empty text, footer text and page label now have length caps and meta at most 500 entries."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/renderer-pdf/render-table-pdf.ts

@@ -7,10 +7,13 @@ import type { PdfPageFormat } from "../template-resolver/index.ts";
 const PDF_TABLE_MAX_ROWS = 10_000;
 const PDF_TABLE_MAX_COLUMNS = 30;
 const PDF_TABLE_MAX_CELL_LENGTH = 5_000;
+const PDF_TABLE_MAX_META_ENTRIES = 500;
+const PDF_TABLE_MAX_TEXT_LENGTH = 20_000;
+const PDF_TABLE_MAX_PAGE_LABEL_LENGTH = 100;
 
 const pdfTableColumnSchema = z
   .object({
-    header: z.string(),
+    header: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
     weight: z.number().positive().optional(),
     align: z.enum(["left", "right"]).optional(),
   })
@@ -18,10 +21,18 @@ const pdfTableColumnSchema = z
 
 export const pdfTableDocumentSchema = z
   .object({
-    title: z.string(),
-    subtitle: z.string().optional(),
+    title: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+    subtitle: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     meta: z
-      .array(z.object({ label: z.string(), value: z.string() }).readonly())
+      .array(
+        z
+          .object({
+            label: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+            value: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH),
+          })
+          .readonly(),
+      )
+      .max(PDF_TABLE_MAX_META_ENTRIES)
       .readonly()
       .optional(),
     columns: z.array(pdfTableColumnSchema).min(1).max(PDF_TABLE_MAX_COLUMNS).readonly(),
@@ -29,10 +40,10 @@ export const pdfTableDocumentSchema = z
       .array(z.array(z.string().max(PDF_TABLE_MAX_CELL_LENGTH)).readonly())
       .max(PDF_TABLE_MAX_ROWS)
       .readonly(),
-    emptyText: z.string().optional(),
-    footerText: z.string().optional(),
+    emptyText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
+    footerText: z.string().max(PDF_TABLE_MAX_TEXT_LENGTH).optional(),
     // Template with `{page}` and `{pages}`; default `"{page} / {pages}"`.
-    pageLabel: z.string().optional(),
+    pageLabel: z.string().max(PDF_TABLE_MAX_PAGE_LABEL_LENGTH).optional(),
   })
   .readonly();
 
@@ -235,12 +246,18 @@ function resolveTableLayout(
 }
 
 export async function renderTablePdf(
-  doc: PdfTableDocument,
+  untrustedDoc: PdfTableDocument,
   options?: PdfTableOptions,
 ): Promise<PdfTableResult> {
-  if (doc.columns.length === 0) {
-    throw new RendererError("table needs at least one column", "invalid_payload");
+  // Direct callers bypass renderTablePdfRequest, so the size caps are enforced here too.
+  const parsed = pdfTableDocumentSchema.safeParse(untrustedDoc);
+  if (!parsed.success) {
+    throw new RendererError(
+      `table document is invalid: ${parsed.error.message}`,
+      "invalid_payload",
+    );
   }
+  const doc = parsed.data;
   assertRowShape(doc);
 
   const pdf = await PDFDocument.create({ updateMetadata: false });

package/packages/bundled-features/src/secrets/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Feature-prefixed undeclared secret keys are not deletable",
+    "detail": "The delete handler still accepts legacy undeclared keys, but a key starting with \"<feature>:\" of a mounted feature now fails as unknown key. Feature-owned credentials keep their writeRoles protection."
+  },
   {
     "version": "0.370.0",
     "type": "improvement",

package/packages/bundled-features/src/secrets/write-gate.ts

@@ -28,6 +28,11 @@ function unknownKeyFailure(key: string): SecretKeyWriteCheck {
   };
 }
 
+function isUnderMountedFeaturePrefix(registry: Registry, key: string): boolean {
+  const separator = key.indexOf(":");
+  return separator > 0 && registry.getFeature(key.slice(0, separator)) !== undefined;
+}
+
 function namespaceAcceptsKey(namespace: SecretNamespaceDefinition, key: string): boolean {
   const suffix = key.slice(namespace.qualifiedPrefix.length);
   if (suffix.length === 0) return false;
@@ -38,7 +43,9 @@ function namespaceAcceptsKey(namespace: SecretNamespaceDefinition, key: string):
 // are writable through the API, so a tenant admin cannot plant arbitrary rows
 // next to the feature-owned ones. writeRoles narrows the handler access
 // further for a key or a whole namespace. Delete passes allowUndeclared: it
-// creates nothing, and legacy rows under since-undeclared keys must stay removable.
+// creates nothing, and legacy rows under since-undeclared keys must stay removable,
+// unless the key sits under a mounted feature's prefix: those rows belong to the
+// feature and must not be removable by a tenant admin outside its writeRoles.
 export function checkSecretKeyWrite(
   registry: Registry,
   userRoles: readonly string[],
@@ -50,7 +57,7 @@ export function checkSecretKeyWrite(
   if (
     !keyDef &&
     !(namespace && namespaceAcceptsKey(namespace, key)) &&
-    options.allowUndeclared !== true
+    (options.allowUndeclared !== true || isUnderMountedFeaturePrefix(registry, key))
   ) {
     return unknownKeyFailure(key);
   }

package/packages/bundled-features/src/sessions/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "breaking",
+    "title": "isPrincipalBlocked is no longer exported from sessions",
+    "detail": "The sessions export dropped its re-export of isPrincipalBlocked, which ignored isDeleted. isPrincipalRowBlocked from the user export covers status and isDeleted and is what the session callbacks use.",
+    "migration": "import isPrincipalRowBlocked (for a user row) or isPrincipalBlocked (for a bare status) from \"@cosmicdrift/kumiko-bundled-features/user\" instead of the sessions export"
+  },
   {
     "version": "0.384.0",
     "type": "improvement",

package/packages/bundled-features/src/sessions/feature.ts

@@ -59,8 +59,10 @@ export type SessionsFeatureOptions = {
   readonly adminAccess?: "admin" | "systemAdmin";
 };
 
-export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => void;
-export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => void;
+// The returned unbind only clears the binding while it is still this revoker, so a stack that
+// stops later cannot unbind a newer stack sharing the same feature instance.
+export type BindAutoRevokeOnPasswordChange = (revoker: SessionMassRevoker) => () => void;
+export type BindRevokeAllOtherSessions = (revoker: SessionAllOthersRevoker) => () => void;
 
 // Reads the late-bind setter off a mounted sessions feature's exports.
 // run{Prod,Dev}App call it once the DB connection is concrete — the feature
@@ -100,6 +102,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     "sessions",
     (r) => {
       const adminRoles = access[options?.adminAccess ?? "admin"];
+      r.adoptsBundledLists();
       r.describe(
         "Tracks signed-in clients in the `store_user_sessions` table (one row per JWT, keyed by the `sid`/`jti` claim) and exposes handlers for `mine` (list your sessions), `revoke`, and `revokeAllOthers`. Session creation and revocation on the hot auth path are handled by `createSessionCallbacks()`, wired into `buildServer({ auth: { ... } })` outside the dispatcher; the same callbacks are also registered as an auth-foundation sessionStore provider, resolvable generically via `resolveSessionStore()`. The feature also ships a manual-trigger cleanup job for pruning expired rows and an optional `autoRevokeOnPasswordChange` hook that mass-revokes all sessions for a user whenever their `passwordHash` changes.",
       );
@@ -236,6 +239,9 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
 
       const bindAutoRevokeOnPasswordChange: BindAutoRevokeOnPasswordChange = (revoker) => {
         boundAutoRevoke = revoker;
+        return () => {
+          if (boundAutoRevoke === revoker) boundAutoRevoke = undefined;
+        };
       };
 
       r.translations({ keys: SESSIONS_I18N });

package/packages/bundled-features/src/sessions/index.ts

@@ -15,7 +15,7 @@ export type {
   SessionCallbacksOptions,
   SessionMassRevoker,
 } from "./session-callbacks.ts";
-export { createSessionCallbacks, isPrincipalBlocked } from "./session-callbacks.ts";
+export { createSessionCallbacks } from "./session-callbacks.ts";
 export type { SessionRevokedPayload } from "./session-revoked-event.ts";
 export {
   SESSION_REVOKED_AGGREGATE_TYPE,

package/packages/bundled-features/src/sessions/session-callbacks.ts

@@ -18,12 +18,7 @@ import { generateId, parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { encryptForDirectWrite } from "../shared/index.ts";
 import { tenantMembershipsTable } from "../tenant/index.ts";
-import {
-  isPrincipalBlocked,
-  isPrincipalRowBlocked,
-  type UserStatus,
-  userTable,
-} from "../user/index.ts";
+import { isPrincipalRowBlocked, type UserStatus, userTable } from "../user/index.ts";
 import {
   DEFAULT_SESSION_EXPIRY_MS,
   LAST_SEEN_REFRESH_MS,
@@ -36,9 +31,6 @@ import {
   sessionRevokedSchema,
 } from "./session-revoked-event.ts";
 
-// Re-exported so existing `../sessions` importers keep working unchanged.
-export { isPrincipalBlocked };
-
 type SettledLookup<T> = { readonly ok: true; readonly value: T } | { readonly ok: false };
 
 function settleLookup<T>(lookup: Promise<T>): Promise<SettledLookup<T>> {

package/packages/bundled-features/src/shared/decrypt-stored-pii.ts

@@ -2,6 +2,7 @@ import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import {
   configuredPiiSubjectKms,
   decryptPiiFieldValues,
+  PII_ERASED_SENTINEL,
 } from "@cosmicdrift/kumiko-framework/crypto";
 
 // Raw reads (fetchOne/selectMany) return the stored column value — with an
@@ -24,3 +25,12 @@ export async function decryptStoredPii(
   const decrypted = out[field];
   return typeof decrypted === "string" ? decrypted : value;
 }
+
+// Null for an erased subject: the sentinel must never be mailed or shown as an address.
+export async function decryptStoredUserEmail(
+  stored: string,
+  fallbackRequestId: string,
+): Promise<string | null> {
+  const email = await decryptStoredPii(stored, "email", fallbackRequestId);
+  return email === PII_ERASED_SENTINEL ? null : email;
+}

package/packages/bundled-features/src/shared/index.ts

@@ -15,7 +15,7 @@ export {
   classifyStoredEnvelope,
   type StoredEnvelopeClassification,
 } from "./classify-stored-envelope.ts";
-export { decryptStoredPii } from "./decrypt-stored-pii.ts";
+export { decryptStoredPii, decryptStoredUserEmail } from "./decrypt-stored-pii.ts";
 export { encryptForDirectWrite } from "./encrypt-for-direct-write.ts";
 export { entitiesOf } from "./entities-of.ts";
 export { isWithinGracePeriod } from "./grace-period.ts";